CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 561:

  Which statement is WRONG regarding the usage of the Central Deployment in SmartConsole?

  A. You can install Hotfixes with the Central Deployment in SmartConsole
  B. You can install Jumbo Hotfix accumulators with the Central Deployment in SmartConsole.
  C. Only be installed Hotfixes can with the Central Deployment in SmartConsole
  D. You can upgrade your cluster without user intervention with the Central Deployment in SmartConsole from R80.40 to R81.20.
  C. Only be installed Hotfixes can with the Central Deployment in SmartConsole

  ---

  Explanation/Reference:

  The statement that is wrong regarding the usage of the Central Deployment in SmartConsole is that only be installed Hotfixes can with the Central Deployment in SmartConsole. This is wrong because Central Deployment can also be used to install Jumbo Hotfix accumulators, upgrade clusters, and perform other operations on multiple gateways simultaneously. Central Deployment simplifies and automates the deployment process and reduces human errors and downtime. References: [Check Point Security Expert R81 Administration Guide], page 23.

• Question 562:

  To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab. How many options are available to calculate the traffic direction?

  A. 5 Network; Host; Objects; Services; API
  B. 3 Incoming; Outgoing; Network
  C. 2 Internal; External
  D. 4 Incoming; Outgoing; Internal; Other
  D. 4 Incoming; Outgoing; Internal; Other

  ---

  Explanation/Reference:

  To help SmartEvent determine whether events originated internally or externally, you must define the traffic direction using the Initial Settings under General Settings in the Policy Tab. There are four options available to calculate the traffic direction: Incoming, Outgoing, Internal, and Other. Incoming means the source is external and the destination is internal. Outgoing means the source is internal and the destination is external. Internal means both the source and the destination are internal. Other means both the source and the destination are external. References: SmartEvent R81 Administration Guide

• Question 563:

  Secure Configuration Verification (SCV), makes sure that remote access client computers are configured in accordance with the enterprise Security Policy. Bob was asked by Alice to implement a specific SCV configuration but therefore Bob needs to edit and configure a specific Check Point file. Which location file and directory is true?

  A. $FWDIR/conf/client.scv
  B. $CPDIR/conf/local.scv
  C. $CPDIR/conf/client.svc
  D. $FWDIR/conf/local.scv
  D. $FWDIR/conf/local.scv

  ---

  Explanation/Reference:

  Secure Configuration Verification (SCV) is a feature that allows the Mobile Access Gateway to check the compliance of remote access clients with the enterprise security policy before granting them access to internal resources. SCV checks can be defined in a file named local.scv, which is located in the $FWDIR/conf directory on the Mobile Access Gateway1. The file can be edited manually or using the SCV Editor tool2. Therefore, the correct answer is D. References: 1: Secure Configuration Verification 2: SCV Editor

• Question 564:

  What is the port used for SmartConsole to connect to the Security Management Server?

  A. CPMI port 18191/TCP
  B. CPM port/TCP port 19009
  C. SIC port 18191/TCP
  D. https port 4434/TCP
  A. CPMI port 18191/TCP

  ---

  Explanation/Reference:

  The port used for SmartConsole to connect to the Security Management Server is CPMI port 18191/TCP. CPMI stands for Check Point Management Interface, which is a proprietary protocol that enables secure communication between the SmartConsole and the Security Management Server. CPMI uses SSL encryption and authentication to protect the data exchange. References: Check Point Security Expert R81 Course, SK52421 - Ports used by Check Point software

• Question 565:

  By default, how often does Threat Emulation update the engine on the Security Gateway?

  A. Once per day
  B. Once an hour
  C. Once a week
  D. Twice per day
  A. Once per day

  ---

  Explanation/Reference:

  By default, Threat Emulation updates the engine on the Security Gateway once per day. This is the recommended frequency for optimal performance and security. However, the admin can change the update frequency to a different value, such as once an hour, once a week, or twice per day, depending on the network needs and resources. The admin can also manually update the engine at any time using the SmartConsole or the command line interface. References: Threat Emulation Engine Release Updates - Check Point Software, Check Point R81.20 Gaia Fresh Install and upgrade

• Question 566:

  What is the valid range for VRID value in VRRP configuration?

  A. 1 - 254
  B. 1 - 255
  C. 0 - 254
  D. 0 - 255
  B. 1 - 255

  ---

  Explanation/Reference:

  The valid range for VRID value in VRRP configuration is 1 - 255. VRID stands for Virtual Router ID, and it is a number that identifies a virtual router in a VRRP cluster. A VRRP cluster consists of one or more routers that share a virtual IP address and provide redundancy and load balancing for network traffic. Each router in the cluster must have a unique VRID value, and the VRID value must match the VRID value configured on the interface that connects to the VRRP cluster. The VRID value can be any number from 1 to 255, inclusive.

• Question 567:

  Which method below is NOT one of the ways to communicate using the Management API's?

  A. Typing API commands using the "mgmt_cli" command
  B. Typing API commands from a dialog box inside the SmartConsole GUI application
  C. Typing API commands using Gaia's secure shell(clish)19+
  D. Sending API commands over an http connection using web-services
  D. Sending API commands over an http connection using web-services

  ---

  Explanation/Reference:

  The Management API supports three methods of communication: mgmt_cli command, SmartConsole GUI dialog box, and Gaia CLI. Sending API commands over an http connection using web-services is not a supported method. References: Check Point Management APIs

• Question 568:

  fwssd is a child process of which of the following Check Point daemons?

  A. fwd
  B. cpwd
  C. fwm
  D. cpd
  A. fwd

  ---

  Explanation/Reference:

  fwssd is a child process of fwd, which is the firewall daemon that handles policy installation, logging, and state synchronization. cpwd is the watchdog process that monitors and restarts other processes. fwm is the management server process that handles communication with GUI clients. cpd is the infrastructure daemon that handles SIC, licensing, and policy code generation. References: Check Point Processes Cheat Sheet ?LazyAdmins, Check Point R81 Gaia Administration Guide, Certified Security Expert (CCSE) R81.20 Course Overview

• Question 569:

  According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

  A. Firewall
  B. VPN
  C. IPS
  D. HTTPS
  C. IPS

  ---

  Explanation/Reference:

  According to out of the box SmartEvent policy, the blade that will automatically be correlated into events is IPS. IPS (Intrusion Prevention System) is a blade that detects and prevents network attacks by inspecting traffic and applying signatures and protections. SmartEvent correlates IPS logs into events based on predefined event definitions, such as IPS Attack, IPS Attack High Confidence, IPS Attack Critical Confidence, etc. The other blades are not automatically correlated into events by default, but they can be added to the SmartEvent policy manually. References: [SmartEvent Policy]

• Question 570:

  Where is the license for Check Point Mobile users installed?

  A. The Primary Gateway
  B. The Standby Gateway
  C. The Endpoint Server
  D. The Security Management Server
  D. The Security Management Server

  ---

  Explanation/Reference:

  The license for Check Point Mobile users is installed on the Security Management Server. Check Point Mobile is a client application that allows remote users to securely access corporate resources from their mobile devices. To use Check Point Mobile, you need to have a valid license for the Mobile Access Software Blade on the Security Management Server. The license determines the number of concurrent users that can connect to the Security Gateway using Check Point Mobile. You can view and manage the license from the SmartConsole or the CPUSE WebUI. For more information, you can refer to the Check Point R81 Mobile Access Blade Administration Guide1 or the Check Point Cybersecurity BootCamp R81.20 ?CCSAand; CCSE Training2.