CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 231:

  Ken wants to obtain a configuration lock from other administrator on R81 Security Management Server. He can do this via WebUI or via CLI.

  Which command should he use in CLI? (Choose the correct answer.)

  A. remove database lock

  B. The database feature has one command lock database override.

  C. override database lock

  D. The database feature has two commands lock database override and unlock database. Both will work.

  Correct Answer: D

  Ken can use either of the two commands lock database override or unlock database to obtain a configuration lock from another administrator on R81 Security Management Server via CLI. These commands allow him to override the existing lock and gain exclusive access to the database. He can also use the WebUI to perform the same action. References: Training and Certification | Check Point Software, New Courses and Certificates for R81.20 - Check Point CheckMates

• Question 232:

  What command lists all interfaces using Multi-Queue?

  A. cpmq get

  B. show interface all

  C. cpmq set

  D. show multiqueue all

  Correct Answer: A

  The command that lists all interfaces using Multi-Queue is cpmq get. Multi- Queue is a feature that allows network interfaces to use multiple transmit and receive queues, which improves the performance and scalability of the Security Gateway by distributing the network load among several CPU cores. Cpmq is a command that allows administrators to configure and manage Multi-Queue settings on network interfaces. Cpmq get lists all interfaces using Multi-Queue and shows their queue count and core distribution.

• Question 233:

  When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

  A. ThreatCloud is a database-related application which is located on-premise to preserve privacy of company-related data

  B. ThreatCloud is a collaboration platform for all the CheckPoint customers to form a virtual cloud consisting of a combination of all on-premise private cloud environments

  C. ThreatCloud is a collaboration platform for Check Point customers to benefit from VMWare ESXi infrastructure which supports the Threat Emulation Appliances as virtual machines in the EMC Cloud

  D. ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary

  Correct Answer: D

  ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary. ThreatCloud is a cloud-based service that collects and analyzes threat intelligence from multiple sources, such as Check Point products, third-party vendors, open sources, and customers. ThreatCloud provides real-time updates and feeds to Check Point products, such as SandBlast, which is a solution that detects and prevents zero-day attacks by emulating files in a sandbox environment. By integrating with ThreatCloud, a Threat Emulation appliance can benefit from the shared information about malicious and benign files, and avoid emulating files that are already known to be safe or harmful. This can improve the performance and efficiency of the Threat Emulation appliance. The other options are either incorrect or not relevant to ThreatCloud or Threat Emulation.

• Question 234:

  What are the methods of SandBlast Threat Emulation deployment?

  A. Cloud, Appliance and Private

  B. Cloud, Appliance and Hybrid

  C. Cloud, Smart-1 and Hybrid

  D. Cloud, OpenServer and Vmware

  Correct Answer: A

  The methods of SandBlast Threat Emulation deployment are Cloud, Appliance, and Private. SandBlast Threat Emulation is a solution that detects and prevents zero-day attacks by emulating files in a sandbox environment and analyzing their behavior for malicious indicators. SandBlast Threat Emulation can be deployed in three different methods: Cloud, Appliance, and Private. Cloud method is when the files are sent to the Check Point cloud service for emulation and analysis. This method does not require any additional hardware or software on the customer's side, and provides the fastest updates and feeds from ThreatCloud. Appliance method is when the files are sent to a dedicated appliance on the customer's network for emulation and analysis. This method provides more control and privacy for the customer, and supports more file types and sizes. Private method is when the files are sent to a private cloud service on the customer's network for emulation and analysis. This method provides the highest level of control and privacy for the customer, and supports customizing the emulation environment and scenarios.

• Question 235:

  What is the minimum amount of RAM needed for a Threat Prevention Appliance?

  A. 6 GB

  B. 8GB with Gaia in 64-bit mode

  C. 4 GB

  D. It depends on the number of software blades enabled

  Correct Answer: C

  According to the Check Point Resource Library, the minimum amount of RAM needed for a Threat Prevention Appliance is 4 GB. This applies to both physical and virtual appliances. The other options are either incorrect or irrelevant. References: Check Point Resource Library

• Question 236:

  The essential means by which state synchronization works to provide failover in the event an active member goes down, ____________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.

