CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 581:

  Bob needs to know if Alice was configuring the new virtual cluster interface correctly. Which of the following Check Point commands is true?

  A. cphaprob-aif
  B. cp hap rob state
  C. cphaprob list
  D. probcpha -a if
  A. cphaprob-aif

  ---

  Explanation/Reference:

  You can use the cphaprob -a if command to check the status of the virtual cluster interface1. This command displays the state, virtual IP address, and physical IP address of each cluster interface2. It also shows the load balancing method,

  the load on each interface, and the active member for each interface2. This command can help you verify that Alice configured the virtual cluster interface correctly and that it is working properly. To run this command, you need to access the

  cluster member in Clish and run cphaprob -a if1.

  References: How to configure ClusterXL in Load Sharing Unicast mode - Check Point Software, cphaprob -a if - Check Point Software

• Question 582:

  How long may verification of one file take for Sandblast Threat Emulation?

  A. up to 1 minutes
  B. within seconds cleaned file will be provided
  C. up to 5 minutes
  D. up to 3 minutes
  A. up to 1 minutes
  B. within seconds cleaned file will be provided
  D. up to 3 minutes

• Question 583:

  How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

  A. Install appliance TE250X on SpanPort on LAN switch in MTA mode.
  B. Install appliance TE250X in standalone mode and setup MTA.
  C. You can utilize only Check Point Cloud Services for this scenario.
  D. It is not possible, always Check Point SGW is needed to forward emails to SandBlast appliance.
  C. You can utilize only Check Point Cloud Services for this scenario.

  ---

  Explanation/Reference:

  To deploy a TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway, you can utilize Check Point Cloud Services. In this scenario, you can leverage cloud-based email security services provided by Check Point without the need for an on-premises Security Gateway.

  Option C correctly states that you can use only Check Point Cloud Services for this scenario, making it the verified answer.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 584:

  Fill in the blanks: Gaia can be configured using the ______ or _____ .

  A. GaiaUI; command line interface
  B. WebUI; Gaia Interface
  C. Command line interface; WebUI
  D. Gaia Interface; GaiaUI
  C. Command line interface; WebUI

  ---

  Explanation/Reference:

  Gaia can be configured using the command line interface (CLI) or the WebUI. The CLI is a text-based interface that allows users to enter commands and view responses in a terminal window. The CLI can be accessed through a console connection, an SSH connection, or a Telnet connection. The WebUI is a graphical interface that allows users to configure Gaia settings through a web browser. The WebUI can be accessed by entering the IP address of the Gaia device in the browser's address bar.

• Question 585:

  By default, what type of rules in the Access Control rulebase allow the control connections?

  A. Implicit Rules
  B. Explicitly Implied Rules
  C. Implied Rules
  D. Explicit Rules
  C. Implied Rules

• Question 586:

  How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

  A. cphaprob set int fwha_vmac_global_param_enabled 1
  B. clusterXL set int fwha_vmac_global_param_enabled 1
  C. fw ctl set int fwha_vmac_global_param_enabled 1
  D. cphaconf set int fwha_vmac_global_param_enabled 1
  C. fw ctl set int fwha_vmac_global_param_enabled 1

  ---

  Explanation/Reference:

  To enable VMAC mode on a cluster member, you need to set the value of the global kernel parameter fwha_vmac_global_param_enabled to 1. This can be done on- the-fly using the command fw ctl set int fwha_vmac_global_param_enabled 1 on all cluster members. This command does not require a reboot or a policy installation. VMAC mode allows the cluster to use a virtual MAC address for its virtual IP addresses, which reduces the number of gratuitous ARP packets sent upon failover and avoids ARP cache issues on some routers and switches. References: How to enable ClusterXL Virtual MAC (VMAC) mode

• Question 587:

  Which of the following cannot be configured in an Access Role Object?

  A. Networks
  B. Machines
  C. Users
  D. Time
  D. Time

  ---

  Explanation/Reference:

  The verified answer is D. Time.

  An Access Role object is a logical representation of a set of users, machines, or networks that can be used in the security policy1. An Access Role object can include the following components1:

  Networks: IP addresses or network objects that define the source or destination of the traffic.

  Machines: Specific hosts or machine groups that are identified by their MAC addresses or certificates.

  Users: Specific users or user groups that are authenticated by one or more identity sources, such as Active Directory, LDAP, or Identity Awareness. Time is not a component of an Access Role object, and it cannot be configured in it. Time is

  a separate object type that can be used to define the validity period of a rule or a policy2.

  References:

  LDAP group vs Access role objects - Check Point CheckMates3 THE IMPORTANCE OF ACCESS ROLES - Check Point Software1 Time Objects - Check Point Software2

• Question 588:

  CoreXL is NOT supported when one of the following features is enabled: (Choose three)

  A. Route-based VPN
  B. IPS
  C. IPv6
  D. Overlapping NAT
  A. Route-based VPN
  C. IPv6
  D. Overlapping NAT

  ---

  Explanation/Reference:

  CoreXL is not supported when one of the following features is enabled:

  Check Point QoS (Quality of Service), Route-based VPN, IPv6 on IPSO, or Overlapping NAT. CoreXL is a performance-enhancing technology that allows multiple CPU cores to concurrently handle network traffic. IPS is supported by CoreXL

  and can benefit from its acceleration. References: : Check Point Software, Getting Started, CoreXL; : Check Point Software, Getting Started, IPS.

• Question 589:

  Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

  A. AV issues
  B. VPN errors
  C. Network traffic issues
  D. Authentication issues
  C. Network traffic issues

  ---

  Explanation/Reference:

  The "fw monitor" tool can be best used to troubleshoot network traffic issues. Fw monitor is a tool that allows administrators to capture packets at different inspection points in the Firewall kernel, and apply filters and flags to analyze the traffic. Fw monitor can help troubleshoot network connectivity problems, packet drops, NAT issues, VPN issues, and more. The other options are either not related or less suitable for fw monitor.

• Question 590:

  What is the purpose of the command "ps aux | grep twd"?

  A. You can check the Process ID and the processing time of the twd process.
  B. You can convert the log file into Post Script format.
  C. You can list all Process IDs for all running services.
  D. You can check whether the IPS default setting is set to Detect or Prevent mode
  A. You can check the Process ID and the processing time of the twd process.

  ---

  Explanation/Reference:

  The command "ps aux | grep twd" is used to check the process ID and the processing time of the twd process on the Security Gateway. The ps command displays information about the active processes on the system. The aux option shows

  all processes for all users, including those without a controlling terminal. The grep command filters the output of the ps command by searching for the pattern "twd", which is the name of the process that handles VPN traffic encryption and

  decryption1. The output of the command shows the process ID, CPU usage, memory usage, start time, and other details of the twd process2. Therefore, the correct answer is A.

  References: 1: [Check Point Processes and Daemons] 2: [How to troubleshoot VPN issues with cpview utility]