156-315.81.20 Dumps Help You Study Objectives

Category:

Comments:

0 Comments

Post Date:

July 26, 2024

By practicing with 156-315.81.20 exam-like questions, you can identify areas where you may need to focus your studies. Check Point 156-315.81.20 dumps can help you create a more targeted study plan and avoid wasting time studying topics you already know well. Taking 156-315.81.20 dumps can help you get used to the format and structure of the real exam. 156-315.81.20 dumps can help you feel more comfortable and confident on exam day, which can improve your chances of success. Practice Check Point 156-315.81.20 exam free dumps below.

Page 1 of 19

1. What is the port used for SmartConsole to connect to the Security Management Server?

CPMI port 18191/TCP

CPM port/TCP port 19009

SIC port 18191/TCP

https port 4434/TCP

2. Under which file is the proxy arp configuration stored?

$FWDIR/state/proxy_arp.conf on the management server

$FWDIR/conf/local.arp on the management server

$FWDIR/state/_tmp/proxy.arp on the security gateway

$FWDIR/conf/local.arp on the gateway

3. What are the two high availability modes?

Load Sharing and Legacy

Traditional and New

Active and Standby

New and Legacy

4. SandBlast offers flexibility in implementation based on their individual business needs.

What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Smart Cloud Services

Load Sharing Mode Services

Threat Agent Solution

Public Cloud Services

5. Using ClusterXL, what statement is true about the Sticky Decision Function?

Can only be changed for Load Sharing implementations

All connections are processed and synchronized by the pivot

Is configured using cpconfig

Is only relevant when using SecureXL

6. Joey wants to upgrade from R75.40 to R81 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.

What is one of the requirements for his success?

Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine

Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine

Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR/log directory on the source machine

Size of the /var/log folder of the target machine must be at least 25GB or more

7. SmartEvent uses it's event policy to identify events.

How can this be customized?

By modifying the firewall rulebase

By creating event candidates

By matching logs against exclusions

By matching logs against event rules

8. When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.

SecureID

SecurID

Complexity

TacAcs

9. Which of the following is NOT an internal/native Check Point command?

fwaccel on

fw ct1 debug

tcpdump

cphaprob

10. You have enabled “Full Log” as a tracking option to a security rule. However, you are still not seeing any data type information.

What is the MOST likely reason?

Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database.

Data Awareness is not enabled.

Identity Awareness is not enabled.

Logs are arriving from Pre-R81 gateways.

Page 2 of 19

11. Which Check Point process provides logging services, such as forwarding logs from Gateway to Log Server, providing Log Export API (LEA) & Event Logging API (EL-A) services.

DASSERVICE

FWD

CPVIEWD

CPD

12. You have successfully backed up Check Point configurations without the OS information.

What command would you use to restore this backup?

restore_backup

import backup

cp_merge

migrate import

13. Which application should you use to install a contract file?

SmartView Monitor

WebUI

SmartUpdate

SmartProvisioning

14. The SmartEvent R81 Web application for real-time event monitoring is called:

SmartView Monitor

SmartEventWeb

There is no Web application for SmartEvent

SmartView

15. How can SmartView application accessed?

http:///smartview

http://:4434/smartview/

https:///smartview/

https://:4434/smartview/

16. Which command collects diagnostic data for analyzing customer setup remotely?

cpinfo

migrate export

sysinfo

cpview

17. Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

Yes, but they need to have a mutually trusted certificate authority

Yes, but they have to have a pre-shared secret key

No, they cannot share certificate authorities

No, Certificate based VPNs are only possible between Check Point devices

18. CoreXL is NOT supported when one of the following features is enabled: (Choose three)

Route-based VPN

IPS

IPv6

Overlapping NAT

19. How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Install appliance TE250X on SpanPort on LAN switch in MTA mode.

Install appliance TE250X in standalone mode and setup MT

You can utilize only Check Point Cloud Services for this scenario.

It is not possible, always Check Point SGW is needed to forward emails to SandBlast appliance.

