CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 541:

  SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's machine via the web browser. What are the two modes of SNX?

  A. Application and Client Service
  B. Network and Application
  C. Network and Layers
  D. Virtual Adapter and Mobile App
  B. Network and Application

  ---

  Explanation/Reference:

  SSL Network Extender (SNX) has two modes of operation: Network Mode and Application Mode. Network Mode provides full network connectivity to the remote user, while Application Mode provides access to specific applications on the corporate network. References: [SSL Network Extender]

• Question 542:

  When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

  A. None, Security Management Server would be installed by itself.
  B. SmartConsole
  C. SecureClient
  D. Security Gateway
  E. SmartEvent
  D. Security Gateway

  ---

  Explanation/Reference:

  When doing a Stand-Alone Installation, you would install the Security Management Server with the Security Gateway as the other Check Point architecture component. A Stand-Alone Installation is where the Security Management Server and the Security Gateway are installed on the same machine2. The other options are either not Check Point architecture components, or not suitable for a Stand-Alone Installation. References: Check Point R81 Installation and Upgrade Guide

• Question 543:

  What is the difference between SSL VPN and IPSec VPN?

  A. IPSec VPN does not require installation of a resilient VPN client.
  B. SSL VPN requires installation of a resident VPN client.
  C. SSL VPN and IPSec VPN are the same.
  D. IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser.
  D. IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser.

  ---

  Explanation/Reference:

  The main difference between SSL VPN (Secure Sockets Layer Virtual Private Network) and IPSec VPN (Internet Protocol Security Virtual Private Network) is in the way they operate:

  SSL VPN typically does not require the installation of a resident VPN client. It often relies on a web browser to establish the VPN connection, making it more convenient for remote users who may not want to install dedicated VPN software.

  IPSec VPN, on the other hand, often requires the installation of a resident VPN client on the user's device to establish the VPN connection. This client software is necessary for configuring and managing the VPN connection. Option C, stating

  that SSL VPN and IPSec VPN are the same, is incorrect because they have distinct characteristics as described above.

  Option A is incorrect because it inaccurately suggests that IPSec VPN does not require a resident VPN client, which is not true in most cases. Option B is incorrect because it wrongly claims that SSL VPN requires the installation of a resident

  VPN client.

  References: Check Point Certified Security Expert R81 Study Guide

• Question 544:

  Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?

  A. Auditor
  B. Read Only All
  C. Super User
  D. Full Access
  B. Read Only All

  ---

  Explanation/Reference:

  The pre-defined Permission Profile that should be assigned to an administrator that requires full access to audit all configurations without modifying them is Read Only All. This profile grants read-only access to all features and blades in SmartConsole, including logs and reports. This profile is suitable for auditors who need to review the security policy and settings, but not change them. References: R81 Security Management Administration Guide, page 57.

• Question 545:

  When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

  A. Threat Emulation
  B. HTTPS
  C. QOS
  D. VoIP
  D. VoIP

  ---

  Explanation/Reference:

  When Dynamic Dispatcher is enabled, it dynamically assigns connections, but there are exceptions. The exception mentioned in the question is:

  VoIP (Option D): VoIP connections are an exception when Dynamic Dispatcher is enabled. They are not assigned dynamically but follow a different rule set to ensure quality and reliability for VoIP traffic. The other options, Threat Emulation

  (Option A), HTTPS (Option B), and QoS (Option C), are dynamically assigned when Dynamic Dispatcher is enabled.

  References: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.

• Question 546:

  You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

  A. Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.
  B. Create a separate Security Policy package for each remote Security Gateway.
  C. Create network objects that restricts all applicable rules to only certain networks.
  D. Run separate SmartConsole instances to login and configure each Security Gateway directly.
  B. Create a separate Security Policy package for each remote Security Gateway.

  ---

  Explanation/Reference:

  To simplify security administration when working with multiple Security Gateways enforcing an extensive number of rules, you would choose to create a separate Security Policy package for each remote Security Gateway. A Security Policy package is a set of rules and objects that can be assigned to one or more Security Gateways. This allows you to manage different policies for different gateways from the same Management Server1. The other options are either not effective or not feasible for simplifying security administration. References: Check Point R81 Security Management Administration Guide

• Question 547:

  What scenario indicates that SecureXL is enabled?

  A. Dynamic objects are available in the Object Explorer
  B. SecureXL can be disabled in cpconfig
  C. fwaccel commands can be used in clish
  D. Only one packet in a stream is seen in a fw monitor packet capture
  C. fwaccel commands can be used in clish

  ---

  Explanation/Reference:

  SecureXL is a technology that accelerates the performance of the Check Point Security Gateway by offloading CPU-intensive operations from the Firewall kernel to the SecureXL device. SecureXL can handle various types of traffic, such as

  TCP, UDP, ICMP, non-IP, VPN, NAT, etc. SecureXL can also work with various features, such as CoreXL, ClusterXL, QoS, etc.

