CheckPoint Checkpoint Certifications 156-915.80 Questions & Answers

• Question 241:

  You have existing dbedit scripts from R77. Can you use them with R80.10?

  A. dbedit is not supported in R80.10

  B. dbedit is fully supported in R80.10

  C. You can use dbedit to modify threat prevention or access policies, but not create or modify layers

  D. dbedit scripts are being replaced by mgmt._cli in R80.10

  Correct Answer: D

  dbedit (or GuiDbEdit) uses the cpmi protocol which is gradually being replaced by the new R80.10 automation architecture. cpmi clients are still supported in R80.10, but there are some functionalities that cannot be managed by cpmi anymore. For example, the Access and Threat policies do not have a cpmi representation. They can be managed only by the new mgmt_cli and not by cpmi clients. There are still many tables that have an inner cpmi representation (for example, network objects, services, servers, and global properties) and can still be managed using cpmi. Reference: https://www.checkpoint.com/downloads/product-related/r80.10-mgmt-architecture-overview.pdf

• Question 242:

  SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

  A. This statement is true because SecureXL does improve all traffic

  B. This statement is false because SecureXL does not improve this traffic but CoreXL does

  C. This statement is true because SecureXL does improve this traffic

  D. This statement is false because encrypted traffic cannot be inspected

  Correct Answer: C

  SecureXL improved non-encrypted firewall traffic throughput, and encrypted VPN traffic throughput, by nearly an order-of-magnitude- particularly for small packets flowing in long duration connections. Reference: https:// downloads.checkpoint.com/fileserver/SOURCE/direct/ID/10001/FILE/SecureXL_and_Nokia_IPSO_White_Paper_20080401.pdf

• Question 243:

  On R80.10 the IPS Blade is managed by:

  A. Threat Protection policy

  B. Anti-Bot Blade

  C. Threat Prevention policy

  D. Layers on Firewall policy

  Correct Answer: C

• Question 244:

  Which packet info is ignored with Session Rate Acceleration?

  A. source port ranges

  B. source ip

  C. source port

  D. same info from Packet Acceleration is used

  Correct Answer: C

  Reference: http://trlj.blogspot.com/2015/10/check-point-acceleration.html

• Question 245:

  What is the purpose of Priority Delta in VRRP?

  A. When a box is up, Effective Priority = Priority + Priority Delta

  B. When an Interface is up, Effective Priority = Priority + Priority Delta

  C. When an Interface fail, Effective Priority = Priority ?Priority Delta

  D. When a box fail, Effective Priority = Priority ?Priority Delta

  Correct Answer: C

  Each instance of VRRP running on a supported interface may monitor the link state of other interfaces. The monitored interfaces do not have to be running VRRP. If a monitored interface loses its link state, then VRRP will decrement its priority over a VRID by the specified delta value and then will send out a new VRRP HELLO packet. If the new effective priority is less than the priority a backup platform has, then the backup platform will beging to send out its own HELLO packet. Once the master sees this packet with a priority greater than its own, then it releases the VIP. Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk38524

• Question 246:

  What is the purpose of a SmartEvent Correlation Unit?

  A. The SmartEvent Correlation Unit is designed to check the connection reliability from SmartConsole to the SmartEvent Server

  B. The SmartEvent Correlation Unit's task it to assign severity levels to the identified events.

  C. The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events.

  D. The SmartEvent Correlation Unit is designed to check the availability of the SmartReporter Server

  Correct Answer: C

• Question 247:

  The CDT utility supports which of the following?

  A. Major version upgrades to R77.30

  B. Only Jumbo HFA's and hotfixes

  C. Only major version upgrades to R80.10

  D. All upgrades

  Correct Answer: D

  The Central Deployment Tool (CDT) is a utility that runs on an R77 / R77.X / R80 / R80.10 Security Management Server / Multi-Domain Security Management Server (running Gaia OS). It allows the administrator to automatically install CPUSE Offline packages (Hotfixes, Jumbo Hotfix Accumulators (Bundles), Upgrade to a Minor Version, Upgrade to a Major Version) on multiple managed Security Gateways and Cluster Members at the same time. Reference: https://community.checkpoint.com/thread/5319-my-top-3-check-point-cli-commands

• Question 248:

  The Firewall kernel is replicated multiple times, therefore:

  A. The Firewall kernel only touches the packet if the connection is accelerated

  B. The Firewall can run different policies per core

  C. The Firewall kernel is replicated only with new connections and deletes itself once the connection times out

  D. The Firewall can run the same policy on all cores

  Correct Answer: D

  On a Security Gateway with CoreXL enabled, the Firewall kernel is replicated multiple times. Each replicated copy, or instance, runs on one processing core. These instances handle traffic concurrently, and each instance is a complete and independent inspection kernel. When CoreXL is enabled, all the kernel instances in the Security Gateway process traffic through the same interfaces and apply the same security policy. Reference: https://sc1.checkpoint.com/documents/R77/CP_R77_PerformanceTuning_WebAdmin/6731.htm

• Question 249:

  Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

  A. Symmetric routing

  B. Failovers

  C. Asymmetric routing

  D. Anti-Spoofing

  Correct Answer: C

• Question 250:

  Which is not a blade option when configuring SmartEvent?

  A. Correlation Unit

  B. SmartEvent Unit

  C. SmartEvent Server

  D. Log Server

  Correct Answer: B

  On the Management tab, enable these Software Blades: Logging and Status SmartEvent Server SmartEvent Correlation Unit

  Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_LoggingAndMonitoring/html_frameset.htm?topic=documents/R80/CP_R80_LoggingAndMonitoring/120829