CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 71:

  Which of the following is NOT a component of Check Point Capsule?

  A. Capsule Docs
  B. Capsule Cloud
  C. Capsule Enterprise
  D. Capsule Workspace
  C. Capsule Enterprise

  ---

  Explanation/Reference:

  Check Point Capsule is a suite of solutions designed to provide comprehensive mobile security and secure access. The components of Check Point Capsule include:

  Capsule Docs (Option A): A component that secures document sharing and protects sensitive data.

  Capsule Cloud (Option B): A component that provides cloud-based security services.

  Capsule Workspace (Option D): A component that provides secure workspace on mobile devices.

  Option C, "Capsule Enterprise," is not a recognized component of Check Point Capsule based on the available information. Therefore, it is the correct answer as the component that is NOT part of Check Point Capsule.

  References: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.

• Question 72:

  What is Dynamic Balancing?

  A. It is a ClusterXL feature that switches an HA cluster into an LS cluster if required to maximize throughput
  B. It is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load
  C. It is a new feature that is capable of dynamically reserve the amount of Hash kernel memory to reflect the resource usage necessary for maximizing the session rate.
  D. It is a CoreXL feature that assigns the SND to network interfaces to balance the RX Cache of the interfaces
  B. It is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load

  ---

  Explanation/Reference:

  Dynamic Balancing is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load. It dynamically changes the split between CoreXL SNDs and CoreXL Firewalls and does not require a reboot or cause an outage. It monitors the system and makes changes as needed to optimize the performance of the Security Gateway. It is supported on Check Point Appliances with R80.40 and higher versions. References: Dynamic Balancing for CoreXL - Check Point Software, Dynamic Balancing available on R80.40 - Check Point CheckMates, CLI R81.20 Reference Guide - Check Point Software, Performance Tuning R81.20 Administration Guide - Check Point Software

• Question 73:

  Which of the following is NOT a method used by Identity Awareness for acquiring identity?

  A. Remote Access
  B. Active Directory Query
  C. Cloud IdP (Identity Provider)
  D. RADIUS
  C. Cloud IdP (Identity Provider)

  ---

  Explanation/Reference:

• Question 74:

  Which GUI client is supported in R81?

  A. SmartProvisioning
  B. SmartView Tracker
  C. SmartView Monitor
  D. SmartLog
  C. SmartView Monitor

  ---

  Explanation/Reference:

  SmartView Monitor is a GUI client that is supported in R81. It allows you to monitor the network and security performance of your Security Gateways and devices5. You can use it to view real-time statistics, alerts, logs, reports, and graphs6. The other GUI clients are not supported in R81 because:

  A. SmartProvisioning was replaced by SmartLSM in R80.20 and later versions7. SmartLSM is a unified solution for managing large-scale deployments of Security Gateways8. B. SmartView Tracker was replaced by SmartLog in R80 and later versions9. SmartLog is a powerful log analysis tool that enables fast and easy access to log data from multiple Security Gateways10. D. SmartLog is not a GUI client, but a web-based application that runs on the Security Management Server or Log Server10. You can access it from any web browser or from SmartConsole. References: SmartView Monitor R81 Help, SmartView Monitor R81 Administration Guide, What's New in Check Point R80.20, SmartLSM R81 Help, What's New in Check Point R80, SmartLog R81 Help

• Question 75:

  You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the tight protections in place. Check Point has been selected for the security vendor. Which Check Point product protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?

  A. IPS AND Application Control
  B. IPS, anti-virus and anti-bot
  C. IPS, anti-virus and e-mail security
  D. SandBlast
  D. SandBlast

  ---

  Explanation/Reference:

  SandBlast is the best Check Point product to protect against malware and zero-day attacks while ensuring quick delivery of safe content to your users. SandBlast is an advanced network threat prevention solution that uses a combination of technologies to detect and block known and unknown threats before they reach your network. SandBlast uses Threat Emulation, which is a sandboxing technology that inspects files for malicious behavior in a virtual environment; Threat Extraction, which removes potentially malicious elements from files and delivers clean and safe content to your users; Anti-Bot, which identifies and blocks botnet communications and prevents data exfiltration; Anti-Virus, which scans files for known malware signatures; and IPS, which monitors network traffic for malicious or anomalous patterns. SandBlast also provides comprehensive reports and forensic analysis on the detected threats and their origin and behavior.

