CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 261:

  Which command would you use to set the network interfaces' affinity in Manual mode?

  A. sim affinity -m

  B. sim affinity -l

  C. sim affinity -a

  D. sim affinity -s

  Correct Answer: D

  The command that would be used to set the network interfaces' affinity in Manual mode is sim affinity -s. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. Core affinity is a feature that binds network interfaces and SecureXL instances to specific CPU cores, which improves the performance and load balancing of the Security Gateway. Sim affinity -s sets the network interfaces' affinity in Manual mode, which means that administrators can manually assign network interfaces to CPU cores. The other options are either invalid or perform different functions.

• Question 262:

  Which is not a blade option when configuring SmartEvent?

  A. Correlation Unit

  B. SmartEvent Unit

  C. SmartEvent Server

  D. Log Server

  Correct Answer: B

  SmartEvent Unit is not a blade option when configuring SmartEvent. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules. SmartEvent Unit is not a valid component or blade of SmartEvent.

• Question 263:

  The ____ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

  A. Next Generation Threat Prevention

  B. Next Generation Threat Emulation

  C. Next Generation Threat Extraction

  D. Next Generation Firewall

  Correct Answer: B

  The software blade package that uses CPU-level and OS-level sandboxing in order to detect and block malware is the Next Generation Threat Emulation. This package is part of the Check Point SandBlast Zero-Day Protection solution, which protects organizations against unknown malware, zero-day threats and targeted attacks, and prevents infections from undiscovered exploits1. CPU-level and OS-level sandboxing are two techniques that Check Point uses to analyze files and objects for malicious behavior. CPU-level inspection is a unique technology that detects malware at the pre-infection stage by examining the CPU instructions that the file executes. This allows Check Point to identify and block malware that tries to evade detection by using obfuscation, encryption, or polymorphism12. OS-level sandboxing is a complementary technology that runs files and objects in a virtualized environment and monitors their behavior for malicious indicators. This allows Check Point to detect and block malware that tries to exploit vulnerabilities in the operating system or applications, or that performs malicious actions such as downloading additional payloads, modifying system settings, or communicating with command and control servers12. Therefore, the correct answer is B. The Next Generation Threat Emulation software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware. References: 1, Understanding SandBlast - Check Point Software Technologies 2, HOW TO CHOOSE YOUR NEXT SANDBOXING SOLUTION - Check Point Software 3, CHECK POINT + SERVICENOW 4, Check Point Quantum Edge Datasheet

• Question 264:

  What will SmartEvent automatically define as events?

  A. Firewall

  B. VPN

  C. IPS

  D. HTTPS

  Correct Answer: C

  SmartEvent automatically defines events based on IPS (Intrusion Prevention System) alerts. IPS is a feature that detects and prevents malicious network traffic based on predefined or custom signatures. IPS alerts are generated when IPS detects an attack or an anomaly that matches a signature. SmartEvent collects and correlates IPS alerts from different gateways and displays them as events in SmartEventWeb. The other options are not automatically defined as events by SmartEvent.

• Question 265:

  On what port does the CPM process run?

  A. TCP 857

  B. TCP 18192

  C. TCP 900

  D. TCP 19009

  Correct Answer: D

  The port that the CPM process runs on is TCP 19009. CPM stands for Check Point Management, and it is the main process that runs on the Security Management Server and interacts with SmartConsole clients. CPM is responsible for managing policies, objects, logs, tasks, and other management functions. CPM listens on TCP port 19009 for incoming connections from SmartConsole clients. The other ports are either used by other processes or not related to CPM.

• Question 266:

  Vanessa is firewall administrator in her company. Her company is using Check Point firewall on a central and several remote locations which are managed centrally by R77.30 Security Management Server. On central location is installed R77.30 Gateway on Open server. Remote locations are using Check Point UTM-1570 series appliances with R75.30 and some of them are using a UTM-1-Edge-X or Edge-W with latest available firmware. She is in process of migrating to R81.

