CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 551:

  Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?

  A. Synchronized
  B. Never been synchronized
  C. Lagging
  D. Collision
  D. Collision

  ---

  Explanation/Reference:

  The least ideal Synchronization Status for Security Management Server High Availability deployment is Collision. This status indicates that both members have modified the same object independently, resulting in a conflict that needs to be resolved manually. The other statuses are either normal or indicate a temporary delay in synchronization. References: High Availability Administration Guide

• Question 552:

  In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with ____________ will not apply.

  A. ffff
  B. 1
  C. 2
  D. 3
  B. 1

  ---

  Explanation/Reference:

  In the Check Point Firewall Kernel Module, each kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with 1 will not apply, as they are related to NAT, VPN, or other features that are not supported in Wire Mode. Wire Mode is a mode of operation that allows transparent traffic forwarding without any inspection or modification by the firewall. References: Check Point Security Expert R81 Course, Wire Mode Configuration Guide

• Question 553:

  Fill in the blank: An Endpoint identity agent uses a________ for user authentication.

  A. Shared secret
  B. Username/password or Kerberos Ticket
  C. Token
  D. Certificate
  B. Username/password or Kerberos Ticket

  ---

  Explanation/Reference:

  An Endpoint Identity Agent is a software component that runs on the user's device and communicates with the Check Point gateway to provide user identity information. An Endpoint Identity Agent can use different methods for user authentication, such as username/password, Kerberos ticket, or certificate. However, the most common and recommended method is username/password or Kerberos ticket, which allows the user to log in to the device with their domain credentials and automatically authenticate with the gateway without entering additional credentials. This method also supports Single Sign-On (SSO) and Multi-Factor Authentication (MFA) features. The references are: Check Point R81 Identity Awareness Administration Guide, page 15 Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 14 Endpoint Identity Agent - Check Point CheckMates

• Question 554:

  What is the base level encryption key used by Capsule Docs?

  A. RSA 2048
  B. RSA 1024
  C. SHA-256
  D. AES
  A. RSA 2048

  ---

  Explanation/Reference:

  The base level encryption key used by Capsule Docs is RSA 2048. This means that Capsule Docs uses a 2048-bit RSA public key encryption algorithm to encrypt and decrypt documents. RSA is an asymmetric encryption algorithm that uses two keys: a public key that can be shared with anyone, and a private key that must be kept secret. AES, SHA-256, and RSA 1024 are not the base level encryption keys used by Capsule Docs. References: : Check Point Software, Getting Started, Capsule Docs Encryption.

• Question 555:

  What does Backward Compatibility mean upgrading the Management Server and how can you check it?

  A. The Management Server is able to manage older Gateways. The lowest supported version is documented in the Installation and Upgrade Guide
  B. The Management Server is able to manage older Gateways The lowest supported version is documented in the Release Notes
  C. You will be able to connect to older Management Server with the SmartConsole. The lowest supported version is documented in the Installation and Upgrade Guide
  D. You will be able to connect to older Management Server with the SmartConsole The lowest supported version is documented in the Release Notes
  B. The Management Server is able to manage older Gateways The lowest supported version is documented in the Release Notes

  ---

  Explanation/Reference:

  Backward Compatibility means that the Management Server is able to manage older Gateways. The lowest supported version is documented in the Release Notes of each version. The Installation and Upgrade Guide only provides information about how to install or upgrade the Management Server and the Gateways, not about the compatibility between them. References: Check Point R81 Release Notes, page 6.

• Question 556:

  You have used the "set inactivity-timeout 120" command to prevent the session to be disconnected after 10 minutes of inactivity. However, the Web session is being disconnected after 10 minutes. Why?

  A. The idle timeout for the web session is specified with the "set web session-timeout" command.
  B. The number specified is the amount of the idle timeout in seconds rather than in minutes. So you have to use the command "set inactivity-timeout 600" instead.
  C. Probably, you have forgotten to make sure that nobody is accessing the management server via the SmartConsole which locks the management database.
  D. The number of minutes is correct. Probably, you have forgotten to save this setting with the "save config" command.
  A. The idle timeout for the web session is specified with the "set web session-timeout" command.

