CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 421:

  What command is used to manually failover a Multi-Version Cluster during the upgrade?

  A. set cluster member state down in Clish
  B. clusterXL_admin down in Expert Mode
  C. set cluster down in Expert Mode
  D. clusterXL_admin down in Clish
  B. clusterXL_admin down in Expert Mode

• Question 422:

  When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?

  A. Includes the registry
  B. Gets information about the specified Virtual System
  C. Does not resolve network addresses
  D. Output excludes connection table
  B. Gets information about the specified Virtual System

  ---

  Explanation

  The cpinfo command is a tool that collects diagnostic data from a Check Point gateway or management server. The data includes configuration files, logs, status reports, and more. The cpinfo output can be used for troubleshooting or sent to Check Point support for analysis. The -x parameter is used to get information about the specified Virtual System on a VSX gateway. A Virtual System is a virtualized firewall instance that runs on a VSX gateway and has its own security policy and objects.

  References:

  Check Point Security Expert R81 Course, cpinfo Utility, VSX Administration Guide

• Question 423:

  Which of the following is NOT a valid type of SecureXL template?

  A. Accept Template
  B. Deny template
  C. Drop Template
  D. NAT Template
  B. Deny template

  ---

  Explanation

  The type of SecureXL template that is not valid among the options is Deny template. SecureXL templates are pre-allocated data structures that store information about connections that match certain criteria. They are used to accelerate the processing of packets that belong to those connections. The valid types of SecureXL templates are Accept, Drop, NAT, and Crypt. The Accept template is used for connections that are allowed by the Firewall policy. The Drop template is used for connections that are blocked by the Firewall policy. The NAT template is used for connections that require Network Address Translation. The Crypt template is used for connections that require encryption or decryption.

  References:

  [SecureXL Templates]

• Question 424:

  SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data.

  Which component is NOT part of the SandBlast Mobile solution?

  A. Management Dashboard
  B. Gateway
  C. Personal User Storage
  D. Behavior Risk Engine
  C. Personal User Storage

  ---

  Explanation

  SandBlast Mobile has four components: Management Dashboard, Gateway, Behavior Risk Engine, and On-Device Network Protection. Personal User Storage is not part of the SandBlast Mobile solution.

  References:

  SandBlast Mobile Architecture

• Question 425:

  Bob is asked by Alice to disable the SecureXL mechanism temporary for further diagnostic by their Check Point partner.

  Which of the following CheckPoint Command is true?

  A. fwaccel templates
  B. fwaccel suspend
  C. fwaccel standby
  D. fwaccel off
  D. fwaccel off

• Question 426:

  By default, what type of rules in the Access Control rulebase allow the control connections?

  A. Implicit Rules
  B. Explicitly Implied Rules
  C. Implied Rules
  D. Explicit Rules
  C. Implied Rules

• Question 427:

  Where is the license for Check Point Module users installed?

  A. The Primary Gateway
  B. The Standby Gateway
  C. The Endpoint Server
  D. The Security Management Server
  D. The Security Management Server

• Question 428:

  What is a best practice before starting to troubleshoot using the "fw monitor" tool?

  A. Run the command: fw monitor debug on
  B. Clear the connections table
  C. Disable CoreXL
  D. Disable SecureXL
  D. Disable SecureXL

  ---

  Explanation

  A best practice before starting to troubleshoot using the fw monitor tool is to disable SecureXL. SecureXL is a performance acceleration solution that optimizes the packet flow through the Security Gateway.

  However, SecureXL can also bypass some inspection points and cause some packets to be invisible to fw monitor. Therefore, disabling SecureXL can ensure that fw monitor captures all the relevant packets for troubleshooting purposes.

  References:

  Check Point Security Expert R81 Course, fw monitor, SecureXL

• Question 429:

  You have used the "set inactivity-timeout 120" command to prevent the session to be disconnected after 10 minutes of inactivity. However, the Web session is being disconnected after 10 minutes.

  Why?

  A. The idle timeout for the web session is specified with the "set web session-timeout" command.
  B. The number specified is the amount of the idle timeout in seconds rather than in minutes. So you have to use the command "set inactivity-timeout 600" instead.
  C. Probably, you have forgotten to make sure that nobody is accessing the management server via the SmartConsole which locks the management database.
  D. The number of minutes is correct. Probably, you have forgotten to save this setting with the "save config" command.
  A. The idle timeout for the web session is specified with the "set web session-timeout" command.

  ---

  Explanation

  The reason why the web session is being disconnected after 10 minutes is that the idle timeout for the web session is specified with the "set web session-timeout" command, not the "set inactivity-timeout" command. The "set inactivity-timeout" command only affects the CLI session, not the web session. To

  prevent the web session from being disconnected after 10 minutes of inactivity, you need to use the "set web session-timeout" command with a higher value than 10 minutes.

  References:

  [Check Point Security Expert R81 Administration Guide], page 77.

• Question 430:

  You have pushed policy to GW-3 and now cannot pass traffic through the gateway.

  As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?

  A. fw unloadlocal
  B. fw unloadpolicy
  C. fwm unload local
  D. fwm unload policy
  A. fw unloadlocal

  ---

  Explanation

  The command fw unloadlocal removes the current security policy from the local gateway and returns it to its initial state. This command can be used as a last resort to restore traffic flow through the gateway if the policy is causing problems. The command fw unloadpolicy is not valid, and the commands fwm unload local and fwm unload policy are used to remove policies from remote gateways.

  References:

  Check Point Software, Getting Started, Unloading Security Policies

  Check Point Software, Getting Started, Unloading Security Policies from Remote Gateways.