CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 631:

  What is a possible command to delete all of the SSH connections of a gateway?

  A. fw sam -I dport 22
  B. fw ctl conntab -x -dpott=22
  C. fw tab -t connections -x -e 00000016
  D. fwaccel dos config set dport ssh
  A. fw sam -I dport 22

  ---

  Explanation

  The command 'fw sam -I dport 22' will delete all of the SSH connections of a gateway by adding a temporary rule to the Security Policy that blocks traffic with destination port 22. The other commands are not valid or do not have the same effect.

  References:

  Check Point R81 Command Line Interface Reference Guide, page 101.

• Question 632:

  Security Checkup Summary can be easily conducted within:

  A. Summary
  B. Views
  C. Reports
  D. Checkups
  B. Views

  ---

  Explanation

  Security Checkup Summary can be easily conducted within Views. Views is a feature in SmartConsole that allows you to create customized dashboards and reports based on various security data sources, such as logs, events, audit trails, and more. You can use Views to perform a Security Checkup Summary, which is a comprehensive analysis of your network security posture and potential risks. You can use predefined templates or create your own views to generate the summary.

  References:

  Check Point Security Expert R81 Course, Views Administration Guide

• Question 633:

  Which command is used to view system performance in real time?

  A. top
  B. cpview
  C. fw monitor
  D. netstat
  B. cpview

  ---

  Explanation

  cpview provides real-time monitoring of system performance, including CPU, memory, and network statistics.

• Question 634:

  NO: 219

  What cloud-based SandBlast Mobile application is used to register new devices and users?

  A. Check Point Protect Application
  B. Management Dashboard
  C. Behavior Risk Engine
  D. Check Point Gateway
  D. Check Point Gateway

  ---

  Explanation

  The cloud-based SandBlast Mobile application that is used to register new devices and users is Check Point Gateway. Check Point Gateway is a web portal that allows administrators to enroll devices and users into the SandBlast Mobile service, which is a cloud-based solution that protects mobile devices from advanced threats. Check Point Gateway also allows administrators to configure policies, monitor device status, and generate reports for SandBlast Mobile.

• Question 635:

  Which of the following statements is TRUE about R81 management plug-ins?

  A. The plug-in is a package installed on the Security Gateway.
  B. Installing a management plug-in requires a Snapshot, just like any upgrade process.
  C. A management plug-in interacts with a Security Management Server to provide new features and support for new products.
  D. Using a plug-in offers full central management only if special licensing is applied to specific features of the plug-in.
  C. A management plug-in interacts with a Security Management Server to provide new features and support for new products.

  ---

  Explanation

  A management plug-in is a software component that interacts with a Security Management Server to provide new features and support for new products. A management plug-in can extend the functionality of SmartConsole, SmartDashboard, SmartView Monitor, SmartView Tracker, SmartEvent, SmartReporter, SmartProvisioning, SmartUpdate, and other management tools. A management plug-in can also add new objects, policies, rules, actions, reports, views, and wizards to the management system. Some examples of management plug-ins are CloudGuard Controller, SandBlast Agent, Endpoint Security Server, Threat Extraction for Web, etc.

• Question 636:

  When users connect to the Mobile Access portal they are unable to open File Shares.

  Which log file would you want to examine?

  A. cvpnd.elg
  B. httpd.elg
  C. vpnd.elg
  D. fw.elg
  A. cvpnd.elg

  ---

  Explanation

  When users connect to the Mobile Access portal they are unable to open File Shares. The log file that you would want to examine is cvpnd.elg. This log file contains information about the Mobile Access VPN daemon, which handles the connections from the Mobile Access portal to the internal resources, such as File Shares, Web Applications, etc. The log file is located in the directory $FWDIR/log/on the Security Gateway. You can use the command fw log -f cvpnd.elg to view the log file in real time.

  References:

  R81 Mobile Access Administration Guide, page 255.

• Question 637:

  What level of CPU load on a Secure Network Distributor would indicate that another may be necessary?

  A. Idle <20%
  B. USR <20%
  C. SYS <20%
  D. Wait <20%
  A. Idle <20%

  ---

  Explanation

  The CPU load on a Secure Network Distributor (SND) indicates how much processing power is available for distributing traffic among cluster members. If the CPU load is high, it means that the SND is overloaded and cannot handle more traffic efficiently. A good indicator of SND overload is when the Idle CPU percentage is less than 20%. In this case, you may need to add another SND to balance the load or optimize your cluster configuration.

  References:

  Getting Started - Check Point Software, section "Monitoring ClusterXL Status"

• Question 638:

  Which Check Point feature enables application scanning and the detection?

  A. Application Dictionary
  B. AppWiki
  C. Application Library
  D. CPApp
  B. AppWiki

  ---

  Explanation

  AppWiki is the Check Point feature that enables application scanning and the detection. AppWiki is an easy to use tool that lets you search and filter Check Point's Web 2.0 Applications Database to find out information about internet applications, including social network widgets; filter by a category, tag, or risk level; and search for a keyword or application. AppWiki helps you to identify and control the applications on your network, and to apply granular policies based on the application type, risk, and characteristics.

  AppWiki is integrated with the Check Point Application Control Software Blade, which provides the industry's strongest application security and identity control to organizations of all sizes.

  References:

  1: AppWiki | Check Point Software

• Question 639:

  To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following command in Expert mode then reboot:

  A. fw ctl multik set_mode 1
  B. fw ctl Dynamic_Priority_Queue on
  C. fw ctl Dynamic_Priority_Queue enable
  D. fw ctl multik set_mode 9
  D. fw ctl multik set_mode 9

  ---

  Explanation

  Dynamic Dispatcher is a feature that optimizes the performance of Security Gateways with multiple CPU cores by dynamically allocating traffic to different cores based on their load and priority. Firewall Priority Queues is a feature that prioritizes traffic based on its type and importance by assigning it to different queues with different weights and limits. To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, you need to run the following command in Expert mode then reboot:

  This command sets the multi-core mode to 9, which means that Dynamic Dispatcher is enabled with Firewall Priority Queues. The other commands are not valid or do not enable both features.

  References:

  R81 Performance Tuning Administration Guide

• Question 640:

  The Security Gateway is installed on GAIA R81. The default port for the Web User Interface is ______.

  A. TCP 18211
  B. TCP 257
  C. TCP 4433
  D. TCP 443
  D. TCP 443