CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 31:

  Which is NOT a SmartEvent component?

  A. SmartEvent Server
  B. Correlation Unit
  C. Log Consolidator
  D. Log Server
  C. Log Consolidator

  ---

  Explanation/Reference:

  Log Consolidator is NOT a SmartEvent component. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules. Log Consolidator is not a valid component or blade of SmartEvent.

• Question 32:

  How many users can have read/write access in Gaia at one time?

  A. Infinite
  B. One
  C. Three
  D. Two
  B. One

  ---

  Explanation/Reference:

  How many users can have read/write access in Gaia at one time? Only one user can have read/write access in Gaia at one time. This is to prevent conflicts and inconsistencies in the configuration changes made by different users. If another user tries to login with read/write access while a user is already logged in, they will receive a warning message and will be given the option to either login with read-only access or force the other user to logout. References: [Gaia Administration Guide R81], page 15.

• Question 33:

  Vanessa is firewall administrator in her company. Her company is using Check Point firewall on a central and several remote locations which are managed centrally by R77.30 Security Management Server. On central location is installed

  R77.30 Gateway on Open server. Remote locations are using Check Point UTM-1570 series appliances with R75.30 and some of them are using a UTM-1-Edge-X or Edge-W with latest available firmware.

  She is in process of migrating to R81.

  What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R81?

  A. Missing an installed R77.20 Add-on on Security Management Server
  B. Unsupported firmware on UTM-1 Edge-W appliance
  C. Unsupported version on UTM-1 570 series appliance
  D. Unsupported appliances on remote locations
  A. Missing an installed R77.20 Add-on on Security Management Server

  ---

  Explanation/Reference:

  What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R81, is missing an installed R77.20 Add-on on Security Management Server. R77.20 Add-on is a package that adds new features and enhancements to R77 Security Management Server, such as support for new appliances, Gaia OS features, VPN features, etc. One of the requirements for migrating to R81 from R77 Security Management Server is to have R77.20 Add-on installed on the server. If Vanessa did not check this requirement and tried to migrate without R77.20 Add-on, she would encounter errors and failures during the migration process. The other options are either not relevant or not problematic for migration to R81.

• Question 34:

  CPM process stores objects, policies, users, administrators, licenses and management data in a database. The database is:

  A. MySQL
  B. Postgres SQL
  C. MarisDB
  D. SOLR
  B. Postgres SQL

  ---

  Explanation/Reference:

  CPM process stores objects, policies, users, administrators, licenses and management data in a Postgres SQL database. This database is located in $FWDIR/conf and can be accessed using the pg_client command2. The other options are not the correct database type for CPM. References: Check Point R81 Security Management Administration Guide

• Question 35:

  There are multiple types of licenses for the various VPN components and types. License type related to management and functioning of Remote Access VPNs are - which of the following license requirement statement is NOT true:

  A. MobileAccessLicense ?This license is required on the Security Gateway for the following Remote Access solutions
  B. EndpointPolicyManagementLicense ?The Endpoint Security Suite includes blades other than the Remote Access VPN, hence this license is required to manage the suite
  C. EndpointContainerLicense ?The Endpoint Software Blade Licenses does not require an Endpoint Container License as the base
  D. IPSecVPNLicense ?This license is installed on the VPN Gateway and is a basic requirement for a Remote Access VPN solution
  C. EndpointContainerLicense ?The Endpoint Software Blade Licenses does not require an Endpoint Container License as the base

  ---

  Explanation/Reference:

  The Endpoint Policy Management License is required for managing the Endpoint Security Suite, which includes blades such as the Remote Access VPN. The IPSec VPN License is installed on the VPN Gateway and is a basic requirement for a Remote Access VPN solution. The MobileAccessLicense is required on the Security Gateway for the following Remote Access solutions.

• Question 36:

  

  You are the administrator for ABC Corp. You have logged into your R81 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.

  What does this mean?

  A. This rule No. 6 has been marked for deletion in your Management session.
  B. This rule No. 6 has been marked for deletion in another Management session.
  C. This rule No. 6 has been marked for editing in your Management session.
  D. This rule No. 6 has been marked for editing in another Management session.
  C. This rule No. 6 has been marked for editing in your Management session.

  ---

  Explanation/Reference:

  You are the administrator for ABC Corp. You have logged into your R81 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it. This means that rule No.6 has been marked

  for editing in your Management session. In R81, every administrator works in a session that is independent of other administrators. Changes made by one administrator are not visible to others until they are published. When you edit a rule, it

  is marked with a pencil icon to indicate that it has been modified in your session. You can also lock a rule to prevent other administrators from editing it until you unlock it or publish your session.

  References: R81 Security Management Administration Guide, page 43.

• Question 37:

  You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet. However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet. How can you fix this?

  

  A. Right click Accept in the rule, select "More", and then check `Enable Identity Captive Portal'.
  B. On the firewall object, Legacy Authentication screen, check `Enable Identity Captive Portal'.
  C. In the Captive Portal screen of Global Properties, check `Enable Identity Captive Portal'.
  D. On the Security Management Server object, check the box `Identity Logging'.
  A. Right click Accept in the rule, select "More", and then check `Enable Identity Captive Portal'.

  ---

  Explanation/Reference:

  The correct way to enable Identity Captive Portal for a specific rule is to right click Accept in the rule, select "More", and then check `Enable Identity Captive Portal'. This will allow guest users to see the splash page and accept the Terms of Service before accessing the Internet. Identity Captive Portal is a feature that enables identity awareness for guest users who are not authenticated by other methods, such as Active Directory or Identity Agent. Identity Captive Portal can be enabled globally or per rule, depending on the security policy requirements.

• Question 38:

  What command would show the API server status?

  A. cpm status
  B. api restart
  C. api status
  D. show api status
  C. api status

  ---

  Explanation/Reference:

  The command that would show the API server status is api status. API stands for Application Programming Interface, and it is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. API status is a command that shows the current status of the API server, such as whether it is enabled or disabled, running or stopped, listening on which port, using which certificate, etc. The other commands are either invalid or perform different functions.

• Question 39:

  Fill in the blanks: A _______ license requires an administrator to designate a gateway for attachment whereas a ________ license is automatically attached to a Security Gateway.

  A. Formal; corporate
  B. Local; formal
  C. Local; central
  D. Central; local
  D. Central; local

  ---

  Explanation/Reference:

  A central license requires an administrator to designate a gateway for attachment whereas a local license is automatically attached to a Security Gateway. A central license is managed by a Security Management Server or a Multi-Domain Security Management Server and can be attached to any gateway that is managed by that server. A local license is managed by a local license server on each gateway and cannot be moved to another gateway. Central licenses are more flexible and scalable than local licenses, as they can be easily transferred between gateways without generating new licenses.

• Question 40:

  If SecureXL is disabled which path is used to process traffic?

  A. Passive path
  B. Medium path
  C. Firewall path
  D. Accelerated path
  C. Firewall path

  ---

  Explanation/Reference:

  If SecureXL is disabled, which means that packet acceleration is not available, the traffic is processed by the Firewall path. The Firewall path is the slowest path in the Check Point architecture, as it involves a full inspection of each packet by the Firewall kernel and all the enabled Software Blades. The Firewall path is also known as the F2F (Firewall to Firewall) path or the INSPECT path. References: Check Point Architecture