CheckPoint 156-315.81.20 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81.20 Online Questions & Answers

• Question 81:

  An administrator wishes to enable Identity Awareness on the Check Point firewalls. However, they allow users to use company issued or personal laptops.

  Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

  A. AD Query
  B. Terminal Servers Agent
  C. Identity Agents
  D. Browser-Based Authentication
  D. Browser-Based Authentication

  ---

  Explanation

  Browser-Based Authentication is an identity awareness method that enables you to identify users who are not authenticated by other methods, such as Active Directory or VPN. Browser-Based Authentication redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity. Browser-Based Authentication is suitable for scenarios where users can use company issued or personal laptops, since it does not require any installation or configuration on the user's device. It also supports various operating systems and browsers, and can be customized to match the company's branding.

  References:

  Check Point R81 Identity Awareness Administration Guide, page 9 Configuring Browser-Based Authentication in SmartConsole Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 13

• Question 82:

  Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________.

  A. The license is attached to the wrong Security Gateway.
  B. The existing license expires.
  C. The license is upgraded.
  D. The IP address of the Security Management or Security Gateway has changed.
  D. The IP address of the Security Management or Security Gateway has changed.

  ---

  Explanation

  A new license should be generated and installed in all of the following situations except when the IP address of the Security Management or Security Gateway has changed. This is because Check Point licenses are not bound to IP addresses, but to other parameters such as MAC addresses, CPU IDs, or hostnames. Therefore, changing the IP address of a licensed machine does not affect the validity of the license. However, changing other parameters, such as replacing a network card or renaming a machine, may require a new license. Additionally, when the existing license expires or the license is upgraded to a higher level or a different package, a new license is needed.

• Question 83:

  Fill in the blank: The R81 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows then as prioritized security events.

  A. SmartMonitor
  B. SmartView Web Application
  C. SmartReporter
  D. SmartTracker
  B. SmartView Web Application

  ---

  Explanation

  The R81 SmartConsole, SmartEvent GUI client, and SmartView Web Application consolidate billions of logs and show them as prioritized security events. The SmartView Web Application is a web-based interface that allows you to access the SmartEvent Server from any browser. You can use the SmartView Web Application to view and analyze security events, generate reports, and configure SmartEvent settings.

  References:

  1: Check Point R81 SmartConsole User Guide - Check Point Software, page 10

  2: Check Point R81 SmartEvent Administration Guide - Check Point Software, page 9

• Question 84:

  What is the mechanism behind Threat Extraction?

  A. This a new mechanism which extracts malicious files from a document to use it as a counter-attack against its sender.
  B. This is a new mechanism which is able to collect malicious files out of any kind of file types to destroy it prior to sending it to the intended recipient.
  C. This is a new mechanism to identify the IP address of the sender of malicious codes and put it into the SAM database (Suspicious Activity Monitoring).
  D. Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.
  D. Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.

  ---

  Explanation

  Threat Extraction is a technology that removes potentially malicious features that are known to be risky from files (macros, embedded objects and more), rather than determining their maliciousness. By cleaning the file before it enters the organization, Threat Extraction preemptively prevents both known and unknown threats, providing better protection against zero-day attacks. Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast. The other options are either incorrect or irrelevant to the mechanism behind Threat Extraction.

  References:

  Threat Extraction (CDR) - Check Point Software, Check Point Document Threat Extraction Technology

• Question 85:

  Which statements below are CORRECT regarding Threat Prevention profiles in Smart Dashboard?

  A. You can assign only one profile per gateway and a profile can be assigned to one rule Only.
  B. You can assign multiple profiles per gateway and a profile can be assigned to one rule only.
  C. You can assign multiple profiles per gateway and a profile can be assigned to one or more rules.
  D. You can assign only one profile per gateway and a profile can be assigned to one or more rules.
  C. You can assign multiple profiles per gateway and a profile can be assigned to one or more rules.

  ---

  Explanation

  In SmartDashboard, Threat Prevention profiles can be assigned to one or more rules. This means that you can have multiple profiles assigned to a single gateway, and each of these profiles can be associated with one or more rules. This allows for granular control over threat prevention settings for different rules or scenarios.

  Check Point Certified Security Expert R81 documentation and learning resources.

• Question 86:

  Which of the following is NOT an option to calculate the traffic direction?

  A. Incoming
  B. Internal
  C. External
  D. Outgoing
  D. Outgoing

  ---

  Explanation

  The option that is NOT an option to calculate the traffic direction is Outgoing. Traffic direction is a parameter that determines how traffic is classified as internal or external based on its source and destination. Traffic direction can be calculated using three options: Incoming, Internal, or External.

  Incoming means that traffic is classified as internal if its destination is one of the Security Gateway's interfaces, and external otherwise. Internal means that traffic is classified as internal if its source or destination belongs to one of the internal networks defined in the topology, and external otherwise.

  External means that traffic is classified as internal if both its source and destination belong to one of the internal networks defined in the topology, and external otherwise. Outgoing is not a valid option to calculate traffic direction.

• Question 87:

  The installation of a package via SmartConsole CANNOT be applied on

  A. A single Security Gateway
  B. A full Security Cluster (All Cluster Members included)
  C. Multiple Security Gateways and/or Clusters
  D. R81.20 Security Management Server
  D. R81.20 Security Management Server

• Question 88:

  In ClusterXL Load Sharing Multicast Mode:

  A. only the primary member received packets sent to the cluster IP address
  B. only the secondary member receives packets sent to the cluster IP address
  C. packets sent to the cluster IP address are distributed equally between all members of the cluster
  D. every member of the cluster received all of the packets sent to the cluster IP address
  D. every member of the cluster received all of the packets sent to the cluster IP address

  ---

  Explanation

  In ClusterXL Load Sharing Multicast Mode, every member of the cluster receives all of the packets sent to the cluster IP address. This mode uses multicast MAC addresses to distribute packets to all cluster members. Each member decides whether to accept or reject the packet based on a load balancing algorithm. This mode provides better performance and scalability than Unicast mode, but requires a switch that supports multicast MAC addresses.

• Question 89:

  You want to store the GAIA configuration in a file for later reference.

  What command should you use?

  A. write mem <filename>
  B. show config -f <filename>
  C. save config -o <filename>
  D. save configuration <filename>
  D. save configuration <filename>

  ---

  Explanation

  The correct command to store the GAIA configuration in a file is save configuration <filename>. This will create a file with the current system level configuration in the home directory of the current user. The other commands are incorrect because they either do not exist or do not save the configuration to a file.

  References:

  1: Backing up Gaia system level configuration (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102234)

• Question 90:

  Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

  A. 50%
  B. 75%
  C. 80%
  D. 15%
  D. 15%

  ---

  Explanation

  Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to a certain threshold. In this case, the correct threshold is specified as option

  D: 15%. So, when the available disk space reaches or falls below 15%, old log entries should be deleted to free up space. Options A, B, and C do not represent the recommended threshold for deleting old log entries according to Check Point's best practices.

  References:

  Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.