CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 601:

  Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal website, file share and emails?

  A. Check Point Remote User
  B. Check Point Capsule Workspace
  C. Check Point Mobile Web Portal
  D. Check Point Capsule Remote
  C. Check Point Mobile Web Portal

  ---

  Explanation/Reference:

  Check Point Mobile Web Portal is a Mobile Access Application that allows a secure container on mobile devices to give users access to internal websites, file shares and emails. The Mobile Web Portal is a web-based application that can be accessed from any browser on any device. It provides a user-friendly interface to access various resources on the corporate network without requiring a VPN client or additional software installation. The Mobile Web Portal supports authentication methods such as user name and password, certificate, one-time password (OTP), etc. The Mobile Web Portal also supports security features such as encryption, data leakage prevention (DLP), threat prevention, etc. References: R81 Mobile Access Administration Guide

• Question 602:

  Joey wants to upgrade from R75.40 to R81 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.

  What is one of the requirements for his success?

  A. Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine
  B. Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine
  C. Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR/log directory on the source machine
  D. Size of the /var/log folder of the target machine must be at least 25GB or more
  B. Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine

  ---

  Explanation/Reference:

  One of the requirements for Joey's success in upgrading from R75.40 to R81 version of Security management using Advanced Upgrade with Database Migration method is that the size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine. Advanced Upgrade with Database Migration method is a procedure that allows administrators to upgrade their Security Management Server to a newer version by migrating their database from an older version to a new machine with a fresh installation of the newer version. One of the steps in this procedure is to copy the /var/log folder from the source machine to the target machine, which contains important log files and configuration files. To ensure that there is enough disk space on the target machine for this operation, it is required that the size of the /var/log folder on the target machine must be at least 25% of the size of the /var/log folder on the source machine.

• Question 603:

  Why would an administrator see the message below?

  

  A. A new Policy Package created on both the Management and Gateway will be deleted and must be backed up first before proceeding.
  B. A new Policy Package created on the Management is going to be installed to the existing Gateway.
  C. A new Policy Package created on the Gateway is going to be installed on the existing Management.
  D. A new Policy Package created on the Gateway and transferred to the Management will be overwritten by the Policy Package currently on the Gateway but can be restored from a periodic backup on the Gateway.
  B. A new Policy Package created on the Management is going to be installed to the existing Gateway.

  ---

  Explanation/Reference:

  A Policy Package is a set of rules and settings that define how a Security Gateway enforces security on traffic that passes through it. A Policy Package can be created on either the Management Server or the Security Gateway, but it must be

  installed on both to take effect. When a new Policy Package is created on the Management Server, it must be installed on an existing Security Gateway that has a different Policy Package installed. The message below warns the administrator

  that installing a new Policy Package will overwrite the existing one on the Security Gateway.

  https://www.bing.com/images/blob?bcid=qMoRhR0dzSkGmg The message also advises the administrator to back up their existing configuration before proceeding with the installation.

• Question 604:

  Which command can you use to verify the number of active concurrent connections?

  A. fw conn all
  B. fw ctl pstat
  C. show all connections
  D. show connections
  B. fw ctl pstat

  ---

  Explanation/Reference:

  The command fw ctl pstat can be used to verify the number of active concurrent connections on a gateway. This command displays various statistics about the firewall kernel, such as memory usage, CPU utilization, packet rates, and connection table information. The output of this command includes a line that shows the current number of connections and the peak number of connections since the last reboot. For example:

  

  This means that there are currently 1234 active connections out of a maximum of 8192 connections, which is 15% of the connection table capacity. The peak number of connections since the last reboot was 2345.

• Question 605:

  What is true about VRRP implementations?

  A. VRRP membership is enabled in cpconfig
  B. VRRP can be used together with ClusterXL, but with degraded performance
  C. You cannot have a standalone deployment
  D. You cannot have different VRIDs in the same physical network
  C. You cannot have a standalone deployment

• Question 606:

  Which is not a blade option when configuring SmartEvent?

