CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 411:

  Which statement is false in respect of the SmartConsole after upgrading the management server to R81.20?

  A. Yes. You can download the SmartConsole directly from the Download Center

  B. As far as you use version R80.40, no upgrade is needed due to compatibility mode

  C. Yes, using CPUSE you can make the installer available in the Web Portal of the Management Server D. Yes, the SmartConsole Upgrade package can be installed using CPUSE

  Correct Answer: B

  The statement that is false in respect of the SmartConsole after upgrading the management server to R81.20 is that as far as you use version R80.40, no upgrade is needed due to compatibility mode. This is false because SmartConsole R80.40 is not compatible with R81.20 management server and you need to upgrade your SmartConsole to R81.20 as well. The other statements are true and valid ways to obtain the SmartConsole upgrade package. References: [Check Point Security Expert R81 Installation and Upgrade Guide], page 18.

• Question 412:

  Which is the command to identify the NIC driver before considering about the employment of the Multi-Queue feature?

  A. ip show int eth0

  B. show interface eth0 mq

  C. ifconfig -i eth0 verbose

  D. ethtool -i eth0

  Correct Answer: D

• Question 413:

  What should the admin do in case the Primary Management Server is temporary down?

  A. Use the VIP in SmartConsole you always reach the active Management Server.

  B. The Secondary will take over automatically Change the IP in SmartConsole to logon to the private IP of the Secondary Management Server.

  C. Run the 'promote_util' to activate the Secondary Management server

  D. Logon with SmartConsole to the Secondary Management Server and choose "Make Active' under Actions in the HA Management Menu

  Correct Answer: A

  High Availability (HA) is a deployment scenario where two or more Security Management Servers are configured to work together as a cluster. One server acts as the Primary server and handles all management operations, while another server acts as the Secondary server and serves as a backup. If the Primary server fails, the Secondary server takes over and becomes active. The cluster members communicate using a Virtual IP (VIP) address, which is used by SmartConsole to connect to the active server. If the Primary server is temporarily down, the administrator does not need to do anything, as SmartConsole will automatically connect to the VIP address and reach the Secondary server that has become active. Therefore, the correct answer is A. References: 6: High Availability Administration Guide

• Question 414:

  You want to allow your Mobile Access Users to connect to an internal file share. Adding the Mobile Application 'File Share' to your Access Control Policy in the SmartConsole didn't work. You will be only allowed to select Services for the 'Service and Application' column How to fix it?

  A. A Quantum Spark Appliance is selected as Installation Target for the policy packet.

  B. The Mobile Access Blade is not enabled for the Access Control Layer of the policy.

  C. The Mobile Access Policy Source under Gateway properties Is set to Legacy Policy and not to Unified Access Policy.

  D. The Mobile Access Blade is not enabled under Gateway properties.

  Correct Answer: C

• Question 415:

  Which of the following is NOT supported by CPUSE?

  A. Automatic download of full installation and upgrade packages

  B. Automatic download of hotfixes

  C. Installation of private hotfixes

  D. Offline installations

  Correct Answer: D

  The option that is not supported by CPUSE is offline installations. CPUSE (Check Point Update Service Engine) is a Gaia software update agent that manages software updates on Gaia OS and Check Point products. It requires an internet connection to download and install updates from the Check Point Cloud or a local Deployment Agent. The other options are supported by CPUSE. It can automatically download full installation and upgrade packages, hotfixes, and private hotfixes. It can also install them manually or automatically according to a schedule. References: [CPUSE Overview]

  https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_AdminWebAdminGuide/ html_frameset.htm?topic=documents/R77/CP_R77_Gaia_AdminWebAdminGuide/112109

• Question 416:

  After replacing a faulty Gateway the admin installed the new Hardware and want to push the policy. Installing the policy using the SmartConsole he got an Error for the Threat Prevention Policy. There is no error for the Access Control Policy. What will be the most common cause for the issue?

  A. The admin forgot to reestablish the SIC for the new hardware. That is typically the case when configure only the interfaces of the replacement hardware instead restoring a backup.

