CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 71:

  Which port is used for full synchronization in ClusterXL?

  A. TCP 256
  B. UDP 256
  C. TCP 8116
  D. UDP 8116
  A. TCP 256

  ---

  Explanation

  Full synchronization uses TCP port 256 to transfer state tables between cluster members.

• Question 72:

  What are the available options for downloading Check Point hotfixes in Gala WebUI (CPUSE)?

  A. Manually, Scheduled, Automatic
  B. Manually, Automatic, Disabled
  C. Manually, Scheduled, Disabled
  D. Manually, Scheduled, Enabled
  A. Manually, Scheduled, Automatic

  ---

  Explanation

  The available options for downloading Check Point hotfixes in Gaia WebUI (CPUSE) are Manually, Scheduled, and Automatic. These options can be configured in the CPUSE Settings tab of the Gaia Portal.

  The Manual option lets you download hotfixes manually from the Check Point Cloud or a local Deployment Agent when you need them. The Scheduled option lets you download hotfixes automatically at a specified time interval (daily, weekly, or monthly). The Automatic option lets you download hotfixes automatically as soon as they are available.

  References:

  https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_AdminWebAdminGuide/html_frameset.htm?topic=documents/R77/CP_R77_Gaia_AdminWebAdminGuide/112109

• Question 73:

  Which of the following is NOT a VPN routing option available in a star community?

  A. To satellites through center only.
  B. To center, or through the center to other satellites, to Internet and other VPN targets.
  C. To center and to other satellites through center.
  D. To center only.
  A. To satellites through center only.
  D. To center only.

  ---

  Explanation

  A star community is a VPN topology where one or more satellites connect to a center gateway. The center gateway can be a Security Gateway or a Security Management Server. The VPN routing option determines how the traffic is routed between the satellites and the center, and between the satellites themselves. There are three VPN routing options available in a star community: To center only: The satellites can only communicate with the center gateway, and not with each other or with any other VPN targets. This option is useful for remote access clients that only need to access resources on the center gateway. To center, or through the center to other satellites, to Internet and other VPN targets: The satellites can communicate with the center gateway, and also with other satellites, Internet hosts, and other VPN targets through the center gateway. This option is useful for branch offices that need to access resources on the center gateway, as well as on other branch offices, Internet hosts, and other VPN targets.

  To center and to other satellites through center: The satellites can communicate with the center gateway, and also with other satellites through the center gateway. However, they cannot communicate with Internet hosts or other VPN targets. This option is useful for branch offices that need to access resources on the center gateway and on other branch offices, but not on Internet hosts or other VPN targets. Therefore, the options A (To satellites through center only) and D (To center only) are not valid VPN routing options in a star community.

  References:

  1: Remote Access VPN R81.20 Administration Guide - Check Point Software, page 13

  2: Gaia R81.20 Administration Guide - Check Point Software, page 1030

• Question 74:

  Which feature dynamically assigns traffic to CPU cores?

  A. CoreXL
  B. SecureXL
  C. Dynamic Dispatcher
  D. ClusterXL
  C. Dynamic Dispatcher

  ---

  Explanation

  Dynamic Dispatcher dynamically distributes traffic across CPU cores based on load.

• Question 75:

  What is the best sync method in the ClusterXL deployment?

  A. Use 1 cluster + 1st sync
  B. Use 1 dedicated sync interface
  C. Use 3 clusters + 1st sync + 2nd sync + 3rd sync
  D. Use 2 clusters +1st sync + 2nd sync
  B. Use 1 dedicated sync interface

  ---

  Explanation

  The best sync method in the ClusterXL deployment is to use one dedicated sync interface. This means that one interface on each cluster member is used exclusively for synchronization traffic, which improves performance and security. Using multiple clusters or sync interfaces is not recommended, as it can cause network congestion or synchronization issues.

  References:

  Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 8.

• Question 76:

  What are scenarios supported by the Central Deployment in SmartConsole?

  A. Installation of Jumbo Hotfix on a ClusterXL environment in High Availability Mode
  B. Upgrading a Dedicated SmartEvent Server
  C. Upgrading a Dedicated Log Server to R81
  D. Upgrading a Standalone environment
  A. Installation of Jumbo Hotfix on a ClusterXL environment in High Availability Mode

• Question 77:

  Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

  A. AV issues
  B. VPN errors
  C. Network traffic issues
  D. Authentication issues
  C. Network traffic issues

  ---

  Explanation

  The "fw monitor" tool can be best used to troubleshoot network traffic issues. Fw monitor is a tool that allows administrators to capture packets at different inspection points in the Firewall kernel, and apply filters and flags to analyze the traffic. Fw monitor can help troubleshoot network connectivity problems, packet drops, NAT issues, VPN issues, and more. The other options are either not related or less suitable for fw monitor.

• Question 78:

  Which Check Point process provides logging services, such as forwarding logs from Gateway to Log Server, providing Log Export API (LEA) & Event Logging API (ELA) services.

  A. DASSERVICE
  B. FWD
  C. CPVIEWD
  D. CPD
  B. FWD

• Question 79:

  The customer has about 150 remote access user with Windows laptops. Not more than 50 Clients will be connected at the same time. The customer wants to use multiple VPN Gateways as entry point and a personal firewall.

  What will be the best license for him?

  A. He will need Harmony Endpoint because of the personal firewall.
  B. Mobile Access license because he needs only a 50 user license, license count is per concurrent user.
  C. Because the customer uses only Windows clients SecuRemote will be sufficient and no additional license is needed.
  D. He will need Capsule Connect using MEP (multiple entry points).
  B. Mobile Access license because he needs only a 50 user license, license count is per concurrent user.

• Question 80:

  To enable Dynamic Dispatcher on a Security Gateway without Firewall Priority Queues, run the following command in Expert mode and reboot:

  A. fw ctl Dyn_Dispatch on
  B. fw ctl Dyn_Dispatch enable
  C. fw ctl multik set_mode 4
  D. fw ctl multik set_mode 9
  D. fw ctl multik set_mode 9

  ---

  Explanation

  Dynamic Dispatcher is a CoreXL feature that dynamically distributes traffic across firewall instances based on CPU load.

  To fully enable Dynamic Dispatcher without Firewall Priority Queues (FPQ), the correct command is:

  fw ctl multik set_mode 9

  This mode enables Dynamic Dispatcher while disabling FPQ, which is the recommended configuration for most deployments.

  The other options are incorrect:

  Options A and B use non-existent commands

  Option C (set_mode 4) does not represent the correct mode for enabling Dynamic Dispatcher without FPQ

  References:

  Check Point R81 Performance Tuning Administration Guide