CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 91:

  Please choose the path to monitor the compliance status of the Check Point R81.20 based management.

  A. Gateways and Servers --> Compliance View
  B. Compliance blade not available under R81.20
  C. Logs and Monitor --> New Tab --> Open compliance View
  D. Security and Policies --> New Tab --> Compliance View
  C. Logs and Monitor --> New Tab --> Open compliance View

  ---

  Explanation/Reference:

  The path to monitor the compliance status of the Check Point R81.20 based management is Logs and Monitor > New Tab > Open compliance View. Compliance View is a feature that allows administrators to monitor and assess the compliance level of their Check Point products and security policies based on best practices and industry standards. Compliance View provides a dashboard that shows the overall compliance status, compliance score, compliance trends, compliance issues, compliance reports, and compliance blades for different security aspects, such as data protection, threat prevention, identity awareness, etc. To access Compliance View in R81.20 SmartConsole, administrators need to go to Logs and Monitor > New Tab > Open compliance View. The other options are either incorrect or not available in R81.20.

• Question 92:

  Which Check Point software blade provides Application Security and identity control?

  A. Identity Awareness
  B. Data Loss Prevention
  C. URL Filtering
  D. Application Control
  D. Application Control

  ---

  Explanation/Reference:

  Application Control is the software blade that provides Application Security and identity control. It allows administrators to define granular policies based on users or groups to identify, block or limit the usage of web applications and widgets. Application Control also integrates with Identity Awareness to provide user-level visibility and control. References: Training and Certification | Check Point Software, Check Point Resource Library

• Question 93:

  Alice and Bob are concurrently logged In via SSH on the same Check Point Security Gateway as user "admin* however Bob was first logged in and acquired the lock Alice Is not aware that Bob is also togged in to the same Security Management Server as she is but she needs to perform very urgent configuration changes - which of the following GAlAclish command is true for overriding Bobs configuration database lock:

  A. lock database override
  B. unlock override database
  C. unlock database override
  D. database unlock override
  A. lock database override

  ---

  Explanation/Reference:

  To override Bob's configuration database lock, Alice can use the command lock database override in the clish shell. This command will transfer the lock from Bob to Alice and allow her to make the urgent configuration changes. However, this command should be used with caution, as it may cause conflicts or inconsistencies if Bob and Alice are working on the same objects or policies. It is recommended to communicate with other administrators before using this command and to release the lock as soon as possible after finishing the changes1. The other commands are not valid in clish and will result in an error message.

• Question 94:

  Customer's R81 management server needs to be upgraded to R81.20. What is the best upgrade method when the management server is not connected to the Internet?

  A. Export R81 configuration, clean install R81.20 and import the configuration
  B. CPUSE offline upgrade
  C. CPUSE online upgrade
  D. SmartUpdate upgrade
  C. CPUSE online upgrade

  ---

  Explanation/Reference:

  CPUSE offline upgrade is the best upgrade method when the management server is not connected to the Internet. CPUSE (Check Point Upgrade Service Engine) is a tool that automates the process of upgrading and installing software packages on Check Point devices. CPUSE can work in online mode or offline mode. Online mode requires an Internet connection to download the packages from Check Point servers. Offline mode allows you to download the packages manually from another device and transfer them to the management server using a USB drive or SCP. References: Check Point Security Expert R81 Course, CPUSE Administration Guide

• Question 95:

  What information is NOT collected from a Security Gateway in a Cpinfo?

  A. Firewall logs
  B. Configuration and database files
  C. System message logs
  D. OS and network statistics
  A. Firewall logs

  ---

  Explanation/Reference:

  In a Cpinfo (Checkpoint information) command, various information is collected from a Security Gateway. However, firewall logs are NOT collected from a Security Gateway in a Cpinfo.

  A. Firewall logs

  The Cpinfo command typically collects information such as configuration and database files, system message logs, OS and network statistics, but it does not include firewall logs. Firewall logs are usually obtained separately using other

  methods or tools.

  References: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on Cpinfo.

• Question 96:

  Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

  A. 15 sec
  B. 60 sec
  C. 5 sec
  D. 30 sec
  B. 60 sec

  ---

  Explanation/Reference:

  Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every 60 seconds based on the current traffic load. This ensures optimal performance and load balancing of SecureXL instances. References: SecureXL Mechanism

• Question 97:

  You want to gather data and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?

