CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 51:

  What are the steps to configure the HTTPS Inspection Policy?

  A. Go to ManageandSettings > Blades > HTTPS Inspection > Configure in SmartDashboard
  B. Go to Applicationandurl filtering blade > Advanced > Https Inspection > Policy
  C. Go to ManageandSettings > Blades > HTTPS Inspection > Policy
  D. Go to Applicationandurl filtering blade > Https Inspection > Policy
  A. Go to ManageandSettings > Blades > HTTPS Inspection > Configure in SmartDashboard

  ---

  Explanation/Reference:

  The correct steps to configure the HTTPS Inspection Policy in Check Point R81 are as follows1:

  Go to ManageandSettings > Blades > HTTPS Inspection > Configure in SmartDashboard.

  Enable HTTPS Inspection and select the Policy tab. Create a new HTTPS Inspection Layer or edit an existing one. Define the rules for inspecting HTTPS traffic based on the source, destination, service, and action.

  Install the policy on the relevant gateways.

  The other options are incorrect because they either use wrong blade names, wrong menu options, or wrong configuration steps. References: 1: LAB:25 How to Configure HTTPS Inspection in Check Point Firewall R81(https://

  www.youtube.com/watch?v=NCvV7-R9ZgU)

• Question 52:

  Which CLI command will reset the IPS pattern matcher statistics?

  A. ips reset pmstat
  B. ips pstats reset
  C. ips pmstats refresh
  D. ips pmstats reset
  D. ips pmstats reset

  ---

  Explanation/Reference:

  The CLI command to reset the IPS (Intrusion Prevention System) pattern matcher statistics is option D: ips pmstats reset. This command will reset the statistics related to the IPS pattern matcher.

  Options A, B, and C are not the correct syntax for resetting the IPS pattern matcher statistics. References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 53:

  What is the least amount of CPU cores required to enable CoreXL?

  A. 2
  B. 1
  C. 4
  D. 6
  A. 2

  ---

  Explanation/Reference:

  The least amount of CPU cores required to enable CoreXL is 2. CoreXL is a technology that improves the performance of Security Gateways by using multiple CPU cores to process traffic in parallel. CoreXL requires at least two CPU cores, one for SND (Secure Network Distributor) and one for a Firewall instance. The other options are either too few or too many CPU cores for enabling CoreXL. References: [Check Point R81 SecureXL Administration Guide], [Check Point R81 Performance Tuning Administration Guide]

• Question 54:

  You have existing dbedit scripts from R77. Can you use them with R81.20?

  A. dbedit is not supported in R81.20
  B. dbedit is fully supported in R81.20
  C. You can use dbedit to modify threat prevention or access policies, but not create or modify layers
  D. dbedit scripts are being replaced by mgmt_cli in R81.20
  D. dbedit scripts are being replaced by mgmt_cli in R81.20

  ---

  Explanation/Reference:

  In R81.20, dbedit scripts are being replaced by the mgmt_cli utility for managing and configuring security policies and objects. Here's an explanation of each option:

  A. dbedit is not supported in R81.20: This is not entirely accurate. While dbedit is still available and functional in R81.20, it is being phased out in favor of mgmt_cli for policy and object management.

  B. dbedit is fully supported in R81.20: This statement is not accurate because although dbedit can still be used, it is not the primary recommended tool for policy management in R81.20.

  C. You can use dbedit to modify threat prevention or access policies, but not create or modify layers: This statement is partially true, but it does not provide the complete picture. You can use dbedit for some policy-related tasks, but it's not the primary tool for policy management in R81.20.

  D. dbedit scripts are being replaced by mgmt_cli in R81.20: This is the correct and recommended approach. mgmt_cli is the primary tool for managing security policies and objects in R81.20, and it is gradually replacing dbedit for these tasks.

  Therefore, option D is the most accurate and recommended answer.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 55:

  Which components allow you to reset a VPN tunnel?

  A. vpn tu command or SmartView monitor
  B. delete vpn ike sa or vpn she11 command
  C. vpn tunnelutil or delete vpn ike sa command
  D. SmartView monitor only
  A. vpn tu command or SmartView monitor

  ---

  Explanation/Reference:

  The vpn tu command and the SmartView Monitor are two components that allow you to reset a VPN tunnel. The vpn tu command is a command-line tool that lets you view and manage the status of VPN tunnels on a Security Gateway or cluster member. The SmartView Monitor is a graphical tool that lets you monitor the network and security performance, view VPN tunnel status, and reset VPN tunnels. Both components can be used to reset a VPN tunnel by selecting the option to delete IKE SA or IPsec SA for a specific peer or all peers. References: R81 VPN Administration Guide, page 29-30; R81 SmartConsole R81 Resolved Issues, sk170114

• Question 56:

  The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API command can he use in the script to achieve the requirement?

