CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 571:

  Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

  A. $FWDIR/database/fwauthd.conf
  B. $FWDIR/conf/fwauth.conf
  C. $FWDIR/conf/fwauthd.conf
  D. $FWDIR/state/fwauthd.conf
  C. $FWDIR/conf/fwauthd.conf

  ---

  Explanation

  The configuration file that contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status is $FWDIR/conf/fwauthd.conf. This file is used for configuring authentication services in Check Point Security Servers.

  References:

  Check Point documentation or training materials related to Security Server configuration.

• Question 572:

  The essential means by which state synchronization works to provide failover in the event an active member goes down, ____________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.

  A. ccp
  B. cphaconf
  C. cphad
  D. cphastart
  A. ccp

  ---

  Explanation

  The essential means by which state synchronization works to provide failover in the event an active member goes down, ccp is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster. Ccp stands for Cluster Control Protocol, and it is a proprietary protocol that runs on UDP port 8116. Ccp is responsible for exchanging state information, health checks, load balancing decisions, and synchronization network configuration between cluster members. The other options are either commands or daemons that are related to cluster operations, but not the protocol itself.

• Question 573:

  You want to allow your Mobile Access Users to connect to an internal file share. Adding the Mobile Application `File Share' to your Access Control Policy in the SmartConsole didn't work.

  You will be only allowed to select Services for the `Service & Application' column.

  How to fix it?

  A. The Mobile Access Blade is not enabled under Gateway properties.
  B. The Mobile Access Blade is not enabled for the Access Control Layer of the policy.
  C. A Quantum Spark Appliance is selected as Installation Target for the policy packet.
  D. The Mobile Access Policy Source under Gateway properties is set to Legacy Policy and not to Unified Access Policy
  A. The Mobile Access Blade is not enabled under Gateway properties.

• Question 574:

  Office mode means that:

  A. SecurID client assigns a routable MAC address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.
  B. Users authenticate with an Internet browser and use secure HTTPS connection.
  C. Local ISP (Internet service Provider) assigns a non-routable IP address to the remote user.
  D. Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.
  D. Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

  ---

  Explanation

  Office mode is a feature that allows a security gateway to assign a remote client an IP address from a network that is protected by the security gateway. This way, the remote client can access resources on the internal network as if it was physically connected to it. The IP address is assigned to the remote client after the user authenticates for a tunnel, and it is routable, meaning that it can be reached by other hosts on the network. Office mode is useful for scenarios where the remote client needs to use applications that rely on IP addresses, such as VoIP or file sharing.

  References:

  1. Support, Support Requests, Training... - Check Point Software

  2. Gaia R81.20 Administration Guide - Check Point Software

• Question 575:

  What is true about the IPS-Blade?

  A. In R81, IPS is managed by the Threat Prevention Policy
  B. In R81, in the IPS Layer, the only three possible actions are Basic, Optimized and Strict
  C. In R81, IPS Exceptions cannot be attached to "all rules"
  D. In R81, the GeoPolicy Exceptions and the Threat Prevention Exceptions are the same
  A. In R81, IPS is managed by the Threat Prevention Policy

  ---

  Explanation

  In R81, IPS is managed by the Threat Prevention Policy. The Threat Prevention Policy is a unified policy that allows you to configure and enforce IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction settings in one place.

  References:

  Threat Prevention Administration Guide

• Question 576:

  What is the limitation of employing Sticky Decision Function?

  A. With SDF enabled, the involved VPN Gateways only supports IKEv1
  B. Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF
  C. With SDF enabled, only ClusterXL in legacy mode is supported
  D. With SDF enabled, you can only have three Sync interfaces at most
  B. Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF

  ---

  Explanation

  Sticky Decision Function (SDF) is a feature that ensures that VPN traffic is handled by the same core on a Security Gateway with multiple CPU cores. This improves the performance and stability of VPN tunnels by avoiding out-of-order packets and reducing encryption overhead. However, the limitation of employing SDF is that acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF. This means that SDF may reduce the overall throughput and scalability of the Security Gateway. Therefore, SDF should be used only when necessary and only on gateways that are dedicated to VPN traffic.

  References:

  R81 Performance Tuning Administration Guide

• Question 577:

  When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.

  A. SecureID
  B. SecurID
  C. Complexity
  D. TacAcs
  B. SecurID

  ---

  Explanation

  When requiring certificates for mobile devices, the authentication method should be set to one of the following: Username and Password RADIUS SecurID (RSA SecurID) So, the correct answer is option B, "SecurID." Options A, C, and D are not standard authentication methods for mobile devices in this context.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 578:

  Gaia has two default user accounts that cannot be deleted.

  What are those user accounts?

  A. Admin and Default
  B. Expert and Clish
  C. Control and Monitor
  D. Admin and Monitor
  D. Admin and Monitor

  ---

  Explanation

  Gaia has two default user accounts that cannot be deleted: Admin and Monitor. Admin is a superuser account that has full access to all Gaia features and commands. Monitor is a read-only account that can view Gaia configuration and status but cannot make any changes. Both accounts have predefined passwords that can be changed by the Admin user.

  References:

  [Check Point R81 Gaia Administration Guide], page 29 SRC: GAIA R81.20 Administration Guide User

  Management -> Users These users are created by default and cannot be deleted: admin and monitor

• Question 579:

  How long may verification of one file take for Sandblast Threat Emulation?

  A. up to 1 minutes
  B. within seconds cleaned file will be provided
  C. up to 5 minutes
  D. up to 3 minutes
  D. up to 3 minutes

  ---

  Explanation

  How long may verification of one file take for SandBlast Threat Emulation? Verification of one file may take up to 3 minutes for SandBlast Threat Emulation. SandBlast Threat Emulation is a software blade that provides protection against malicious files by emulating them in a virtual sandbox and analyzing their behavior. The emulation time depends on various factors, such as file size, file type, emulation mode, etc.

  The default emulation time limit is 180 seconds, but it can be changed in the Threat Prevention policy settings.

  References:

  [R81 Threat Prevention Administration Guide], page 39.

• Question 580:

  Besides fw monitor, what is another command that can be used to capture packets?

  A. arp
  B. traceroute
  C. tcpdump
  D. ping
  C. tcpdump

  ---

  Explanation

  Tcpdump is a tool that captures and analyzes network traffic on a given interface. It can be used to troubleshoot connectivity or performance issues, or to inspect the content of the packets. To use tcpdump, you need to access the Security Gateway in expert mode and run tcpdump -i <interface> [options] [filter] .

  You can specify various options and filters to customize the output, such as source or destination IP address, port number, protocol, packet size, etc. You can also save the captured packets to a file for later analysis by using the -w option. For more information about tcpdump, you can run man tcpdump or visit the

  official website.