  A. Check Point Capsule Cloud
  B. Sandblast Mobile Protect
  C. SecuRemote
  D. SmartEvent Client Info
  B. Sandblast Mobile Protect

  ---

  Explanation/Reference:

  SandBlast Mobile Protect is an application that provides comprehensive protection for mobile devices against cyber threats. SandBlast Mobile Protect is a lightweight app that does not affect the device performance or battery life. It monitors network traffic, device behavior, and installed apps to detect and prevent attacks such as phishing, malware, ransomware, botnets, and man-in-the-middle5. SandBlast Mobile Protect also integrates with Check Point's ThreatCloud intelligence network to provide real- time threat information and updates6. Therefore, the correct answer is B. References: 5: [SandBlast Mobile Protect] 6: [SandBlast Mobile Administration Guide]

• Question 98:

  Which of the following Windows Security Events will not map a username to an IP address in Identity Awareness?

  A. Kerberos Ticket Renewed
  B. Kerberos Ticket Requested
  C. Account Logon
  D. Kerberos Ticket Timed Out
  D. Kerberos Ticket Timed Out

  ---

  Explanation/Reference:

  Identity Awareness maps usernames to IP addresses by collecting Windows Security Events from Active Directory Domain Controllers. These events include Account Logon, Kerberos Ticket Requested, and Kerberos Ticket Renewed. These

  events indicate that a user has successfully authenticated to the domain and obtained a Kerberos ticket for accessing network resources. Identity Awareness can use these events to associate the username with the source IP address of the

  authentication request. However, Kerberos Ticket Timed Out is not a Windows Security Event that Identity Awareness can use to map usernames to IP addresses. This event indicates that a user's Kerberos ticket has expired and needs to be

  renewed. This event does not contain the source IP address of the user, only the username and the ticket information. Therefore, Identity Awareness cannot use this event to map a username to an IP address.

  References:

  1, Training and Certification | Check Point Software, section "Security Expert R81.20 (CCSE) Core Training"

  2, Certified Security Expert (CCSE) R81.20 Course Overview, page 1 3, Check Point Certified Security Expert R81, page 5 5, Identity Awareness Administration Guide R81, section "How Identity Awareness Collects Identities"

• Question 99:

  Which of the following statements about Site-to-Site VPN Domain-based is NOT true?

  A. Domain-based- VPN domains are pre-defined for all VPN Gateways. When the Security Gateway encounters traffic originating from one VPN Domain with the destination to a VPN Domain of another VPN Gateway, that traffic is identified as VPN traffic and is sent through the VPN Tunnel between the two Gateways.
  B. Route-based- The Security Gateways will have a Virtual Tunnel Interface (VTI) for each VPN Tunnel with a peer VPN Gateway. The Routing Table can have routes to forward traffic to these VTIs. Any traffic routed through a VTI is automatically identified as VPN Traffic and is passed through the VPN Tunnel associated with the VTI.
  C. Domain-based- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway.
  D. Domain-based- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a host or network that can send or receive VPN traffic through a VPN Gateway.
  C. Domain-based- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway.

  ---

  Explanation/Reference:

  The statement that is not true about site-to-site VPN domain-based is that a VPN domain is a service or user that can send or receive VPN traffic through a VPN gateway. A VPN domain is a host or network that can send or receive VPN

  traffic through a VPN gateway, not a service or user. A service or user can be part of a VPN community, which defines the encryption and authentication methods for the VPN traffic. References:

  [Check Point Security Expert R81 Administration Guide], page 146.

• Question 100:

  SmartEvent does NOT use which of the following procedures to identify events:

  A. Matching a log against each event definition
  B. Create an event candidate
  C. Matching a log against local exclusions
  D. Matching a log against global exclusions
  C. Matching a log against local exclusions

  ---

  Explanation/Reference:

  SmartEvent does not use matching a log against local exclusions to identify events. Local exclusions are filters that are applied to logs before they are sent to the SmartEvent server. They are used to reduce the amount of logs that are forwarded by the Security Gateways or Log Servers, and to avoid sending irrelevant or sensitive logs. Local exclusions do not affect the event detection process, which is performed by the SmartEvent Correlation Unit on the SmartEvent server. References: Check Point Security Expert R81 Course, SmartEvent Administration Guide, SK120193 - How to configure Local Log Filtering on Security Gateway / Cluster / VSX