CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 611:

  There are 4 ways to use the Management API for creating host object with the Management API. Which one is NOT correct?

  A. Using cpconfig
  B. Using CLISH
  C. Using SmartConsole GUI console
  D. Using Web Services
  A. Using cpconfig

• Question 612:

  The admin is connected via ssh lo the management server. He wants to run a mgmt_dl command but got a Error 404 message. To check the listening ports on the management he runs netstat with the results shown below. What can be the cause for the issue?

  

  A. Wrong Management API Access setting^for Ihe client IP To correct it go to SmartConsole / Management and Settings / Blades / Management API and press "Advanced Settings..' and choose GUI clients or ALL IP's.
  B. The API didn't run on the default port check it with api status' and add '-port 4434' to the mgmt_clt command.
  C. The management permission in the user profile is mrssing. Go to SmartConsole / Management and Settings I Permissions and Administrators / Permission Profiles. Select the profile of the user and enable 'Management API Login' under Management Permissions
  D. The API is not running, the services shown by netstat are the gaia services. To start the API run 'api start'
  D. The API is not running, the services shown by netstat are the gaia services. To start the API run 'api start'

  ---

  Explanation/Reference:

  The error message "Error 404. The Management API server is not available. Please check that the Management API server is up and running." indicates that the API is not running on the Management Server. The netstat command shows that there is no process listening on port 4434, which is the default port for the API. To start the API, the command `api start' should be used. The other options are not relevant to this issue. References: Check Point R81 Installation and Upgrade Guide, page 18.

• Question 613:

  How would you enable VMAC Mode in ClusterXL?

  A. Cluster Object -> Edit -> ClusterXL and VRRP -> Use Virtual MAC
  B. fw ctl set int vmac_mode 1
  C. cphaconf vmac_mode set 1
  D. Cluster Object -> Edit -> Cluster Members -> Edit -> Use Virtual MAC
  A. Cluster Object -> Edit -> ClusterXL and VRRP -> Use Virtual MAC

  ---

  Explanation/Reference:

  To enable VMAC Mode in ClusterXL, you need to go to Cluster Object -> Edit -> ClusterXL and VRRP -> Use Virtual MAC. VMAC Mode is a feature that allows ClusterXL to use a virtual MAC address for cluster interfaces instead of physical MAC addresses. This simplifies the cluster configuration and avoids issues with MAC address flapping or spoofing on switches. References: [VMAC Mode]

• Question 614:

  Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.

  Which component of SandBlast protection is her company using on a Gateway?

  A. SandBlast Threat Emulation
  B. SandBlast Agent
  C. Check Point Protect
  D. SandBlast Threat Extraction
  D. SandBlast Threat Extraction

  ---

  Explanation/Reference:

  Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the

  file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.

  The component of SandBlast protection that her company is using on a Gateway is SandBlast Threat Extraction. SandBlast Threat Extraction is a software blade that provides protection against malicious files by removing potentially risky

  elements, such as macros, embedded objects, scripts, etc. The sanitized files are delivered to the users with a notification about the removed elements. SandBlast Threat Extraction can also reconstruct the original files after they are scanned

  by SandBlast Threat Emulation, which is another software blade that provides protection against malicious files by emulating them in a virtual sandbox and analyzing their behavior. References: R81 Threat Prevention Administration Guide,

  page 37.

• Question 615:

  Which of the following statements is TRUE about R81 management plug-ins?

  A. The plug-in is a package installed on the Security Gateway.
  B. Installing a management plug-in requires a Snapshot, just like any upgrade process.
  C. A management plug-in interacts with a Security Management Server to provide new features and support for new products.
  D. Using a plug-in offers full central management only if special licensing is applied to specific features of the plug-in.
  C. A management plug-in interacts with a Security Management Server to provide new features and support for new products.

  ---

  Explanation/Reference:

  A management plug-in is a software component that interacts with a Security Management Server to provide new features and support for new products. A management plug-in can extend the functionality of SmartConsole, SmartDashboard, SmartView Monitor, SmartView Tracker, SmartEvent, SmartReporter, SmartProvisioning, SmartUpdate, and other management tools. A management plug-in can also add new objects, policies, rules, actions, reports, views, and wizards to the management system. Some examples of management plug-ins are CloudGuard Controller, SandBlast Agent, Endpoint Security Server, Threat Extraction for Web, etc.

