CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 481:

  How would you enable VMAC Mode in ClusterXL?

  A. Cluster Object -> Edit -> ClusterXL and VRRP -> Use Virtual MAC
  B. fw ctl set int vmac_mode 1
  C. cphaconf vmac_mode set 1
  D. Cluster Object -> Edit -> Cluster Members -> Edit -> Use Virtual MAC
  A. Cluster Object -> Edit -> ClusterXL and VRRP -> Use Virtual MAC

  ---

  Explanation

  To enable VMAC Mode in ClusterXL, you need to go to Cluster Object -> Edit -> ClusterXL and VRRP ->

  Use Virtual MAC. VMAC Mode is a feature that allows ClusterXL to use a virtual MAC address for cluster interfaces instead of physical MAC addresses. This simplifies the cluster configuration and avoids issues with MAC address flapping or spoofing on switches.

• Question 482:

  What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

  A. CCP and 18190
  B. CCP and 257
  C. CCP and 8116
  D. CPC and 8116
  C. CCP and 8116

  ---

  Explanation

  ClusterXL is a clustering technology that provides high availability and load sharing for Security Gateways.

  ClusterXL uses a proprietary protocol called Check Point Cluster Protocol (CCP) to communicate between cluster members. CCP has two main functions: Health Check and State Synchronization. Health Check is the mechanism that monitors the status and availability of each cluster member and determines which member is the active one. State Synchronization is the mechanism that synchronizes the connection and NAT tables between cluster members to ensure a smooth failover in case of a member failure. CCP uses UDP port 8116 for both Health Check and State Synchronization messages. The other options are not correct because:

  Option A. CCP and 18190: This option is incorrect because CCP does not use port 18190. Port 18190 is used by Secure Internal Communication (SIC) between Security Gateways and Management Servers.

  Option B. CCP and 257: This option is incorrect because CCP does not use port 257. Port 257 is used by Check Point Security Management Protocol (CPM) for communication between SmartConsole and Management Servers.

  Option D. CPC and 8116: This option is incorrect because there is no such protocol as CPC in ClusterXL.

  References:

  ClusterXL R81.20 Administration Guide, ClusterXL Administration Guide R80.40, sk25977 -Ports used by Check Point software

• Question 483:

  On R81.20 the IPS Blade is managed by:

  A. Threat Protection policy
  B. Anti-Bot Blade
  C. Threat Prevention policy
  D. Layers on Firewall policy
  C. Threat Prevention policy

  ---

  Explanation

  On R81.20 the IPS Blade is managed by the Threat Prevention policy. The Threat Prevention policy is a unified policy that includes Anti-virus, IPS, Anti-bot, and Threat Emulation software blades. The IPS blade provides protection against network attacks and exploits by inspecting the traffic and blocking malicious packets. The IPS blade can be configured with different profiles and exceptions to suit different security needs.

  References:

  R81 Threat Prevention Administration Guide, page 15.

• Question 484:

  Alice works for a big security outsourcing provider company and as she receives a lot of change requests per day she wants to use for scripting daily tasks the API services from Check Point for the Management API. Firstly, she needs to be aware if the API services are running for the management.

  Which of the following Check Point Command is true:

  A. status mgmt api
  B. api mgmt status.
  C. status api
  D. api status
  D. api status

• Question 485:

  Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

  A. To satellites through center only
  B. To center only
  C. To center and to other satellites through center
  D. To center, or through the center to other satellites, to Internet and other VPN targets
  D. To center, or through the center to other satellites, to Internet and other VPN targets

  ---

  Explanation

  This VPN routing option uses VPN routing for every connection a satellite gateway handles, regardless of the destination. This means that all traffic from the satellite gateway will go through the VPN tunnel to the center gateway, and then be routed to the appropriate destination, whether it is another satellite, the Internet, or another VPN target. This option provides the highest level of security and control, but also consumes more bandwidth and processing power.

• Question 486:

  Joey wants to upgrade from R75.40 to R81 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.

  What is one of the requirements for his success?

  A. Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine
  B. Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine
  C. Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR / log directory on the source machine
  D. Size of the /var/log folder of the target machine must be at least 25GB or more
  B. Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine

  ---

  Explanation

  One of the requirements for Joey's success in upgrading from R75.40 to R81 version of Security management using Advanced Upgrade with Database Migration method is that the size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine. Advanced Upgrade with Database Migration method is a procedure that allows administrators to upgrade their Security Management Server to a newer version by migrating their database from an older version to a new machine with a fresh installation of the newer version. One of the steps in this procedure is to copy the /var /log folder from the source machine to the target machine, which contains important log files and configuration files. To ensure that there is enough disk space on the target machine for this operation, it is required that the size of the /var/log folder on the target machine must be at least 25% of the size of the /var /log folder on the source machine.

