CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 281:

  You can access the ThreatCloud Repository from:

  A. R81.20 SmartConsole and Application Wiki

  B. Threat Prevention and Threat Tools

  C. Threat Wiki and Check Point Website

  D. R81.20 SmartConsole and Threat Prevention

  Correct Answer: D

  According to the Check Point R81 release notes, you can access the ThreatCloud Repository from R81.20 SmartConsole and Threat Prevention. The ThreatCloud Repository is a cloud-based service that provides real-time threat intelligence and updates to Check Point products. The other options are either outdated or nonexistent. References: Check Point R81

• Question 282:

  SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

  A. ping, traceroute, netstat, and route

  B. ping, nslookup, Telnet, and route

  C. ping, whois, nslookup, and Telnet

  D. ping, traceroute, netstat, and nslookup

  Correct Answer: C

  The default commands that appear when right-clicking the IP address, source or destination, in an event in SmartEvent are ping, whois, nslookup, and Telnet. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent has a feature that allows administrators to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands that can be executed on the IP address of the active cell. The default commands are ping, whois, nslookup, and Telnet. Ping is a command that tests the connectivity and latency between two hosts by sending packets and measuring the response time. Whois is a command that queries a database for information about the owner and registrar of a domain name or an IP address. Nslookup is a command that queries a DNS server for information about a domain name or an IP address, such as its IP address, name server, mail server, etc. Telnet is a command that establishes a remote connection to another host using the Telnet protocol.

• Question 283:

  You want to verify if your management server is ready to upgrade to R81.20. What tool could you use in this process?

  A. migrate export

  B. upgrade_tools verify

  C. pre_upgrade_verifier

  D. migrate import

  Correct Answer: C

  According to the Check Point website, you can use the pre_upgrade_verifier tool to verify if your management server is ready to upgrade to R81.20. This tool checks the compatibility of your current configuration and database with the target version, and provides a detailed report of any issues or warnings. The other tools are either used for exporting or importing databases, or not valid tools. References: Upgrade Verification Service

• Question 284:

  Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________ .

  A. Sent to the Internal Certificate Authority.

  B. Sent to the Security Administrator.

  C. Stored on the Security Management Server.

  D. Stored on the Certificate Revocation List.

  Correct Answer: D

  Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is stored on the Certificate Revocation List (CRL). The CRL is a list of certificates that have been revoked by the Internal Certificate Authority (ICA) and are no longer valid for Secure Internal Communication (SIC). The CRL is signed by the ICA and issued to all the managed Security Gateways the next time a SIC connection is made12. The CRL helps to prevent unauthorized access to the Security Management Server by revoked Security Gateways. References: 1: How to renew SIC after changing IP Address of Security Management Server - Check Point Software, Solution ID: sk43784 2: Check Point R81 Security Engineering Guide - Check Point Software, page 162

• Question 285:

  What is true of the API server on R81.20?

  A. By default the API-server is activated and does not have hardware requirements.

  B. By default the API-server is not active and should be activated from the WebUI.

  C. By default the API server is active on management and stand-alone servers with 16GB of RAM (or more).

  D. By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more).

  Correct Answer: D

  The true statement about the API server on R81.20 is: By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more). The API server is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. The API server is enabled by default on R81.20 management servers that have at least 4 GB of RAM, and on stand-alone servers that have at least 8 GB of RAM. The API server can also be manually enabled or disabled from the WebUI or the CLI.

• Question 286:

  Vanessa is a Firewall administrator. She wants to test a backup of her company's production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup

  via SmartConsole in lab environment.

  Which details she need to fill in System Restore window before she can click OK button and test the backup?

  A. Server, SCP, Username, Password, Path, Comment, Member

  B. Server, TFTP, Username, Password, Path, Comment, All Members

  C. Server, Protocol, Username, Password, Path, Comment, All Members

  D. Server, Protocol, username Password, Path, Comment, Member

  Correct Answer: C

  According to the Check Point website, Vanessa needs to fill in the following details in the System Restore window before she can click OK button and test the backup: Server, Protocol, Username, Password, Path, Comment, All Members. These details specify the source and destination of the backup file, as well as the scope of the restore operation. The other options are either missing or incorrect details. References: System Restore

• Question 287:

  What is the valid range for VRID value in VRRP configuration?

  A. 1 - 254

  B. 1 - 255

  C. 0 - 254

  D. 0 - 255

  Correct Answer: B

  The valid range for VRID value in VRRP configuration is 1 - 255. VRID stands for Virtual Router ID, and it is a number that identifies a virtual router in a VRRP cluster. A VRRP cluster consists of one or more routers that share a virtual IP address and provide redundancy and load balancing for network traffic. Each router in the cluster must have a unique VRID value, and the VRID value must match the VRID value configured on the interface that connects to the VRRP cluster. The VRID value can be any number from 1 to 255, inclusive.

• Question 288:

  Check Point security components are divided into the following components:

  A. GUI Client, Security Gateway, WebUI Interface

  B. GUI Client, Security Management, Security Gateway

  C. Security Gateway, WebUI Interface, Consolidated Security Logs

  D. Security Management, Security Gateway, Consolidate Security Logs

  Correct Answer: B

  Check Point security components are divided into the following components: GUI Client, Security Management, Security Gateway. GUI Client is the graphical user interface that allows administrators to configure, manage, and monitor Check Point products and security policies. Security Management is the server that stores and enforces the security policies and provides logging and reporting functions. Security Gateway is the device that inspects and filters network traffic according to the security policies.

• Question 289:

  Which is NOT an example of a Check Point API?

  A. Gateway API

  B. Management API

  C. OPSEC SDK

  D. Threat Prevention API

  Correct Answer: A

  Gateway API is NOT an example of a Check Point API. Check Point API is a general term that refers to various application programming interfaces (APIs) that allow external applications to interact with Check Point products and services using standard methods such as HTTP(S) requests and JSON objects. There are several types of Check Point APIs, such as Management API, Threat Prevention API, OPSEC SDK, etc. Management API is an API that allows external applications to configure, manage, and monitor Check Point management server using web services. Threat Prevention API is an API that allows external applications to send files or URLs to Check Point Threat Prevention products for scanning and analysis using web services. OPSEC SDK is an API that allows external applications to integrate with Check Point OPSEC products using C/C++ libraries and protocols. Gateway API is not a valid or existing type of Check Point API.

• Question 290:

  Which of the following is NOT an option to calculate the traffic direction?

  A. Incoming

  B. Internal

  C. External

  D. Outgoing

  Correct Answer: D

  The option that is NOT an option to calculate the traffic direction is Outgoing. Traffic direction is a parameter that determines how traffic is classified as internal or external based on its source and destination. Traffic direction can be calculated using three options: Incoming, Internal, or External. Incoming means that traffic is classified as internal if its destination is one of the Security Gateway's interfaces, and external otherwise. Internal means that traffic is classified as internal if its source or destination belongs to one of the internal networks defined in the topology, and external otherwise. External means that traffic is classified as internal if both its source and destination belong to one of the internal networks defined in the topology, and external otherwise. Outgoing is not a valid option to calculate traffic direction.