  A. Correlation Unit
  B. SmartEvent Unit
  C. SmartEvent Server
  D. Log Server
  B. SmartEvent Unit

  ---

  Explanation/Reference:

  SmartEvent Unit is not a blade option when configuring SmartEvent. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules. SmartEvent Unit is not a valid component or blade of SmartEvent.

• Question 607:

  Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

  A. UserCheck
  B. Active Directory Query
  C. Account Unit Query
  D. User Directory Query
  B. Active Directory Query

  ---

  Explanation/Reference:

  Active Directory Query is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers by querying domain controllers for security event logs. The Security Gateway sends a WMI query to each domain controller and receives a WMI event when a user logs in, logs out, or unlocks their computer. The Security Gateway then maps IP addresses to user names based on these events. Active Directory Query does not require any software installation on domain controllers or clients, but it requires certain permissions and configurations on the domain controllers Reference : https://sc1.checkpoint.com/documents/R76/CP_R76_IdentityAwareness_AdminGuide/62402.htm

• Question 608:

  What are the correct steps upgrading a HA cluster (M1 is active, M2 is passive) using Multi- Version Cluster(MVC)Upgrade?

  A. 1) Enable the MVC mechanism on both cluster members #cphaprob mvc on 2) Upgrade the passive node M2 to R81.20 3) In SmartConsole, change the version of the cluster object 4) Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism
  B. 1) Enable the MVC mechanism on both cluster members #cphaprob mvc on 2) Upgrade the passive node M2 to R81.20 3) In SmartConsole, change the version of the cluster object 4) Install the Access Control Policy 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy
  C. 1) In SmartConsole, change the version of the cluster object 2) Upgrade the passive node M2 to R81.20 3) Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 #cphaconf mvc on 4) Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy SmartConsole, change the version of the cluster object
  D. 1) Upgrade the passive node M2 to R81.20 2) Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 #cphaconf mvc on 3) In SmartConsole, change the version of the cluster object 4) Install the Access Control Policy 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy upgrade the passive node M2 to R81.20
  C. 1) In SmartConsole, change the version of the cluster object 2) Upgrade the passive node M2 to R81.20 3) Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 #cphaconf mvc on 4) Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy SmartConsole, change the version of the cluster object

  ---

  Explanation/Reference:

  The correct steps upgrading a HA cluster (M1 is active, M2 is passive) using Multi-Version Cluster (MVC) Upgrade are: In SmartConsole, change the version of the cluster object to R81.20. Upgrade the passive node M2 to R81.20 using CPUSE or CLI. Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 using the command cphaconf mvc on. Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails by selecting Continue installing on other Gateways in the Policy Installation Settings dialog box. After examining the cluster states using cphaprob stat and verifying that both members are synchronized, upgrade node M1 to R81.20 using CPUSE or CLI. On each Cluster Member, disable the MVC mechanism using the command cphaconf mvc off and Install the Access Control Policy3. References: Check Point R81 Installation and Upgrade Guide

• Question 609:

  What is the purpose of extended master key extension/session hash?

  A. UDP VOIP protocol extension
  B. In case of TLS1.x it is a prevention of a Man-in-the-Middle attack/disclosure of the client- server communication
  C. Special TCP handshaking extension
  D. Supplement DLP data watermark
  B. In case of TLS1.x it is a prevention of a Man-in-the-Middle attack/disclosure of the client- server communication

  ---

  Explanation/Reference:

  The extended master key extension/session hash is a feature introduced in TLS 1.3 to prevent a Man-in-the-Middle attack/disclosure of the client-server communication. It works by generating a unique session hash for each connection, which is derived from the master key and other parameters. This session hash is then used to authenticate the application data and the end-of-handshake messages, ensuring that no one can tamper with or eavesdrop on the communication. References: Check Point Security Expert R81 Course, TLS 1.3 RFC

• Question 610:

  Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .

  A. The license is attached to the wrong Security Gateway.
  B. The existing license expires.
  C. The license is upgraded.
  D. The IP address of the Security Management or Security Gateway has changed.
  A. The license is attached to the wrong Security Gateway.
  C. The license is upgraded.
  D. The IP address of the Security Management or Security Gateway has changed.