CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 621:

  What is the limitation of employing Sticky Decision Function?

  A. With SDF enabled, the involved VPN Gateways only supports IKEv1
  B. Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF
  C. With SDF enabled, only ClusterXL in legacy mode is supported
  D. With SDF enabled, you can only have three Sync interfaces at most
  B. Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF

  ---

  Explanation/Reference:

  Sticky Decision Function (SDF) is a feature that ensures that VPN traffic is handled by the same core on a Security Gateway with multiple CPU cores. This improves the performance and stability of VPN tunnels by avoiding out-of-order packets and reducing encryption overhead. However, the limitation of employing SDF is that acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF. This means that SDF may reduce the overall throughput and scalability of the Security Gateway. Therefore, SDF should be used only when necessary and only on gateways that are dedicated to VPN traffic. References: R81 Performance Tuning Administration Guide

• Question 622:

  Fill in the blank: A ________ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser.

  A. Clientless remote access
  B. Clientless direct access
  C. Client-based remote access
  D. Direct access
  A. Clientless remote access

  ---

  Explanation/Reference:

  A clientless remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. A clientless remote access VPN does not require any software installation or configuration on the user's device. Instead, it uses a web-based portal that acts as a proxy between the user and the corporate resources. The user can access web applications and services through the portal using a standard web browser that supports SSL/TLS encryption. The portal can also provide single sign-on (SSO) capabilities for SAML-enabled applications. A clientless remote access VPN is suitable for scenarios where users need to access mainly web-based resources from unmanaged devices or devices that cannot run VPN clients. The other options are incorrect because: A client-based remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by installing a VPN client software on the user's device. A client-based remote access VPN requires software installation and configuration on the user's device. It uses IPsec or SSL/TLS protocols to create a secure tunnel between the user's device and the VPN gateway. The user can access any type of resource through the tunnel using any application that supports TCP/IP protocols. A client-based remote access VPN is suitable for scenarios where users need to access various types of resources from managed devices or devices that can run VPN clients. A clientless direct access deployment is not a valid term for a VPN deployment. Direct access is a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user's device and the direct access server. A direct access deployment is not a term for a VPN deployment, but a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user's device and the direct access server.

• Question 623:

  The back-end database for Check Point R81 Management uses:

  A. DBMS
  B. MongoDB
  C. PostgreSQL
  D. MySQL
  C. PostgreSQL

  ---

  Explanation/Reference:

  The back end database for Check Point R81 Management uses PostgreSQL, which is an open source relational database management system2. MongoDB, MySQL, and DBMS are not used by Check Point R81 Management. References: 2: Check Point Software, Getting Started, Database.

• Question 624:

  When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?

  A. Toni? AND 10.0.4.210 NOT 10.0.4.76
  B. To** AND 10.0.4.210 NOT 10.0.4.76
  C. Ton* AND 10.0.4.210 NOT 10.0.4.75
  D. "Toni" AND 10.0.4.210 NOT 10.0.4.76
  D. "Toni" AND 10.0.4.210 NOT 10.0.4.76

  ---

  Explanation/Reference:

  When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, you would use the following query syntax:

  "Toni" AND 10.0.4.210 NOT 10.0.4.76

  This query will match logs that contain the exact phrase "Toni" and the IP address 10.0.4.210, but not the IP address 10.0.4.76. The quotation marks around "Toni" ensure that only logs with that exact word are matched, not variations like

  Toni? or To**. The AND operator combines two conditions that must both be true, while the NOT operator excludes logs that match a certain condition. References: [SmartLog User Guide]