CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 461:

  What are the minimum open server hardware requirements for a Security Management Server/Standalone in R81?

  A. 2 CPU cores, 4GB of RAM and 15GB of disk space

  B. 8 CPU cores, 16GB of RAM and 500 GB of disk space

  C. 4 CPU cores, 8GB of RAM and 500GB of disk space

  D. 8 CPU cores, 32GB of RAM and 1 TB of disk space

  Correct Answer: C

  The minimum open server hardware requirements for a Security Management Server/Standalone in R81 are:

  CPU: Intel Core i5-4590 or equivalent (4 cores)

  Memory: 8 GB RAM

  Disk space: 500 GB

  The other options do not match the minimum requirements. Option A has insufficient CPU cores, memory and disk space. Option B has excessive CPU cores and disk space. Option D has excessive CPU cores, memory and disk space.

  References: Check Point R81 Release Notes, page 6

• Question 462:

  What could NOT be a reason for synchronization issues in a Management HA environment?

  A. Accidentally, you have configured unique IP addresses per Management Server which invalidates the CA Certificate

  B. There is a network connectivity failure between the servers

  C. Servers are in Collision Mode. Two servers, both in active state cannot be synchronized either automatically or manually.

  D. The products installed on the servers do not match: one device is a Standalone Server while the other is only a Security Management server

  Correct Answer: D

  The statement that could not be a reason for synchronization issues in a Management HA environment is that the products installed on the servers do not match:

  one device is a Standalone Server while the other is only a Security Management server. This is not a valid reason because Management HA requires that both servers have the same products installed, either both as Standalone Servers or

  both as Security Management servers. The other statements are possible reasons for synchronization issues in a Management HA environment. References: [Check Point Security Expert R81 High Availability Administration Guide], page 11.

• Question 463:

  Which of the following cannot be configured in an Access Role Object?

  A. Networks

  B. Machines

  C. Users

  D. Time

  Correct Answer: D

  The verified answer is D. Time.

  An Access Role object is a logical representation of a set of users, machines, or networks that can be used in the security policy1. An Access Role object can include the following components1:

  Networks: IP addresses or network objects that define the source or destination of the traffic.

  Machines: Specific hosts or machine groups that are identified by their MAC addresses or certificates.

  Users: Specific users or user groups that are authenticated by one or more identity sources, such as Active Directory, LDAP, or Identity Awareness. Time is not a component of an Access Role object, and it cannot be configured in it. Time is

  a separate object type that can be used to define the validity period of a rule or a policy2.

  References:

  LDAP group vs Access role objects - Check Point CheckMates3 THE IMPORTANCE OF ACCESS ROLES - Check Point Software1 Time Objects - Check Point Software2

• Question 464:

  Which of the following is NOT a type of Endpoint Identity Agent?

  A. Terminal

  B. Light

  C. Full

  D. Custom

  Correct Answer: A

  The type of Endpoint Identity Agent that does not exist is Terminal. Endpoint Identity Agent is a software component that runs on Windows or Mac devices and provides identity information to the Check Point Security Gateway. Endpoint Identity Agent allows the Security Gateway to enforce granular access policies based on user identity and device compliance status. There are three types of Endpoint Identity Agent: Full Identity Agent - a persistent agent that provides seamless and transparent identity acquisition and SSO (single sign-on) capabilities. It supports various authentication methods, such as Active Directory, LDAP, RADIUS, certificate, etc. It also supports endpoint compliance checks and remediation actions. Light Identity Agent - a lightweight agent that provides identity acquisition through a web browser. It supports Active Directory authentication only. It does not support SSO or endpoint compliance features. Custom Identity Agent - a customized agent that provides identity acquisition through an API. It allows third-party applications or systems to integrate with Check Point Identity Awareness and provide user identity information. Terminal is not a type of Endpoint Identity Agent, but it is a type of Terminal Server Agent. Terminal Server Agent is a software component that runs on Windows Terminal Servers or Citrix Servers and provides identity information for multiple concurrent users who connect to these servers using Remote Desktop Protocol (RDP) or Independent Computing Architecture (ICA) protocol. Terminal Server Agent allows the Security Gateway to enforce granular access policies based on user identity and session information.

• Question 465:

  Fill in the blanks: A _______ license requires an administrator to designate a gateway for attachment whereas a ________ license is automatically attached to a Security Gateway.

  A. Formal; corporate

  B. Local; formal

  C. Local; central

  D. Central; local

  Correct Answer: D

  A central license requires an administrator to designate a gateway for attachment whereas a local license is automatically attached to a Security Gateway. A central license is managed by a Security Management Server or a Multi-Domain Security Management Server and can be attached to any gateway that is managed by that server. A local license is managed by a local license server on each gateway and cannot be moved to another gateway. Central licenses are more flexible and scalable than local licenses, as they can be easily transferred between gateways without generating new licenses.

