CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 101:

  Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

  A. assign privileges to users.
  B. edit the home directory of the user.
  C. add users to your Gaia system.
  D. assign user rights to their home directory in the Security Management Server.
  C. add users to your Gaia system.
  D. assign user rights to their home directory in the Security Management Server.

• Question 102:

  One of major features in R81 SmartConsole is concurrent administration.

  Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?

  A. A lock icon shows that a rule or an object is locked and will be available.
  B. AdminA and AdminB are editing the same rule at the same time.
  C. A lock icon next to a rule informs that any Administrator is working on this particular rule.
  D. AdminA, AdminB and AdminC are editing three different rules at the same time.
  B. AdminA and AdminB are editing the same rule at the same time.

  ---

  Explanation/Reference:

  One of the major features in R81 SmartConsole is concurrent administration. This feature allows multiple administrators to work on the same Security Policy simultaneously, without blocking each other or creating conflicts. Concurrent administration improves the efficiency and productivity of security management operations1. However, not all of the options given are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. The correct answer is B. AdminA and AdminB are editing the same rule at the same time. This is not possible because concurrent administration uses a locking mechanism to prevent multiple administrators from modifying the same rule or object at the same time. When an administrator clicks on a rule or an object, it becomes locked and a lock icon appears next to it. The lock icon shows the name of the administrator who is working on that rule or object, and prevents other administrators from editing it until it is unlocked12. Therefore, the other options are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. Option A is possible because a lock icon shows that a rule or an object is locked and will be available when the administrator who locked it finishes working on it or logs out of SmartConsole12. Option C is possible because a lock icon next to a rule informs that any administrator is working on this particular rule, and hovering over the lock icon will show the name of that administrator12. Option D is possible because AdminA, AdminB and AdminC are editing three different rules at the same time, which does not create any conflicts or blockages12.

• Question 103:

  Connections to the Check Point R81 Web API use what protocol?

  A. HTTPS
  B. RPC
  C. VPN
  D. SIC
  A. HTTPS

  ---

  Explanation/Reference:

  Connections to the Check Point R81 Web API use the HTTPS protocol. The Web API is a RESTful web service that allows you to perform management tasks on the Security Management Server using HTTP requests. References: Check Point Management APIs

• Question 104:

  Ken wants to obtain a configuration lock from other administrator on R81 Security Management Server. He can do this via WebUI or via CLI.

  Which command should he use in CLI? (Choose the correct answer.)

  A. remove database lock
  B. The database feature has one command lock database override.
  C. override database lock
  D. The database feature has two commands lock database override and unlock database. Both will work.
  D. The database feature has two commands lock database override and unlock database. Both will work.

  ---

  Explanation/Reference:

  Ken can use either of the two commands lock database override or unlock database to obtain a configuration lock from another administrator on R81 Security Management Server via CLI. These commands allow him to override the existing lock and gain exclusive access to the database. He can also use the WebUI to perform the same action. References: Training and Certification | Check Point Software, New Courses and Certificates for R81.20 - Check Point CheckMates

• Question 105:

  What command is used to manually failover a cluster during a zero-downtime upgrade?

  A. set cluster member down
  B. cpstop
  C. clusterXL_admin down
  D. set clusterXL down
  C. clusterXL_admin down

  ---

  Explanation/Reference:

  To manually failover a cluster during a zero-downtime upgrade, you can use the command clusterXL_admin down on the active cluster member. This command will gracefully change the state of the cluster member to down and trigger a failover to the standby cluster member. This way, you can upgrade the cluster member that is now down without affecting the traffic processed by the other cluster member. You can then use the command clusterXL_admin up to bring the upgraded cluster member back online and repeat the process for the other cluster member. This command is useful for testing and debugging purposes and does not survive reboot unless you add the -p option or use the set cluster member admin down/up permanent command in clish1. The other commands are not valid for initiating a manual failover. The set cluster member down command is used to remove a cluster member from a cluster. The cpstop command is used to stop all Check Point services on a gateway. The set clusterXL down command does not exist.

• Question 106:

  If there are two administration logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available or other administrators? (Choose the BEST answer.)

