CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 561:

  What is the correct Syntax for adding an access-rule via R80 API?

  A. add access-rule layer "Network" action "Allow"
  B. add access-rule layer "Network" position 1 name "Rule 1" service. 1 "SMTP" service.2 "hup"
  C. add access-rule <CR> and follow the wizard
  D. add rule position 1 name "Rule 1" policy-package "Standard" add service "http"
  B. add access-rule layer "Network" position 1 name "Rule 1" service. 1 "SMTP" service.2 "hup"

  ---

  Explanation

  The correct syntax for adding an access-rule via R80 API is to use the add access-rule command with the layer, position, name, and service parameters. The layer parameter specifies the name of the access control policy layer where the rule will be added. The position parameter specifies the ordinal number in which to place the rule in the rulebase. The name parameter specifies the name of the rule. The service parameter specifies one or more services that match this rule.

  References:

  [Check Point Security Expert R81 API Reference Guide], page 18.

• Question 562:

  Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or ______.

  A. On all satellite gateway to satellite gateway tunnels
  B. On specific tunnels for specific gateways
  C. On specific tunnels in the community
  D. On specific satellite gateway to central gateway tunnels
  C. On specific tunnels in the community

  ---

  Explanation

  Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or on specific tunnels in the community. Permanent VPN tunnels are always active and prevent VPN tunnel negotiation failures due to idle time or traffic volume. You can configure permanent VPN tunnels in SmartConsole by selecting the Permanent Tunnel option in the VPN Community Properties window.

• Question 563:

  To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

  A. fw ctl set int fwha vmac global param enabled
  B. fw ctl get int vmac global param enabled; result of command should return value 1
  C. cphaprob-a if
  D. fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1
  D. fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1

  ---

  Explanation

  To ensure that VMAC mode is enabled, the CLI command that should be run on all cluster members is fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1. VMAC mode is a feature that allows ClusterXL to use virtual MAC addresses for cluster interfaces, instead of physical MAC addresses. This improves the failover performance and compatibility of ClusterXL with switches and routers. To check if VMAC mode is enabled, the command fw ctl get int fwha_vmac_global_param_enabled can be used, which returns 1 if VMAC mode is enabled, and 0 if VMAC mode is disabled.

• Question 564:

  What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?

  A. Choose different setting for log storage and SmartEvent db
  B. It is not possible
  C. Install Management and SmartEvent on different machines
  D. Use Multi-Domain Management Server
  A. Choose different setting for log storage and SmartEvent db

• Question 565:

  What is the command to check the status of Check Point processes?

  A. cphaprob list
  B. top
  C. cpwd_adminlist
  D. cptop
  C. cpwd_adminlist

• Question 566:

  After the initial installation on Check Point appliance, you notice that the Management-interface and default

  gateway are incorrect.

  Which commands could you use to set the IP to 192.168.80.200/24 and default gateway to 192.168.80.1?

  A. set interface Mgmt ipv4-address 192.168.80.200 mask-length 24set static-route default nexthop gateway address 192.168.80.1 onsave config
  B. set interface Mgmt ipv4-address 192.168.80.200 255.255.255.0add static-route 0.0.0.0. 0.0.0.0 gw 192.168.80.1 onsave config
  C. set interface Mgmt ipv4-address 192.168.80.200 255.255.255.0set static-route 0.0.0.0. 0.0.0.0 gw 192.168.80.1 onsave config
  D. set interface Mgmt ipv4-address 192.168.80.200 mask-length 24add static-route default nexthop gateway address 192.168.80.1 onsave config
  A. set interface Mgmt ipv4-address 192.168.80.200 mask-length 24set static-route default nexthop gateway address 192.168.80.1 onsave config

  ---

  Explanation

  To set the IP address and default gateway of the Management interface on a Check Point appliance, you can use the following commands: set interface Mgmt ipv4-address 192.168.80.200 mask-length 24 - This

  command sets the IPv4 address of the Management interface to 192.168.80.200 and the subnet mask to 255.255.255.0 (24 bits). set static-route default nexthop gateway address 192.168.80.1 on - This command

  sets the default gateway to 192.168.80.1 and enables the static route. save config - This command saves the configuration changes to the appliance. These commands are documented in the Check Point appliance initial installation guide, which you can find in the web search results. The other options are incorrect because they use invalid syntax or parameters for the commands. For example, option B uses

  add static-route instead of set static-route, option C uses 0.0.0.0. instead of 0.0.0.0, and option D uses add static-route default instead of set static-route default.

• Question 567:

  Which Operating Systems are supported for the Endpoint Security VPN?

  A. Windows and Red Hat Linux
  B. Windows and SPARC Solaris
  C. Windows and x86 Solaris
  D. Windows and macOS computers
  D. Windows and macOS computers

• Question 568:

  To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection.

  Which of the these is NOT a SecureXL template?

  A. Accept Template
  B. Deny Template
  C. Drop Template
  D. NAT Template
  B. Deny Template

  ---

  Explanation

  SecureXL templates are a mechanism to accelerate the rate of connection establishment by grouping connections that match a particular service and whose sole differentiating element is the source port.

  SecureXL templates enable even the very first packets of a TCP handshake to be accelerated, without waiting for the Firewall kernel to create a connection entry. The first packets of the first connection on the same service will be forwarded to the Firewall kernel, which will then create a template of the connection.

  The template will contain all the relevant information for the connection, such as source and destination IP addresses, destination port, NAT information, policy decision, etc. The template will be used by SecureXL to handle subsequent connections on the same service, without involving the Firewall kernel. This reduces the CPU load and increases the throughput. There are three types of SecureXL templates: Accept, Drop, and NAT. Accept templates are used for connections that are allowed by the Firewall policy. Drop templates are used for connections that are blocked by the Firewall policy. NAT templates are used for connections that require NAT translation. Deny templates are not a valid type of SecureXL template.

  References:

  SecureXL NAT Templates in R80.20 and lower, Part 3 - SecureXL, Security Gateway Performance Optimization - Part 5 - SecureXL

• Question 569:

  Which two of these Check Point Protocols are used by SmartEvent Processes?

  A. ELA and CPD
  B. FWD and LEA
  C. FWD and CPLOG
  D. ELA and CPLOG
  D. ELA and CPLOG

  ---

  Explanation

  SmartEvent Processes use two

  Check Point Protocols: ELA (Event Log Agent) and CPLOG (Check Point Log). ELA collects logs from Security Gateways and forwards them to the Log Server. CPLOG is used by the Log Server to communicate with the SmartEvent Server.

  References:

  [SmartEvent Architecture]

• Question 570:

  Which of the following cannot be configured in an Access Role Object?

  A. Networks
  B. Machines
  C. Users
  D. Time
  D. Time