CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 1:

  After replacing a faulty Gateway the admin installed the new Hardware and want to push the policy. Installing the policy using the SmartConsole he got an Error for the Threat Prevention Policy. There is no error for the Access Control Policy. What will be the most common cause for the issue?

  A. The admin forgot to reestablish the SIC for the new hardware. That is typically the case when configure only the interfaces of the replacement hardware instead restoring a backup.
  B. The IPS Protection engine on the replacement hardware is too old. Before pushing the Threat Prevention Policy use SmartConsole -> Security Policies -> Updates -> IPS 'Update Now' to update the engine.
  C. The admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing.
  D. The Threat Prevention Policy can't be installed on a Gateway without an already installed Access Control Policy. First install only the Access Control Policy.
  C. The admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing.

  ---

  Explanation/Reference:

  The most common cause for the issue is that the admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing. Without a valid license, the Threat Prevention Policy cannot be installed on the new hardware. The admin should check the license status on the SmartConsole -> Gateways and Servers -> Licenses and Contracts and apply the appropriate license for the replacement hardware. References: Check Point Certified Security Expert R81.20 Course Overview, sk171213: Threat Prevention policy installation reports failure in SmartConsole with this error: "Policy installation had failed due to an internal error."

• Question 2:

  Identity Awareness lets an administrator easily configure network access and auditing based on three items. Choose the correct statement.

  A. Network location, the identity of a user and the identity of a machine.
  B. Geographical location, the identity of a user and the identity of a machine.
  C. Network location, the identity of a user and the active directory membership.
  D. Network location, the telephone number of a user and the UID of a machine.
  A. Network location, the identity of a user and the identity of a machine.

  ---

  Explanation/Reference:

  The correct answer is A. Network location, the identity of a user and the identity of a machine.

  Identity Awareness allows you to easily configure network access and auditing based on three items: network location, the identity of a user and the identity of a machine1. This enables you to create granular and accurate identity-based

  policies that control who can access what, when and how. You can also monitor and log user and machine activities for compliance and auditing purposes. Geographical location, the telephone number of a user and the UID of a machine are

  not the items that Identity Awareness uses to identify and authorize users and machines.

  References:

  Identity Awareness - Check Point Software1

• Question 3:

  You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down. What command do you run to determine the cause?

  A. cphaprob register
  B. cphaprob report
  C. cpstat all
  D. cphaprob list
  D. cphaprob list

  ---

  Explanation/Reference:

  To determine the cause of a cluster gateway showing "Down" despite running "clusterXL_admin up" on the down member, you can run the following command: This command will provide a list of cluster members along with their statuses and can help diagnose the issue with the down member. References: Check Point documentation or training materials related to High Availability and ClusterXL.

  

• Question 4:

  Which of the following commands shows the status of processes?

  A. cpwd_admin -l
  B. cpwd -l
  C. cpwd admin_list
  D. cpwd_admin list
  D. cpwd_admin list

  ---

  Explanation/Reference:

  The command that shows the status of processes is cpwd_admin list. Cpwd_admin is a command that allows administrators to manage processes that are registered with the Check Point WatchDog (CPWD) daemon. CPWD is a daemon that monitors the health of critical processes on the Security Gateway or Management Server, and restarts them if they fail or stop responding. Cpwd_admin list shows the process name, PID, status, start time, monitor status, and number of restarts for each process registered with CPWD.

• Question 5:

  What SmartEvent component creates events?

  A. Consolidation Policy
  B. Correlation Unit
  C. SmartEvent Policy
  D. SmartEvent GUI
  B. Correlation Unit

  ---

  Explanation/Reference:

  The SmartEvent component that creates events is the Correlation Unit, which is responsible for correlating and analyzing security events to identify patterns and potential threats.

  Option A, "Consolidation Policy," does not create events but is used to configure policies for event consolidation.

