CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 171:

  You need to change the MAC-address on eth2 interface of the gateway. What is the correct way to change MAC-address in Check Point Gaia?

  A. In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11
  B. In expert-mode run ifconfig eth1 hw 11:11:11:11 11 11
  C. In CLISH run set interface eth2 hw-addr 11 11 11:11:11 11
  D. In expert-mode run: ethtool -4 eth2 mac 11 11:11:11:11:11
  A. In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11

  ---

  Explanation/Reference:

  The correct way to change MAC-address in Check Point Gaia is to run the command set interface eth2 mac-addr 11:11:11:11:11:11 in CLISH mode. This command will change the MAC address of the eth2 interface to 11:11:11:11:11:11 and save the configuration. The other commands are either incorrect or not supported in Gaia. The ifconfig command is used in Expert mode to configure network interfaces, but it does not support changing MAC addresses. The ethtool command is used in Expert mode to query and control network device driver and hardware settings, but it does not support changing MAC addresses. The set interface eth2 hw-addr command is not a valid command in CLISH mode. References: [Changing MAC Address]

• Question 172:

  What is the minimum amount of RAM needed for a Threat Prevention Appliance?

  A. 6 GB
  B. 8GB with Gaia in 64-bit mode
  C. 4 GB
  D. It depends on the number of software blades enabled
  C. 4 GB

  ---

  Explanation/Reference:

  According to the Check Point Resource Library, the minimum amount of RAM needed for a Threat Prevention Appliance is 4 GB. This applies to both physical and virtual appliances. The other options are either incorrect or irrelevant. References: Check Point Resource Library

• Question 173:

  When installing a dedicated R81 SmartEvent server. What is the recommended size of the root partition?

  A. Any size
  B. Less than 20GB
  C. More than 10GB and less than 20GB
  D. At least 20GB
  D. At least 20GB

  ---

  Explanation/Reference:

  At least 20GB is the recommended size of the root partition when installing a dedicated R81 SmartEvent server. The root partition is the primary partition that contains the operating system files and other essential files for booting and running the system. The SmartEvent server requires at least 20GB of free space on the root partition to install and operate properly. If the root partition size is less than 20GB, you may encounter errors or performance issues with SmartEvent. References: Check Point Security Expert R81 Course, SmartEvent Administration Guide

• Question 174:

  Which two Cluster Solutions are available under R81.20?

  A. ClusterXL and NSRP
  B. VRRPandHSRP
  C. VRRP and IP Clustering
  D. ClusterXL and VRitP
  D. ClusterXL and VRitP

  ---

  Explanation/Reference:

  ClusterXL and VRRP are the two cluster solutions that are available under R81.20. According to the ClusterXL R81.20 Administration Guide1, ClusterXL is a Check Point software-based clustering solution that provides high availability and load sharing for Check Point Security Gateways and Cluster Members. ClusterXL supports two modes: High Availability and Load Sharing. In High Availability mode, all Cluster Members are connected to the same network segment and share a virtual IP address. One member is active and handles all traffic, while the others are in standby mode and ready to take over in case of a failure. In Load Sharing mode, all Cluster Members are active and share the traffic load according to a predefined algorithm. ClusterXL supports both unicast and multicast modes for Load Sharing1. VRRP (Virtual Router Redundancy Protocol) is an industry standard protocol that provides high availability for routers or firewalls by creating a virtual router with a virtual IP address that is shared by a group of routers or firewalls. One router or firewall is elected as the master and handles all traffic directed to the virtual IP address, while the others are backups that monitor the master and take over if it fails. VRRP can be used with Check Point Security Gateways to provide redundancy and failover for external interfaces1. NSRP (NetScreen Redundancy Protocol) is a proprietary protocol developed by Juniper Networks that provides high availability and load balancing for NetScreen firewalls. NSRP is not supported by Check Point products2. HSRP (Hot Standby Router Protocol) is a Cisco proprietary protocol that provides high availability for routers by creating a virtual router with a virtual IP address that is shared by a group of routers. One router is elected as the active router and handles all traffic directed to the virtual IP address, while another router is elected as the standby router and monitors the active router and takes over if it fails. HSRP is not supported by Check Point products. IP Clustering is a feature of Linux Virtual Server (LVS) that provides high availability and load balancing for IP-based services by creating a cluster of real servers that are accessed through a virtual IP address. The cluster is managed by a director that routes requests to the real servers according to a scheduling algorithm. IP Clustering is not supported by Check Point products. References: : ClusterXL R81.20 Administration Guide : Check Point R81.20 : Solved: R81.20 - Check Point CheckMates : [Hot Standby Router Protocol - Wikipedia] : [Linux Virtual Server - Wikipedia]

• Question 175:

  Which process handles connection from SmartConsole R81?