• Question 466:

  What are the modes of SandBlast Threat Emulation deployment?

  A. Cloud, Smart-1 and Hybrid

  B. Cloud. OpenServer and Vmware

  C. Cloud, Appliance and Private

  D. Cloud, Appliance and Hybrid

  Correct Answer: D

  SandBlast Threat Emulation is a technology that protects against zero-day and unknown malware by inspecting files in a secure sandbox environment and emulating their behavior. SandBlast Threat Emulation can be deployed in three modes: Cloud, Appliance and Hybrid1. Cloud mode: The files are sent to the Check Point cloud service for emulation. This mode does not require any additional hardware or software installation. It is the easiest and most cost-effective way to deploy SandBlast Threat Emulation. Appliance mode: The files are sent to a dedicated appliance (TE1000X, TE2500X, or TE100X) for emulation. This mode provides the highest level of performance and scalability, as well as data privacy and compliance. It is suitable for large organizations with high security and throughput requirements. Hybrid mode: The files are first sent to the Check Point cloud service for emulation, and if the cloud service cannot determine the verdict, they are then sent to a dedicated appliance for further analysis. This mode combines the benefits of both cloud and appliance modes, offering fast response time and high accuracy. References: 1: SandBlast Threat Emulation Deployment Modes

• Question 467:

  What is the best method to upgrade a Security Management Server to R81.x when it is not connected to the Internet?

  A. CPUSE offline upgrade only

  B. Advanced upgrade or CPUSE offline upgrade

  C. Advanced Upgrade only

  D. SmartUpdate offline upgrade

  Correct Answer: B

  The best method to upgrade a Security Management Server to R81.x when it is not connected to the Internet is either Advanced upgrade or CPUSE offline upgrade. Advanced upgrade is a manual procedure that involves backing up the current configuration, installing the new version from an ISO image, and restoring the configuration. CPUSE offline upgrade is an automated procedure that involves downloading the upgrade package from the Check Point User Center, transferring it to the Security Management Server, and installing it using CPUSE. SmartUpdate offline upgrade is not a valid option, as SmartUpdate is a tool for managing licenses and software packages on multiple gateways and servers1. References: 1: Check Point Software, Getting Started, Upgrading Security Management Servers.

• Question 468:

  The admin is connected via ssh lo the management server. He wants to run a mgmt_dl command but got a Error 404 message. To check the listening ports on the management he runs netstat with the results shown below. What can be the cause for the issue?

  

  A. Wrong Management API Access setting^for Ihe client IP To correct it go to SmartConsole / Management and Settings / Blades / Management API and press "Advanced Settings..' and choose GUI clients or ALL IP's.

  B. The API didn't run on the default port check it with api status' and add '-port 4434' to the mgmt_clt command.

  C. The management permission in the user profile is mrssing. Go to SmartConsole / Management and Settings I Permissions and Administrators / Permission Profiles. Select the profile of the user and enable 'Management API Login' under Management Permissions

  D. The API is not running, the services shown by netstat are the gaia services. To start the API run 'api start'

  Correct Answer: D

  The error message "Error 404. The Management API server is not available. Please check that the Management API server is up and running." indicates that the API is not running on the Management Server. The netstat command shows that there is no process listening on port 4434, which is the default port for the API. To start the API, the command `api start' should be used. The other options are not relevant to this issue. References: Check Point R81 Installation and Upgrade Guide, page 18.

• Question 469:

  What is the command to check the status of Check Point processes?

  A. top

  B. cptop

  C. cphaprob list

  D. cpwd_admin list

  Correct Answer: D

  The command to check the status of Check Point processes is cpwd_admin list. This command displays the process ID, name, state, start time, and watchdog status of all the processes that are monitored by the Check Point WatchDog

  daemon (CPWD). You can also use this command to start, stop, or restart a specific process. References:

  [cpwd_admin Command]

• Question 470:

  While using the Gaia CLI. what is the correct command to publish changes to the management server?

  A. json publish

  B. mgmt publish

  C. mgmt_cli commit

  D. commit

  Correct Answer: B

  While using the Gaia CLI, the correct command to publish changes to the management server is mgmt publish. This command publishes all changes made by all administrators since the last publish operation. The json publish command is not valid in Gaia CLI. The mgmt_cli commit command is used to publish changes made by a specific administrator session. The commit command is used to save configuration changes in Gaia CLI. References: Publishing Changes