  A. Publish or discard the session.
  B. Revert the session.
  C. Save and install the Policy.
  D. Delete older versions of database.
  A. Publish or discard the session.

  ---

  Explanation/Reference:

  The only way to make objects locked for editing available for other administrators is to publish or discard the session that contains the changes. Publishing the session will save and share the changes with other administrators, while discarding the session will undo and discard the changes. Saving the session will only save the changes locally, but not share them with others or release the locks. Reverting the session will restore a previous version of the session, but not affect the locks. Saving and installing the policy will only install the policy on the gateways, but not share or discard the changes in SmartConsole. Deleting older versions of database will only free up disk space, but not affect the locks.

• Question 107:

  What will be the effect of running the following command on the Security Management Server?

  

  A. Remove the installed Security Policy.
  B. Remove the local ACL lists.
  C. No effect.
  D. Reset SIC on all gateways.
  A. Remove the installed Security Policy.

  ---

  Explanation/Reference:

  Running the command fw unloadlocal on the Security Management Server will remove the installed Security Policy from the local firewall module. This command is useful for troubleshooting purposes when there is a problem with the policy installation or enforcement. However, it will also expose the Security Management Server to potential attacks, so it should be used with caution. References: Training and Certification | Check Point Software, R81 CCSA and CCSE exams released featuring Promo for... - Check Point ...

• Question 108:

  Which TCP-port does CPM process listen to?

  A. 18191
  B. 18190
  C. 8983
  D. 19009
  D. 19009

  ---

  Explanation/Reference:

  The CPM process is the core process of the Security Management Server that handles all management operations. It listens to TCP-port 19009 by default. References: CPM process

• Question 109:

  What are the modes of SandBlast Threat Emulation deployment?

  A. Cloud, Smart-1 and Hybrid
  B. Cloud. OpenServer and Vmware
  C. Cloud, Appliance and Private
  D. Cloud, Appliance and Hybrid
  D. Cloud, Appliance and Hybrid

  ---

  Explanation/Reference:

  SandBlast Threat Emulation is a technology that protects against zero-day and unknown malware by inspecting files in a secure sandbox environment and emulating their behavior. SandBlast Threat Emulation can be deployed in three modes: Cloud, Appliance and Hybrid1. Cloud mode: The files are sent to the Check Point cloud service for emulation. This mode does not require any additional hardware or software installation. It is the easiest and most cost-effective way to deploy SandBlast Threat Emulation. Appliance mode: The files are sent to a dedicated appliance (TE1000X, TE2500X, or TE100X) for emulation. This mode provides the highest level of performance and scalability, as well as data privacy and compliance. It is suitable for large organizations with high security and throughput requirements. Hybrid mode: The files are first sent to the Check Point cloud service for emulation, and if the cloud service cannot determine the verdict, they are then sent to a dedicated appliance for further analysis. This mode combines the benefits of both cloud and appliance modes, offering fast response time and high accuracy. References: 1: SandBlast Threat Emulation Deployment Modes

• Question 110:

  How many policy layers do Access Control policy support?

  A. 2
  B. 4
  C. 1
  D. 3
  A. 2

  ---

  Explanation/Reference:

  The Access Control policy supports two policy layers. These are the Network layer and the Application and URL Filtering layer. The Network layer contains rules that control the network traffic based on the source, destination, service, and action. The Application and URL Filtering layer contains rules that control the application and web access based on the application, site category, and user identity12. The Access Control policy can also use inline layers, which are sub-policies that are embedded within a rule. Inline layers allow more granular control over specific traffic or scenarios, such as VPN, Mobile Access, or different user groups13. However, inline layers are not considered as separate policy layers, but rather as extensions of the parent rule4. Therefore, the correct answer is A. The Access Control policy supports two policy layers. References: 1, Policy Layers in R80.x - Check Point CheckMates 2, Access Control policies, layers, and rules | Check Point Firewall ... 3, Chapter 8: Introduction to Policies, Layers, and Rules - Check Point ... 4, Creating an Access Control Policy - Check Point Software