CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 511:

  What is the valid range for VRID value in VRRP configuration?

  A. 1 - 254
  B. 1 - 255
  C. 0 - 254
  D. 0 - 255
  B. 1 - 255

  ---

  Explanation

  The valid range for VRID value in VRRP configuration is 1 - 255. VRID stands for Virtual Router ID, and it is a number that identifies a virtual router in a VRRP cluster. A VRRP cluster consists of one or more routers that share a virtual IP address and provide redundancy and load balancing for network traffic. Each router in the cluster must have a unique VRID value, and the VRID value must match the VRID value configured on the interface that connects to the VRRP cluster.

  The VRID value can be any number from 1 to 255, inclusive.

• Question 512:

  Which command shows the current Security Gateway Firewall chain?

  A. show current chain
  B. show firewall chain
  C. fw ctl chain
  D. fw ctl firewall-chain
  C. fw ctl chain

• Question 513:

  SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

  A. This statement is true because SecureXL does improve all traffic.
  B. This statement is false because SecureXL does not improve this traffic but CoreXL does.
  C. This statement is true because SecureXL does improve this traffic.
  D. This statement is false because encrypted traffic cannot be inspected.
  C. This statement is true because SecureXL does improve this traffic.

  ---

  Explanation

  SecureXL is a performance-enhancing technology used in Check Point firewalls. It improves the throughput of both non-encrypted firewall traffic and encrypted VPN traffic. The statement in option C is true because SecureXL does improve both types of traffic by offloading processing to dedicated hardware acceleration, optimizing firewall and VPN operations.

  Option C correctly states that SecureXL improves this traffic, making it the verified answer.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 514:

  Which is the correct order of a log flow processed by SmartEvent components?

  A. Firewall > Correlation Unit > Log Server > SmartEvent Server Database > SmartEvent Client
  B. Firewall > SmartEvent Server Database > Correlation Unit > Log Server > SmartEvent Client
  C. Firewall > Log Server > SmartEvent Server Database > Correlation Unit > SmartEvent Client
  D. Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client
  D. Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client

  ---

  Explanation

  The correct order of a log flow processed by SmartEvent components is: Firewall > Log Server >

  Correlation Unit > SmartEvent Server Database > SmartEvent Client. The Firewall generates logs for traffic and security events. The Log Server receives and stores the logs from the Firewall. The Correlation Unit analyzes the logs and generates SmartEvent events based on predefined or custom rules. The SmartEvent Server Database stores the events generated by the Correlation Unit. The SmartEvent Client displays the events and reports from the SmartEvent Server Database.

  References:

  Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 12:

  Check Point Software, Training & Certification, SmartEvent Introduction.

• Question 515:

  What are the two types of tests when using the Compliance blade?

  A. Tests conducted based on the IoC XML file and analysis of SOLR documents
  B. Access Control policy analysis and Threat Prevention policy analysis
  C. Policy-based tests and Global properties
  D. Global tests and Object-based tests
  D. Global tests and Object-based tests

• Question 516:

  What mechanism can ensure that the Security Gateway can communicate with the Management Server with ease in situations with overwhelmed network resources?

  A. There is a feature for ensuring stable connectivity to the management server and is done via Priority Queuing.
  B. The corresponding feature is new to R81.10 and is called "Management Data Plane Separation"
  C. The corresponding feature is called "Dynamic Split"
  D. The corresponding feature is called "Dynamic Dispatching"
  B. The corresponding feature is new to R81.10 and is called "Management Data Plane Separation"

• Question 517:

  Return oriented programming (ROP) exploits are detected by which security blade?

  A. Data Loss Prevention
  B. Check Point Anti-Virus / Threat Emulation
  C. Application control
  D. Intrusion Prevention Software
  B. Check Point Anti-Virus / Threat Emulation

  ---

  Explanation

  Return-oriented programming (ROP) exploits are detected by Check Point Anti-Virus / Threat Emulation blade. ROP exploits are a type of code reuse attack that bypasses common exploit mitigation techniques such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). Check Point Anti-Virus / Threat Emulation blade can detect and prevent ROP exploits using its behavioral analysis engine that monitors the execution flow of processes and identifies malicious patterns.

  References:

  [Check Point Security Expert R81 Threat Prevention Administration Guide], page 17.

• Question 518:

  Which process monitors and restarts failed Check Point daemons?

  A. cpd
  B. fwd
  C. cpwd
  D. cpm
  C. cpwd

  ---

  Explanation

  The cpwd (Check Point WatchDog) process monitors other daemons and restarts them if they fail, ensuring system stability.

• Question 519:

  Which command can you use to enable or disable multi-queue per interface?

  A. Cpmqueue set
  B. Set cpmq enable
  C. Cpmq config
  D. cpmq set
  D. cpmq set

• Question 520:

  When a packet arrives at the gateway, the gateway checks it against the rules in the hop Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet.

  Which of the following statements about the order of rule enforcement is true?

  A. If the Action is Accept, the gateway allows the packet to pass through the gateway.
  B. If the Action is Drop, the gateway continues to check rules in the next Policy Layer down.
  C. If the Action is Accept, the gateway continues to check rules in the next Policy Layer down.
  D. If the Action is Drop, the gateway applies the Implicit Clean-up Rule for that Policy Layer.
  C. If the Action is Accept, the gateway continues to check rules in the next Policy Layer down.

  ---

  Explanation

  When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches the packet. The order of rule enforcement depends on the action of the matching rule. If the action is Accept, the gateway allows the packet to pass through the gateway, but also continues to check rules in the next Policy Layer down. If the action is Drop, Reject, or Encrypt, the gateway applies that action to the packet and stops checking rules in

  that Policy Layer and any subsequent Policy Layers. If there is no matching rule in a Policy Layer, the gateway applies the Implicit Clean-up Rule for that Policy Layer, which is usually Drop.