CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 191:

  John detected high load on sync interface. Which is most recommended solution?

  A. For short connections like http service ?delay sync for 2 seconds

  B. Add a second interface to handle sync traffic

  C. For short connections like http service ?do not sync

  D. For short connections like icmp service ?delay sync for 2 seconds

  Correct Answer: A

  When John detects a high load on the sync interface, the recommended solution is to implement a delay in the sync process for short-lived connections like HTTP. Here's an explanation of each option:

  A. Delaying the sync for 2 seconds for short connections like HTTP services is a common practice to reduce the load on the sync interface. This allows the interface to handle the incoming connections more effectively.

  B. Adding a second interface to handle sync traffic might be a viable solution, but it can be more complex and costly compared to implementing a delay for short connections.

  C. Not syncing short connections like HTTP services is not a recommended approach because it may lead to synchronization issues and potential data inconsistencies between cluster members.

  D. Delaying the sync for ICMP (ping) services is not a common practice and may not effectively address the high load issue on the sync interface.

  Therefore, option A is the most recommended solution as it addresses the issue by introducing a delay for short-lived connections, optimizing the sync process without causing synchronization problems.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 192:

  To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:

  A. fw ctl Dyn_Dispatch on

  B. fw ctl Dyn_Dispatch enable

  C. fw ctl multik set_mode 4

  D. fw ctl multik set_mode 1

  Correct Answer: C

  Dynamic Dispatch is a feature that enhances CoreXL performance by dynamically assigning new connections to CoreXL FW instances based on their CPU utilization1. To enable Dynamic Dispatch on Security Gateway without enabling Firewall Priority Queues (FPQ), you need to run the command fw ctl multik set_mode 4 in Expert mode and reboot2. This command will set the CoreXL mode to Dynamic Dispatcher without FPQ. The other options are not correct because:

  A. fw ctl Dyn_Dispatch on: This command does not exist and will return an error message.

  B. fw ctl Dyn_Dispatch enable: This command does not exist and will return an error message.

  D. fw ctl multik set_mode 1: This command will set the CoreXL mode to Static Dispatcher without FPQ, which is the default mode2. This mode will use a static hash function to assign new connections to CoreXL FW instances based on their IP addresses and protocol. References: CoreXL Dynamic Dispatcher, To fully enable Dynamic Dispatcher on a Security Gateway, Running Dynamic Dispatch / Dynamic Split / Dynamic Balancing on VSEC/IaaS in Vmware, Dynamic Balancing for CoreXL

• Question 193:

  Automation and Orchestration differ in that:

  A. Automation relates to codifying tasks, whereas orchestration relates to codifying processes.

  B. Automation involves the process of coordinating an exchange of information through web service interactions such as XML and JSON, but orchestration does not involve processes.

  C. Orchestration is concerned with executing a single task, whereas automation takes a series of tasks and puts them all together into a process workflow.

  D. Orchestration relates to codifying tasks, whereas automation relates to codifying processes.

  Correct Answer: A

  Automation and Orchestration differ in that automation relates to codifying tasks, whereas orchestration relates to codifying processes. Automation is the process of converting manual tasks into executable scripts or programs that can be run by machines or software agents. Orchestration is the process of coordinating multiple automated tasks into a coherent workflow that achieves a desired outcome or goal. Orchestration can also involve integrating different systems, tools, and services through web service interactions such as XML and JSON. References: Check Point Security Expert R81 Course, Automation and Orchestration Administration Guide

• Question 194:

  What is the main difference between Threat Extraction and Threat Emulation?

  A. Threat Emulation never delivers a file and takes more than 3 minutes to complete.

  B. Threat Extraction always delivers a file and takes less than a second to complete.

  C. Threat Emulation never delivers a file that takes less than a second to complete.

  D. Threat Extraction never delivers a file and takes more than 3 minutes to complete.

  Correct Answer: B

  Threat Extraction (Answer B): Threat Extraction always delivers a file, but it removes potentially malicious content from the file before delivering it to the user. It is designed to provide a safe version of the file quickly, taking less than a second to complete.

  Threat Emulation (Option A): Threat Emulation does not deliver the original file to the user until it has been thoroughly analyzed for threats. It may take more than 3 minutes to complete the analysis. The emphasis here is on safety and thorough inspection, which may result in a longer processing time.

  Therefore, Option B correctly describes the main difference between Threat Extraction and Threat Emulation. References: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.

• Question 195:

  What is the command to check the status of the SmartEvent Correlation Unit?

