CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 431:

  What technologies are used to deny or permit network traffic?

  A. Stateful Inspection, Firewall Blade, and URL/Application Blade
  B. Packet Filtering, Stateful Inspection, and Application Layer Firewall
  C. Firewall Blade, URL/Application Blade, and IPS
  D. Stateful Inspection, URL/Application Blade, and Threat Prevention
  B. Packet Filtering, Stateful Inspection, and Application Layer Firewall

  ---

  Explanation

  Packet filtering, stateful inspection, and application layer firewall are technologies used to deny or permit network traffic based on different criteria. Packet filtering is a basic firewall technology that examines the header of each packet and compares it to a set of rules to decide whether to allow or drop it. Stateful inspection is an advanced firewall technology that tracks the state and context of each connection and applies security rules based on the connection information. Application layer firewall is a firewall technology that inspects the content and behavior of applications and protocols at the application layer of the OSI model and enforces granular policies based on the application identity, user identity, and content type.

  References:

  Check Point R81 Firewall Administration Guide, page 9-10

• Question 432:

  What is the default shell of Gaia CLI?

  A. Monitor
  B. CLI.sh
  C. Read-only
  D. Bash
  A. Monitor

  ---

  Explanation

  The default shell of Gaia CLI is clish. Clish stands for Command Line Interface Shell and it is a restrictive shell that controls the number of commands available in the CLI. Clish provides a user-friendly interface that supports command completion, history, and help functions. Clish also supports role-based administration, which means that different users can have different levels of access to Gaia features and commands based on their roles.

• Question 433:

  In which scenario will an administrator need to manually define Proxy ARP?

  A. When they configure an "Automatic Static NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.
  B. When they configure an "Automatic Hide NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.
  C. When they configure a "Manual Static NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.
  D. When they configure a "Manual Hide NAT" which translates to an IP address that belongs to one of the firewall's interfaces.
  C. When they configure a "Manual Static NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.

  ---

  Explanation

  Proxy ARP is a technique that allows a device to respond to ARP requests on behalf of another IP address. Proxy ARP is required for Manual Static NAT when the translated IP address does not belong to one of the firewall's interfaces. This is because the firewall needs to intercept the packets destined to the translated IP address and forward them to the original IP address after applying the NAT rule. Without Proxy ARP, the packets would not reach the firewall and the NAT would not work. Proxy ARP is not required for Automatic Static NAT or Automatic Hide NAT, because these types of NAT use IP addresses that belong to the firewall's interfaces. Proxy ARP is also not required for Manual Hide NAT, because this type of NAT does not change the destination IP address of the packets, only the source IP address.

  References:

  Check Point R81 Security Management Administration Guide, page 115

• Question 434:

  How often does Threat Emulation download packages by default?

  A. Once a week
  B. Once an hour
  C. Twice per day
  D. Once per day
  D. Once per day

  ---

  Explanation

  Threat Emulation downloads packages by default once per day. The packages contain updates for the Threat Emulation engine, signatures, and images. The download frequency can be changed in the Threat Prevention policy settings.

  References:

  Threat Emulation Administration Guide, Threat Prevention R81 Release Notes

• Question 435:

  When installing a dedicated R81 SmartEvent server.

  What is the recommended size of the root partition?

  A. Any size
  B. Less than 20GB
  C. More than 10GB and less than 20GB
  D. At least 20GB
  D. At least 20GB

  ---

  Explanation

  At least 20GB is the recommended size of the root partition when installing a dedicated R81 SmartEvent server. The root partition is the primary partition that contains the operating system files and other essential files for booting and running the system. The SmartEvent server requires at least 20GB of free space on the root partition to install and operate properly. If the root partition size is less than 20GB, you may encounter errors or performance issues with SmartEvent.

  References:

  Check Point Security Expert R81 Course, SmartEvent Administration Guide

• Question 436:

  What is the most recommended way to install patches and hotfixes?

  A. CPUSE Check Point Update Service Engine
  B. rpm -Uv
  C. Software Update Service
  D. UnixinstallScript
  A. CPUSE Check Point Update Service Engine

  ---

  Explanation

  The most recommended way to install patches and hotfixes is CPUSE (Check Point Update Service Engine). CPUSE is a tool that automates the process of upgrading and installing software packages on Check Point devices. CPUSE can work in online mode or offline mode. Online mode requires an Internet connection to download the packages from Check Point servers. Offline mode allows you to download the packages manually from another device and transfer them to the target device using a USB drive or SCP.

  References:

  Check Point Security Expert R81 Course, CPUSE Administration Guide

• Question 437:

  You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet.

  However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet.

  

  How can you fix this?

  A. Right click Accept in the rule, select "More", and then check 'Enable Identity Captive Portal'.
  B. On the firewall object, Legacy Authentication screen, check 'Enable Identity Captive Portal'.
  C. In the Captive Portal screen of Global Properties, check 'Enable Identity Captive Portal'.
  D. On the Security Management Server object, check the box 'Identity Logging'.
  A. Right click Accept in the rule, select "More", and then check 'Enable Identity Captive Portal'.

  ---

  Explanation

  The correct way to enable Identity Captive Portal for a specific rule is to right click Accept in the rule, select "More", and then check 'Enable Identity Captive Portal'. This will allow guest users to see the splash page and accept the Terms of Service before accessing the Internet. Identity Captive Portal is a feature that enables identity awareness for guest users who are not authenticated by other methods, such as Active Directory or Identity Agent. Identity Captive Portal can be enabled globally or per rule, depending on the security policy requirements.

• Question 438:

  The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?

  A. field_name:string
  B. name field:string
  C. name_field:string
  D. field name:string
  A. field_name:string

  ---

  Explanation

  The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, the syntax is field_name:string. For example, to search for all rules that have a comment containing "VPN", the syntax is comment:VPN. The other options are not valid syntaxes for searching for a value in a field.

  References:

  Check Point Software, Getting Started, Searching for Text Strings.

• Question 439:

  Which NAT rules are prioritized first?

  A. Post-Automatic/Manual NAT rules
  B. Manual/Pre-Automatic NAT
  C. Automatic Hide NAT
  D. Automatic Static NAT
  B. Manual/Pre-Automatic NAT

  ---

  Explanation

  The NAT rules that are prioritized first are Manual/Pre-Automatic NAT. NAT stands for Network Address Translation, and it is a feature that allows Security Gateways to modify the source or destination IP addresses or ports of packets that pass through them. NAT rules are the rules that define how NAT is applied to traffic that matches certain criteria. There are three types of NAT rules: Manual/Pre-Automatic NAT, Automatic NAT, and Manual/Post-Automatic NAT. Manual/Pre-Automatic NAT rules are the rules that are manually created by administrators and placed before the automatic NAT rules in the rulebase.

  These rules have the highest priority and are processed first by the Security Gateway. Automatic NAT rules are the rules that are automatically generated by the Security Gateway based on the NAT properties of network objects. These rules have the second highest priority and are processed after the manual/pre-automatic NAT rules. Manual /Post-Automatic NAT rules are the rules that are manually created by administrators and placed after the automatic NAT rules in the rulebase. These rules have the lowest priority and are processed last by the Security Gateway.

• Question 440:

  Which feature ensures that packets from the same connection are handled by the same cluster member?

  A. SecureXL
  B. CoreXL
  C. Sticky Decision Function
  D. Dynamic Dispatcher
  C. Sticky Decision Function

  ---

  Explanation

  The Sticky Decision Function (SDF) ensures that packets belonging to the same connection are consistently handled by the same cluster member. This prevents issues such as asymmetric routing.