  A. fwm
  B. cpmd
  C. cpm
  D. cpd
  C. cpm

  ---

  Explanation/Reference:

  The CPM process handles connection from SmartConsole R81. The CPM process is the main process of the Security Management Server and the Multi-Domain Security Management Server. It is responsible for managing the database,

  handling policy installation, communicating with SmartConsole clients, and providing REST API services. The CPM process runs on port 19009 and uses the CPD process as a proxy for communication with other processes.

  References:

  Check Point Processes and Daemons, section "CPM"

  Check Point R81, section "SmartConsole"

  Check Point R81.20, section "REST API"

• Question 176:

  An administrator would like to troubleshoot why templating is not working for some traffic. How can he determine at which rule templating is disabled?

  A. He can use the fw accel stat command on the gateway.
  B. He can use the fw accel statistics command on the gateway.
  C. He can use the fwaccel stat command on the Security Management Server.
  D. He can use the fwaccel stat command on the gateway
  D. He can use the fwaccel stat command on the gateway

  ---

  Explanation/Reference:

  The fwaccel stat command on the gateway shows the status of SecureXL acceleration, including the number of accelerated and non-accelerated connections, and the reason for non-acceleration. The reason for non-acceleration can be either a rule that disables templating, or a feature that is not supported by SecureXL. To determine which rule disables templating, the administrator can use the -s option to show the rule numbers and names. For example:

  

• Question 177:

  Which of the following will NOT affect acceleration?

  A. Connections destined to or originated from the Security gateway
  B. A 5-tuple match
  C. Multicast packets
  D. Connections that have a Handler (ICMP, FTP, H.323, etc.)
  B. A 5-tuple match

  ---

  Explanation/Reference:

  Check Point's SecureXL technology, which is responsible for acceleration, has certain limitations and conditions under which acceleration may not occur. In this context, the question is asking about factors that will NOT affect acceleration.

  Option B, "A 5-tuple match," will not affect acceleration. A 5-tuple match refers to the matching of source IP, source port, destination IP, destination port, and protocol. SecureXL can accelerate traffic that matches these criteria, but it's not a

  factor that hinders acceleration.

  Options A, C, and D can all affect acceleration:

  Option A mentions "Connections destined to or originated from the Security gateway," which implies that SecureXL acceleration can apply to these connections. Option C mentions "Multicast packets," and SecureXL may have limitations in

  handling multicast traffic efficiently.

  Option D mentions "Connections that have a Handler (ICMP, FTP, H.323, etc.)," and certain protocols (such as FTP) may require special handling and might not be fully accelerated by SecureXL.

  References: Check Point Certified Security Expert R81 Study Guide

• Question 178:

  What key is used to save the current CPView page in a filename format cpview_"cpview process ID".cap"number of captures"?

  A. S
  B. W
  C. C
  D. Space bar
  C. C

  ---

  Explanation/Reference:

  The key C is used to save the current CPView page in a filename format cpview_"cpview process ID".cap"number of captures". This is a feature of CPView that allows the user to capture the current page for later analysis or troubleshooting. The file is saved in the /var/log directory on the Security Gateway. References: Check Point Resource Library, page 3.

• Question 179:

  What component of Management is used tor indexing?

  A. DBSync
  B. API Server
  C. fwm
  D. SOLR
  D. SOLR

  ---

  Explanation/Reference:

  The component of Management that is used for indexing is SOLR1. SOLR is an open source enterprise search platform that provides indexing and searching capabilities for various types of data2. Check Point uses SOLR to index logs, objects, policies, and other data that are stored in the Security Management Server or the Multi- Domain Security Management Server3. SOLR enables fast and efficient searches in SmartConsole, SmartLog, SmartView, and other applications3. SOLR also supports advanced features such as full-text search, faceted search, highlighting, spell checking, and geospatial search2. References: Check Point R81.20 Known Limitations - Check Point Software, SOLR - The Enterprise Search Platform, Check Point R81.20 Logging and Monitoring Administration Guide - Check Point Software

• Question 180:

  Which command will allow you to see the interface status?

  A. cphaprob interface
  B. cphaprob interface
  C. cphaprob if
  D. cphaprob stat
  C. cphaprob if