  Option C, "SmartEvent Policy," is not responsible for creating events but is used to configure policies related to SmartEvent.

  Option D, "SmartEvent GUI," is the graphical user interface for managing SmartEvent but does not create events itself.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 6:

  Which command collects diagnostic data for analyzing a customer setup remotely?

  A. cpv
  B. cpinfo
  C. migrate export
  D. sysinfo
  B. cpinfo

  ---

  Explanation/Reference:

  The verified answer is B. cpinfo.

  cpinfo is a command that collects diagnostic data for analyzing a customer setup remotely. It is an auto-updatable utility that runs on the customer's machine and uploads the data to Check Point servers. The data includes information about

  the system, the security policy, the objects, and the logs. Check Point support engineers can use the DiagnosticsView utility to open the cpinfo file and view the customer's configuration and environment settings1. migrate export is a

  command that exports the Check Point configuration and database files to a compressed file. It is used for backup and migration purposes, not for remote analysis2. sysinfo is a command that displays basic information about the system,

  such as the hostname, the OS version, the CPU model, and the memory size. It does not collect or upload any data to Check Point servers3.

  cpv is not a valid command in Check Point.

  References:

  Support, Support Requests, Training ... - Check Point Software1 Migrate export - Check Point Software

  sysinfo - Check Point Software

• Question 7:

  You want to gather and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?

  A. SmartEvent Client Info
  B. SecuRemote
  C. Check Point Protect
  D. Check Point Capsule Cloud
  C. Check Point Protect

  ---

  Explanation/Reference:

  Check Point Protect is a lightweight app that can be used to gather and analyze threats to your mobile device. It provides real-time threat intelligence, device posture assessment, and secure browsing protection3. The other applications are either not designed for mobile devices, or do not offer threat analysis features. References: R81 CCSA and CCSE exams released featuring Promo for... - Check Point ..., Check Point Protect - Apps on Google Play

• Question 8:

  What are the services used for Cluster Synchronization?

  A. 256H-CP tor Full Sync and 8116/UDP for Delta Sync
  B. 8116/UDP for Full Sync and Delta Sync
  C. TCP/256 for Full Sync and Delta Sync
  D. No service needed when using Broadcast Mode
  A. 256H-CP tor Full Sync and 8116/UDP for Delta Sync

  ---

  Explanation/Reference:

  Cluster Synchronization is a mechanism that allows cluster members to share state information and maintain a consistent security policy. Cluster Synchronization uses two types of synchronization: Full Synchronization and Delta Synchronization. Full Synchronization transfers the entire Security Policy and state tables from one cluster member to another. Delta Synchronization transfers only the changes in the state tables. Cluster Synchronization uses two services for communication: TCP port 256 (CPHA) for Full Synchronization and UDP port 8116 for Delta Synchronization3. Therefore, the correct answer is A. References: 3: Cluster Synchronization

• Question 9:

  Which command can you use to enable or disable multi-queue per interface?

  A. cpmq set
  B. Cpmqueue set
  C. Cpmq config
  D. St cpmq enable
  A. cpmq set

  ---

  Explanation/Reference:

  The cpmq set command enables or disables multi-queue per interface. Multi- queue is a feature that allows distributing the network traffic among several CPU cores, improving the throughput and performance of the Security Gateway. References: Multi- Queue

• Question 10:

  Which path below is available only when CoreXL is enabled?

  A. Slow path
  B. Firewall path
  C. Medium path
  D. Accelerated path
  C. Medium path

  ---

  Explanation/Reference:

  According to the Check Point R81 training course, the medium path is available only when CoreXL is enabled. CoreXL is a performance-enhancing technology that allows multiple CPU cores to process traffic simultaneously. The medium path handles packets that require deeper inspection or content awareness, such as IPS, Anti-Virus, or URL Filtering. The other paths are either available regardless of CoreXL or not valid terms. References: Certified Security Expert (CCSE) R81.20 Course Overview