CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 551:

  What is the default size of NAT table fwx_alloc?

  A. 20000
  B. 35000
  C. 25000
  D. 10000
  C. 25000

  ---

  Explanation

  What is the default size of NAT table fwx_alloc? The default size of NAT table fwx_alloc is 25000. This table stores the connections that require NAT translation by the Security Gateway. The size of this table can be changed by using the command fw ctl set int fwx_alloc <value>, where <value> is the desired number of connections. The maximum value is 65535. To make this change permanent, you need to add this command to the file $FWDIR/conf/fwaffinity.conf on the Security Gateway.

  References:

  [R81 Performance Tuning Administration Guide], page 126.

• Question 552:

  Fill in the blank: Authentication rules are defined for ________.

  A. User groups
  B. Users using UserCheck
  C. Individual users
  D. All users in the database
  A. User groups

  ---

  Explanation

  Authentication rules are defined for user groups, not individual users or all users in the database.

  Authentication rules allow you to control which user groups can access specific resources or services through the Security Gateway. You can define different authentication methods and schemes for different user groups, such as Check Point Password, OS Password, RADIUS, TACACS, SecurID, LDAP, or Certificate. You can also define different session timeouts and source restrictions for different user groups.

  Authentication rules are processed before the network access rules in the rule base.

• Question 553:

  Automation and Orchestration differ in that:

  A. Automation relates to codifying tasks, whereas orchestration relates to codifying processes.
  B. Automation involves the process of coordinating an exchange of information through web service interactions such as XML and JSON, but orchestration does not involve processes.
  C. Orchestration is concerned with executing a single task, whereas automation takes a series of tasks and puts them all together into a process workflow.
  D. Orchestration relates to codifying tasks, whereas automation relates to codifying processes.
  A. Automation relates to codifying tasks, whereas orchestration relates to codifying processes.

  ---

  Explanation

  Automation and Orchestration differ in that automation relates to codifying tasks, whereas orchestration relates to codifying processes. Automation is the process of converting manual tasks into executable scripts or programs that can be run by machines or software agents. Orchestration is the process of coordinating multiple automated tasks into a coherent workflow that achieves a desired outcome or goal.

  Orchestration can also involve integrating different systems, tools, and services through web service interactions such as XML and JSON.

  References:

  Check Point Security Expert R81 Course, Automation & Orchestration Administration Guide Topic 3, Exam Pool C

• Question 554:

  Which of the following is NOT a type of Endpoint Identity Agent?

  A. Custom
  B. Full
  C. Terminal
  D. Light
  C. Terminal

• Question 555:

  What command lists all interfaces using Multi-Queue?

  A. cpmq get
  B. show interface all
  C. cpmq set
  D. show multiqueue all
  A. cpmq get

  ---

  Explanation

  The command that lists all interfaces using Multi-Queue is cpmq get. Multi-Queue is a feature that allows network interfaces to use multiple transmit and receive queues, which improves the performance and scalability of the Security Gateway by distributing the network load among several CPU cores. Cpmq is a command that allows administrators to configure and manage Multi-Queue settings on network interfaces.

  Cpmq get lists all interfaces using Multi-Queue and shows their queue count and core distribution.

• Question 556:

  Which one is not a valid Package Option In the Web GUI for CPUSE?

  A. Clean Install
  B. Export Package
  C. Upgrade
  D. Database Conversion to R81.20 only
  B. Export Package

  ---

  Explanation

  CPUSE (Check Point Upgrade Service Engine) is a tool that allows users to download, import, install, and uninstall software packages on Gaia OS. CPUSE has a web-based user interface that can be accessed through Gaia Portal. CPUSE offers four package options in the web GUI for different purposes: Clean Install - This option performs a clean installation of a Major Version package, which erases all existing configuration and data on the system. Export Package - This option exports a package from CPUSE repository to an external location for backup or transfer purposes. Upgrade - This option performs an upgrade of a Major Version package or a Minor Version package, which preserves the existing configuration and data on the system. Database Conversion - This option converts the database schema of a Major Version package to match the current version. Therefore, the correct answer is B.