  A. add host name ip-address
  B. add hostname ip-address
  C. set host name ip-address
  D. set hostname ip-address
  A. add host name ip-address

  ---

  Explanation/Reference:

  The API command add host name ip-address can be used in a script to create 100 new host objects with different IP addresses. This command adds a new host object with the specified name and IP address to the database. The other commands are either not valid or not suitable for creating new host objects. References: Check Point - Management API reference

• Question 57:

  Automation and Orchestration differ in that:

  A. Automation relates to codifying tasks, whereas orchestration relates to codifying processes.
  B. Automation involves the process of coordinating an exchange of information through web service interactions such as XML and JSON, but orchestration does not involve processes.
  C. Orchestration is concerned with executing a single task, whereas automation takes a series of tasks and puts them all together into a process workflow.
  D. Orchestration relates to codifying tasks, whereas automation relates to codifying processes.
  A. Automation relates to codifying tasks, whereas orchestration relates to codifying processes.

  ---

  Explanation/Reference:

  Automation and Orchestration differ in that automation relates to codifying tasks, whereas orchestration relates to codifying processes. Automation is the process of converting manual tasks into executable scripts or programs that can be run by machines or software agents. Orchestration is the process of coordinating multiple automated tasks into a coherent workflow that achieves a desired outcome or goal. Orchestration can also involve integrating different systems, tools, and services through web service interactions such as XML and JSON. References: Check Point Security Expert R81 Course, Automation and Orchestration Administration Guide

• Question 58:

  In which scenario will an administrator need to manually define Proxy ARP?

  A. When they configure an "Automatic Static NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.
  B. When they configure an "Automatic Hide NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.
  C. When they configure a "Manual Static NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.
  D. When they configure a "Manual Hide NAT" which translates to an IP address that belongs to one of the firewall's interfaces.
  C. When they configure a "Manual Static NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.

  ---

  Explanation/Reference:

  Proxy ARP is a technique that allows a device to respond to ARP requests on behalf of another IP address. Proxy ARP is required for Manual Static NAT when the translated IP address does not belong to one of the firewall's interfaces. This is because the firewall needs to intercept the packets destined to the translated IP address and forward them to the original IP address after applying the NAT rule. Without Proxy ARP, the packets would not reach the firewall and the NAT would not work. Proxy ARP is not required for Automatic Static NAT or Automatic Hide NAT, because these types of NAT use IP addresses that belong to the firewall's interfaces. Proxy ARP is also not required for Manual Hide NAT, because this type of NAT does not change the destination IP address of the packets, only the source IP address. References: Check Point R81 Security Management Administration Guide, page 115

• Question 59:

  What is the correct order of the default "fw monitor" inspection points?

  A. i, o, l, O
  B. i, l, o, O
  C. 1, 2, 3, 4
  D. l, i, O, o
  B. i, l, o, O

  ---

  Explanation/Reference:

  https://community.checkpoint.com/t5/General-Topics/Check-Point-Inspection-points- iIoO/td-p/34938

  The default order of the "fw monitor" inspection points is:

  i (input): this is the first inspection point, where packets enter the firewall. l (local): this is the second inspection point, where packets are processed locally by the firewall, before being forwarded to the next hop. o (output): this is the third

  inspection point, where packets are sent out to their final destination.

  O (offload): this is the fourth inspection point, where packets are offloaded to hardware acceleration for faster processing.

• Question 60:

  As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

  A. That is used to deploy the mobile device as a generator of one-time passwords for authenticating to an RSA Authentication Manager.
  B. Fill Layer4 VPN SL VPN that gives users network access to all mobile applications.
  C. Full Layer3 VPN PSec VPN that gives users network access to all mobile applications.
  D. You can make sure that documents are sent to the intended recipients only.
  C. Full Layer3 VPN PSec VPN that gives users network access to all mobile applications.

  ---

  Explanation/Reference:

  The feature that provides Full Layer3 VPN PSec VPN, giving users network access to all mobile applications, is the correct answer.

  Capsule Connect/VPN is used to establish secure VPN connections for mobile devices, and the Full Layer3 VPN (IPSec VPN) option provides comprehensive network access.

  References: Check Point documentation or training materials related to Mobile Access Methods and VPN configurations.