  ---

  Explanation/Reference:

  The reason why the web session is being disconnected after 10 minutes is that the idle timeout for the web session is specified with the "set web session-timeout" command, not the "set inactivity-timeout" command. The "set inactivity-

  timeout" command only affects the CLI session, not the web session. To prevent the web session from being disconnected after 10 minutes of inactivity, you need to use the "set web session-timeout" command with a higher value than 10

  minutes.

  References: [Check Point Security Expert R81 Administration Guide], page 77.

• Question 557:

  The ____ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

  A. Next Generation Threat Prevention
  B. Next Generation Threat Emulation
  C. Next Generation Threat Extraction
  D. Next Generation Firewall
  B. Next Generation Threat Emulation

  ---

  Explanation/Reference:

  The software blade package that uses CPU-level and OS-level sandboxing in order to detect and block malware is the Next Generation Threat Emulation. This package is part of the Check Point SandBlast Zero-Day Protection solution, which protects organizations against unknown malware, zero-day threats and targeted attacks, and prevents infections from undiscovered exploits1. CPU-level and OS-level sandboxing are two techniques that Check Point uses to analyze files and objects for malicious behavior. CPU-level inspection is a unique technology that detects malware at the pre-infection stage by examining the CPU instructions that the file executes. This allows Check Point to identify and block malware that tries to evade detection by using obfuscation, encryption, or polymorphism12. OS-level sandboxing is a complementary technology that runs files and objects in a virtualized environment and monitors their behavior for malicious indicators. This allows Check Point to detect and block malware that tries to exploit vulnerabilities in the operating system or applications, or that performs malicious actions such as downloading additional payloads, modifying system settings, or communicating with command and control servers12. Therefore, the correct answer is B. The Next Generation Threat Emulation software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware. References: 1, Understanding SandBlast - Check Point Software Technologies 2, HOW TO CHOOSE YOUR NEXT SANDBOXING SOLUTION - Check Point Software 3, CHECK POINT + SERVICENOW 4, Check Point Quantum Edge Datasheet

• Question 558:

  Which Identity Source(s) should be selected in Identity Awareness for when there is a requirement for a higher level of security for sensitive servers?

  A. Endpoint Identity Agent and Browser-Based Authentication
  B. AD Query
  C. Terminal Servers Endpoint Identity Agent
  D. RADIUS and Account Logon
  A. Endpoint Identity Agent and Browser-Based Authentication

  ---

  Explanation/Reference:

• Question 559:

  Please choose correct command to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI?

  A. host name myHost12 ip-address 10.50.23.90
  B. mgmt: add host name ip-address 10.50.23.90
  C. add host name emailserver1 ip-address 10.50.23.90
  D. mgmt: add host name emailserver1 ip-address 10.50.23.90
  D. mgmt: add host name emailserver1 ip-address 10.50.23.90

  ---

  Explanation/Reference:

  The correct command to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI is mgmt: add host name emailserver1 ip-address 10.50.23.90. This command will create a new host object in the Security Management Server database, with the specified name and IP address. The mgmt: prefix indicates that the command is executed on the Security Management Server, and not on the local GAiA machine. The other commands are either missing the mgmt: prefix, or have incorrect syntax or parameters.

• Question 560:

  In CoreXL, the Firewall kernel is replicated multiple times. Each replicated copy or instance can perform the following:

  A. The Firewall kernel only touches the packet if the connection is accelerated
  B. The Firewall kernel is replicated only with new connections and deletes itself once the connection times out
  C. The Firewall can run the same policy on all cores
  D. The Firewall can run different policies per core
  C. The Firewall can run the same policy on all cores

  ---

  Explanation/Reference:

  CoreXL is a performance-enhancing technology that enables the Security Gateway to utilize multiple CPU cores for processing traffic. CoreXL creates multiple instances of the Firewall kernel, each running on a separate CPU core. Each Firewall instance can handle traffic concurrently and independently, applying the same security policy to the packets that are assigned to it. CoreXL does not allow different policies per core, as this would create inconsistency and complexity in the security enforcement. The references are: Best Practices - Security Gateway Performance Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 16 Check Point R81 Quantum Security Gateway Guide, page 42