20. What is the difference between an event and a log?

Events are generated at gateway according to Event Policy

A log entry becomes an event when it matches any rule defined in Event Policy

Events are collected with SmartWorkflow form Trouble Ticket systems

Log and Events are synonyms

Page 3 of 19

21. Which of the following is NOT a valid type of SecureXL template?

Accept Template

Deny template

Drop Template

NAT Template

22. The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via which 2 processes?

fwd via cpm

fwm via fwd

cpm via cpd

fwd via cpd

23. SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data.

Which component is NOT part of the SandBlast Mobile solution?

Management Dashboard

Gateway

Personal User Storage

Behavior Risk Engine

24. After finishing installation admin John likes to use top command in expert mode. John has to set the expert-password and was able to use top command. A week later John has to use the top command again, He detected that the expert password is no longer valid.

What is the most probable reason for this behavior?

“write memory” was not issued on clish

changes are only possible via SmartConsole

“save config” was not issued in expert mode

“save config” was not issued on clish

25. What is the purpose of Priority Delta in VRRP?

When a box up, Effective Priority = Priority + Priority Delta

When an Interface is up, Effective Priority = Priority + Priority Delta

When an Interface fail, Effective Priority = Priority C Priority Delta

When a box fail, Effective Priority = Priority C Priority Delta

26. What are the correct steps upgrading a HA cluster (M1 is active, M2 is passive) using Multi-Version Cluster (MVC)Upgrade?

1) Enable the MVC mechanism on both cluster members #cphaprob mvc on 2) Upgrade the passive node M2 to R81.20 3) In SmartConsole, change the version of the cluster object 4) Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism

1) Enable the MVC mechanism on both cluster members #cphaprob mvc on 2) Upgrade the passive node M2 to R81.20 3) In SmartConsole, change the version of the cluster object 4) Install the Access Control Policy 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy

1) In SmartConsole, change the version of the cluster object 2) Upgrade the passive node M2 to R81.20 3) Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 #cphaconf mvc on 4) Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy SmartConsole, change the version of the cluster object

1) Upgrade the passive node M2 to R81.20 2) Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 #cphaconf mvc on 3) In SmartConsole, change the version of the cluster object 4) Install the Access Control Policy 5) After examine the cluster states upgrade node M1 to R81.20 6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy upgrade the passive node M2 to R81.20

27. How can you grant GAiAAPI Permissions for a newly created user?

Assign the user a permission profile in SmartConsole

Assign the user the admin RBAC role in dish

No need to grant access since every user has access by default.

In bash, use the following command: "gaia_api access --user Tom -enable true"

28. In the R81 SmartConsole, on which tab are Permissions and Administrators defined?

Security Policies

Logs and Monitor

Manage and Settings

Gateways and Servers

29. Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

TCP port 19009

TCP Port 18190

TCP Port 18191

TCP Port 18209

30. To fully enable Dynamic Dispatcher on a Security Gateway:

run fw ctl multik set_mode 9 in Expert mode and then Reboot.

Using cpconfig, update the Dynamic Dispatcher value to “full” under the CoreXL menu.

Edit/proc/interrupts to include multik set_mode 1 at the bottom of the file, save, and reboot.

run fw multik set_mode 1 in Expert mode and then reboot.

Page 4 of 19

31. Ken wants to obtain a configuration lock from other administrator on R81 Security Management Server. He can do this via WebUI or via CLI.

Which command should he use in CLI? (Choose the correct answer.)

remove database lock

The database feature has one command lock database override.

override database lock

The database feature has two commands lock database override and unlock database. Both will work.

32. Which tool is used to enable ClusterXL?

SmartUpdate

cpconfig

SmartConsole

sysconfig

33. An established connection is going to www.google.com. The Application Control Blade Is inspecting the traffic.

If SecureXL and CoreXL are both enabled, which path is handling the traffic?

Slow Path

Fast Path

Medium Path

Accelerated Path

34. DLP and Geo Policy are examples of what type of Policy?

Standard Policies

Shared Policies

Inspection Policies

Unified Policies

35. In ClusterXL Load Sharing Multicast Mode:

only the primary member received packets sent to the cluster IP address

only the secondary member receives packets sent to the cluster IP address

packets sent to the cluster IP address are distributed equally between all members of the cluster

every member of the cluster received all of the packets sent to the cluster IP address

36. Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using

________ .

User Directory

Captive Portal and Transparent Kerberos Authentication

Captive Portal

UserCheck

37. What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

CCP and 18190

CCP and 257

CCP and 8116

CPC and 8116

38. Which is not a blade option when configuring SmartEvent?

Correlation Unit

SmartEvent Unit

SmartEvent Server

Log Server

39. John is using Management HA.

Which Smartcenter should be connected to for making changes?

secondary Smartcenter

active Smartenter

connect virtual IP of Smartcenter HA

primary Smartcenter

40. Tom has been tasked to install Check Point R81 in a distributed deployment.

Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

One machine, but it needs to be installed using SecurePlatform for compatibility purposes.

