CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 531:

  Where can you see and search records of action done by R80 SmartConsole administrators?

  A. In SmartAudit Log View
  B. In Smartlog, all logs
  C. In the Logs & Monitor, logs, select "Audit Log View"
  D. In SmartView Tracker, open active log
  C. In the Logs & Monitor, logs, select "Audit Log View"

• Question 532:

  IF the first packet of an UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), what message is sent back through the kernel?

  A. Nothing
  B. TCP FIN
  C. TCP RST
  D. ICMP unreachable
  A. Nothing

  ---

  Explanation

  If the first packet of a UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), nothing is sent back through the kernel. This is because UDP is a connectionless protocol that does not require an acknowledgement from the receiver. Therefore, if a UDP packet is dropped by the Firewall, the sender will not receive any feedback or notification.

  UDP Protocol

• Question 533:

  On R81.20 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

  A. 18210
  B. 18184
  C. 257
  D. 18191
  B. 18184

  ---

  Explanation

  On R81.20, when configuring Third-Party devices to read the logs using the LEA (Log Export API), the default Log Server uses port 18184. This port can be changed using the lea_server command in expert mode. The other ports are either not related to LEA, or used for different purposes, such as 18210 for CPMI, 257 for FW1_log, and 18191 for SIC.

  References:

  [Check Point R81 Logging and Monitoring Administration Guide], [Check Point Ports Used for Communication by Various Check Point Modules]

• Question 534:

  What are not possible commands to acquire the lock in order to make changes in Clish or Web GUI?

  A. set config-lock on override
  B. Click the Lock icon in the WebUI
  C. "set rbac rw = 1''
  D. lock database override
  C. "set rbac rw = 1''

• Question 535:

  With SecureXL enabled, accelerated packets will pass through the following:

  A. Network Interface Card, Check Point Firewall Kernel, and the Acceleration Device
  B. Network Interface Card, OSI Network Layer,OS IP Stack,and the Acceleration Device
  C. Network Interface Card, OSI Network Layer, and the Acceleration Device
  D. Network Interface Card and the Acceleration Device
  D. Network Interface Card and the Acceleration Device

• Question 536:

  What is the purpose of Captive Portal?

  A. It authenticates users, allowing them access to the Gaia OS
  B. It authenticates users, allowing them access to the Internet and corporate resources
  C. It provides remote access to SmartConsole
  D. It manages user permission in SmartConsole
  B. It authenticates users, allowing them access to the Internet and corporate resources

• Question 537:

  How can you see historical data with cpview?

  A. cpview -f <timestamp>
  B. cpview -e <timestamp>
  C. cpview -t <timestamp>
  D. cpview -d <timestamp>
  C. cpview -t <timestamp>

  ---

  Explanation

  To see historical data with cpview, you can use the cpview -t <timestamp> command, where <timestamp> is the date and time you want to view. For example, cpview -t Jan 01 2023 12:00:00 will show you the cpview data for January 1st, 2023 at noon. You can also enter a partial date, such as Jan 02, to see the data for the whole day. This feature is available in R77.10 and higher versions of Check Point software.

  You can also access the historical data by pressing the "t" key while running cpview in live mode and entering the desired date and time. The historical data is stored in the CPViewDB.dat file in the /var/log/ CPView_history directory on your gateway. You can export this file and import it into other tools for visualization, such as Grafana.

• Question 538:

  You need to see which hotfixes are installed on your Check Point server, which command would you use?

  A. cpinfo-h all
  B. cpinfo-o hotfix
  C. cpinfo-y all
  D. cpinfo-l hotfix
  C. cpinfo-y all

• Question 539:

  Kurt is planning to upgrade his Security Management Server to R81.X.

  What is the lowest supported version of the Security Management he can upgrade from?

  A. R76 Splat
  B. R77.X Gaia
  C. R75 Splat
  D. R75 Gaia
  D. R75 Gaia

  ---

  Explanation

  The lowest supported version of the Security Management that can be upgraded to R81.X is R75 Gaia.

  This means that the Security Management Server must be running on the Gaia Operating System and have a version of R75 or higher.

  R76 Splat, R77.X Gaia, and R75 Splat are not supported for upgrading to R81.X1.

  References:

  1: Check Point Software, Getting Started, Supported Upgrade Paths.

• Question 540:

  Which of the following Windows Security Events will not map a username to an IP address in Identity Awareness?

  A. Kerberos Ticket Renewed
  B. Kerberos Ticket Requested
  C. Account Logon
  D. Kerberos Ticket Timed Out
  D. Kerberos Ticket Timed Out

  ---

  Explanation

  Identity Awareness maps usernames to IP addresses by collecting Windows Security Events from Active Directory Domain Controllers. These events include Account Logon, Kerberos Ticket Requested, and Kerberos Ticket Renewed. These events indicate that a user has successfully authenticated to the domain and obtained a Kerberos ticket for accessing network resources. Identity Awareness can use these events to associate the username with the source IP address of the authentication request. However, Kerberos Ticket Timed Out is not a Windows Security Event that Identity Awareness can use to map usernames to IP addresses. This event indicates that a user's Kerberos ticket has expired and needs to be renewed.

  This event does not contain the source IP address of the user, only the username and the ticket information. Therefore, Identity Awareness cannot use this event to map a username to an IP address.

  References:

  1. Training & Certification | Check Point Software, section "Security Expert R81.20 (CCSE) Core Training"

  2. Certified Security Expert (CCSE) R81.20 Course Overview, page 1

  3. Check Point Certified Security Expert R81, page 5 5, Identity Awareness Administration Guide R81, section "How Identity Awareness Collects Identities"