• Question 616:

  When performing a minimal effort upgrade, what will happen to the network traffic?

  A. All connections that were initiated before the upgrade will be dropped, causing network downtime
  B. All connections that were initiated before the upgrade will be handled normally
  C. All connections that were initiated before the upgrade will be handled by the standby gateway
  D. All connections that were initiated before the upgrade will be handled by the active gateway
  B. All connections that were initiated before the upgrade will be handled normally

  ---

  Explanation/Reference:

  A minimal effort upgrade is a process of upgrading the Security Gateway software without changing the configuration or policy. It is done by using the CPUSE (Check Point Update Service Engine) tool, which is available in the Gaia Portal or

  CLI. The CPUSE tool performs a pre-upgrade verification to check the compatibility and readiness of the system for the upgrade. If the verification passes, the CPUSE tool installs the new software package and reboots the system. During the reboot, there is a short network downtime, but it does not affect the existing connections. All connections that were initiated before the upgrade will be handled normally by the upgraded gateway. The minimal effort upgrade preserves the existing configuration and policy, so there is no need to reinstall the policy or reconfigure the gateway after the upgrade. References: Check Point Upgrade Path and Management Servers and Security Gateways Compatibility Maps, section "Minimal Effort Upgrade" INSTALLATION AND UPGRADE GUIDE R81, page 21-22

• Question 617:

  Which of the following is a new R81 Gateway feature that had not been available in R77.X and older?

  A. The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.
  B. Limits the upload and download throughput for streaming media in the company to 1 Gbps.
  C. Time object to a rule to make the rule active only during specified times.
  D. Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.
  D. Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.

  ---

  Explanation/Reference:

  Sub Policies are a new R81 Gateway feature that had not been available in R77.X and older. Sub Policies are sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule. This allows for more granular and modular control over the policy. The other features were already available in previous versions . References: Check Point R81 Security Management Administration Guide, Check Point R77 Security Management Administration Guide, Check Point R77 Gaia Administration Guide, Check Point R77 Security Gateway Technical Administration Guide

• Question 618:

  When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

  A. All UDP packets
  B. All IPv6 Traffic
  C. All packets that match a rule whose source or destination is the Outside Corporate Network
  D. CIFS packets
  D. CIFS packets

  ---

  Explanation/Reference:

  When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions: CIFS packets. SecureXL is a technology that accelerates network traffic processing by offloading intensive operations from the Firewall kernel to a dedicated SecureXL device. However, some packets cannot be accelerated by SecureXL due to various reasons, such as unsupported features, security policy settings, or protocol limitations. One example of packets that cannot be accelerated by SecureXL are CIFS packets, which are used for file sharing and access over SMB protocol. CIFS packets are not accelerated by SecureXL because they require stateful inspection by the Firewall kernel.

• Question 619:

  Which is NOT an example of a Check Point API?

  A. Gateway API
  B. Management API
  C. OPSC SDK
  D. Threat Prevention API
  A. Gateway API

  ---

  Explanation/Reference:

  Gateway API is not an example of a Check Point API. Check Point APIs are interfaces that enable interactions with Check Point products using automation scripts or external applications. The examples of Check Point APIs are Management API, OPSEC SDK, Threat Prevention API, Identity Awareness Web Services API, and others4. Gateway API is not a valid Check Point API name. References: Check Point R81 Security Management Administration Guide, Check Point APIs

• Question 620:

  What command lists all interfaces using Multi-Queue?

  A. cpmq get
  B. show interface all
  C. cpmq set
  D. show multiqueue all
  A. cpmq get

  ---

  Explanation/Reference:

  The command that lists all interfaces using Multi-Queue is cpmq get. Multi- Queue is a feature that allows network interfaces to use multiple transmit and receive queues, which improves the performance and scalability of the Security Gateway by distributing the network load among several CPU cores. Cpmq is a command that allows administrators to configure and manage Multi-Queue settings on network interfaces. Cpmq get lists all interfaces using Multi-Queue and shows their queue count and core distribution.