CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 271:

  What kind of information would you expect to see using the sim affinity command?

  A. The VMACs used in a Security Gateway cluster

  B. The involved firewall kernel modules in inbound and outbound packet chain

  C. Overview over SecureXL templated connections

  D. Network interfaces and core distribution used for CoreXL

  Correct Answer: D

  The kind of information that you would expect to see using the sim affinity command is network interfaces and core distribution used for CoreXL. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. CoreXL is a technology that improves the performance of the Security Gateway by using multiple cores to handle concurrent connections. The sim affinity command can show which network interfaces and SecureXL instances are bound to which CPU cores, and allow administrators to change the affinity settings.

• Question 272:

  For best practices, what is the recommended time for automatic unlocking of locked admin accounts?

  A. 20 minutes

  B. 15 minutes

  C. Admin account cannot be unlocked automatically

  D. 30 minutes at least

  Correct Answer: D

  For best practices, the recommended time for automatic unlocking of locked admin accounts is 30 minutes at least. Admin accounts can be locked due to failed login attempts, password expiration, or manual locking by another admin. To prevent unauthorized access or brute force attacks, locked admin accounts should not be unlocked automatically too soon. The recommended minimum time for automatic unlocking is 30 minutes, which can be configured from the SmartConsole under Manage > Permissions and Administrators > Advanced > Unlock locked administrators after.

• Question 273:

  NO: 219

  What cloud-based SandBlast Mobile application is used to register new devices and users?

  A. Check Point Protect Application

  B. Management Dashboard

  C. Behavior Risk Engine

  D. Check Point Gateway

  Correct Answer: D

  The cloud-based SandBlast Mobile application that is used to register new devices and users is Check Point Gateway. Check Point Gateway is a web portal that allows administrators to enroll devices and users into the SandBlast Mobile service, which is a cloud-based solution that protects mobile devices from advanced threats. Check Point Gateway also allows administrators to configure policies, monitor device status, and generate reports for SandBlast Mobile.

• Question 274:

  With SecureXL enabled, accelerated packets will pass through the following:

  A. Network Interface Card, OSI Network Layer, OS IP Stack, and the Acceleration Device

  B. Network Interface Card, Check Point Firewall Kernal, and the Acceleration Device

  C. Network Interface Card and the Acceleration Device

  D. Network Interface Card, OSI Network Layer, and the Acceleration Device

  Correct Answer: C

  With SecureXL enabled, accelerated packets will pass through the following:

  Network Interface Card and the Acceleration Device. SecureXL is a technology that accelerates network traffic processing by offloading intensive operations from the Firewall kernel to a dedicated SecureXL device. Accelerated packets are

  packets that match certain criteria and can be handled by SecureXL without involving the Firewall kernel. These packets bypass the OSI Network Layer, OS IP Stack, and Check Point Firewall Kernel, and are processed directly by the

  Network Interface Card and the Acceleration Device. The other options are either incorrect or describe non-accelerated packets.

• Question 275:

  Which blades and or features are not supported in R81?

  A. SmartEvent Maps

  B. SmartEvent

  C. Identity Awareness

  D. SmartConsole Toolbars

  Correct Answer: A

  According to the Check Point website, SmartEvent Maps is a feature that was supported in previous versions of SmartEvent, but is not supported in R81. SmartEvent Maps displayed a graphical representation of security events on a world map. The other options are either supported or not valid features in R81. References: SmartEvent Maps

• Question 276:

  What CLI command compiles and installs a Security Policy on the target's Security Gateways?

  A. fwm compile

  B. fwm load

  C. fwm fetch

  D. fwm install

  Correct Answer: B

  The CLI command that compiles and installs a Security Policy on the target's Security Gateways is fwm load. Fwm stands for FireWall Management, and it is a command that allows administrators to perform various management tasks on the

  Security Management Server or Multi-Domain Server. Fwm load takes two arguments: the name of the Security Policy and the name or IP address of the target Security Gateway or Gateway Cluster. For example:

  [Expert@SMS]# fwm load Standard_Policy fw1

  This command will compile and install the Standard_Policy on the Security Gateway named fw1. The other commands are either invalid or perform different functions.

• Question 277:

  What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

  

  A. SmartCenter Server cannot reach this Security Gateway.

  B. There is a blade reporting a problem.

  C. VPN software blade is reporting a malfunction.

  D. Security Gateway's MGNT NIC card is disconnected.

  Correct Answer: B

  If Deyra sees the gateway status as shown in the image, it means that there is a blade reporting a problem. The red exclamation mark indicates that one or more blades on the gateway have an issue that needs attention. The issue could be related to configuration, license, policy, or other factors. Deyra can hover over the icon to see more details about the problem. References: Training and Certification | Check Point Software, New Courses and Certificates for R81.20 - Check Point CheckMates

• Question 278:

  What statement best describes the Proxy ARP feature for Manual NAT in R81.20?

  A. Automatic proxy ARP configuration can be enabled

  B. Translate Destination on Client Side should be configured

  C. fw ctl proxy should be configured

  D. local.arp file must always be configured

  Correct Answer: D

  According to the Check Point R81 training course, the Proxy ARP feature for Manual NAT in R81.20 requires the configuration of the local.arp file on the Security Gateway. This file contains the mapping of IP addresses to MAC addresses for NATed hosts. The other options are either incorrect or irrelevant. References: Certified Security Expert (CCSE) R81.20 Course Overview

• Question 279:

  To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

  A. fw ctl set int fwha vmac global param enabled

  B. fw ctl get int vmac global param enabled; result of command should return value 1

  C. cphaprob-a if

  D. fw ctl get int fwha_vmac_global_param_enabled; result of command should return value

  Correct Answer: D

  To ensure that VMAC mode is enabled, the CLI command that should be run on all cluster members is fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1. VMAC mode is a feature that allows ClusterXL to use virtual MAC addresses for cluster interfaces, instead of physical MAC addresses. This improves the failover performance and compatibility of ClusterXL with switches and routers. To check if VMAC mode is enabled, the command fw ctl get int fwha_vmac_global_param_enabled can be used, which returns 1 if VMAC mode is enabled, and 0 if VMAC mode is disabled.

• Question 280:

  What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

  A. Lagging

  B. Synchronized

  C. Never been synchronized

  D. Collision

  Correct Answer: B

  The most ideal Synchronization Status for Security Management Server High Availability deployment is Synchronized. Security Management Server High Availability deployment is a feature that allows two or more Security Management Servers to provide redundancy and load balancing for managing security policies and logs. Synchronization Status is a parameter that indicates how up-to-date the databases of the Security Management Servers are with each other. Synchronization Status can have one of the following values: Synchronized, Lagging, Never been synchronized, or Collision. Synchronized means that the databases of all Security Management Servers are identical and have no conflicts. This is the most ideal status as it ensures consistency and reliability of security management. Lagging means that one or more Security Management Servers have not received all the updates from other Security Management Servers, and their databases are outdated. Never been synchronized means that one or more Security Management Servers have never synchronized their databases with other Security Management Servers, and their databases are independent. Collision means that one or more Security Management Servers have received conflicting updates from other Security Management Servers, and their databases have discrepancies.