CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 11:

  Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________ .

  A. Sent to the Internal Certificate Authority.
  B. Sent to the Security Administrator.
  C. Stored on the Security Management Server.
  D. Stored on the Certificate Revocation List.
  D. Stored on the Certificate Revocation List.

  ---

  Explanation/Reference:

  Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is stored on the Certificate Revocation List (CRL). The CRL is a list of certificates that have been revoked by the Internal Certificate Authority (ICA) and are no longer valid for Secure Internal Communication (SIC). The CRL is signed by the ICA and issued to all the managed Security Gateways the next time a SIC connection is made12. The CRL helps to prevent unauthorized access to the Security Management Server by revoked Security Gateways. References: 1: How to renew SIC after changing IP Address of Security Management Server - Check Point Software, Solution ID: sk43784 2: Check Point R81 Security Engineering Guide - Check Point Software, page 162

• Question 12:

  What happen when IPS profile is set in Detect Only Mode for troubleshooting?

  A. It will generate Geo-Protection traffic
  B. Automatically uploads debugging logs to Check Point Support Center
  C. It will not block malicious traffic
  D. Bypass licenses requirement for Geo-Protection control
  C. It will not block malicious traffic

  ---

  Explanation/Reference:

  It is recommended to enable Detect-Only for Troubleshooting on the profile during the initial installation of IPS. This option overrides any protections that are set to Prevent so that they will not block any traffic. During this time you can analyze

  the alerts that IPS generates to see how IPS will handle network traffic, while avoiding any impact on the flow of traffic.

  References:

• Question 13:

  There are 4 ways to use the Management API for creating host object with R81 Management API. Which one is NOT correct?

  A. Using Web Services
  B. Using Mgmt_cli tool
  C. Using CLISH
  D. Using SmartConsole GUI console
  E. Events are collected with SmartWorkflow from Trouble Ticket systems
  E. Events are collected with SmartWorkflow from Trouble Ticket systems

  ---

  Explanation/Reference:

  There are four ways to use the Management API for creating host object with R81 Management API: Using Web Services, Using mgmt_cli tool, Using CLISH, and Using SmartConsole GUI console. Events are collected with SmartWorkflow from Trouble Ticket systems is not a correct option. References: Check Point Management APIs

• Question 14:

  What is the command to show SecureXL status?

  A. fwaccel status
  B. fwaccel stats -m
  C. fwaccel -s
  D. fwaccel stat
  D. fwaccel stat

  ---

  Explanation/Reference:

  The command to show SecureXL status is fwaccel stat. This command displays information about SecureXL acceleration, such as the number of accelerated and non- accelerated connections, the reason for non-acceleration, and the SecureXL device name and mode. The other commands are either invalid or show different statistics.

• Question 15:

  You want to store the GAIA configuration in a file for later reference. What command should you use?

  A. write mem
  B. show config
  C. save config
  D. save configuration
  D. save configuration

  ---

  Explanation/Reference:

  The correct command to store the GAIA configuration in a file is save configuration 1. This will create a file with the current system level configuration in the home directory of the current user1. The other commands are incorrect because they either do not exist or do not save the configuration to a file. References: 1: Backing up Gaia system level configuration(https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doG oviewsolutiondetails=andsolutionid=sk102234)

• Question 16:

  What component of R81 Management is used for indexing?

  A. DBSync
  B. API Server
  C. fwm
  D. SOLR
  D. SOLR

  ---

  Explanation/Reference:

  The component of R81 Management that is used for indexing is SOLR. SOLR is an open-source enterprise search platform that provides fast and scalable indexing and searching capabilities. SOLR is used by SmartConsole to index the objects and rules in the security policy, as well as the logs and events in SmartLog and SmartEvent. SOLR enables quick and easy access to the relevant information in the management database. References: Check Point Security Expert R81 Course, SOLR Troubleshooting

• Question 17:

  John detected high load on sync interface. Which is most recommended solution?

  A. For short connections like http service ?delay sync for 2 seconds
  B. Add a second interface to handle sync traffic
  C. For short connections like http service ?do not sync
  D. For short connections like icmp service ?delay sync for 2 seconds
  A. For short connections like http service ?delay sync for 2 seconds

  ---

  Explanation/Reference:

  When John detects a high load on the sync interface, the recommended solution is to implement a delay in the sync process for short-lived connections like HTTP. Here's an explanation of each option:

  A. Delaying the sync for 2 seconds for short connections like HTTP services is a common practice to reduce the load on the sync interface. This allows the interface to handle the incoming connections more effectively.

  B. Adding a second interface to handle sync traffic might be a viable solution, but it can be more complex and costly compared to implementing a delay for short connections.

  C. Not syncing short connections like HTTP services is not a recommended approach because it may lead to synchronization issues and potential data inconsistencies between cluster members.

  D. Delaying the sync for ICMP (ping) services is not a common practice and may not effectively address the high load issue on the sync interface.

  Therefore, option A is the most recommended solution as it addresses the issue by introducing a delay for short-lived connections, optimizing the sync process without causing synchronization problems.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 18:

  When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

  A. RADIUS
  B. Remote Access and RADIUS
  C. AD Query
  D. AD Query and Browser-based Authentication
  D. AD Query and Browser-based Authentication

  ---

  Explanation/Reference:

  When Identity Awareness is enabled, AD Query and Browser-based Authentication are used as identity sources for Application Control. AD Query allows the Security Gateway to query Active Directory servers for identity information based on IP addresses. Browser- based Authentication allows the Security Gateway to redirect unidentified users to a captive portal where they can authenticate with their credentials. These identity sources provide accurate and up-to-date identity information for Application Control, which can enforce granular policies based on user, group, machine, and domain objects. References: R81 Identity Awareness Administration Guide, page 9.

• Question 19:

  What command verifies that the API server is responding?

  A. api stat
  B. api status
  C. show api_status
  D. app_get_status
  B. api status

  ---

  Explanation/Reference:

  The API server is a service that runs on the Security Management Server and enables external applications to communicate with the Check Point management database using REST APIs. You can verify that the API server is responding by using the following command in Expert mode:

  

  This command will display the current status of the API server, such as running, stopped, or initializing. It will also show the API version, port number, and SSL certificate information. References: Check Point R81 REST API Reference Guide

• Question 20:

  Which command is used to obtain the configuration lock in Gaia?

  A. Lock database override
  B. Unlock database override
  C. Unlock database lock
  D. Lock database user
  A. Lock database override

  ---

  Explanation/Reference:

  Which command is used to obtain the configuration lock in Gaia? The command that is used to obtain the configuration lock in Gaia is lock database override. This command allows a user to take over the configuration lock from another user who is currently logged in with read/write access. The other user will be forced to logout and will lose any unsaved changes. This command should be used with caution and only when necessary. References: Gaia Administration Guide R81, page 15.