• Question 76:

  SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

  A. Smart Cloud Services
  B. Load Sharing Mode Services
  C. Threat Agent Solution
  D. Public Cloud Services
  A. Smart Cloud Services

  ---

  Explanation/Reference:

  Check Point SandBlast Zero-Day Protection offers flexibility in implementation to meet individual business needs. One of the deployment options for Check Point SandBlast Zero- Day Protection is:

  Smart Cloud Services (Option A): Smart Cloud Services allow organizations to leverage cloud-based threat intelligence and protection services provided by Check Point. The other options, Load Sharing Mode Services (Option B), Threat

  Agent Solution (Option C), and Public Cloud Services (Option D), may also be components of a security strategy, but they are not specific deployment options for Check Point SandBlast Zero-Day Protection.

  References: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.

• Question 77:

  What must you do first if "fwm sic_reset" could not be completed?

  A. Cpstop then find keyword "certificate" in objects_5_0.C and delete the section
  B. Reinitialize SIC on the security gateway then run "fw unloadlocal"
  C. Reset SIC from Smart Dashboard
  D. Change internal CA via cpconfig
  D. Change internal CA via cpconfig

  ---

  Explanation/Reference:

  The first thing that must be done if "fwm sic_reset" could not be completed is to change internal CA via cpconfig. Fwm sic_reset is a command that allows administrators to reset Secure Internal Communication (SIC) between Security Management Server and Security Gateways or other Check Point modules. SIC is a mechanism that ensures secure and authenticated communication between Check Point components by using certificates issued by an internal Certificate Authority (ICA). If fwm sic_reset fails, it means that there is a problem with the ICA or the certificates that prevents SIC from being reset. To resolve this problem, administrators need to change internal CA via cpconfig, which is a command that allows administrators to configure various settings on Security Gateways or Management Servers, including the ICA. Changing internal CA via cpconfig will create a new ICA with a new certificate, and allow SIC to be reset with the new certificate.

• Question 78:

  Using Web Services to access the API, which Header Name-Value had to be in the HTTP Post request after the login?

  A. X-chkp-sid Session Unique Identifier
  B. API-Key
  C. user-uid
  D. uuid Universally Unique Identifier
  A. X-chkp-sid Session Unique Identifier

  ---

  Explanation/Reference:

  The header name-value that has to be in the HTTP Post request after the login when using Web Services to access the API is X-chkp-sid Session Unique Identifier. This header contains the session ID that is returned by the login command and identifies the session for subsequent API commands. The session ID is valid for a limited time and can be extended by using keepalive or logout commands. References: [Check Point R81 Management API Reference Guide]

• Question 79:

  You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.

  How many cores can be used in a Cluster for Firewall-kernel on the new device?

  A. 3
  B. 2
  C. 1
  D. 4
  D. 4

  ---

  Explanation/Reference:

  The number of cores that can be used in a Cluster for Firewall-kernel on the new device with 4 cores is 4. Cluster is a feature that allows two or more Security Gateways to provide high availability and load balancing for network traffic. Firewall-kernel is a component of the Security Gateway that performs packet inspection according to security policies. The number of cores that can be used for Firewall-kernel in a Cluster depends on the number of cores available on each device in the Cluster. The Cluster will use the lowest common denominator of cores among all devices in the Cluster for Firewall-kernel. Therefore, if one device has 2 cores and another device has 4 cores, the Cluster will use 2 cores for Firewall-kernel on each device. However, if both devices have 4 cores, the Cluster will use 4 cores for Firewall-kernel on each device.

• Question 80:

  What kind of information would you expect to see using the sim affinity command?

  A. The VMACs used in a Security Gateway cluster
  B. The involved firewall kernel modules in inbound and outbound packet chain
  C. Overview over SecureXL templated connections
  D. Network interfaces and core distribution used for CoreXL
  D. Network interfaces and core distribution used for CoreXL

  ---

  Explanation/Reference:

  The kind of information that you would expect to see using the sim affinity command is network interfaces and core distribution used for CoreXL. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. CoreXL is a technology that improves the performance of the Security Gateway by using multiple cores to handle concurrent connections. The sim affinity command can show which network interfaces and SecureXL instances are bound to which CPU cores, and allow administrators to change the affinity settings.