CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 201:

  What level of CPU load on a Secure Network Distributor would indicate that another may be necessary?

  A. Idle
  B. USR
  C. SYS
  D. Wait
  A. Idle

  ---

  Explanation/Reference:

  The CPU load on a Secure Network Distributor (SND) indicates how much processing power is available for distributing traffic among cluster members. If the CPU load is high, it means that the SND is overloaded and cannot handle more traffic efficiently. A good indicator of SND overload is when the Idle CPU percentage is less than 20%. In this case, you may need to add another SND to balance the load or optimize your cluster configuration. References: Getting Started Check Point Software, section "Monitoring ClusterXL Status"

• Question 202:

  Which command would you use to set the network interfaces' affinity in Manual mode?

  A. sim affinity -m
  B. sim affinity -l
  C. sim affinity -a
  D. sim affinity -s
  D. sim affinity -s

  ---

  Explanation/Reference:

  The command that would be used to set the network interfaces' affinity in Manual mode is sim affinity -s. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. Core affinity is a feature that binds network interfaces and SecureXL instances to specific CPU cores, which improves the performance and load balancing of the Security Gateway. Sim affinity -s sets the network interfaces' affinity in Manual mode, which means that administrators can manually assign network interfaces to CPU cores. The other options are either invalid or perform different functions.

• Question 203:

  What is NOT a Cluster Mode?

  A. Load Sharing Unicast
  B. Load Sharing Multicast
  C. Active-Active
  D. High Availability Multicast
  C. Active-Active

  ---

  Explanation/Reference:

  Active-Active is not a cluster mode. Active-Active is a cluster configuration where both members are active and handle traffic simultaneously. However, this configuration is only supported for VSX clusters, not for regular clusters. The cluster modes for regular clusters are High Availability (HA), Load Sharing Unicast, and Load Sharing Multicast. References: [Check Point Security Expert R81 ClusterXL Administration Guide], page 7.

• Question 204:

  When users connect to the Mobile Access portal they are unable to open File Shares.

  Which log file would you want to examine?

  A. cvpnd.elg
  B. httpd.elg
  C. vpnd.elg
  D. fw.elg
  A. cvpnd.elg

  ---

  Explanation/Reference:

  When users connect to the Mobile Access portal they are unable to open File Shares. The log file that you would want to examine is cvpnd.elg. This log file contains information about the Mobile Access VPN daemon, which handles the connections from the Mobile Access portal to the internal resources, such as File Shares, Web Applications, etc. The log file is located in the directory $FWDIR/log/ on the Security Gateway. You can use the command fw log -f cvpnd.elg to view the log file in real time. References: R81 Mobile Access Administration Guide, page 255.

• Question 205:

  Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

  A. Go to clash-Run cpstop | Run cpstart
  B. Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway
  C. Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores
  D. Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway | Install Security Policy
  B. Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway

  ---

  Explanation/Reference:

  Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU. After installation, the administrator needs to perform some additional tasks for it to function properly. The tasks that the administrator needs to perform are: Go to Clish-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway Go to SmartConsole | Install Security Policy The first task is to enable and configure CoreXL, which is a performance enhancement feature that allows running multiple instances of the firewall kernel on multiple CPU cores. CoreXL can be enabled and configured via cpconfig, which is a utility that provides a menu- based interface for various system settings. After enabling CoreXL, the administrator needs to reboot the Security Gateway for the changes to take effect. The second task is to install the security policy on the Security Gateway via SmartConsole, which is a unified graphical user interface for managing Check Point products. Installing the security policy will activate the CoreXL instances and distribute the traffic among them. References: R81 Performance Tuning Administration Guide, page 15; R81 Security Management Administration Guide, page 83.

• Question 206:

  Fill in the blank: With the User Directory Software Blade, you can create user definitions on a(n)_____________ Server.

  A. SecurID
  B. NT domain
  C. LDAP
  D. SMTP
  C. LDAP

  ---

  Explanation/Reference:

  The User Directory Software Blade allows you to create user definitions on an LDAP server, such as Active Directory, and use them in your security policy. You can also integrate with other user authentication methods, such as SecurID,

  RADIUS, or TACACS+, but you cannot create user definitions on those servers.

  The references are:

  Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 13 Check Point R81 Quantum Security Gateway Guide, page 139 Check Point R81 Identity Awareness Administration Guide, page 9

• Question 207:

  What is the purpose of a SmartEvent Correlation Unit?

  A. The SmartEvent Correlation Unit is designed to check the connection reliability from SmartConsole to the SmartEvent Server.
  B. The SmartEvent Correlation Unit's task it to assign severity levels to the identified events.
  C. The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events.
  D. The SmartEvent Correlation Unit is designed to check the availability of the SmartReporter Server.
  C. The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events.

  ---

  Explanation/Reference:

  The purpose of a SmartEvent Correlation Unit is to evaluate logs from the log server component to identify patterns/threats and convert them to events. The SmartEvent Correlation Unit is a software module that runs on the SmartEvent server or on a dedicated server. It applies correlation rules and logic to the logs received from various sources, such as security gateways, endpoints, or third-party devices. It then generates events that represent security incidents or trends that require attention or action. References: Check Point Security Expert R81 Course, SmartEvent Administration Guide

• Question 208:

  Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?

  A. fwm
  B. cpd
  C. cpwd
  D. cpm
  C. cpwd

  ---

  Explanation/Reference:

  The Check Point WatchDog daemon (cpwd) invokes and monitors critical processes and attempts to restart them if they fail. The cpwd daemon is responsible for starting processes such as cpd, cpm, fwm, fwd, and others. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The cpm daemon is the Check Point Management Server daemon that handles database operations and policy installation. The fwm daemon is the Firewall Management daemon that handles communication between Security Gateways and Security Management Servers. References: : Check Point Software, Getting Started, WatchDog Daemon; : Check Point Software, Getting Started, Processes.

• Question 209:

  Which command is used to set the CCP protocol to Multicast?

  A. cphaprob set_ccp multicast
  B. cphaconf set_ccp multicast
  C. cphaconf set_ccp no_broadcast
  D. cphaprob set_ccp no_broadcast
  B. cphaconf set_ccp multicast

  ---

  Explanation/Reference:

  The cphaconf set_ccp multicast command is used to set the Cluster Control Protocol (CCP) to Multicast mode. This mode allows cluster members to communicate with each other using multicast packets. The other commands are either incorrect or set the CCP to Broadcast mode. References: ClusterXL Administration Guide

• Question 210:

  What is the difference between an event and a log?

  A. Events are generated at gateway according to Event Policy
  B. A log entry becomes an event when it matches any rule defined in Event Policy
  C. Events are collected with SmartWorkflow form Trouble Ticket systems
  D. Log and Events are synonyms
  B. A log entry becomes an event when it matches any rule defined in Event Policy

  ---

  Explanation/Reference:

  The difference between an event and a log is that a log entry becomes an event when it matches any rule defined in Event Policy. A log entry is a record of a network activity that is generated by a Security Gateway or a Management Server. An event is a log entry that meets certain criteria and triggers an action or a notification. The other options are either not true or not accurate definitions of events and logs. References: Check Point R81 Logging and Monitoring Administration Guide