156-915.80 Real Exam Questions and Verified Answers

Question 1 Single choice

You run cphaprob -a if. When you review the output, you find the word DOWN.

What does DOWN mean?

A
The cluster link is down.
B
The physical interface is administratively set to DOWN.
C
The physical interface is down.
D
CCP pakets couldn't be sent to or didn't arrive from neighbor member.

Show answer and explanation

Correct answer: D

Question 2 Single choice

What are you required to do before running the command upgrade_export?

A
Run a cpstop on the Security Gateway.
B
Run a cpstop on the Security Management Server.
C
Close all GUI clients.
D
Run cpconfig and set yourself up as a GUI client.

Show answer and explanation

Correct answer: C

Question 3 Single choice

What happen when IPS profile is set in Detect-Only Mode for troubleshooting?

A
It will generate Geo-Protection traffic
B
Automatically uploads debugging logs to Check Point Support Center
C
It will not block malicious traffic
D
Bypass licenses requirement for Geo-Protection control

Show answer and explanation

Correct answer: C

Explanation

It is recommended to enable Detect-Only for Troubleshooting on the profile during the initial installation of IPS. This option overrides any protections that are set to Prevent so that they will not block any traffic.
During this time you can analyze the alerts that IPS generates to see how IPS will handle network traffic, while avoiding any impact on the flow of traffic.
References:
https://sc1.checkpoint.com/documents/R76/CP_R76_IPS_AdminGuide/12750.htm

Question 4 Fill in the blank

FILL BLANK

The command useful for debugging by capturing packet information, including verifying LDAP authentication on all Check Point platforms is ________

Show answer and explanation

Accepted answer: FWMONITOR

Question 5 Single choice

When defining QoS global properties, which option below is not valid?

A
Weight
B
Authenticated timeout
C
Schedule
D
Rate

Show answer and explanation

Correct answer: C

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_QoS_AdminGuide/14871.htm

Question 6 Single choice

What is the difference between an event and a log?

A
Events are generated as gateway according to Event Policy
B
A log entry becomes an event when it matches any rule defined in Event Policy
C
Events are collected with SmartWorkflow from Trouble Ticket systems
D
Logs and Events are synonyms

Show answer and explanation

Correct answer: B

Question 7 Single choice

Which is NOT an example of a Check Point API?

A
Gateway API
B
Management API
C
OPSEC SDK
D
Threat Prevention API

Show answer and explanation

Correct answer: A

Question 8 Single choice

When migrating the SmartEvent data base from one server to another, the last step is to save the files on the new server.

Which of the following commands should you run to save the SmartEvent data base files on the new server?

A
cp
B
restore
C
migrate import
D
eva_db_restore

Show answer and explanation

Correct answer: D

Question 9 Single choice

What is the purpose of the pre-defined exclusions included with SmartEvent R80?

A
To allow SmartEvent R80 to function properly with all other R71 devices.
B
To avoid incorrect event generation by the default IPS event definition; a scenario that may occur in
deployments that include Security Gateways of versions prior to R71.
C
As a base for starting and building exclusions.
D
To give samples of how to write your own exclusion.

Show answer and explanation

Correct answer: B

Question 10 Single choice

You are the Security Administrator for ABC-Corp. A Check Point Firewall is installed and in use on GAiA;
You are concerned that the system might not be retaining your entries for the interfaces and routing

configuration. You would like to verify your entries in the corresponding file(s) on GAiA; Where can you view them? Give the BEST answer.

A
/etc/sysconfig/netconf.C
B
/etc/conf/route.C
C
/etc/sysconfig/network-scripts/ifcfg-ethx
D
/etc/sysconfig/network

Show answer and explanation

Correct answer: A