CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 201:

  Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

  A. AV issues

  B. VPN errors

  C. Network traffic issues

  D. Authentication issues

  Correct Answer: C

  The "fw monitor" tool can be best used to troubleshoot network traffic issues. Fw monitor is a tool that allows administrators to capture packets at different inspection points in the Firewall kernel, and apply filters and flags to analyze the traffic. Fw monitor can help troubleshoot network connectivity problems, packet drops, NAT issues, VPN issues, and more. The other options are either not related or less suitable for fw monitor.

• Question 202:

  Which application should you use to install a contract file?

  A. SmartView Monitor

  B. WebUI

  C. SmartUpdate

  D. SmartProvisioning

  Correct Answer: C

  According to the Check Point website, SmartUpdate is the application that should be used to install a contract file. A contract file contains information about the licenses and services that are purchased from Check Point. SmartUpdate can also be used to install software packages and patches on Security Gateways and Management Servers. The other applications are either not relevant or not capable of installing a contract file. References: SmartUpdate

• Question 203:

  What command would show the API server status?

  A. cpm status

  B. api restart

  C. api status

  D. show api status

  Correct Answer: C

  The command that would show the API server status is api status. API stands for Application Programming Interface, and it is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. API status is a command that shows the current status of the API server, such as whether it is enabled or disabled, running or stopped, listening on which port, using which certificate, etc. The other commands are either invalid or perform different functions.

• Question 204:

  In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

  A. SND is a feature to accelerate multiple SSL VPN connections

  B. SND is an alternative to IPSec Main Mode, using only 3 packets

  C. SND is used to distribute packets among Firewall instances

  D. SND is a feature of fw monitor to capture accelerated packets

  Correct Answer: C

  Secure Network Distributor (SND) is a relevant feature of the Security Gateway because it is used to distribute packets among Firewall instances. SND is a technology that improves the performance and scalability of the Security Gateway by using multiple cores to handle concurrent connections. SND consists of two components: SND driver and Firewall instances. SND driver is responsible for receiving packets from network interfaces and distributing them to Firewall instances based on a load balancing algorithm. Firewall instances are responsible for inspecting packets according to security policies and forwarding them to their destinations. The other options are either incorrect or not related to SND.

• Question 205:

  The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

  A. There is a virus found. Traffic is still allowed but not accelerated.

  B. The connection required a Security server.

  C. Acceleration is not enabled.

  D. The traffic is originating from the gateway itself.

  Correct Answer: B

  According to the Check Point R81 release notes, acceleration is not supported for connections that require a Security server, such as HTTPS Inspection, Content Awareness, or Anti-Virus. The Security server performs deep inspection and modification of the traffic, which prevents acceleration. The other options are either false or not the most likely reason. References: Check Point R81

• Question 206:

  What is the Implicit Clean-up Rule?

  A. A setting is defined in the Global Properties for all policies.

  B. A setting that is configured per Policy Layer.

  C. Another name for the Clean-up Rule.

  D. Automatically created when the Clean-up Rule is defined.

  Correct Answer: C

  The Implicit Clean-up Rule is another name for the Clean-up Rule, which is the last rule in every policy layer. The Clean-up Rule defines the default action for traffic that does not match any of the preceding rules in the layer. The default action is to drop the traffic and log it, but it can be changed by the administrator. References: Training and Certification | Check Point Software, Check Point Resource Library

• Question 207:

  When attempting to start a VPN tunnel, in the logs the error "no proposal chosen" is seen numerous times. No other VPN-related entries are present. Which phase of the VPN negotiations has failed?

  A. IKE Phase 1

  B. IPSEC Phase 2

  C. IPSEC Phase 1

  D. IKE Phase 2

  Correct Answer: A

  The error "no proposal chosen" indicates that the VPN gateway did not find a matching proposal for the IKE Phase 1 negotiation. This phase is responsible for establishing a secure channel between the VPN peers, using a pre-shared secret

  or a certificate. The proposal consists of parameters such as encryption algorithm, hash algorithm, Diffie-Hellman group, and lifetime. If the VPN gateway does not receive a proposal that matches its own configuration, it will reject the

  connection attempt and log the error "no proposal chosen" 1.

  To troubleshoot this issue, one should verify that the VPN peers have the same IKE Phase 1 settings, such as:

  The same pre-shared secret or certificate

  The same encryption algorithm (e.g., AES-256)

  The same hash algorithm (e.g., SHA-256)

  The same Diffie-Hellman group (e.g., Group 14)

  The same lifetime (e.g., 86400 seconds)

  One can use the command vpn tu on the VPN gateway to view the current IKE Phase 1 settings and compare them with the other peer. Alternatively, one can use the SmartConsole to check the VPN community properties and the gateway

  object properties for the IKE Phase 1 settings 2.

  References: 1: Troubleshooting the "no proposal chosen" error - Check Point Software 2: Support, Support Requests, Training ... - Check Point Software

• Question 208:

  When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

  A. All UDP packets

  B. All IPv6 Traffic

  C. All packets that match a rule whose source or destination is the Outside Corporate Network

  D. CIFS packets

  Correct Answer: D

  When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions: CIFS packets. SecureXL is a technology that accelerates network traffic processing by offloading intensive operations from the Firewall kernel to a dedicated SecureXL device. However, some packets cannot be accelerated by SecureXL due to various reasons, such as unsupported features, security policy settings, or protocol limitations. One example of packets that cannot be accelerated by SecureXL are CIFS packets, which are used for file sharing and access over SMB protocol. CIFS packets are not accelerated by SecureXL because they require stateful inspection by the Firewall kernel.

• Question 209:

  What is the order of NAT priorities?

  A. Static NAT, IP pool NAT, hide NAT

  B. IP pool NAT, static NAT, hide NAT

  C. Static NAT, automatic NAT, hide NAT

  D. Static NAT, hide NAT, IP pool NAT

  Correct Answer: A

  The order of NAT priorities is determined by the type of NAT rule that is applied to the traffic. There are three types of NAT rules in Check Point: static NAT, IP pool NAT, and hide NAT12. Static NAT: This type of NAT rule maps a single IP address to another single IP address. It is usually used to allow external hosts to access internal servers or devices. Static NAT has the highest priority among the NAT rules, and it is applied before the security policy is enforced12. IP pool NAT: This type of NAT rule maps a range of IP addresses to another range of IP addresses. It is usually used to balance the load among multiple servers or devices. IP pool NAT has the second highest priority among the NAT rules, and it is applied after the security policy is enforced12. Hide NAT: This type of NAT rule hides a group of IP addresses behind a single IP address or an interface. It is usually used to allow internal hosts to access external resources. Hide NAT has the lowest priority among the NAT rules, and it is applied after the security policy is enforced12. Therefore, the order of NAT priorities is: static NAT, IP pool NAT, hide NAT. References: 1: Check Point R81 Security Administration Guide - Check Point Software, page 209 2: Check Point R81 Security Engineering Guide - Check Point Software, page

• Question 210:

  What is the command to show SecureXL status?

  A. fwaccel status

  B. fwaccel stats -m

  C. fwaccel -s

  D. fwaccel stat

  Correct Answer: D

  The command to show SecureXL status is fwaccel stat. This command displays information about SecureXL acceleration, such as the number of accelerated and non- accelerated connections, the reason for non-acceleration, and the SecureXL device name and mode. The other commands are either invalid or show different statistics.