CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 41:

  What is the command used to activated Multi-Version Cluster mode?

  A. set cluster member mvc on in Clish
  B. set mvc on on Clish
  C. set cluster MVC on in Expert Mode
  D. set cluster mvc on in Expert Mode
  A. set cluster member mvc on in Clish

  ---

  Explanation/Reference:

  The command used to activate Multi-Version Cluster mode is set cluster member mvc on in Clish. Multi-Version Cluster mode is a feature that allows cluster members to run different versions of Check Point software during a cluster upgrade. This reduces downtime and simplifies the upgrade process. To enable Multi-Version Cluster mode, the command set cluster member mvc on must be executed on each cluster member in Clish3. The other options are not valid commands for activating Multi-Version Cluster mode. References: 3: Check Point Software, Getting Started, Multi-Version Cluster.

• Question 42:

  After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?

  A. Security Gateway IP-address cannot be changed without re-establishing the trust.
  B. The Security Gateway name cannot be changed in command line without re- establishing trust.
  C. The Security Management Server name cannot be changed in SmartConsole without re- establishing trust.
  D. The Security Management Server IP-address cannot be changed without re-establishing the trust.
  A. Security Gateway IP-address cannot be changed without re-establishing the trust.

  ---

  Explanation/Reference:

  After trust has been established between the Check Point components, the Security Gateway IP address cannot be changed without re-establishing the trust. This is because the trust is based on the Secure Internal Communication (SIC) mechanism, which uses certificates to authenticate and encrypt the communication. The certificates are issued by the Internal Certificate Authority (ICA) of the Security Management Server / Domain Management Server, and contain the name and IP address of the component. Therefore, if the IP address of a component is changed, the certificate will become invalid and the trust will be lost. To restore the trust, the certificate must be renewed or reissued by the ICA12. However, there are some exceptions to this rule. The Security Gateway name can be changed in command line without re-establishing trust, as long as the IP address remains the same. This is because the SIC mechanism does not rely on the hostname, but on the IP address and the SIC name (which is usually derived from the hostname, but can be manually changed). The Security Management Server name can be changed in SmartConsole without re-establishing trust, as long as the IP address remains the same. This is because SmartConsole uses a different mechanism to connect to the Security Management Server, which does not depend on the SIC certificate. The Security Management Server IP address can be changed without re-establishing trust, as long as some steps are followed to update the Check Point Registry file on the managed Security Gateways / Cluster Members / VSX Virtual Devices. This is because the Registry file contains the IP address of the ICA, which is used for certificate renewal. If the Registry file is not updated, then the certificate renewal will fail and the trust will be lost3. References: 1: Check Point R81 Security Administration Guide - Check Point Software, page 162 2: Check Point R81 Security Engineering Guide - Check Point Software, page 162 3: How to renew SIC after changing IP Address of Security Management Server - Check Point Software, Solution ID: sk103356

• Question 43:

  Which of these is an implicit MEP option?

  A. Primary-backup
  B. Source address based
  C. Round robin
  D. Load Sharing
  A. Primary-backup

  ---

  Explanation/Reference:

  Implicit MEP (Multicast Ethernet Point) options refer to the way multicast traffic is handled within a network. In this case, the question is asking about an implicit MEP option, and the correct answer is:

  A. Primary-backup: This is an implicit MEP option where one switch (primary) forwards multicast traffic while the other switch (backup) does not forward the traffic. It is used to ensure redundancy in case the primary switch fails.

  B. Source address-based, C. Round-robin, and D. Load Sharing are not implicit MEP options; they are different methods of handling multicast traffic and do not describe the concept of primary-backup.

  Therefore, option A is the correct answer as it represents an implicit MEP option.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 44:

  What are possible Automatic Reactions in SmartEvent?

  A. Mail. SNMP Trap, Block Source. Block Event Activity, External Script
  B. Web Mail. Block Destination, SNMP Trap. SmartTask
  C. Web Mail, Block Service. SNMP Trap. SmartTask, Geo Protection
  D. Web Mail, Forward to SandBlast Appliance, SNMP Trap, External Script
  A. Mail. SNMP Trap, Block Source. Block Event Activity, External Script

  ---

  Explanation/Reference:

  The possible Automatic Reactions in SmartEvent are Mail, SNMP Trap, Block Source, Block Event Activity, and External Script1. Automatic Reactions are actions that SmartEvent can perform automatically when a specific event occurs2. They can help you respond quickly and efficiently to security incidents and threats2. The Automatic Reactions are1: Mail: This reaction sends an email notification to a specified recipient with the details of the event. You can customize the subject and the body of the email, and use variables to include relevant information. SNMP Trap: This reaction sends an SNMP trap to a specified SNMP server with the details of the event. You can customize the OID and the community string of the trap, and use variables to include relevant information. Block Source: This reaction blocks the source IP address of the event from accessing your network for a specified duration. You can choose to block the source on all gateways or on specific gateways. You can also choose to block the source on a specific port or service. Block Event Activity: This reaction blocks the specific activity that triggered the event from occurring again for a specified duration. You can choose to block the activity on all gateways or on specific gateways. You can also choose to block the activity on a specific port or service. External Script: This reaction runs an external script on a specified server with the details of the event as arguments. You can use any script that can be executed by the operating system of the server, such as bash, perl, python, etc. You can use variables to include relevant information in the script arguments. References: SmartEvent R81.20 Administration Guide - Check Point Software, SmartEvent

