CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 501:

  What Factor preclude Secure XL Templating?

  A. Source Port Ranges/Encrypted Connections
  B. IPS
  C. ClusterXL in load sharing Mode
  D. CoreXL
  A. Source Port Ranges/Encrypted Connections

  ---

  Explanation

  SecureXL Templating is a feature that accelerates the processing of packets that belong to the same connection or session by creating a template for the first packet and applying it to the subsequent packets.

  SecureXL Templating is precluded by factors that prevent the creation of a template, such as source port ranges, encrypted connections, NAT, QoS, etc.

  References:

  SecureXL Mechanism

• Question 502:

  What kind of information would you expect to see using the sim affinity command?

  A. The VMACs used in a Security Gateway cluster
  B. The involved firewall kernel modules in inbound and outbound packet chain
  C. Overview over SecureXL templated connections
  D. Network interfaces and core distribution used for CoreXL
  D. Network interfaces and core distribution used for CoreXL

  ---

  Explanation

  The kind of information that you would expect to see using the sim affinity command is network interfaces and core distribution used for CoreXL. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. CoreXL is a technology that improves the performance of the Security Gateway by using multiple cores to handle concurrent connections. The sim affinity command can show which network interfaces and SecureXL instances are bound to which CPU cores, and allow administrators to change the affinity settings.

• Question 503:

  Using Web Services to access the API, which Header Name/Value had to be in the HTTP Post request after the login?

  A. uuid Universally Unique Identifier
  B. API-Key
  C. user-uid
  D. X-chkp-sid Session Unique Identifier
  D. X-chkp-sid Session Unique Identifier

• Question 504:

  Which of the following processes pulls the application monitoring status from gateways?

  A. cpm
  B. cpd
  C. fwm
  D. cpwd
  B. cpd

• Question 505:

  Vanessa is a Firewall administrator. She wants to test a backup of her company's production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment.

  Which details she need to fill in System Restore window before she can click OK button and test the backup?

  A. Server, SCP, Username, Password, Path, Comment, Member
  B. Server, TFTP, Username, Password, Path, Comment, All Members
  C. Server, Protocol, Username, Password, Path, Comment, All Members
  D. Server, Protocol, username Password, Path, Comment, Member
  C. Server, Protocol, Username, Password, Path, Comment, All Members

  ---

  Explanation

  According to the Check Point website, Vanessa needs to fill in the following details in the System Restore window before she can click OK button and test the backup: Server, Protocol, Username, Password, Path, Comment, All Members. These details specify the source and destination of the backup file, as well as the scope of the restore operation. The other options are either missing or incorrect details.

  References:

  System Restore

• Question 506:

  When synchronizing clusters, which of the following statements is FALSE?

  A. The state of connections using resources is maintained in a Security Server, so their connections cannot be synchronized.
  B. Only cluster members running on the same OS platform can be synchronized.
  C. In the case of a failover, accounting information on the failed member may be lost despite a properly working synchronization.
  D. Client Authentication or Session Authentication connections through a cluster member will be lost if the cluster member fails.
  B. Only cluster members running on the same OS platform can be synchronized.

  ---

  Explanation

  The statement that only cluster members running on the same OS platform can be synchronized is false.

  Cluster members can be synchronized even if they run on different OS platforms, as long as they have the same Check Point version and hotfixes installed. The other statements are true. The state of connections using resources is maintained in a Security Server, so their connections cannot be synchronized. In the case of a failover, accounting information on the failed member may be lost despite a properly working synchronization. Client Authentication or Session Authentication connections through a cluster member will be lost if the cluster member fails.

  References:

  R81 ClusterXL Administration Guide, page 9-10 [R81 Security Gateway Architecture], page 23

• Question 507:

  Which command is used to view the kernel tables on a Security Gateway?

  A. fw tab
  B. fw ctl stat
  C. cpstat
  D. fw monitor
  A. fw tab

  ---

  Explanation

  The fw tab command is used to view kernel tables, including connection tables and other internal structures. It is commonly used for troubleshooting firewall behavior.

• Question 508:

  Which is not a blade option when configuring SmartEvent?

  A. Correlation Unit
  B. SmartEvent Unit
  C. SmartEvent Server
  D. Log Server
  B. SmartEvent Unit

  ---

  Explanation

  SmartEvent Unit is not a blade option when configuring SmartEvent. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules.

  SmartEvent Unit is not a valid component or blade of SmartEvent.

• Question 509:

  Which command lists firewall chain?

  A. fwctl chain
  B. fw list chain
  C. fw chain module
  D. fw tab -t chainmod
  A. fwctl chain

  ---

  Explanation

  The command that lists firewall chain is fw ctl chain. This command displays the list of chain modules that are registered on the Security Gateway. Chain modules are components of the Firewall kernel that inspect and process packets according to the security policy and other features. The order of the chain modules determines the order of the packet inspection and processing. The fw ctl chain command can help you troubleshoot connectivity or performance issues, or to verify that a feature is enabled or disabled on the Security Gateway. To run this command, you need to access the Security Gateway in expert mode and run fw ctl chain.

  References:

  How to use fw ctl chain - Check Point Software, fw ctl chain - Check Point Software, R81.x Security Gateway Architecture (Logical Packet Flow) - Check Point CheckMates

• Question 510:

  You had setup the VPN Community VPN-Stores'with 3 gateways. There are some issues with one remote gateway(1.1.1.1) and an your local gateway.

  What will be the best log filter to see only the IKE Phase 2 agreed networks for both gateways?

  A. action:"Key Install" AND 1.1.1.1 AND Main Mode
  B. action:"Key Install-AND 1.1.1.1 AND Quick Mode
  C. Blade:"VPN" AND VPN-Stores AND Main Mode
  D. Blade:"VPN" AND VPN-Stores AND Quick Mode
  B. action:"Key Install-AND 1.1.1.1 AND Quick Mode

  ---

  Explanation

  The best log filter to see only the IKE Phase 2 agreed networks for both gateways is B. action:"Key Install" AND 1.1.1.1 AND Quick Mode. This filter will show you the logs that indicate the successful establishment of IKE Phase 2, which is also known as Quick Mode. In this phase, the Security Gateway and the remote gateway negotiate the IPSec Security Associations (SAs) and exchange the encryption keys for the VPN tunnel. The action:"Key Install" field shows that the SAs were installed successfully. The 1.1.1.1 field

  shows that the logs are related to the remote gateway with that IP address. The Quick Mode field shows that the logs are related to IKE Phase 2, as opposed to Main Mode, which is IKE Phase . To use this filter, you need to go to SmartConsole, open SmartLog, and enter the filter expression in the search box.

  References:

  How to troubleshoot VPN issues with IKEVIEW tool - Check Point Software, IPsec and IKE -Check Point Software, SmartLog R81.20 Administration Guide - Check Point Software