CheckPoint 156-315.81 Online Practice Questions and Exam Preparation

CheckPoint 156-315.81 Online Questions & Answers

• Question 81:

  Which command lists firewall chain?

  A. fwctl chain
  B. fw list chain
  C. fw chain module
  D. fw tab -t chainmod
  A. fwctl chain

  ---

  Explanation/Reference:

  The command that lists firewall chain is fw ctl chain1. This command displays the list of chain modules that are registered on the Security Gateway2. Chain modules are components of the Firewall kernel that inspect and process packets according to the security policy and other features3. The order of the chain modules determines the order of the packet inspection and processing3. The fw ctl chain command can help you troubleshoot connectivity or performance issues, or to verify that a feature is enabled or disabled on the Security Gateway2. To run this command, you need to access the Security Gateway in expert mode and run fw ctl chain1. References: How to use fw ctl chain - Check Point Software, fw ctl chain - Check Point Software, R81.x Security Gateway Architecture (Logical Packet Flow) - Check Point CheckMates

• Question 82:

  What is considered Hybrid Emulation Mode?

  A. Manual configuration of file types on emulation location.
  B. Load sharing of emulation between an on premise appliance and the cloud.
  C. Load sharing between OS behavior and CPU Level emulation.
  D. High availability between the local SandBlast appliance and the cloud.
  B. Load sharing of emulation between an on premise appliance and the cloud.

  ---

  Explanation/Reference:

  Hybrid Emulation Mode is a mode of operation that allows load sharing of emulation between an on premise appliance and the cloud. Emulation is a process that analyzes files for malicious behavior by running them in a virtual sandbox. Hybrid Emulation Mode enables you to optimize the performance and scalability of your Threat Emulation solution by distributing the emulation workload between your local SandBlast appliance and the Check Point cloud service. References: Check Point Security Expert R81 Course, Threat Emulation Administration Guide

• Question 83:

  Which command shows actual allowed connections in state table?

  A. fw tab StateTable
  B. fw tab connections
  C. fw tab connection
  D. fw tab connections
  B. fw tab connections

  ---

  Explanation/Reference:

  The correct command to show actual allowed connections in the state table is option B: fw tab connections. This command displays the contents of the "connections" table, which contains information about the active connections being

  tracked by the firewall.

  Option A (fw tab StateTable) is incorrect as there is no "StateTable" table; it should be "connections."

  Option C (fw tab connection) is also incorrect, as it should be "connections." Option D (fw tab connections) is not the correct syntax for the command.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 84:

  SmartConsole R81 requires the following ports to be open for SmartEvent R81 management:

  A. 19090,22
  B. 19190,22
  C. 18190,80
  D. 19009,443
  D. 19009,443

  ---

  Explanation/Reference:

  To use SmartConsole R81 for managing SmartEvent R81, you need to have the following ports open:

  Port 19009 for communication over HTTPS (443)

  Port 19009 for communication over HTTP (80)

  These ports are necessary for the SmartConsole to communicate with SmartEvent for management and monitoring purposes.

  References: Check Point Certified Security Expert R81 documentation and learning resources.

• Question 85:

  Which one is not a valid Package Option In the Web GUI for CPUSE?

  A. Clean Install
  B. Export Package
  C. Upgrade
  D. Database Conversion to R81.20 only
  B. Export Package

  ---

  Explanation/Reference:

  CPUSE (Check Point Upgrade Service Engine) is a tool that allows users to download, import, install, and uninstall software packages on Gaia OS. CPUSE has a web- based user interface that can be accessed through Gaia Portal. CPUSE

  offers four package options in the web GUI for different purposes4:

  Clean Install - This option performs a clean installation of a Major Version package, which erases all existing configuration and data on the system. Export Package - This option exports a package from CPUSE repository to an external

  location for backup or transfer purposes. Upgrade - This option performs an upgrade of a Major Version package or a Minor Version package, which preserves the existing configuration and data on the system.

  Database Conversion - This option converts the database schema of a Major Version package to match the current version.

  Therefore, the correct answer is B.

  References: 4: CPUSE - Gaia Deployment Agent

• Question 86:

  GAiA Software update packages can be imported and installed offline in situation where:

  A. Security Gateway with GAiA does NOT have SFTP access to Internet
  B. Security Gateway with GAiA does NOT have access to Internet.
  C. Security Gateway with GAiA does NOT have SSH access to Internet.
  D. The desired CPUSE package is ONLY available in the Check Point CLOUD.
  B. Security Gateway with GAiA does NOT have access to Internet.

