CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 521:

  After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

  A. cvpnd_restart
  B. cvpnd_restart
  C. cvpnd restart
  D. cvpnrestart
  B. cvpnd_restart

  ---

  Explanation

  The cvpnd_restart command is used to restart the daemon after making modifications to the $CVPNDIR/ conf /cvpnd.C file. The cvpnd daemon is responsible for managing the communication between the Check Point components and the Content Vectoring Protocol (CVP) server. The CVP server is an external server that provides content inspection and filtering services for Check Point gateways. The $CVPNDIR/conf/ cvpnd.C file contains the configuration settings for the cvpnd daemon, such as the CVP server IP address, port number, timeout value, and debug level.

  References:

  Check Point Security Expert R81 Course, Content Inspection Using ICAP, cvpnd daemon debug file

• Question 522:

  After finishing installation admin John likes to use top command in expert mode. John has to set the expert-password and was able to use top command. A week later John has to use the top command again, He detected that the expert password is no longer valid.

  What is the most probable reason for this behavior?

  A. "write memory" was not issued on clish
  B. changes are only possible via SmartConsole
  C. "save config" was not issued in expert mode
  D. "save config" was not issued on clish
  D. "save config" was not issued on clish

  ---

  Explanation

  The most probable reason for the expert password to be no longer valid after a week is that save config was not issued on clish. The clish command set expert-password sets the expert password for the current session only. To make the password persistent, the clish command save config must be issued after setting the expert password 2. The other options are not relevant for setting the expert password.

  References:

  Check Point Software, Getting Started, Setting Expert Password.

• Question 523:

  Which software blade does NOT accompany the Threat Prevention policy?

  A. Anti-virus
  B. IPS
  C. Threat Emulation
  D. Application Control and URL Filtering
  D. Application Control and URL Filtering

  ---

  Explanation

  Which software blade does NOT accompany the Threat Prevention policy? Application Control and URL Filtering software blade does not accompany the Threat Prevention policy. The Threat Prevention policy is a unified policy that includes Anti-virus, IPS, Anti-bot, and Threat Emulation software blades. Application

  Control and URL Filtering software blade is part of the Access Control policy, which is a separate policy that controls network access based on users, applications, content, and other criteria.

  References:

  Security Management Administration Guide, page 29.

• Question 524:

  What are the blades of Threat Prevention?

  A. IPS, DLP, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction
  B. DLP, AntiVirus, QoS, AntiBot, Sandblast Threat Emulation/Extraction
  C. IPS, AntiVirus, AntiBot
  D. IPS, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction
  D. IPS, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction

  ---

  Explanation

  The blades of Threat Prevention in Check Point include: Intrusion Prevention System (IPS) AntiVirus AntiBot SandBlast Threat Emulation/Extraction So, the correct answer is D, which includes all the mentioned blades.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 525:

  You have existing dbedit scripts from R77.

  Can you use them with R81.20?

  A. dbedit is not supported in R81.20
  B. dbedit is fully supported in R81.20
  C. You can use dbedit to modify threat prevention or access policies, but not create or modify layers
  D. dbedit scripts are being replaced by mgmt_cli in R81.20
  D. dbedit scripts are being replaced by mgmt_cli in R81.20

  ---

  Explanation

  In R81.20, dbedit scripts are being replaced by the mgmt_cli utility for managing and configuring security policies and objects. Here's an explanation of each option:

  Option A. dbedit is not supported in R81.20: This is not entirely accurate. While dbedit is still available and functional in R81.20, it is being phased out in favor of mgmt_cli for policy and object management.

  Option B. dbedit is fully supported in R81.20: This statement is not accurate because although dbedit can still be used, it is not the primary recommended tool for policy management in R81.20.

  Option C. You can use dbedit to modify threat prevention or access policies, but not create or modify layers: This statement is partially true, but it does not provide the complete picture. You can use dbedit for some policy-related tasks, but it's not the primary tool for policy management in R81.20.

  Option D. dbedit scripts are being replaced by mgmt_cli in R81.20: This is the correct and recommended approach. mgmt_cli is the primary tool for managing security policies and objects in R81.20, and it is gradually replacing dbedit for these tasks. Therefore,

  option D is the most accurate and recommended answer.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 526:

  Firewall polices must be configured to accept VRRP packets on the GAiA platform if it Firewall software.

  The Multicast destination assigned by the internet Assigned Number Authority (IANA) for VRRP is:

  A. 224.0.0.18
  B. 224 00 5
  C. 224.0.0.102
  D. 224.0.0.22
  A. 224.0.0.18

  ---

  Explanation

  The multicast destination assigned by the Internet Assigned Numbers Authority (IANA) for VRRP is 224.0.0.18. This is a reserved multicast address that is used by VRRP routers to communicate with each other and announce their priority and state. Firewall policies must be configured to accept VRRP packets on the Gaia platform if it runs Firewall software. Otherwise, VRRP packets will be dropped by default.

• Question 527:

  When setting up an externally managed log server, what is one item that will not be configured on the R81 Security Management Server?

  A. IP
  B. SIC
  C. NAT
  D. FQDN
  C. NAT

  ---

  Explanation

  NAT (Network Address Translation) is one item that will not be configured on the R81 Security Management Server when setting up an externally managed log server. NAT is a technique that allows devices with private IP addresses to communicate with devices with public IP addresses by translating the private addresses to public ones. NAT is not relevant for configuring an externally managed log server, which requires only the IP address, SIC (Secure Internal Communication), and FQDN (Fully Qualified Domain Name) of the log server.

  References:

  Check Point Security Expert R81 Course, Logging and Monitoring Administration Guide

• Question 528:

  During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity.

  Which of those hosts should you try to remediate first?

  A. Host having a Critical event found by Threat Emulation
  B. Host having a Critical event found by IPS
  C. Host having a Critical event found by Antivirus
  D. Host having a Critical event found by Anti-Bot
  D. Host having a Critical event found by Anti-Bot

  ---

  Explanation

  The host having a Critical event found by Anti-Bot should be remediated first, as it indicates that the host is infected by a botnet malware that is communicating with a Command and Control server. This poses a serious threat to the network security and data integrity. The other events may indicate potential malware infection or attack attempts, but not necessarily successful ones.

  References:

  Threat Prevention Administration Guide

• Question 529:

  You have used the SmartEvent GUI to create a custom Event policy.

  What is the best way to display the correlated Events generated by SmartEvent Policies?

  A. In the SmartConsole / Logs & Monitor -> open the Logs View and use type:Correlated as query filter.
  B. Select the Events tab in the SmartEvent GUI or use the Events tab in the SmartView web interface.
  C. Open SmartView Monitor and select the SmartEvent Window from the main menu.
  D. In the SmartConsole / Logs & Monitor -> open a new Tab and select External Apps / SmartEvent.
  A. In the SmartConsole / Logs & Monitor -> open the Logs View and use type:Correlated as query filter.

• Question 530:

  What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?

  A. 2 Interfaces - a data interface leading to the organization and the Internet, a second interface for synchronization
  B. 3 Interfaces - an interface leading to the organization, a second interface leading to the internet, a third interface for synchronization
  C. 4 Interfaces - an interface leading to the organization, a second interface leading to the internet, a third interface for synchronization, a fourth interface leading to the Security Management Server
  D. 1 interface - an interface leading to the organization and the Internet, and configure for synchronization
  B. 3 Interfaces - an interface leading to the organization, a second interface leading to the internet, a third interface for synchronization