CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 181:

  Which statement is NOT TRUE about Delta synchronization?

  A. Using UDP Multicast or Broadcast on port 8161
  B. Using UDP Multicast or Broadcast on port 8116
  C. Quicker than Full sync
  D. Transfers changes in the Kernel tables between cluster members.
  A. Using UDP Multicast or Broadcast on port 8161

  ---

  Explanation/Reference:

  The statement that is not true about Delta synchronization is Using UDP Multicast or Broadcast on port 8161. Delta synchronization is a mechanism that transfers only the changes in the kernel tables between cluster members, instead of sending the entire tables. It uses UDP Multicast or Broadcast on port 8116, not 81612. The other statements are true about Delta synchronization. References: Check Point R81 ClusterXL Administration Guide

• Question 182:

  Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

  A. After upgrading the hardware, increase the number of kernel instances using cpconfig
  B. Hyperthreading must be enabled in the bios to use CoreXL
  C. Run cprestart from dish
  D. Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores.
  A. After upgrading the hardware, increase the number of kernel instances using cpconfig

  ---

  Explanation/Reference:

  https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Perform anceTuning_AdminGuide/Content/Topics-PTG/CoreXL-Configuring-IPv4-and-IPv6- CoreXL-FW- instances.htm?Highlight=Configuring%20the% 20Number%20of%20IPv4%20CoreXL%20Fi rewall%20Instances R81 https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_PerformanceT uning_AdminGuide/Topics-PTG/CoreXL-Configuring-IPv4-and-IPv6-CoreXL-FW- instances.htm cpconfig -> Enter the number of the Check Point CoreXL option. ( Enter 1 to select Change the number of firewall instances. OR Enter 2 for the option Change the number of IPv6 firewall instances.) -> Enter the total number of IPv4 (IPv6) CoreXL Firewall instances you wish the Security Gateway to run. Follow the instructions on the screen. -> Exit from the cpconfig menu. - Reboot the Security Gateway.

• Question 183:

  What are valid authentication methods for mutual authenticating the VPN gateways?

  A. PKI Certificates and Kerberos Tickets
  B. PKI Certificates and DynamicID OTP
  C. Pre-Shared Secrets and Kerberos Ticket
  D. Pre-shared Secret and PKI Certificates
  D. Pre-shared Secret and PKI Certificates

  ---

  Explanation/Reference:

  The valid authentication methods for mutual authenticating the VPN gateways are Pre-shared Secret and PKI Certificates. Pre-shared Secret is a method that uses a secret key that is known only to the two VPN gateways. PKI Certificates is a

  method that uses digital certificates that are issued by a trusted Certificate Authority (CA) and contain the public key of each VPN gateway. Both methods ensure that the VPN gateways can verify each other's identity before establishing a

  secure VPN tunnel. References:

  [Check Point R81 VPN Administration Guide]

• Question 184:

  What is required for a site-to-site VPN tunnel that does not use certificates?

  A. Pre-Shared Secret
  B. RSA Token
  C. Unique Passwords
  D. SecurelD
  A. Pre-Shared Secret

  ---

  Explanation/Reference:

  A pre-shared secret is a secret key that is shared between the two VPN peers before establishing a secure connection. It is used to authenticate the VPN peers and encrypt the VPN traffic. A pre-shared secret is required for a site-to-site VPN tunnel that does not use certificates, because certificates are another way of authenticating the VPN peers using public key cryptography. Without certificates, the VPN peers need to have a common secret key that only they know. References: Check Point R81 VPN Administration Guide, page 13

• Question 185:

  Fill in the blank: The IPS policy for pre-R81 gateways is installed during the _______ .

  A. Firewall policy install
  B. Threat Prevention policy install
  C. Anti-bot policy install
  D. Access Control policy install
  C. Anti-bot policy install

  ---

  Explanation/Reference:

  The IPS policy for pre-R81 gateways is installed during the Anti-bot policy install. The Anti- bot policy install includes both Anti-bot and IPS protections for pre-R81 gateways, since they share the same inspection engine. For R81 and above gateways, the IPS policy is installed separately as part of the Threat Prevention policy install, which also includes Anti- virus and Threat Emulation protections. References: R81 Threat Prevention Administration Guide, page 15.

• Question 186:

  Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R81.20 SmartConsole application?