  ---

  Explanation/Reference:

  According to the Check Point website, GAiA Software update packages can be imported and installed offline in situation where the Security Gateway with GAiA does not have access to Internet. This allows you to manually download the packages from another device and transfer them to the Security Gateway using a USB drive or other media. The other situations are either not relevant or not possible. References: Offline Software Updates

• Question 87:

  What Is the difference between Updatable Objects and Dynamic Objects

  A. Dynamic Objects ate maintained automatically by the Threat Cloud. Updatable Objects are created and maintained locally. In both cases there is no need to install policy for the changes to take effect.
  B. Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally For Dynamic Objects there is no need to install policy for the changes to take effect.
  C. Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally In both cases there is no need to install policy for the changes to take effect.
  D. Dynamic Objects are maintained automatically by the Threat Cloud. For Dynamic Objects there rs no need to install policy for the changes to take effect. Updatable Objects are created and maintained locally.
  B. Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally For Dynamic Objects there is no need to install policy for the changes to take effect.

  ---

  Explanation/Reference:

  Updatable Objects are a Threat Cloud Service that provides network objects that represent external services, such as Office 365, AWS, GEO locations, and more. These objects are updated automatically by Check Point and do not require policy installation for the changes to take effect. Dynamic Objects are created and maintained locally by the administrator and can be used to define temporary or changing network objects, such as IP addresses, ports, or ranges. Dynamic Objects also do not require policy installation for the changes to take effect. References: Updatable Objects, Updateable Objects and NAT, R80.20 Updatable Domain Objects and CLI Commands.

• Question 88:

  When performing a minimal effort upgrade, what will happen to the network traffic?

  A. All connections that were Initiated before the upgrade will be dropped, causing network downtime.
  B. All connections that were initiated before the upgrade will be handled by the active gateway
  C. All connections that were initiated before the upgrade will be handled normally
  D. All connections that were initiated before the upgrade will be handled by the standby gateway
  B. All connections that were initiated before the upgrade will be handled by the active gateway

  ---

  Explanation/Reference:

  All connections that were initiated before the upgrade will be handled by the active gateway. According to the Check Point documentation1, a minimal effort upgrade is a procedure that allows you to upgrade each Security Gateway individually, without affecting the cluster operation. The active gateway continues to handle the traffic while the standby gateway is upgraded, and then they switch roles. This way, there is no network downtime and no need to synchronize the cluster members before or after the upgrade1. However, some connections may be dropped during the switch-over, so it is recommended to use a connectivity upgrade or a zero downtime upgrade for mission- critical environments2. References: : Best Practices - Security Gateway Performance - Check Point Software : Checkpoint Cluster Firmware Upgrade - Check Point CheckMates

• Question 89:

  How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

  A. By dropping traffic from websites identified through ThreatCloud Verification and URL Caching
  B. By dropping traffic that is not proven to be from clean websites in the URL Filtering blade
  C. By allowing traffic from websites that are known to run Antivirus Software on servers regularly
  D. By matching logs against ThreatCloud information about the reputation of the website
  D. By matching logs against ThreatCloud information about the reputation of the website

  ---

  Explanation/Reference:

  The Anti-Virus feature of the Threat Prevention policy blocks traffic from infected websites by matching logs against ThreatCloud information about the reputation of the website. ThreatCloud is a collaborative network that collects and analyzes threat data from millions of sources worldwide. It assigns a reputation score to each website based on its malicious activity and behavior. If a website has a low reputation score, it is considered infected and blocked by the Anti-Virus blade. References: Training and Certification | Check Point Software, CCSE section

• Question 90:

  Which SmartConsole tab is used to monitor network and security performance?

  A. Manage Setting
  B. Security Policies
  C. Gateway and Servers
  D. Logs and Monitor
  D. Logs and Monitor

  ---

  Explanation/Reference:

  The Logs and Monitor tab is used to monitor network and security performance in SmartConsole. The Logs and Monitor tab lets you view and analyze logs, events, reports, and alerts from various sources, such as Security Gateways, Security Management Servers, Endpoint Security Servers, and SmartEvent Servers. You can also use the Logs and Monitor tab to create custom views, filters, queries, and charts to display the data that is relevant to your needs12. References: 1: Check Point R81 Security Administration Guide - Check Point Software, page 23 2: Check Point R81 SmartConsole User Guide - Check Point Software, page 9