CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 441:

  The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?

  A. field_name:string

  B. name field:string

  C. name_field:string

  D. field name:string

  Correct Answer: A

  The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, the syntax is field_name:string. For example, to search for all rules that have a comment containing "VPN", the syntax is comment:VPN. The other options are not valid syntaxes for searching for a value in a field3. References: 3: Check Point Software, Getting Started, Searching for Text Strings.

• Question 442:

  Using Web Services to access the API, which Header Name-Value had to be in the HTTP Post request after the login?

  A. X-chkp-sid Session Unique Identifier

  B. API-Key

  C. user-uid

  D. uuid Universally Unique Identifier

  Correct Answer: A

  The header name-value that has to be in the HTTP Post request after the login when using Web Services to access the API is X-chkp-sid Session Unique Identifier. This header contains the session ID that is returned by the login command and identifies the session for subsequent API commands. The session ID is valid for a limited time and can be extended by using keepalive or logout commands. References: [Check Point R81 Management API Reference Guide]

• Question 443:

  Name the authentication method that requires token authenticator.

  A. SecurelD

  B. DynamiclD

  C. Radius

  D. TACACS

  Correct Answer: A

  The correct answer is A. SecurelD.

  SecurelD is an authentication method that uses a token-based system to generate one- time passwords (OTPs) for users. Users need to have a physical or software token that displays a code that changes periodically. The code is used

  along with a personal identification number (PIN) to authenticate the user. DynamiclD is another authentication method that uses OTPs, but it does not require a token. Instead, it sends the OTP to the user's email or phone number. Radius

  and TACACS are protocols that allow remote authentication of users through a centralized server. They do not use tokens, but they can support different types of authentication methods, such as passwords, certificates, or OTPs.

  References:

  Certified Security Expert (CCSE) R81.20 Course Overview1 What Is Token-Based Authentication? | Okta2

• Question 444:

  In terms of Order Rule Enforcement, when a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom Which of the following statements is correct?

  A. If the Action of the matching rule is Accept the gateway will drop the packet

  B. If the Action of the matching rule is Drop, the gateway continues to check rules in the next Policy Layer down

  C. If the Action of the matching rule is Drop the gateway stops matching against later rules in the Policy Rule Base and drops the packet

  D. If the rule does not match in the Network policy it will continue to other enabled polices

  Correct Answer: C

  If the action of the matching rule is Drop, the gateway stops matching against later rules in the Policy Rule Base and drops the packet. This is because the Drop action is a final action that terminates the rule matching process and discards the packet. The gateway does not continue to check rules in the next Policy Layer down or in other enabled policies. References: [Policy Layers and Sub-Policies] https://sc1.checkpoint.com/documents/R81/CP_R81_SecMGMT/ html_frameset.htm?topic= documents/R81/CP_R81_SecMGMT/126197

• Question 445:

  After finishing installation admin John likes to use top command in expert mode. John has to set the expert-password and was able to use top command. A week later John has to use the top command again, He detected that the expert password is no longer valid. What is the most probable reason for this behavior?

  A. "write memory" was not issued on clish

  B. changes are only possible via SmartConsole

  C. "save config" was not issued in expert mode

  D. "save config" was not issued on clish

  Correct Answer: D

  The most probable reason for the expert password to be no longer valid after a week is that save config was not issued on clish. The clish command set expert- password sets the expert password for the current session only. To make the password persistent, the clish command save config must be issued after setting the expert password2. The other options are not relevant for setting the expert password. References: 2: Check Point Software, Getting Started, Setting Expert Password.

• Question 446:

  What is the best sync method in the ClusterXL deployment?

  A. Use 1 cluster + 1st sync

  B. Use 1 dedicated sync interface

  C. Use 3 clusters + 1st sync + 2nd sync + 3rd sync D. Use 2 clusters +1st sync + 2nd sync

  Correct Answer: B

  The best sync method in the ClusterXL deployment is to use one dedicated sync interface. This means that one interface on each cluster member is used exclusively for synchronization traffic, which improves performance and security. Using multiple clusters or sync interfaces is not recommended, as it can cause network congestion or synchronization issues. References: : Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 8.

• Question 447:

  Which component is NOT required to communicate with the Web Services API?

  A. API key

  B. session ID token

  C. content-type

  D. Request payload

  Correct Answer: A

  The component that is not required to communicate with the Web Services API is the API key. The Web Services API uses a session ID token for authentication, which is obtained by sending a login request with a valid username and password. The other components are required for sending requests and receiving responses from the Web Services API. The content-type specifies the format of the data being sent or received, such as JSON or XML. The request payload contains the data and parameters for the API call, such as command name, object name, etc. References: [Web Services API Reference Guide]

• Question 448:

  When performing a minimal effort upgrade, what will happen to the network traffic?

  A. All connections that were Initiated before the upgrade will be dropped, causing network downtime.

  B. All connections that were initiated before the upgrade will be handled by the active gateway

  C. All connections that were initiated before the upgrade will be handled normally

  D. All connections that were initiated before the upgrade will be handled by the standby gateway

  Correct Answer: B

  All connections that were initiated before the upgrade will be handled by the active gateway. According to the Check Point documentation1, a minimal effort upgrade is a procedure that allows you to upgrade each Security Gateway individually, without affecting the cluster operation. The active gateway continues to handle the traffic while the standby gateway is upgraded, and then they switch roles. This way, there is no network downtime and no need to synchronize the cluster members before or after the upgrade1. However, some connections may be dropped during the switch-over, so it is recommended to use a connectivity upgrade or a zero downtime upgrade for mission- critical environments2. References: : Best Practices - Security Gateway Performance - Check Point Software : Checkpoint Cluster Firmware Upgrade - Check Point CheckMates

• Question 449:

  What are valid authentication methods for mutual authenticating the VPN gateways?

  A. PKI Certificates and Kerberos Tickets

  B. PKI Certificates and DynamicID OTP

  C. Pre-Shared Secrets and Kerberos Ticket

  D. Pre-shared Secret and PKI Certificates

  Correct Answer: D

  The valid authentication methods for mutual authenticating the VPN gateways are Pre-shared Secret and PKI Certificates. Pre-shared Secret is a method that uses a secret key that is known only to the two VPN gateways. PKI Certificates is a

  method that uses digital certificates that are issued by a trusted Certificate Authority (CA) and contain the public key of each VPN gateway. Both methods ensure that the VPN gateways can verify each other's identity before establishing a

  secure VPN tunnel. References:

  [Check Point R81 VPN Administration Guide]

• Question 450:

  Which command collects diagnostic data for analyzing a customer setup remotely?

  A. cpv

  B. cpinfo

  C. migrate export

  D. sysinfo

  Correct Answer: B

  The verified answer is B. cpinfo.

  cpinfo is a command that collects diagnostic data for analyzing a customer setup remotely. It is an auto-updatable utility that runs on the customer's machine and uploads the data to Check Point servers. The data includes information about

  the system, the security policy, the objects, and the logs. Check Point support engineers can use the DiagnosticsView utility to open the cpinfo file and view the customer's configuration and environment settings1. migrate export is a

  command that exports the Check Point configuration and database files to a compressed file. It is used for backup and migration purposes, not for remote analysis2. sysinfo is a command that displays basic information about the system,

  such as the hostname, the OS version, the CPU model, and the memory size. It does not collect or upload any data to Check Point servers3.

  cpv is not a valid command in Check Point.

  References:

  Support, Support Requests, Training ... - Check Point Software1 Migrate export - Check Point Software

  sysinfo - Check Point Software