  A. fw ctl get int cpsead_stat

  B. cpstat cpsead

  C. fw ctl stat cpsemd

  D. cp_conf get_stat cpsemd

  Correct Answer: B

  The SmartEvent Correlation Unit is responsible for analyzing the log entries and identifying events from them. It runs on the Log Server machine or on a dedicated machine1. To check the status of the SmartEvent Correlation Unit, you can use the command cpstat cpsead on the machine where it is installed. This command will show you information such as the number of logs processed, the number of events generated, the CPU and memory usage, and the status of the connection to the SmartEvent Server23. References: SmartEvent Administration Guide R76, SmartEvent Administration Guide R75, SmartEvent Performance Tuning Guide

• Question 196:

  When an encrypted packet is decrypted, where does this happen?

  A. Security policy

  B. Inbound chain

  C. Outbound chain

  D. Decryption is not supported

  Correct Answer: A

  When an encrypted packet is received by a Check Point Security Gateway, it is decrypted according to the security policy. The security policy defines the rules and settings for encryption and decryption of traffic, such as the encryption algorithm, the encryption domain, the pre-shared secret or certificate, etc. The security policy is enforced by the Firewall kernel, which is responsible for decrypting the packets before passing them to the inbound chain for further inspection. The inbound chain consists of various inspection modules that apply security checks and actions on the decrypted packets. The outbound chain is the reverse process, where the packets are inspected and then encrypted according to the security policy before being sent out. References: Check Point Firewall Security Solution, Check Point R81 Cyber Security Platform, Check Point VPN Administration Guide R81

• Question 197:

  Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?

  A. enable DLP and select.exe and .bat file type

  B. enable .exe and .bat protection in IPS Policy

  C. create FW rule for particular protocol

  D. tecli advanced attributes set prohibited_file_types exe.bat

  Correct Answer: A

  The best way to block .exe and .bat file types using Threat Emulation technologies is to enable DLP and select .exe and .bat file type. DLP stands for Data Loss Prevention, and it is a feature that allows administrators to define rules and actions to protect sensitive data from unauthorized access or transfer. One of the DLP rule conditions is File Type, which can be used to block or alert on specific file types, such as .exe and .bat, that may contain malicious code or scripts. The other options are either not related to Threat Emulation technologies, or not effective in blocking .exe and .bat file types.

• Question 198:

  When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?

  A. Includes the registry

  B. Gets information about the specified Virtual System

  C. Does not resolve network addresses

  D. Output excludes connection table

  Correct Answer: B

  The cpinfo command is a tool that collects diagnostic data from a Check Point gateway or management server. The data includes configuration files, logs, status reports, and more. The cpinfo output can be used for troubleshooting or sent to Check Point support for analysis. The -x parameter is used to get information about the specified Virtual System on a VSX gateway. A Virtual System is a virtualized firewall instance that runs on a VSX gateway and has its own security policy and objects. References: Check Point Security Expert R81 Course, cpinfo Utility, VSX Administration Guide

• Question 199:

  The following command is used to verify the CPUSE version:

  A. HostName:0>show installer status build

  B. [Expert@HostName:0]#show installer status

  C. [Expert@HostName:0]#show installer status build

  D. HostName:0>show installer build

  Correct Answer: A

  The correct command to verify the CPUSE (Check Point Update Service Engine) version is:

  

  Option B is incorrect because it uses the "[Expert@HostName:0]#" prompt, which is typically used for expert mode commands, but the CPUSE version can be checked using the "show installer status build" command in standard mode.

  Option C is incorrect because it uses the "[Expert@HostName:0]#" prompt, and while it includes the "build" parameter, it's not the standard command to check the CPUSE version.

  Option D is incorrect because it uses the "HostName:0>" prompt, but it lacks the "show" command and uses "build" instead of "status build."

  References: Check Point Certified Security Expert R81 documentation

• Question 200:

  Which one of the following is true about Threat Extraction?

  A. Always delivers a file to user

  B. Works on all MS Office, Executables, and PDF files

  C. Can take up to 3 minutes to complete

  D. Delivers file only if no threats found

  Correct Answer: A

  Threat Extraction is a software blade that always delivers a file to user. Threat Extraction removes or sanitizes the active content from the files and converts them to PDF format, which is safer and more compatible. Threat Extraction can also work together with Threat Emulation to provide both clean and original files to the users. Threat Extraction works on MS Office, PDF, and archive files, but not on executables. Threat Extraction can take up to 3 minutes to complete, depending on the file size and complexity. References: Check Point Security Expert R81 Course, Threat Extraction Administration Guide