CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 61:

  In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories. Which of the following is NOT an objects category?

  A. Limit
  B. Resource
  C. Custom Application / Site
  D. Network Object
  B. Resource

  ---

  Explanation/Reference:

  Resource is not an objects category in SmartConsole. Objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories, such as Network Object, Host, Gateway, Service, Time Object, Custom Application / Site, Limit, and Group. A resource is a type of object that represents an application or content that is accessible through HTTP or HTTPS protocols. A resource can be used to define access rules for users who connect through Identity Awareness or Mobile Access blades.

• Question 62:

  Identity Awareness allows the Security Administrator to configure network access based on which of the following?

  A. Name of the application, identity of the user, and identity of the machine
  B. Identity of the machine, username, and certificate
  C. Browser-Based Authentication, identity of a user, and network location
  D. Network location, identity of a user, and identity of a machine
  D. Network location, identity of a user, and identity of a machine

  ---

  Explanation/Reference:

  Implied rules are predefined rules that are automatically added to the Access Control rulebase by the Security Management Server. Implied rules allow the control connections that are essential for the functionality and security of the Check Point products, such as communication between the Security Gateway and the Security Management Server, synchronization between cluster members, logging, VPN, and ICMP. Implied rules are not visible in the SmartConsole, but they can be viewed and modified using the Global Properties window. The references are: Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 12 Check Point R81 Quantum Security Gateway Guide, page 141 Check Point R81 Firewall Administration Guide, page 21

• Question 63:

  When Configuring Endpoint Compliance Settings for Applications and Gateways within Mobile Access, which of the three approaches will allow you to configure individual policies for each application?

  A. Basic Approach
  B. Strong Approach
  C. Very Advanced Approach
  D. Medium Approach
  C. Very Advanced Approach

  ---

  Explanation/Reference:

  The approach that will allow you to configure individual policies for each application when configuring Endpoint Compliance Settings for Applications and Gateways within Mobile Access is Very Advanced Approach. This approach lets you define compliance rules for each application separately and assign different actions for each rule. You can also create custom messages and notifications for each application. The other approaches are either less granular or not applicable in this scenario. The Basic Approach lets you define compliance rules for all applications globally and assign a single action for all rules. The Medium Approach lets you define compliance rules for all applications globally and assign different actions for each rule. The Strong Approach is not a valid option for Endpoint Compliance Settings. References: [Endpoint Compliance Settings]

• Question 64:

  Which two Identity Awareness daemons are used to support identity sharing?

  A. Policy Activation Point (PAP) and Policy Decision Point (PDP)
  B. Policy Manipulation Point (PMP) and Policy Activation Point (PAP)
  C. Policy Enforcement Point (PEP) and Policy Manipulation Point (PMP)
  D. Policy Decision Point (PDP) and Policy Enforcement Point (PEP)
  D. Policy Decision Point (PDP) and Policy Enforcement Point (PEP)

  ---

  Explanation/Reference:

  The two Identity Awareness daemons that are used to support identity sharing are Policy Decision Point (PDP) and Policy Enforcement Point (PEP). PDP is a daemon that runs on Security Gateways that acquire identities from various sources, such as AD Query, Identity Agent, Captive Portal, etc. PEP is a daemon that runs on Security Gateways that enforce the security policy based on identities received from PDPs. Identity sharing is a feature that allows PDPs to share identities with other PDPs or PEPs in different gateways or domains. References: [Check Point R81 Identity Awareness Administration Guide]

• Question 65:

  For Management High Availability, which of the following is NOT a valid synchronization status?

  A. Collision
  B. Down
  C. Lagging
  D. Never been synchronized
  B. Down

  ---

  Explanation/Reference:

  For Management High Availability, the valid synchronization status options are:

  A. Collision

  B. Down

  C. Lagging

  D. Never been synchronized

  In this context, "Down" indicates that the synchronization is not functioning correctly or that the standby management server is not reachable. This is a valid synchronization status, so the answer is not B.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 66:

  Which Check Point feature enables application scanning and the detection?

  A. Application Dictionary
  B. AppWiki
  C. Application Library
  D. CPApp
  B. AppWiki

  ---

  Explanation/Reference:

  AppWiki is the Check Point feature that enables application scanning and the detection. AppWiki is an easy to use tool that lets you search and filter Check Point's Web 2.0 Applications Database to find out information about internet applications, including social network widgets; filter by a category, tag, or risk level; and search for a keyword or application1. AppWiki helps you to identify and control the applications on your network, and to apply granular policies based on the application type, risk, and characteristics1. AppWiki is integrated with the Check Point Application Control Software Blade, which provides the industry's strongest application security and identity control to organizations of all sizes1. References: 1: AppWiki | Check Point Software

• Question 67:

  In R81, how do you manage your Mobile Access Policy?

  A. Through the Unified Policy
  B. Through the Mobile Console
  C. From SmartDashboard
  D. From the Dedicated Mobility Tab
  A. Through the Unified Policy

  ---

  Explanation/Reference:

  In R81, you can manage your Mobile Access Policy through the Unified Policy. The Unified Policy is a single policy that combines access control, threat prevention, data protection, and identity awareness. You can create rules for mobile access in the Unified Policy rulebase and apply them to mobile devices, users, and applications. You can also use the Mobile Access blade to configure additional settings for mobile access, such as authentication methods, VPN settings, and application portal.

• Question 68:

  The Check Point installation history feature in provides the following:

  A. View install changes and install specific version
  B. Policy Installation Date only
  C. Policy Installation Date, view install changes and install specific version
  D. View install changes
  C. Policy Installation Date, view install changes and install specific version

  ---

  Explanation/Reference:

  The Check Point installation history feature provides the following:

  Policy Installation Date: The date and time when the policy was installed on the Security Gateway.

  View install changes: The ability to view the differences between two policy versions that were installed on the Security Gateway. Install specific version: The ability to install a specific policy version from the installation history on the Security

  Gateway3. References: Check Point R81 SmartConsole Guide

• Question 69:

  Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. Which is NOT an option to adjust or configure?

  A. Severity
  B. Automatic reactions
  C. Policy
  D. Threshold
  C. Policy

  ---

  Explanation/Reference:

  An event is a notification that something significant has occurred on a Check Point product or network. Events are generated by various sources, such as blades, gateways, servers, SmartEvent, etc. You can view and manage events in

  SmartConsole by using the Events tab in the Logs and Monitor view. Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. The configurable properties include:

  Severity: The level of importance or urgency of the event. You can change the severity of an event by selecting a different value from the drop-down list. Automatic reactions: The actions that are triggered when an event occurs. You can add,

  edit, or delete automatic reactions for an event by clicking on the + icon or the pencil icon.

  Threshold: The minimum number or frequency of occurrences of an event that triggers an automatic reaction. You can change the threshold of an event by entering a different value in the text box. The policy is not an option to adjust or

  configure for an event. The policy is a set of rules that define how to handle events based on their source, type, severity, etc. You can create and manage policies in SmartEvent by using the Policies tab in the Logs and Monitor view.

  References: R81 Logging and Monitoring Administration Guide

• Question 70:

  In which deployment is the security management server and Security Gateway installed on the same appliance?

  A. Standalone
  B. Remote
  C. Distributed
  D. Bridge Mode
  A. Standalone

  ---

  Explanation/Reference:

  In a Standalone deployment, a Check Point computer runs both the Security Gateway and Security Management Server products. This means that the same appliance performs both network security functions and security policy management functions. A Standalone deployment is suitable for small or branch offices that do not require a separate management server. References: Check Point R81 Installation and Upgrade Guide, page