• Question 487:

  Which one of the following is true about Threat Extraction?

  A. Always delivers a file to user
  B. Works on all MS Office, Executables, and PDF files
  C. Can take up to 3 minutes to complete
  D. Delivers file only if no threats found
  A. Always delivers a file to user

  ---

  Explanation

  Threat Extraction is a software blade that always delivers a file to user. Threat Extraction removes or sanitizes the active content from the files and converts them to PDF format, which is safer and more compatible. Threat Extraction can also work together with Threat Emulation to provide both clean and original files to the users. Threat Extraction works on MS Office, PDF, and archive files, but not on executables. Threat Extraction can take up to 3 minutes to complete, depending on the file size and complexity.

  References:

  Check Point Security Expert R81 Course, Threat Extraction Administration Guide

• Question 488:

  When attempting to start a VPN tunnel, in the logs the error "no proposal chosen" is seen numerous times.

  No other VPN-related entries are present.

  Which phase of the VPN negotiations has failed?

  A. IKE Phase 1
  B. IPSEC Phase 2
  C. IPSEC Phase 1
  D. IKE Phase 2
  A. IKE Phase 1

  ---

  Explanation

  The error "no proposal chosen" indicates that the VPN gateway did not find a matching proposal for the IKE Phase 1 negotiation. This phase is responsible for establishing a secure channel between the VPN peers, using a pre-shared secret or a certificate. The proposal consists of parameters such as encryption algorithm, hash algorithm, Diffie-Hellman group, and lifetime. If the VPN gateway does not receive a proposal that matches its own configuration, it will reject the connection attempt and log the error "no proposal chosen" 1. To troubleshoot this issue, one should verify that the VPN peers have the same IKE Phase 1 settings, such as: The same pre-shared secret or certificate.

  The same encryption algorithm (e.g., AES-256) The same hash algorithm (e.g., SHA-256) The same Diffie-Hellman group (e.g., Group 14) The same lifetime (e.g., 86400 seconds) One can use the command vpn tu on the VPN gateway to view the current IKE Phase 1 settings and compare them with the other peer. Alternatively, one can use the SmartConsole to check the VPN community properties and the gateway object properties for the IKE Phase 1 settings 2.

  References:

  1: Troubleshooting the "no proposal chosen" error - Check Point Software

  2: Support, Support Requests, Training... - Check Point Software

• Question 489:

  John is using Management HA.

  Which Smartcenter should be connected to for making changes?

  A. secondary Smartcenter
  B. active Smartenter
  C. connect virtual IP of Smartcenter HA
  D. primary Smartcenter
  B. active Smartenter

  ---

  Explanation

  Management HA is a feature that allows the Security Management server to have one or more backup Standby Security Management servers that are ready to take over in case of failure. The Active Security Management server is the one that handles all the management operations, such as policy installation, object creation, configuration backup, etc. The Standby Security Management servers are synchronized with the Active Security Management server and store the same data, such as databases, certificates, CRLs, etc. The Standby Security Management servers can also perform some operations, such as fetching a Security Policy or retrieving a CRL. To make changes to the system, such as editing objects or policies, the administrator needs to connect to the Active Security Management server. This is because the Active Security Management server is the only one that can modify the data and synchronize it with the Standby Security Management servers. The administrator can use SmartConsole to connect to the Active Security Management server by entering its IP address or hostname. The administrator can also use SmartDashboard to connect to the Active Security Management server by selecting Policy > Management High Availability. This shows information about the Security Management server that includes its peers - displayed with the name, status and type of Security Management server. The other options are incorrect because:

  Option A: secondary

  Smartcenter: This is a synonym for a Standby Security Management server, which cannot be used to make changes to the system.

  Option C: connect virtual

  IP of Smartcenter HA: This is not a valid option because there is no virtual IP for Smartcenter HA. Each Security Management server has its own IP address and hostname.

  Option D: primary

  Smartcenter: This is a synonym for the Active Security Management server, but it is not the correct term to use. The term primary implies that there is only one Active Security Management server, which is not true. The administrator can put the Active Security Management server on standby and promote a Standby Security Management server to active at any time.

  References:

  How to Configure Management HA

• Question 490:

  In a Client to Server scenario, which inspection point is the first point immediately following the tables and rule base check of a packet coming from outside of the network?

  A. Big l
  B. Little o
  C. Little i
  D. Big O
  A. Big l

  ---

  Explanation

  The inspection point Big l is the first point immediately following the tables and rule base check of a packet coming from outside of the network. It is also the last point before the packet leaves the Security Gateway to the internal network.

  The other inspection points are either before or after the rule base check, or in a different direction of traffic flow.

  References:

  Check Point R81 Security Gateway Architecture and Packet Flow, 156-315.81 Checkpoint Exam Info and Free Practice Test - ExamTopics