CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 171:

  What are the three components for Check Point Capsule?

  A. Capsule Docs, Capsule Cloud, Capsule Connect

  B. Capsule Workspace, Capsule Cloud, Capsule Connect

  C. Capsule Workspace, Capsule Docs, Capsule Connect

  D. Capsule Workspace, Capsule Docs, Capsule Cloud

  Correct Answer: D

  The three components for Check Point Capsule are Capsule Workspace, Capsule Docs, and Capsule Cloud. Capsule Workspace is a secure container app that allows users to access corporate data and applications from their mobile devices. Capsule Docs is a solution that protects documents with encryption and granular access control. Capsule Cloud is a cloud-based security service that enforces security policies on devices that are outside the corporate network. References: Check Point Capsule

• Question 172:

  Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. Which is NOT an option to adjust or configure?

  A. Severity

  B. Automatic reactions

  C. Policy

  D. Threshold

  Correct Answer: C

  An event is a notification that something significant has occurred on a Check Point product or network. Events are generated by various sources, such as blades, gateways, servers, SmartEvent, etc. You can view and manage events in

  SmartConsole by using the Events tab in the Logs and Monitor view. Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. The configurable properties include:

  Severity: The level of importance or urgency of the event. You can change the severity of an event by selecting a different value from the drop-down list. Automatic reactions: The actions that are triggered when an event occurs. You can add,

  edit, or delete automatic reactions for an event by clicking on the + icon or the pencil icon.

  Threshold: The minimum number or frequency of occurrences of an event that triggers an automatic reaction. You can change the threshold of an event by entering a different value in the text box. The policy is not an option to adjust or

  configure for an event. The policy is a set of rules that define how to handle events based on their source, type, severity, etc. You can create and manage policies in SmartEvent by using the Policies tab in the Logs and Monitor view.

  References: R81 Logging and Monitoring Administration Guide

• Question 173:

  Fill in the blank: The R81 feature _____ permits blocking specific IP addresses for a specified time period.

  A. Block Port Overflow

  B. Local Interface Spoofing

  C. Suspicious Activity Monitoring

  D. Adaptive Threat Prevention

  Correct Answer: C

  Suspicious Activity Rules Solution Suspicious Activity Rules is a utility integrated into SmartView Monitor that is used to modify access privileges upon detection of any suspicious network activity (for example, several attempts to gain unauthorized access). The detection of suspicious activity is based on the creation of Suspicious Activity rules. Suspicious Activity rules are Firewall rules that enable the system administrator to instantly block suspicious connections that are not restricted by the currently enforced security policy. These rules, once set (usually with an expiration date), can be applied immediately without the need to perform an Install Policy operation.

• Question 174:

  Fill in the blank: The R81 utility fw monitor is used to troubleshoot ______________________.

  A. User data base corruption

  B. LDAP conflicts

  C. Traffic issues

  D. Phase two key negotiations

  Correct Answer: C

  Check Point's FW Monitor is a powerful built-in tool for capturing network traffic at the packet level. The FW Monitor utility captures network packets at multiple capture points along the FireWall inspection chains. These captured packets can be inspected later using the WireShark.

• Question 175:

  Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

  A. UDP port 265

  B. TCP port 265

  C. UDP port 256

  D. TCP port 256

  Correct Answer: D

  Full synchronization between cluster members is handled by Firewall Kernel using TCP port 256 by default. Full synchronization occurs when a cluster member joins or rejoins the cluster and needs to receive the entire state table from

  another member. References:

  [ClusterXL Administration Guide]

• Question 176:

  Which of these statements describes the Check Point ThreatCloud?

  A. Blocks or limits usage of web applications

  B. Prevents or controls access to web sites based on category

  C. Prevents Cloud vulnerability exploits

  D. A worldwide collaborative security network

  Correct Answer: D

  The Check Point ThreatCloud is a worldwide collaborative security network that collects and analyzes threat data from millions of sensors, security gateways, and other sources, and delivers real-time threat intelligence and protection to Check Point products. References: Check Point ThreatCloud

• Question 177:

  Which command can you use to enable or disable multi-queue per interface?

  A. cpmq set

  B. Cpmqueue set

  C. Cpmq config

  D. St cpmq enable

  Correct Answer: A

  The cpmq set command enables or disables multi-queue per interface. Multi- queue is a feature that allows distributing the network traffic among several CPU cores, improving the throughput and performance of the Security Gateway. References: Multi- Queue

• Question 178:

  What is true about VRRP implementations?

  A. VRRP membership is enabled in cpconfig

  B. VRRP can be used together with ClusterXL, but with degraded performance

  C. You cannot have a standalone deployment

  D. You cannot have different VRIDs in the same physical network

  Correct Answer: C

• Question 179:

  Session unique identifiers are passed to the web api using which http header option?

  A. X-chkp-sid

  B. Accept-Charset

  C. Proxy-Authorization

  D. Application

  Correct Answer: A

  Session unique identifiers are passed to the web API using the X-chkp-sid HTTP header option. The web API is a service that runs on the Security Management Server and enables external applications to communicate with the Check Point management database using REST APIs. To use the web API, you need to create a session with the management server by sending a login request with your credentials. The management server will respond with a session unique identifier (SID) that represents your session. You need to pass this SID in every subsequent request to the web API using the X-chkp-sid HTTP header option. This way, the management server can identify and authenticate your session and perform the requested operations. References: Check Point R81 REST API Reference Guide

• Question 180:

  What is the least amount of CPU cores required to enable CoreXL?

  A. 2

  B. 1

  C. 4

  D. 6

  Correct Answer: A

  The least amount of CPU cores required to enable CoreXL is 2. CoreXL is a technology that improves the performance of Security Gateways by using multiple CPU cores to process traffic in parallel. CoreXL requires at least two CPU cores, one for SND (Secure Network Distributor) and one for a Firewall instance. The other options are either too few or too many CPU cores for enabling CoreXL. References: [Check Point R81 SecureXL Administration Guide], [Check Point R81 Performance Tuning Administration Guide]