  -Check Point Software

• Question 45:

  During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

  A. Host having a Critical event found by Threat Emulation
  B. Host having a Critical event found by IPS
  C. Host having a Critical event found by Antivirus
  D. Host having a Critical event found by Anti-Bot
  D. Host having a Critical event found by Anti-Bot

  ---

  Explanation/Reference:

  The host having a Critical event found by Anti-Bot should be remediated first, as it indicates that the host is infected by a botnet malware that is communicating with a Command and Control server. This poses a serious threat to the network security and data integrity. The other events may indicate potential malware infection or attack attempts, but not necessarily successful ones. References: Threat Prevention Administration Guide

• Question 46:

  When setting up an externally managed log server, what is one item that will not be configured on the R81 Security Management Server?

  A. IP
  B. SIC
  C. NAT
  D. FQDN
  C. NAT

  ---

  Explanation/Reference:

  NAT (Network Address Translation) is one item that will not be configured on the R81 Security Management Server when setting up an externally managed log server. NAT is a technique that allows devices with private IP addresses to communicate with devices with public IP addresses by translating the private addresses to public ones. NAT is not relevant for configuring an externally managed log server, which requires only the IP address, SIC (Secure Internal Communication), and FQDN (Fully Qualified Domain Name) of the log server. References: Check Point Security Expert R81 Course, Logging and Monitoring Administration Guide

• Question 47:

  What has to be taken into consideration when configuring Management HA?

  A. The Database revisions will not be synchronized between the management servers
  B. SmartConsole must be closed prior to synchronized changes in the objects database
  C. If you wanted to use Full Connectivity Upgrade, you must change the Implied Rules to allow FW1_cpredundant to pass before the Firewall Control Connections.
  D. For Management Server synchronization, only External Virtual Switches are supported. So, if you wanted to employ Virtual Routers instead, you have to reconsider your design.
  A. The Database revisions will not be synchronized between the management servers

  ---

  Explanation/Reference:

  When configuring Management HA, you have to take into consideration that the Database revisions will not be synchronized between the management servers. Database revisions are snapshots of the database that are created manually or automatically when installing a policy or saving changes. They are stored locally on each management server and are not replicated by Management HA. The other options are either not true or not relevant to Management HA. References: Check Point R81 Installation and Upgrade Guide

• Question 48:

  What does the "unknown" SIC status shown on SmartConsole mean?

  A. SIC activation key requires a reset
  B. Administrator input the wrong SIC key
  C. The management can contact the Security Gateway but cannot establish Secure Internal Communication
  D. There is no connection between the Security Gateway and Security Management Server
  D. There is no connection between the Security Gateway and Security Management Server

  ---

  Explanation/Reference:

  The "unknown" SIC status shown on SmartConsole means that there is no connection between the Security Gateway and Security Management Server. SIC stands for Secure Internal Communication, which is a mechanism that ensures secure communication between Check Point components using certificates and encryption. SIC status can be one of the following: Trust established, Trust expired, Uninitialized, or Unknown. Trust established means that SIC is working properly and the components can communicate securely. Trust expired means that the SIC certificate has expired and needs to be renewed. Uninitialized means that SIC has not been configured yet and needs to be initialized with an activation key. Unknown means that the Security Management Server cannot reach the Security Gateway or vice versa, and therefore cannot verify the SIC status. This could be due to network issues, firewall rules, routing problems, or other causes that prevent connectivity between the components. References: Check Point R81 Security Management Administration Guide, page 32-33

• Question 49:

  You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.

  What is the first step to run management API commands on GAIA's shell?

  A. mgmt_admin@teabag > id.txt
  B. mgmt_login
  C. login user admin password teabag
  D. mgmt_cli login user "admin" password "teabag" > id.txt
  B. mgmt_login

  ---

  Explanation/Reference:

  You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.

  The first step to run management API commands on GAIA's shell is mgmt_login. This command allows you to login to the management server and obtain a session ID, which is required for running other management API commands. You can

  also specify the user name and password as parameters, or enter them interactively. The session ID is stored in the file $CPDIR/tmp/.api_session by default, unless you specify a different file name. References: R81 Management API

  Reference Guide, page 15.

• Question 50:

  Which options are given on features, when editing a Role on Gaia Platform?

  A. Read/Write, Read Only
  B. Read/Write, Read Only, None
  C. Read/Write, None
  D. Read Only, None
  B. Read/Write, Read Only, None

  ---

  Explanation/Reference:

  The options that are given on features, when editing a Role on Gaia Platform are Read/Write, Read Only, and None. These options determine the level of access that a user has to a specific feature or command in Gaia. If a user has Read/ Write access to a feature, they can view and modify the settings of that feature. If a user has Read Only access to a feature, they can only view the settings of that feature, but not change them. If a user has None access to a feature, they cannot view or modify the settings of that feature.