  B. The IPS Protection engine on the replacement hardware is too old. Before pushing the Threat Prevention Policy use SmartConsole -> Security Policies -> Updates -> IPS 'Update Now' to update the engine.

  C. The admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing.

  D. The Threat Prevention Policy can't be installed on a Gateway without an already installed Access Control Policy. First install only the Access Control Policy.

  Correct Answer: C

  The most common cause for the issue is that the admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing. Without a valid license, the Threat Prevention Policy cannot be installed on the new hardware. The admin should check the license status on the SmartConsole -> Gateways and Servers -> Licenses and Contracts and apply the appropriate license for the replacement hardware. References: Check Point Certified Security Expert R81.20 Course Overview, sk171213: Threat Prevention policy installation reports failure in SmartConsole with this error: "Policy installation had failed due to an internal error."

• Question 417:

  After having saved the Cllsh Configuration with the "save configuration config.txt* command, where can you find the config.txt file?

  A. You will find it in the home directory of your usef account (e.g. /home/admirV)

  B. You can locate the file via SmartConsole > Command Line.

  C. You have to launch the WebUl and go to "Config" -> "Export Conflg File" and specifly the destination directory of your local tile system

  D. You cannot locate the file in the file system sine?Clish does not have any access to the bash fie system

  Correct Answer: B

  You can locate the file via SmartConsole > Command Line. According to the CLISH documentation1, when you save the configuration with the "save configuration config.txt" command, the file is stored in a temporary location on the management server. To access the file, you need to use SmartConsole and go to Command Line > View File > config.txt2. Alternatively, you can also use the "show configuration" command in CLISH to view the current configuration2. References: : CLISH - SourceForge : Summary of Gaia Clish Commands - Check Point Software

• Question 418:

  By default, which port does the WebUI listen on?

  A. 80

  B. 4434

  C. 443

  D. 8080

  Correct Answer: C

  The default port for the Gaia WebUI Portal is HTTPS 443. This is the standard port for secure web communication over SSL/TLS. Changing the port may cause inconsistency with the settings on the SmartConsole and is not recommended unless necessary. To change the port, you can use the CLISH command set web ssl-port and save the configuration. References: 13

• Question 419:

  What are the two modes for SNX (SSL Network Extender)?

  A. Network Mode and Application Mode

  B. Visitor Mode and Office Mode

  C. Network Mode and Hub Mode

  D. Office Mode and Hub Mode

  Correct Answer: A

  SNX (SSL Network Extender) is a thin VPN client installed on an endpoint user computer that provides secure remote access to a corporate network. It can be used with Mobile Access blade or the IPsec VPN blade via the Mobile Access or SNX portals1. SNX has two modes: Network Mode and Application Mode2. Network Mode: In this mode, SNX creates a virtual network adapter on the endpoint computer and assigns it an IP address from the internal network. This allows the endpoint computer to access all the resources on the internal network as if it was physically connected to it. Network Mode supports all IP-based applications, including TCP and UDP applications2. Application Mode: In this mode, SNX does not create a virtual network adapter on the endpoint computer, but instead intercepts the traffic of specific applications and forwards it to the Security Gateway. Application Mode supports only TCP- based applications that are defined in the Mobile Access policy. Application Mode is useful when Network Mode is not supported or when granular control over the applications is required2. References: : SSL Network Extender : SNX Modes

• Question 420:

  On R81.20 the IPS Blade is managed by:

  A. Threat Protection policy

  B. Anti-Bot Blade

  C. Threat Prevention policy

  D. Layers on Firewall policy

  Correct Answer: C

  On R81.20 the IPS Blade is managed by the Threat Prevention policy. The Threat Prevention policy is a unified policy that includes Anti-virus, IPS, Anti-bot, and Threat Emulation software blades. The IPS blade provides protection against network attacks and exploits by inspecting the traffic and blocking malicious packets. The IPS blade can be configured with different profiles and exceptions to suit different security needs. References: R81 Threat Prevention Administration Guide, page 15.