One machine

Two machines

Three machines

Page 5 of 19

41. Which command is used to add users to or from existing roles?

Add rba user roles

Add rba user

Add user roles

Add user

42. Which command lists all tables in Gaia?

fw tab Ct

fw tab Clist

fw-tab Cs

fw tab -1

43. Which of the following Check Point commands is true to enable Multi-Version Cluster (MVC)?

Check Point Security Management HA (Secondary): set cluster member mvc on

Check Point Security Gateway Only: set cluster member mvc on

Check Point Security Management HA (Primary): set cluster member mvc on

Check Point Security Gateway Cluster Member: set cluster member mvc on

44. To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following command in Expert mode then reboot:

fw ctl multik set_mode 1

fw ctl Dynamic_Priority_Queue on

fw ctl Dynamic_Priority_Queue enable

fw ctl multik set_mode 9

45. Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port.

Which CLISH commands are required to be able to change this TCP port?

set web ssl-port

set Gaia-portal port

set Gaia-portal https-port

set web https-port

46. Fill in the blank: With the User Directory Software Blade, you can create user definitions on a(n)_____________ Server.

SecurID

NT domain

LDAP

SMTP

47. What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Stateful Mode

VPN Routing Mode

Wire Mode

Stateless Mode

48. Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane.

Which is NOT an option to adjust or configure?

Severity

Automatic reactions

Policy

Threshold

49. Which is NOT an example of a Check Point API?

Gateway API

Management API

OPSC SDK

Threat Prevention API

50. Which is the command to identify the NIC driver before considering about the employment of the Multi-Queue feature?

show interface eth0 mq

ethtool A eth0

ifconfig -i eth0 verbose

ip show Int eth0

Page 6 of 19

51. Where do you create and modify the Mobile Access policy in R81?

SmartConsole

SmartMonitor

SmartEndpoint

SmartDashboard

52. What is not a purpose of the deployment of Check Point API?

Execute an automated script to perform common tasks

Create a customized GUI Client for manipulating the objects database

Create products that use and enhance the Check Point solution

Integrate Check Point products with 3rd party solution

53. The Check Point installation history feature in provides the following:

View install changes and install specific version

Policy Installation Date only

Policy Installation Date, view install changes and install specific version

View install changes

54. Which of the following is NOT a type of Endpoint Identity Agent?

Terminal

Light

Full

Custom

55. During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

Dropped without sending a negative acknowledgment

Dropped without logs and without sending a negative acknowledgment

Dropped with negative acknowledgment

Dropped with logs and without sending a negative acknowledgment

56. Which statement is correct about the Sticky Decision Function?

It is not supported with either the Performance pack of a hardware based accelerator card

Does not support SPI’s when configured for Load Sharing

It is automatically disabled if the Mobile Access Software Blade is enabled on the cluster

It is not required L2TP traffic

57. In CoreXL, the Firewall kernel is replicated multiple times. Each replicated copy or instance can perform the following:

The Firewall kernel only touches the packet if the connection is accelerated

The Firewall kernel is replicated only with new connections and deletes itself once the connection times out

The Firewall can run the same policy on all cores

The Firewall can run different policies per core

58. Which is NOT a SmartEvent component?

SmartEvent Server

Correlation Unit

Log Consolidator

Log Server

59. Which command is used to set the CCP protocol to Multicast?

cphaprob set_ccp multicast

cphaconf set_ccp multicast

cphaconf set_ccp no_broadcast

cphaprob set_ccp no_broadcast

60. When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

ThreatCloud is a database-related application which is located on-premise to preserve privacy of company-related data

ThreatCloud is a collaboration platform for all the CheckPoint customers to form a virtual cloud consisting of a combination of all on-premise private cloud environments

ThreatCloud is a collaboration platform for Check Point customers to benefit from VMWare ESXi infrastructure which supports the Threat Emulation Appliances as virtual machines in the EMC Cloud

ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary

Page 7 of 19

61. Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________ .