  A. IPS, Anti-Bot, URL Filtering, Application Control, Threat Emulation.
  B. Firewall, IPS, Threat Emulation, Application Control.
  C. IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction.
  D. Firewall, IPS, Anti-Bot, Anti-Virus, Threat Emulation.
  C. IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction.

  ---

  Explanation/Reference:

  The Threat Prevention profile in Check Point R81.20 SmartConsole application allows you to enforce the following software blades: IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction. These software blades provide comprehensive protection against various types of threats, such as network attacks, malware, ransomware, phishing, and zero-day exploits. You can configure the profile settings for each software blade, such as the action to take, the protection scope, and the exceptions. References: Check Point Security Expert R81 Course, Threat Prevention Administration Guide

• Question 187:

  Which tool is used to enable ClusterXL?

  A. SmartUpdate
  B. cpconfig
  C. SmartConsole
  D. sysconfig
  B. cpconfig

  ---

  Explanation/Reference:

  The tool that is used to enable ClusterXL is cpconfig. ClusterXL is a software-based Load Sharing and High Availability solution that distributes network traffic between clusters of redundant Security Gateways1. ClusterXL can be enabled on

  Check Point Security Gateways running on Gaia OS, SecurePlatform OS, IPSO OS, or X-Series XOS2.

  To enable ClusterXL, the administrator must run the cpconfig command on each cluster member and select the option to enable ClusterXL. This will prompt the administrator to choose the ClusterXL mode (High Availability or Load Sharing)

  and the Cluster Control Protocol (CCP) mode (Broadcast or Multicast). After enabling ClusterXL, the administrator must reboot the cluster members for the changes to take effect34. Therefore, the correct answer is B. The tool that is used to

  enable ClusterXL is cpconfig.

  References:

  1, Introduction to ClusterXL - Check Point Software 2, ClusterXL Requirements and Compatibility - Check Point Software 3, Configuring ClusterXL - Check Point Software 4, How to configure ClusterXL - Check Point Software Technologies

• Question 188:

  In terms of Order Rule Enforcement, when a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom Which of the following statements is correct?

  A. If the Action of the matching rule is Accept the gateway will drop the packet
  B. If the Action of the matching rule is Drop, the gateway continues to check rules in the next Policy Layer down
  C. If the Action of the matching rule is Drop the gateway stops matching against later rules in the Policy Rule Base and drops the packet
  D. If the rule does not match in the Network policy it will continue to other enabled polices
  C. If the Action of the matching rule is Drop the gateway stops matching against later rules in the Policy Rule Base and drops the packet

  ---

  Explanation/Reference:

  If the action of the matching rule is Drop, the gateway stops matching against later rules in the Policy Rule Base and drops the packet. This is because the Drop action is a final action that terminates the rule matching process and discards the packet. The gateway does not continue to check rules in the next Policy Layer down or in other enabled policies. References: [Policy Layers and Sub-Policies] https://sc1.checkpoint.com/documents/R81/CP_R81_SecMGMT/ html_frameset.htm?topic= documents/R81/CP_R81_SecMGMT/126197

• Question 189:

  IF the first packet of an UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), what message is sent back through the kernel?

  A. Nothing
  B. TCP FIN
  C. TCP RST
  D. ICMP unreachable
  A. Nothing

  ---

  Explanation/Reference:

  If the first packet of a UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), nothing is sent back through the kernel. This is because UDP is a connectionless protocol that does not require an acknowledgement from the receiver. Therefore, if a UDP packet is dropped by the Firewall, the sender will not receive any feedback or notification. References: UDP Protocol

• Question 190:

  Fill in the blank: The R81 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows then as prioritized security events.

  A. SmartMonitor
  B. SmartView Web Application
  C. SmartReporter
  D. SmartTracker
  B. SmartView Web Application

  ---

  Explanation/Reference:

  The R81 SmartConsole, SmartEvent GUI client, and SmartView Web Application consolidate billions of logs and show them as prioritized security events. The SmartView Web Application is a web-based interface that allows you to access the SmartEvent Server from any browser. You can use the SmartView Web Application to view and analyze security events, generate reports, and configure SmartEvent settings12. References: 1: Check Point R81 SmartConsole User Guide Check Point Software, page 10 2: Check Point R81 SmartEvent Administration Guide - Check Point Software, page 9