CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 541:

  Using fw monitor you see the following inspection point notion E and i what does that mean?

  A. E shows the packet before the VPN encryption, i after the inbound firewall VM
  B. E shows the packet reaching the external interface, i leaving the internal interface
  C. E shows the packet after the VPN encryption, i before the inbound firewall VM
  D. E shows the packet leaving the external interface, i reaching the internal interface
  C. E shows the packet after the VPN encryption, i before the inbound firewall VM

  ---

  Explanation

  Using fw monitor, the inspection point notation E and i means that E shows the packet after the VPN encryption, and i shows the packet before the inbound firewall VM. E (for example, eth4:E) is the Post-Outbound inspection point, which captures packets after they are encrypted by VPN Outbound. i (for example, eth4:i) is the Pre-Inbound inspection point, which captures packets before they are inspected by the in-bound FireWall VM.

  References:

  Check Point R81 CLI Reference Guide

• Question 542:

  If an administrator wants to add manual NAT for addresses now owned by the Check Point firewall, what else is necessary to be completed for it to function properly?

  A. Nothing - the proxy ARP is automatically handled in the R81 version
  B. Add the proxy ARP configurations in a file called /etc/conf/local.arp
  C. Add the proxy ARP configurations in a file called $FWDIR/conf/local.arp
  D. Add the proxy ARP configurations in a file called $CPDIR/conf/local.arp
  C. Add the proxy ARP configurations in a file called $FWDIR/conf/local.arp

  ---

  Explanation

  If an administrator wants to add manual NAT for addresses not owned by the Check Point firewall, they also need to add the proxy ARP configurations in a file called $FWDIR/conf/local.arp. This file contains the mappings between the IP addresses and the MAC addresses of the NATed hosts. The proxy ARP feature allows the firewall to answer ARP requests on behalf of the NATed hosts and forward the traffic to them.

  The local.arp file needs to be edited manually and reloaded with the command arp -f $FWDIR/conf/ local.arp.

  References:

  Security Management Administration Guide, page 1014.

• Question 543:

  Which process handles SIC and policy communication?

  A. fwd
  B. cpd
  C. cpm
  D. cpwd
  B. cpd

  ---

  Explanation

  cpd manages Secure Internal Communication (SIC), licensing, and policy communication.

• Question 544:

  According to the policy installation flow the transfer state (CPTA) is responsible for the code generated by the FWM. On the Security Gateway side, a process receives them and first stores them into a temporary directory.

  Which process is true for receiving these files:

  A. CPD
  B. RAD
  C. FWD
  D. FWM
  A. CPD

• Question 545:

  How can you switch the active log file?

  A. Run fw logswitch on the Management Server
  B. Run fwm logswitch on the Management Server
  C. Run fw logswitch on the gateway
  D. Run fwm logswitch on the gateway
  A. Run fw logswitch on the Management Server

• Question 546:

  When using the Mail Transfer Agent, where are the debug logs stored?

  A. $FWDIR/bin/emaild.mta. elg
  B. $FWDIR/log/mtad elg
  C. /var/log/mail.mta elg
  D. $CPDIR/log/emaild elg
  C. /var/log/mail.mta elg

  ---

  Explanation

  When using the Mail Transfer Agent, the debug logs are stored in /var/log/mail.mta.elg. This file contains information about the email messages that are processed by the Mail Transfer Agent, such as sender, recipient, subject, size, action, etc. You can use the command mailq to view the current mail queue and the command maild -d to enable debug mode for the Mail Transfer Agent.

  References:

  [Mail Transfer Agent]

• Question 547:

  On what port does the CPM process run?

  A. TCP 857
  B. TCP 18192
  C. TCP 900
  D. TCP 19009
  D. TCP 19009

  ---

  Explanation

  The port that the CPM process runs on is TCP 19009. CPM stands for Check Point Management, and it is the main process that runs on the Security Management Server and interacts with SmartConsole clients.

  CPM is responsible for managing policies, objects, logs, tasks, and other management functions. CPM listens on TCP port 19009 for incoming connections from SmartConsole clients. The other ports are either used by other processes or not related to CPM.

• Question 548:

  What are the minimum open server hardware requirements for a Security Management Server/Standalone in R81?

  A. 2 CPU cores, 4GB of RAM and 15GB of disk space
  B. 8 CPU cores, 16GB of RAM and 500 GB of disk space
  C. 4 CPU cores, 8GB of RAM and 500GB of disk space
  D. 8 CPU cores, 32GB of RAM and 1 TB of disk space
  C. 4 CPU cores, 8GB of RAM and 500GB of disk space

  ---

  Explanation

  The minimum open server hardware requirements for a Security Management Server/Standalone in R81 are:

  CPU: Intel Core i5-4590 or equivalent (4 cores)

  Memory: 8 GB RAM Disk space: 500 GB The other options do not match the minimum requirements. Option A has insufficient CPU cores, memory and disk space.

  Option B has excessive CPU cores and disk space.

  Option D has excessive CPU cores, memory and disk space.

  References:

  Check Point R81 Release Notes, page 6

• Question 549:

  If SecureXL is disabled which path is used to process traffc?

  A. Passive path
  B. Firewall path
  C. Medium path
  D. Accelerated path
  B. Firewall path

• Question 550:

  What are the three SecureXL Templates available in R81.10?

  A. Accept Templates, Drop Templates, NAT Templates
  B. PEP Templates, QoS Templates, VPN Templates
  C. Accept Templates, PDP Templates, PEP Templates
  D. Accept Templates,Drop Templates, Reject Templates
  A. Accept Templates, Drop Templates, NAT Templates