  What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R81?

  A. Missing an installed R77.20 Add-on on Security Management Server

  B. Unsupported firmware on UTM-1 Edge-W appliance

  C. Unsupported version on UTM-1 570 series appliance

  D. Unsupported appliances on remote locations

  Correct Answer: A

  What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R81, is missing an installed R77.20 Add-on on Security Management Server. R77.20 Add-on is a package that adds new features and enhancements to R77 Security Management Server, such as support for new appliances, Gaia OS features, VPN features, etc. One of the requirements for migrating to R81 from R77 Security Management Server is to have R77.20 Add-on installed on the server. If Vanessa did not check this requirement and tried to migrate without R77.20 Add-on, she would encounter errors and failures during the migration process. The other options are either not relevant or not problematic for migration to R81.

• Question 267:

  Which Check Point feature enables application scanning and the detection?

  A. Application Dictionary

  B. AppWiki

  C. Application Library

  D. CPApp

  Correct Answer: B

  AppWiki is the Check Point feature that enables application scanning and the detection. AppWiki is an easy to use tool that lets you search and filter Check Point's Web 2.0 Applications Database to find out information about internet applications, including social network widgets; filter by a category, tag, or risk level; and search for a keyword or application1. AppWiki helps you to identify and control the applications on your network, and to apply granular policies based on the application type, risk, and characteristics1. AppWiki is integrated with the Check Point Application Control Software Blade, which provides the industry's strongest application security and identity control to organizations of all sizes1. References: 1: AppWiki | Check Point Software

• Question 268:

  In ClusterXL Load Sharing Multicast Mode:

  A. only the primary member received packets sent to the cluster IP address

  B. only the secondary member receives packets sent to the cluster IP address

  C. packets sent to the cluster IP address are distributed equally between all members of the cluster

  D. every member of the cluster received all of the packets sent to the cluster IP address

  Correct Answer: D

  In ClusterXL Load Sharing Multicast Mode, every member of the cluster receives all of the packets sent to the cluster IP address. This mode uses multicast MAC addresses to distribute packets to all cluster members. Each member decides whether to accept or reject the packet based on a load balancing algorithm. This mode provides better performance and scalability than Unicast mode, but requires a switch that supports multicast MAC addresses.

• Question 269:

  What is the responsibility of SOLR process on R81.20 management server?

  A. Validating all data before it's written into the database

  B. It generates indexes of data written to the database

  C. Communication between SmartConsole applications and the Security Management Server

  D. Writing all information into the database

  Correct Answer: B

  The responsibility of SOLR process on R81.20 management server is to generate indexes of data written to the database. SOLR is an open source search platform that provides fast and scalable indexing and querying capabilities. SOLR is used by the R81.20 management server to index data such as logs, objects, policies, tasks, and events, and to enable quick and efficient searches on this data by SmartConsole and SmartView applications.

• Question 270:

  In what way are SSL VPN and IPSec VPN different?

  A. SSL VPN is using HTTPS in addition to IKE, whereas IPSec VPN is clientless

  B. SSL VPN adds an extra VPN header to the packet, IPSec VPN does not

  C. IPSec VPN does not support two factor authentication, SSL VPN does support this

  D. IPSec VPN uses an additional virtual adapter; SSL VPN uses the client network adapter only.

  Correct Answer: D

  The way SSL VPN and IPSec VPN are different is that IPSec VPN uses an additional virtual adapter; SSL VPN uses the client network adapter only. SSL VPN and IPSec VPN are two types of VPN technologies that provide secure remote access to network resources over the internet. SSL VPN uses SSL/TLS protocol to establish an encrypted tunnel between the client and the server, and does not require any additional software or hardware on the client side. IPSec VPN uses IPSec protocol to establish an encrypted tunnel between the client and the server, and requires a dedicated virtual adapter on the client side to handle the IPSec traffic. The other options are either incorrect or not relevant to SSL VPN and IPSec VPN.