Sent to the Internal Certificate Authority.

Sent to the Security Administrator.

Stored on the Security Management Server.

Stored on the Certificate Revocation List.

62. What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

SmartCenter Server cannot reach this Security Gateway.

There is a blade reporting a problem.

VPN software blade is reporting a malfunction.

Security Gateway’s MGNT NIC card is disconnected.

63. SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run.

The default commands are:

ping, traceroute, netstat, and route

ping, nslookup, Telnet, and route

ping, whois, nslookup, and Telnet

ping, traceroute, netstat, and nslookup

64. What is the correct order of the default “fw monitor” inspection points?

i, o, l, O

i, l, o, O

1,2,3,4

l, i, O, o

65. Fill in the blank: The R81 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of

logs and shows then as prioritized security events.

SmartMonitor

SmartView Web Application

SmartReporter

SmartTracker

66. You want to gather data and analyze threats to your mobile device. It has to be a lightweight app.

Which application would you use?

Check Point Capsule Cloud

Sandblast Mobile Protect

SecuRemote

SmartEvent Client Info

67. What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?

Use Multi-Domain Management Server.

Choose different setting for log storage and SmartEvent db

Install Management and SmartEvent on different machines.

it is not possible.

68. What will SmartEvent automatically define as events?

Firewall

VPN

IPS

HTTPS

69. Which features are only supported with R81.20 Gateways but not R77.x?

Access Control policy unifies the Firewall, Application Control & URL Filtering, Data Awareness, and Mobile Access Software Blade policies.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

Time object to a rule to make the rule active only during specified times.

70. Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically

reset every

15 sec

60 sec

5 sec

30 sec

Page 8 of 19

71. You can access the ThreatCloud Repository from:

R81.20 SmartConsole and Application Wiki

Threat Prevention and Threat Tools

Threat Wiki and Check Point Website

R81.20 SmartConsole and Threat Prevention

72. There are 4 ways to use the Management API for creating host object with R81 Management API.

Which one is NOT correct?

Using Web Services

Using Mgmt_cli tool

Using CLISH

Using SmartConsole GUI console

Events are collected with SmartWorkflow from Trouble Ticket systems

73. What are valid Policy Types in R81.X?

Access Control, Threat Prevention, QoS, Desktop Security

Access Control, IPS, Threat Emulation, NAT

Access Control, IPS, QoS, DLP

Access Control, RemoteAccess VPN, NAT, IPS

74. Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

ffffffff

00000001

00000002

00000003

75. What should the admin do in case the Primary Management Server is temporary down?

Use the VIP in SmartConsole you always reach the active Management Server.

The Secondary will take over automatically Change the IP in SmartConsole to logon to the private IP of the Secondary Management Server.

Run the 'promote_util' to activate the Secondary Management server

Logon with SmartConsole to the Secondary Management Server and choose "Make Active' under Actions in the HA Management Menu

76. What is the limitation of employing Sticky Decision Function?

With SDF enabled, the involved VPN Gateways only supports IKEv1

Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF

With SDF enabled, only ClusterXL in legacy mode is supported

With SDF enabled, you can only have three Sync interfaces at most

77. View the rule below.

What does the lock-symbol in the left column mean? (Choose the BEST answer.)

The current administrator has read-only permissions to Threat Prevention Policy.

Another user has locked the rule for editing.

Configuration lock is present. Click the lock symbol to gain read-write access.

The current administrator is logged in as read-only because someone else is editing the policy.