  One way to indicate that SecureXL is enabled is to use the fwaccel commands in clish. Clish is a command-line shell that provides a user-friendly interface for configuring and managing Check Point products. The fwaccel commands are used

  to control and monitor SecureXL operations, such as enabling or disabling SecureXL, viewing SecureXL statistics, managing SecureXL templates, etc. For example, the command fwaccel stat shows the status of SecureXL, such as whether it

  is on or off, how many packets are accelerated or not accelerated, etc.

  The other options are not valid indicators of SecureXL being enabled:

  A. Dynamic objects are available in the Object Explorer: Dynamic objects are objects that represent IP addresses that change over time, such as VPN clients, DHCP clients, etc. Dynamic objects are available in the Object Explorer regardless

  of whether SecureXL is enabled or not.

  B. SecureXL can be disabled in cpconfig: Cpconfig is a command-line tool that allows you to configure various settings of Check Point products, such as administrator password, GUI clients, SNMP extension, etc. SecureXL can be disabled in

  cpconfig only if it was enabled before. Therefore, this option does not indicate that SecureXL is enabled.

  D. Only one packet in a stream is seen in a fw monitor packet capture: Fw monitor is a command-line tool that allows you to capture and analyze network traffic passing through the Security Gateway. Fw monitor shows the traffic at different

  inspection points in the Firewall kernel. If SecureXL is enabled, some packets may be accelerated by SecureXL and bypass the Firewall kernel inspection. Therefore, fw monitor may not see all packets in a stream. However, this does not

  mean that only one packet in a stream will be seen by fw monitor. Some packets may still go through the Firewall kernel inspection and be seen by fw monitor. Therefore, this option does not indicate that SecureXL is enabled.

  Therefore, the correct answer is C.

  References: How to enable/disable Check Point SecureXL via CLI, Part 3 - SecureXL, What is SecureXL?, Clish - Command Line Interface Shell, sk30583: What is FW Monitor?

• Question 548:

  You have pushed policy to GW-3 and now cannot pass traffic through the gateway. As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?

  A. fw unloadlocal
  B. fw unloadpolicy
  C. fwm unload local
  D. fwm unload policy
  A. fw unloadlocal

  ---

  Explanation/Reference:

  The command fw unloadlocal removes the current security policy from the local gateway and returns it to its initial state2. This command can be used as a last resort to restore traffic flow through the gateway if the policy is causing problems. The command fw unloadpolicy is not valid, and the commands fwm unload local and fwm unload policy are used to remove policies from remote gateways3. References: 2: Check Point Software, Getting Started, Unloading Security Policies;

  3: Check Point Software, Getting Started, Unloading Security Policies from Remote Gateways.

• Question 549:

  Which upgrade method you should use upgrading from R80.40 to R81.20 to avoid any downtime?

  A. Zero Downtime Upgrade (ZDU)
  B. Connectivity Upgrade (CU)
  C. Minimal Effort Upgrade (ME)
  D. Multi-Version Cluster Upgrade (MVC)
  D. Multi-Version Cluster Upgrade (MVC)

  ---

  Explanation/Reference:

  The correct upgrade method for upgrading from R80.40 to R81.20 without any downtime is the Multi-Version Cluster Upgrade (MVC). MVC is a new feature in R80.40 that replaces the deprecated Connectivity Upgrade (CU). MVC allows you to upgrade cluster members to a newer version without losing connectivity and test the new version on some of the cluster members before you decide to upgrade the rest of the cluster members. MVC synchronizes connections between cluster members that run different versions and ensures that the cluster remains operational during the upgrade process. MVC is intended only to test the current configuration in the newer version and not to change the security policy and install it on cluster members with different software versions. MVC is disabled by default and can be enabled on each cluster member individually. MVC has some limitations, such as not supporting VSX clusters, IPS blade, or SecureXL acceleration. References: Multi-Version Cluster (MVC) replaces Connectivity Upgrade (CU) in R80.40 Multi-Version Cluster (MVC) Upgrade Configuring the Multi-Version Cluster Mechanism

• Question 550:

  From SecureXL perspective, what are the three paths of traffic flow:

  A. Initial Path; Medium Path; Accelerated Path
  B. Layer Path; Blade Path; Rule Path
  C. Firewall Path; Accelerated Path; Medium Path
  D. Firewall Path; Accept Path; Drop Path
  C. Firewall Path; Accelerated Path; Medium Path

  ---

  Explanation/Reference:

  From SecureXL perspective, the three paths of traffic flow are Firewall Path, Accelerated Path, and Medium Path. Firewall Path is the path that handles packets that are not processed by SecureXL and are sent to the Firewall kernel for inspection. Accelerated Path is the path that handles packets that are processed by SecureXL and bypass the Firewall kernel. Medium Path is the path that handles packets that are partially processed by SecureXL and partially by the Firewall kernel1. References: Check Point R81 Performance Tuning Administration Guide