CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 471:

  Which command would you use to set the network interfaces' affinity in Manual mode?

  A. sim affinity -m
  B. sim affinity -l
  C. sim affinity -a
  D. sim affinity -s
  D. sim affinity -s

  ---

  Explanation

  The command that would be used to set the network interfaces' affinity in Manual mode is sim affinity -s.

  Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. Core affinity is a feature that binds network interfaces and SecureXL instances to specific CPU cores, which improves the performance and load balancing of the Security Gateway. Sim affinity -s sets the network interfaces' affinity in Manual mode, which means that administrators can manually assign network interfaces to CPU cores. The other options are either invalid or perform different functions.

• Question 472:

  Which one of the following is true about Threat Emulation?

  A. Takes less than a second to complete
  B. Works on MS Office and PDF files only
  C. Always delivers a file
  D. Takes minutes to complete (less than 3 minutes)
  D. Takes minutes to complete (less than 3 minutes)

  ---

  Explanation

  Threat Emulation is a software blade that takes minutes to complete (less than 3 minutes). Threat Emulation analyzes files for malicious behavior by running them in a virtual sandbox. Threat Emulation works on MS Office, PDF, executables, and archive files. Threat Emulation does not always deliver a file, but only if no threats are found or if the user chooses to download the original file after seeing a warning message.

  References:

  Check Point Security Expert R81 Course, Threat Emulation Administration Guide

• Question 473:

  Which GUI client is supported in R81?

  A. SmartProvisioning
  B. SmartView Tracker
  C. SmartView Monitor
  D. SmartLog
  C. SmartView Monitor

  ---

  Explanation

  SmartView Monitor is a GUI client that is supported in R81. It allows you to monitor the network and security performance of your Security Gateways and devices. You can use it to view real-time statistics, alerts, logs, reports, and graphs. The other GUI clients are not supported in R81 because:

  A. SmartProvisioning was replaced by SmartLSM in R80.20 and later versions. SmartLSM is a unified solution for managing large-scale deployments of Security Gateways.

  B. SmartView Tracker was replaced by SmartLog in R80 and later versions. SmartLog is a powerful log analysis tool that enables fast and easy access to log data from multiple Security Gateways.

  D. SmartLog is not a GUI client but a web-based application that runs on the Security Management Server or Log Server. You can access it from any web browser or from SmartConsole.

  References:

  SmartView Monitor R81 Help, SmartView Monitor R81 Administration Guide, What's New in Check Point R80.20, SmartLSM R81 Help, What's New in Check Point R80, SmartLog R81 Help

• Question 474:

  The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

  A. Secure Internal Communication (SIC)
  B. Restart Daemons if they fail
  C. Transfers messages between Firewall processes
  D. Pulls application monitoring status
  D. Pulls application monitoring status

  ---

  Explanation

  The CPD daemon is a Firewall Kernel Process that does not pull application monitoring status. The CPD daemon is responsible for Secure Internal Communication (SIC), restarting daemons if they fail, transferring messages between Firewall processes, and managing policy installation.

  References:

  CPD process

• Question 475:

  SmartEvent uses it's event policy to identify events.

  How can this be customized?

  A. By modifying the firewall rulebase
  B. By creating event candidates
  C. By matching logs against exclusions
  D. By matching logs against event rules
  D. By matching logs against event rules

  ---

  Explanation

  SmartEvent uses its event policy to identify events. The event policy can be customized by matching logs against event rules. Event rules define the conditions and actions for generating events. You can create, edit, delete, enable, or disable event rules in the SmartEvent Policy tab of the SmartConsole.

  References:

  [SmartEvent Administration Guide]

• Question 476:

  If the Active Security Management Server falls or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss.

  Providing the Active Security Management Server is responsive, which if these steps should NOT be performed:

  A. Rename the hostname of the Standby member to match exactly the hostname of the Active member.
  B. Change the Active Security Management Server to Standby.
  C. Manually synchronize the Active and Standby Security Management Servers.
  D. Change the Standby Security Management Server to Active.
  A. Rename the hostname of the Standby member to match exactly the hostname of the Active member.

• Question 477:

  Which of the following is NOT a type of Check Point API available in R80.

  x?

  A. Identity Awareness Web Services
  B. OPSEC SDK
  C. Management
  D. Mobile Access
  D. Mobile Access

• Question 478:

  What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

  A. Anti-Bot is the only countermeasure against unknown malware
  B. Anti-Bot is the only protection mechanism which starts a counter-attack against known Command & Control Centers
  C. Anti-Bot is the only signature-based method of malware protection.
  D. Anti-Bot is a post-infection malware protection to prevent a host from establishing a connection to a Command & Control Center.
  D. Anti-Bot is a post-infection malware protection to prevent a host from establishing a connection to a Command & Control Center.

  ---

  Explanation

  Anti-Bot is a post-infection malware protection that detects and blocks botnet communications from infected hosts to Command & Control servers. It is different from other Threat Prevention mechanisms that prevent malware from entering the network or executing on the hosts.

  References:

  Anti-Bot Software Blade

• Question 479:

  Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

  A. assign privileges to users.
  B. edit the home directory of the user.
  C. add users to your Gaia system.
  D. assign user rights to their home directory in the Security Management Server.
  D. assign user rights to their home directory in the Security Management Server.

  ---

  Explanation

  The WebUI can be used to manage user accounts and assign privileges to users. It can also add users to your Gaia system and edit the home directory of the user. However, it cannot assign user rights to their home directory in the Security Management Server.

  References:

  Check Point Resource Library, page 3.

• Question 480:

  Which feature allows unified policy management?

  A. SmartEvent
  B. Unified Policy
  C. SmartView
  D. QoS
  B. Unified Policy

  ---

  Explanation

  Unified Policy allows centralized management of multiple security features within a single rule base.