  References:

  CPUSE - Gaia Deployment Agent

• Question 557:

  What is the purpose of extended master key extension/session hash?

  A. UDP VOIP protocol extension
  B. In case of TLS1.x it is a prevention of a Man-in-the-Middle attack/disclosure of the client-server communication
  C. Special TCP handshaking extension
  D. Supplement DLP data watermark
  B. In case of TLS1.x it is a prevention of a Man-in-the-Middle attack/disclosure of the client-server communication

  ---

  Explanation

  The extended master key extension/session hash is a feature introduced in TLS 1.3 to prevent a Man-in- the-Middle attack/disclosure of the client-server communication. It works by generating a unique session hash for each connection, which is derived from the master key and other parameters. This session hash is then used to authenticate the application data and the end-of-handshake messages, ensuring that no one can tamper with or eavesdrop on the communication.

  References:

  Check Point Security Expert R81 Course, TLS 1.3

• Question 558:

  Check Point security components are divided into the following components:

  A. GUI Client, Security Gateway, WebUI Interface
  B. GUI Client, Security Management, Security Gateway
  C. Security Gateway, WebUI Interface, Consolidated Security Logs
  D. Security Management, Security Gateway, Consolidate Security Logs
  B. GUI Client, Security Management, Security Gateway

  ---

  Explanation

  Check Point security components are divided into the following components: GUI Client, Security Management, Security Gateway. GUI Client is the graphical user interface that allows administrators to configure, manage, and monitor Check Point products and security policies. Security Management is the server that stores and enforces the security policies and provides logging and reporting functions. Security Gateway is the device that inspects and filters network traffic according to the security policies.

• Question 559:

  Identity Awareness lets an administrator easily configure network access and auditing based on three times. Choose the correct statement.

  A. Network location, the identity of a user and the identity of a machine.
  B. Geographical location, the identity of a user and the identity of a machine.
  C. Network location, the identity of a user and the active directory membership.
  D. Network location, the telephone number of a user and the UID of a machine.
  A. Network location, the identity of a user and the identity of a machine.

• Question 560:

  What are types of Check Point APIs available currently as part of R81.20 code?

  A. Security Gateway API Management API, Threat Prevention API and Identity Awareness Web Services API
  B. Management API, Threat Prevention API, Identity Awareness Web Services API and OPSEC SDK API
  C. OSE API, OPSEC SDK API, Threat Extraction API and Policy Editor API
  D. CPMI API, Management API, Threat Prevention API and Identity Awareness Web Services API
  B. Management API, Threat Prevention API, Identity Awareness Web Services API and OPSEC SDK API

  ---

  Explanation

  What are types of Check Point APIs available currently as part of R81.20 code? The types of Check Point APIs available currently as part of R81.20 code are:

  Management API: This API allows you to automate and orchestrate various management tasks, such as creating and modifying objects, installing policies, generating reports, etc. The Management API can be accessed via CLI, Web Services, or GUI clients.

  Threat Prevention API: This API allows you to interact with the Threat Prevention software blades, such as Anti-Virus, Anti-Bot, Threat Emulation, etc. The Threat Prevention API can be used to query and update indicators, upload files for emulation, retrieve verdicts and reports, etc.

  Identity Awareness Web Services API: This API allows you to integrate external identity sources with the Identity Awareness software blade, which provides identity-based access control for network traffic. The Identity Awareness Web Services API can be used to send identity and session information to the Security Gateway, query identity information from the Security Gateway, etc.

  OPSEC SDK API: This API allows you to develop custom applications that can communicate with Check Point products using the OPSEC protocol. The OPSEC SDK API supports various OPSEC services, such as LEA, CPMI, SAM, ELA, UFP, etc.

  R81 Management API Reference Guide, page 7 [R81 Threat Prevention API Reference Guide], page 7 [R81 Identity Awareness Administration Guide], page 105 [OPSEC SDK R81 Documentation Package].