  A. ccp

  B. cphaconf

  C. cphad

  D. cphastart

  Correct Answer: A

  The essential means by which state synchronization works to provide failover in the event an active member goes down, ccp is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster. Ccp stands for Cluster Control Protocol, and it is a proprietary protocol that runs on UDP port 8116. Ccp is responsible for exchanging state information, health checks, load balancing decisions, and synchronization network configuration between cluster members. The other options are either commands or daemons that are related to cluster operations, but not the protocol itself.

• Question 237:

  Which of the following technologies extracts detailed information from packets and stores that information in state tables?

  A. INSPECT Engine

  B. Stateful Inspection

  C. Packet Filtering

  D. Application Layer Firewall

  Correct Answer: A

  According to the Check Point website, INSPECT Engine is the technology that extracts detailed information from packets and stores that information in state tables. INSPECT Engine is the core of Check Point's Stateful Inspection technology, which enables Security Gateways to inspect traffic at multiple layers and enforce security policies. The other technologies are either not related or not specific enough. References: INSPECT Engine

• Question 238:

  What is the SandBlast Agent designed to do?

  A. Performs OS-level sandboxing for SandBlast Cloud architecture

  B. Ensure the Check Point SandBlast services is running on the end user's system

  C. If malware enters an end user's system, the SandBlast Agent prevents the malware from spreading with the network

  D. Clean up email sent with malicious attachments

  Correct Answer: C

  The SandBlast Agent is designed to prevent malware from spreading within the network if it enters an end user's system. SandBlast Agent is a lightweight endpoint security solution that protects devices from advanced threats such as ransomware, phishing, zero-day attacks, and data exfiltration. SandBlast Agent uses various technologies such as behavioral analysis, anti-exploitation, anti-ransomware, threat emulation, threat extraction, and forensics to detect and block malware before it can harm the device or the network. The other options are either not the main purpose or not the functionality of SandBlast Agent.

• Question 239:

  In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with __________________ will not apply.

  A. ffff

  B. 1

  C. 3

  D. 2

  Correct Answer: D

  For Stateful Mode configuration, chain modules marked with 2 will not apply. Stateful Mode configuration is a feature that allows administrators to define how packets are processed by different firewall kernel modules in inbound and outbound directions. Chain modules are firewall kernel modules that perform various security functions, such as VPN, IPS, QoS, etc. Each chain module is associated with a key, which specifies the type of traffic applicable to the chain module. The key can be one of the following values: 0 for all packets, 1 for stateful packets, 2 for stateless packets, and 3 for no match packets. For Stateful Mode configuration, only chain modules with key 0 or 1 will apply, as they handle all packets or stateful packets. Chain modules with key 2 will not apply, as they handle stateless packets, which are not relevant for Stateful Mode configuration.

• Question 240:

  Which NAT rules are prioritized first?

  A. Post-Automatic/Manual NAT rules

  B. Manual/Pre-Automatic NAT

  C. Automatic Hide NAT

  D. Automatic Static NAT

  Correct Answer: B

  The NAT rules that are prioritized first are Manual/Pre-Automatic NAT. NAT stands for Network Address Translation, and it is a feature that allows Security Gateways to modify the source or destination IP addresses or ports of packets that pass through them. NAT rules are the rules that define how NAT is applied to traffic that matches certain criteria. There are three types of NAT rules: Manual/Pre-Automatic NAT, Automatic NAT, and Manual/Post-Automatic NAT. Manual/Pre-Automatic NAT rules are the rules that are manually created by administrators and placed before the automatic NAT rules in the rulebase. These rules have the highest priority and are processed first by the Security Gateway. Automatic NAT rules are the rules that are automatically generated by the Security Gateway based on the NAT properties of network objects. These rules have the second highest priority and are processed after the manual/pre-automatic NAT rules. Manual/ Post-Automatic NAT rules are the rules that are manually created by administrators and placed after the automatic NAT rules in the rulebase. These rules have the lowest priority and are processed last by the Security Gateway.