CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 591:

  At what point is the Internal Certificate Authority (ICA) created?

  A. Upon creation of a certificate.
  B. During the primary Security Management Server installation process.
  C. When an administrator decides to create one.
  D. When an administrator initially logs into SmartConsole.
  B. During the primary Security Management Server installation process.

  ---

  Explanation/Reference:

  The Internal Certificate Authority (ICA) is created during the primary Security Management Server installation process. The ICA is responsible for issuing and managing certificates for all Check Point components in the network. The ICA is automatically installed as an integral part of the Security Management Server and can be managed from SmartConsole. References: R81 Security Management Administration Guide, page 113.

• Question 592:

  John detected high load on sync interface. Which is most recommended solution?

  A. For FTP connections ?do not sync
  B. Add a second interface to handle sync traffic
  C. For short connections like http service ?do not sync
  D. For short connections like icmp service ?delay sync for 2 seconds
  A. For FTP connections ?do not sync

  ---

  Explanation/Reference:

  The most recommended solution for high load on sync interface is to exclude FTP connections from synchronization. This is because FTP connections are usually long- lived and consume a lot of bandwidth and resources on the sync interface. By excluding FTP connections from synchronization, the load on the sync interface can be reduced and the performance of the cluster can be improved. References: Synchronization Optimization

• Question 593:

  What are the three SecureXL Templates available in R81.20?

  A. PEP Templates. QoS Templates. VPN Templates
  B. Accept Templates. Drop Templates. NAT Templates
  C. Accept Templates. Drop Templates. Reject Templates
  D. Accept Templates. PDP Templates. PEP Templates
  B. Accept Templates. Drop Templates. NAT Templates

  ---

  Explanation/Reference:

  SecureXL is a technology that improves the performance of the Security Gateway by offloading CPU-intensive operations to a dedicated hardware or software module. SecureXL uses templates to accelerate traffic processing based on

  predefined patterns and conditions. SecureXL supports three types of templates: Accept Templates, Drop Templates, and NAT Templates3. Accept Templates are used to accelerate traffic that matches an Accept rule in the Security Policy.

  Accept Templates bypass most of the inspection stages and send packets directly to the network interface. Drop Templates are used to accelerate traffic that matches a Drop rule in the Security Policy. Drop Templates drop packets without

  sending them to the firewall kernel for inspection. NAT Templates are used to accelerate traffic that requires Network Address Translation (NAT). NAT Templates perform NAT operations without sending packets to the firewall kernel.

  Therefore, the correct answer is B.

  References: 3: SecureXL for R80.20 and higher

• Question 594:

  The SmartEvent R81 Web application for real-time event monitoring is called:

  A. SmartView Monitor
  B. SmartEventWeb
  C. There is no Web application for SmartEvent
  D. SmartView
  B. SmartEventWeb

  ---

  Explanation/Reference:

  The SmartEvent R81 Web application for real-time event monitoring is called SmartEventWeb. SmartEventWeb is a web-based interface that allows administrators to view and analyze security events from various sources, such as logs, reports, incidents, and indicators. SmartEventWeb provides dashboards, widgets, filters, and drill-down options to help administrators gain insights into their security posture. The other options are either incorrect or refer to different applications.

• Question 595:

  Native Applications require a thin client under which circumstances?

  A. If you want to use a legacy 32-Bit Windows OS
  B. If you want to use a VPN Client that is not officially supported by the underlying operating system
  C. If you want to have assigned a particular Office Mode IP address.
  D. If you are about to use a client (FTP. RDP, ...) that is installed on the endpoint.
  D. If you are about to use a client (FTP. RDP, ...) that is installed on the endpoint.

  ---

  Explanation/Reference:

  Native Applications require a thin client under the circumstance that you are about to use a client (FTP, RDP, etc.) that is installed on the endpoint. A thin client is a lightweight software component that enables secure connectivity for native applications without requiring additional configuration or user intervention. A thin client is automatically downloaded and installed on the endpoint when a user initiates a native application session through Mobile Access Portal or SNX Portal. References: [Check Point Security Expert R81 Mobile Access Administration Guide], page 16.

• Question 596:

  Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

  A. Yes, but they need to have a mutually trusted certificate authority
  B. Yes, but they have to have a pre-shared secret key
  C. No, they cannot share certificate authorities
  D. No, Certificate based VPNs are only possible between Check Point devices
  A. Yes, but they need to have a mutually trusted certificate authority

  ---

  Explanation/Reference:

  Check Point and Third-party Gateways can establish a certificate-based Site-to-Site VPN tunnel if they have a mutually trusted certificate authority. This means that both gateways trust the same root CA or intermediate CA that issued their certificates. This way, they can authenticate each other using their certificates and establish a secure VPN tunnel. References: Check Point Resource Library, page 5

• Question 597:

  Which command shows the current connections distributed by CoreXL FW instances?

