CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 571:

  Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process:

  A. Allow GUI Client and management server to communicate via TCP Port 19001
  B. Allow GUI Client and management server to communicate via TCP Port 18191
  C. Performs database tasks such as creating, deleting, and modifying objects and compiling policy.
  D. Performs database tasks such as creating, deleting, and modifying objects and compiling as well as policy code generation.
  C. Performs database tasks such as creating, deleting, and modifying objects and compiling policy.

• Question 572:

  Security Checkup Summary can be easily conducted within:

  A. Summary
  B. Views
  C. Reports
  D. Checkups
  B. Views

  ---

  Explanation/Reference:

  Security Checkup Summary can be easily conducted within Views. Views is a feature in SmartConsole that allows you to create customized dashboards and reports based on various security data sources, such as logs, events, audit trails, and more. You can use Views to perform a Security Checkup Summary, which is a comprehensive analysis of your network security posture and potential risks. You can use predefined templates or create your own views to generate the summary. References: Check Point Security Expert R81 Course, Views Administration Guide

• Question 573:

  What is true about the IPS-Blade?

  A. In R81, IPS is managed by the Threat Prevention Policy
  B. In R81, in the IPS Layer, the only three possible actions are Basic, Optimized and Strict
  C. In R81, IPS Exceptions cannot be attached to "all rules"
  D. In R81, the GeoPolicy Exceptions and the Threat Prevention Exceptions are the same
  A. In R81, IPS is managed by the Threat Prevention Policy

  ---

  Explanation/Reference:

  In R81, IPS is managed by the Threat Prevention Policy. The Threat Prevention Policy is a unified policy that allows you to configure and enforce IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction settings in one place. References: Threat Prevention Administration Guide

• Question 574:

  What is the benefit of "tw monitor" over "tcpdump"?

  A. "fw monitor" reveals Layer 2 information, while "tcpdump" acts at Layer 3.
  B. "fw monitor" is also available for 64-Bit operating systems.
  C. With "fw monitor", you can see the inspection points, which cannot be seen in "tcpdump"
  D. "fw monitor" can be used from the CLI of the Management Server to collect information from multiple gateways.
  C. With "fw monitor", you can see the inspection points, which cannot be seen in "tcpdump"

  ---

  Explanation/Reference:

  The benefit of fw monitor over tcpdump is that with fw monitor, you can see the inspection points, which cannot be seen in tcpdump. Inspection points are the locations in the firewall kernel where packets are inspected by the security policy and other software blades. Fw monitor allows you to capture packets at different inspection points and see how they are processed by the firewall. Tcpdump, on the other hand, is a generic packet capture tool that only shows the packets as they enter or leave the network interface. References: Check Point Security Expert R81 Course, fw monitor, tcpdump

• Question 575:

  Which of the following process pulls application monitoring status?

  A. fwd
  B. fwm
  C. cpwd
  D. cpd
  C. cpwd
  D. cpd

• Question 576:

  What are the two high availability modes?

  A. Load Sharing and Legacy
  B. Traditional and New
  C. Active and Standby
  D. New and Legacy
  D. New and Legacy

  ---

  Explanation/Reference:

  The two high availability modes are New and Legacy. High availability (HA) is a feature that allows you to create a cluster of two or more Security Gateways that act as a single entity to provide redundancy and reliability for your network traffic. HA ensures that if one Security Gateway fails or becomes unavailable, another Security Gateway in the cluster takes over its role seamlessly and continues to process the traffic. HA also provides load balancing and synchronization of the cluster members. The New mode is the recommended mode for HA clusters, as it provides better performance, scalability, and stability than the Legacy mode. The New mode uses the ClusterXL mechanism to manage the cluster members and the state synchronization. The Legacy mode uses the High Availability Security Extension (HASE) mechanism to manage the cluster members and the state synchronization. The Legacy mode is supported for backward compatibility with older versions of Check Point products, but it has some limitations and disadvantages compared to the New mode.

• Question 577:

  Which Check Point software blade provides protection from zero-day and undiscovered threats?

  A. Firewall
  B. Threat Emulation
  C. Application Control
  D. Threat Extraction
  B. Threat Emulation

  ---

  Explanation/Reference:

  The Check Point software blade that provides protection from zero-day and undiscovered threats is Threat Emulation. Threat Emulation is a sandboxing technology that inspects files for malicious behavior in a virtual environment before they reach the end user. Threat Emulation can detect and block malware that tries to evade traditional signature-based solutions by using unknown or obfuscated techniques. Threat Emulation can also generate forensic reports and provide actionable intelligence on the malware origin and behavior.

• Question 578:

  For best practices, what is the recommended time for automatic unlocking of locked admin accounts?

  A. 20 minutes
  B. 15 minutes
  C. Admin account cannot be unlocked automatically
  D. 30 minutes at least
  D. 30 minutes at least

  ---

  Explanation/Reference:

  For best practices, the recommended time for automatic unlocking of locked admin accounts is 30 minutes at least. Admin accounts can be locked due to failed login attempts, password expiration, or manual locking by another admin. To prevent unauthorized access or brute force attacks, locked admin accounts should not be unlocked automatically too soon. The recommended minimum time for automatic unlocking is 30 minutes, which can be configured from the SmartConsole under Manage > Permissions and Administrators > Advanced > Unlock locked administrators after.

• Question 579:

  What is a best practice before starting to troubleshoot using the "fw monitor" tool?

  A. Run the command: fw monitor debug on
  B. Clear the connections table
  C. Disable CoreXL
  D. Disable SecureXL
  D. Disable SecureXL

  ---

  Explanation/Reference:

  A best practice before starting to troubleshoot using the fw monitor tool is to disable SecureXL. SecureXL is a performance acceleration solution that optimizes the packet flow through the Security Gateway. However, SecureXL can also bypass some inspection points and cause some packets to be invisible to fw monitor. Therefore, disabling SecureXL can ensure that fw monitor captures all the relevant packets for troubleshooting purposes. References: Check Point Security Expert R81 Course, fw monitor, SecureXL

• Question 580:

  What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

  A. Lagging
  B. Synchronized
  C. Never been synchronized
  D. Collision
  B. Synchronized

  ---

  Explanation/Reference:

  The most ideal Synchronization Status for Security Management Server High Availability deployment is Synchronized. Security Management Server High Availability deployment is a feature that allows two or more Security Management Servers to provide redundancy and load balancing for managing security policies and logs. Synchronization Status is a parameter that indicates how up-to-date the databases of the Security Management Servers are with each other. Synchronization Status can have one of the following values: Synchronized, Lagging, Never been synchronized, or Collision. Synchronized means that the databases of all Security Management Servers are identical and have no conflicts. This is the most ideal status as it ensures consistency and reliability of security management. Lagging means that one or more Security Management Servers have not received all the updates from other Security Management Servers, and their databases are outdated. Never been synchronized means that one or more Security Management Servers have never synchronized their databases with other Security Management Servers, and their databases are independent. Collision means that one or more Security Management Servers have received conflicting updates from other Security Management Servers, and their databases have discrepancies.