CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 451:

  What is the main objective when using Application Control?

  A. To filter out specific content.
  B. To assist the firewall blade with handling traffic.
  C. To see what users are doing.
  D. Ensure security and privacy of information.
  D. Ensure security and privacy of information.

  ---

  Explanation

  The main objective when using Application Control is to ensure security and privacy of information.

  Application Control is a blade that enables administrators to control access to web applications and web sites based on categories, users, groups, machines, and time. Application Control can also block or limit usage of applications that pose security risks or consume excessive bandwidth.

  References:

  Check Point R81 Application Control Administration Guide

• Question 452:

  Your manager asked you to check the status of SecureXL, and its enabled templates and features.

  What command will you use to provide such information to manager?

  A. fw accel stat
  B. fwaccel stat
  C. fw acces stats
  D. fwaccel stats
  B. fwaccel stat

  ---

  Explanation

  The fwaccel stat command displays the status of SecureXL, and its enabled templates and features. The other commands are either incorrect or incomplete.

  References:

  [SecureXL Commands]

• Question 453:

  Hit Count is a feature to track the number of connections that each rule matches, which one is not benefit of Hit Count.

  A. Better understand the behavior of the Access Control Policy
  B. Improve Firewall performance - You can move a rule that has hot count to a higher position in the Rule Base
  C. Automatically rearrange Access Control Policy based on Hit Count Analysis
  D. Analyze a Rule Base - You can delete rules that have no matching connections
  C. Automatically rearrange Access Control Policy based on Hit Count Analysis

  ---

  Explanation

  Hit Count is a feature to track the number of connections that each rule matches, which can help to optimize the Rule Base efficiency and analyze the network traffic behavior. The benefit that is not provided by Hit Count is automatically rearrange Access Control Policy based on Hit Count Analysis. Hit Count does not change the order of the rules automatically, but it allows the administrator to manually move the rules up or down based on the hit count statistics. The administrator can also use the SmartOptimize feature to get suggestions for improving the Rule Base order and performance.

  References:

  R81 Security Management Administration Guide, page 97.

• Question 454:

  Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?

  A. cpm
  B. cpwd
  C. fwm
  D. cpd
  B. cpwd

• Question 455:

  What is the purpose of Priority Delta in VRRP?

  A. When a box up, Effective Priority = Priority + Priority Delta
  B. When an Interface is up, Effective Priority = Priority + Priority Delta
  C. When an Interface fail, Effective Priority = Priority - Priority Delta
  D. When a box fail, Effective Priority = Priority - Priority Delta
  C. When an Interface fail, Effective Priority = Priority - Priority Delta

  ---

  Explanation

  Each instance of VRRP running on a supported interface may monitor the link state of other interfaces.

  The monitored interfaces do not have to be running VRRP. If a monitored interface loses its link state, then VRRP will decrement its priority over a VRID by the specified delta value and then will send out a new VRRP HELLO packet. If the new effective priority is less than the priority a backup platform has, then the backup platform will begin to send out its own HELLO packet. Once the master sees this packet with a priority greater than its own, then it releases the VIP.

• Question 456:

  Which of the following is NOT a method used by Identity Awareness for acquiring identity?

  A. Remote Access
  B. Active Directory Query
  C. Cloud IdP (Identity Provider)
  D. RADIUS
  C. Cloud IdP (Identity Provider)

• Question 457:

  Which one is not a valid upgrade method to R81.20?

  A. RPM Upgrade
  B. Upgrade with Migration
  C. Advanced Upgrade
  D. CPUSE Upgrade
  A. RPM Upgrade

  ---

  Explanation

  RPM upgrade is not a valid upgrade method to R81.20. RPM upgrade is a method of upgrading from R80.20. M1 to R80.20.M2 or later, but it is not supported for upgrading to R81.20. The valid upgrade methods to R81. 20 are CPUSE upgrade, advanced upgrade, and upgrade with migration.

  [Check Point Security Expert R81 Installation and Upgrade Guide], page 12.

• Question 458:

  What is UserCheck?

  A. Messaging tool used to verify a user's credentials.
  B. Communication tool used to inform a user about a website or application they are trying to access.
  C. Administrator tool used to monitor users on their network.
  D. Communication tool used to notify an administrator when a new user is created.
  B. Communication tool used to inform a user about a website or application they are trying to access.

  ---

  Explanation

  UserCheck is a communication tool used to inform a user about a website or application they are trying to access. UserCheck allows administrators to interact with users in real time, informing them of the security policy and the actions they need to take. UserCheck can also enable users to self-remediate incidents or request exceptions from the administrator.

  References:

  Training & Certification | Check Point Software, Check Point Resource Library

• Question 459:

  What traffic does the Anti-bot feature block?

  A. Command and Control traffic from hosts that have been identified as infected
  B. Command and Control traffic to servers with reputation for hosting malware
  C. Network traffic that is directed to unknown or malicious servers
  D. Network traffic to hosts that have been identified as infected
  A. Command and Control traffic from hosts that have been identified as infected

  ---

  Explanation

  The traffic that the Anti-bot feature blocks is command and control traffic from hosts that have been identified as infected. Anti-bot is a blade that detects and prevents botnet attacks by using a cloud-based service that provides up-to-date threat intelligence. When Anti-bot detects a host that is communicating with a malicious command and control server, it blocks the traffic and generates an alert. The other options are not the types of traffic that Anti-bot blocks.

  References:

  Check Point Software, Getting Started, Anti-Bot.

• Question 460:

  Which directory below contains log files?

  A. /opt/CPSmartlog-R81/log
  B. /opt/CPshrd-R81/log
  C. /opt/CPsuite-R81/fw1/log
  D. /opt/CPsuite-R81/log
  C. /opt/CPsuite-R81/fw1/log

  ---

  Explanation

  The directory /opt/CPsuite-R81/fw1/log contains the log files for the Security Gateway, such as firewall, VPN, IPS, and anti-virus logs. These log files can be viewed and analyzed using SmartConsole or SmartView. The other directories are not correct because:

  Option A. The directory /opt/CPSmartlog-R81/log contains the log files for the SmartLog server, which is a separate component that indexes and searches logs from multiple Security Gateways.

  Option B. The directory /opt/CPshrd-R81/log contains the log files for the shared components of the Check Point suite, such as cpwd, cpca, cpd, and cpwatchdog.

  Option D. The directory /opt/CPsuite-R81/log does not exist by default and is not used for logging purposes.

  References:

  Logging and Monitoring R81 Administration Guide, SmartConsole R81 Help, SmartLog R81 Help, Check Point Processes and Daemons