  A. fw ctl multik stat
  B. fw ctl affinity -l
  C. fw ctl instances -v
  D. fw ctl iflist
  A. fw ctl multik stat

  ---

  Explanation/Reference:

  CoreXL is a performance-enhancing technology that enables the processing CPU cores to concurrently perform multiple tasks on Security Gateways with multiple CPU cores. CoreXL replicates the Firewall kernel multiple times, creating multiple Firewall instances that run on different CPU cores. These Firewall instances handle traffic concurrently, and each Firewall instance is a complete and independent Firewall inspection kernel. To show the current connections distributed by CoreXL FW instances, you can use the command fw ctl multik stat on the Security Gateway. This command will display information such as the number of connections, packets, bytes, drops, and errors handled by each CoreXL FW instance, as well as the CPU utilization and affinity of each instance. The other options are not correct because:

  B. fw ctl affinity -l: This command will show the CPU affinity of all processes and IRQs on the Security Gateway. It will not show the current connections distributed by CoreXL FW instances. C. fw ctl instances -v: This command will show the details of all CoreXL FW instances on the Security Gateway, such as their ID, type, state, priority, and interfaces. It will not show the current connections distributed by CoreXL FW instances.

  D. fw ctl iflist: This command will show the list of all interfaces on the Security Gateway, along with their names References: Part 3 - SecureXL, What is CoreXL and SecureXL, SecureXL Fast Accelerator (fw fast_accel) for R80.20 and above

• Question 598:

  What is the correct command to observe the Sync traffic in a VRRP environment?

  A. fw monitor "accept[12:4,b]=224.0.0.18;"
  B. fw monitor "accept port(6118;"
  C. fw monitor "accept proto=mcVRRP;"
  D. fw monitor "accept dst=224.0.0.18;"
  D. fw monitor "accept dst=224.0.0.18;"

  ---

  Explanation/Reference:

  The correct command to observe the Sync traffic in a VRRP environment is fw monitor "accept dst=224.0.0.18;". This command captures the packets that have the destination IP address of 224.0.0.18, which is the multicast address used by VRRP for synchronization. The other commands are either not valid or not specific to VRRP Sync traffic. References: [Check Point R81 ClusterXL Administration Guide], Check Point R81 Performance Tuning Administration Guide

• Question 599:

  With Mobile Access enabled, administrators select the web-based and native applications that can be accessed by remote users and define the actions that users can perform the applications. Mobile Access encrypts all traffic using:

  A. HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender.
  B. HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, they need to install the SSL Network Extender.
  C. HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, no additional software is required.
  D. HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, no additional software is required.
  A. HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender.

  ---

  Explanation/Reference:

  Mobile Access encrypts all traffic using HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender, which is a lightweight VPN client that creates a secure SSL tunnel to the Mobile Access gateway. The SSL Network Extender supports various types of native applications, such as email clients, file sharing, and remote desktop. References: Mobile Access Administration Guide, SSL Network Extender

• Question 600:

  How do Capsule Connect and Capsule Workspace differ?

  A. Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications.
  B. Capsule Workspace can provide access to any application.
  C. Capsule Connect provides Business data isolation.
  D. Capsule Connect does not require an installed application at client.
  A. Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications.

  ---

  Explanation/Reference:

  Capsule Connect and Capsule Workspace are both components of Check Point's remote access solution, but they serve different purposes and have distinct features:

  A. Capsule Connect provides a Layer 3 VPN, which allows remote users to connect securely to their corporate network. It typically provides network-level access, allowing users to access resources on the corporate network. On the other hand, Capsule Workspace provides a secure workspace environment, including a virtual desktop with usable applications. It is more focused on providing application-level access to users in a secure manner.

  B. This statement is partially true. Capsule Workspace is designed to provide secure access to a wide range of applications and resources, not limited to specific applications.

  C. Capsule Connect does provide business data isolation by creating a secure VPN tunnel for remote users, ensuring that their network traffic is isolated from the public internet.

  D. Capsule Connect usually requires an installed application or VPN client on the client device to establish a secure connection to the corporate network. This statement is not entirely accurate because an installed application or client is typically required.

  Therefore, option A is the correct answer as it accurately distinguishes between Capsule Connect and Capsule Workspace based on their primary functionalities. References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.