78. Security Checkup Summary can be easily conducted within:

Summary

Views

Reports

Checkups

79. Main Mode in IKEv1 uses how many packages for negotiation?

depends on the make of the peer gateway

80. From SecureXL perspective, what are the three paths of traffic flow:

Initial Path; Medium Path; Accelerated Path

Layer Path; Blade Path; Rule Path

Firewall Path; Accelerated Path; Medium Path

Firewall Path; Accept Path; Drop Path

Page 9 of 19

81. What is the SOLR database for?

Used for full text search and enables powerful matching capabilities

Writes data to the database and full text search

Serves GUI responsible to transfer request to the DLE server

Enables powerful matching capabilities and writes data to the database

82. In which deployment is the security management server and Security Gateway installed on the same appliance?

Standalone

Remote

Distributed

Bridge Mode

83. The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Secure Internal Communication (SIC)

Restart Daemons if they fail

Transfers messages between Firewall processes

Pulls application monitoring status

84. SmartEvent does NOT use which of the following procedures to identify events:

Matching a log against each event definition

Create an event candidate

Matching a log against local exclusions

Matching a log against global exclusions

85. Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use which operating system?

Centos Linux

Gaia embedded.

Gaia

Red Hat Enterprise Linux version 5

86. Alice & Bob are concurrently logged In via SSH on the same Check Point Security Gateway as user "admin* however Bob was first logged in and acquired the lock Alice Is not aware that Bob is also togged in to the same Security Management Server as she is but she needs to perform very urgent configuration changes - which of the following GAlAclish command is true for overriding Bobs configuration database lock:

lock database override

unlock override database

unlock database override

database unlock override

87. Choose the correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI?

mgmt_cli add host name “myHost12 ip” address 10.50.23.90

mgmt_cli add host name ip-address 10.50.23.90

mgmt_cli add host “emailserver1” address 10.50.23.90

mgmt_cli add host name “emailserver1” ip-address 10.50.23.90

88. Where is the license for Check Point Mobile users installed?

The Primary Gateway

The Standby Gateway

The Endpoint Server

The Security Management Server

89. Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic.

Assuming acceleration is enabled which path is handling the traffic?

Slow Path

Medium Path

Fast Path

Accelerated Path

90. What is the best sync method in the ClusterXL deployment?

Use 1 cluster + 1st sync

Use 1 dedicated sync interface

Use 3 clusters + 1st sync + 2nd sync + 3rd sync

Use 2 clusters +1st sync + 2nd sync

Page 10 of 19

91. Fill in the blank: An Endpoint identity agent uses a________ for user authentication.

Shared secret

Username/password or Kerberos Ticket

Token

Certificate

92. Which command shows the current connections distributed by CoreXL FW instances?

fw ctl multik stat

fw ctl affinity -l

fw ctl instances -v

fw ctl iflist

93. Which component is NOT required to communicate with the Web Services API?

API key

session ID token

content-type

Request payload

94. Which one of the following is NOT a configurable Compliance Regulation?

GLBA

CJIS

SOCI

NCIPA

95. You have existing dbedit scripts from R77. Can you use them with R81.20?

dbedit is not supported in R81.20

dbedit is fully supported in R81.20

You can use dbedit to modify threat prevention or access policies, but not create or modify layers

dbedit scripts are being replaced by mgmt_cli in R81.20

96. In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log.

Which of the following options can you add to each Log, Detailed Log and Extended Log?

Accounting

Suppression

Accounting/Suppression

Accounting/Extended

97. Besides fw monitor, what is another command that can be used to capture packets?

arp

traceroute

tcpdump

ping

98. GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

Check Point Update Service Engine

Check Point Software Update Agent

Check Point Remote Installation Daemon (CPRID)

Check Point Software Update Daemon

99. Which process handles connection from SmartConsole R81?

fwm

cpmd

cpm

cpd

100. Check Point ClusterXL Active/Active deployment is used when:

Only when there is Multicast solution set up.

There is Load Sharing solution set up.

Only when there is Unicast solution set up.

There is High Availability solution set up.

Page 11 of 19

101. An administrator wishes to enable Identity Awareness on the Check Point firewalls. However, they allow users to use company issued or personal laptops.

Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

AD Query

Terminal Servers Agent

Identity Agents

Browser-Based Authentication

102. Using fw monitor you see the following inspection point notion E and i what does that mean?

E shows the packet before the VPN encryption, i after the inbound firewall VM

E shows the packet reaching the external interface, i leaving the internal interface

E shows the packet after the VPN encryption, i before the inbound firewall VM

E shows the packet leaving the external interface, i reaching the internal interface

103. Fill in the blank: The “fw monitor” tool can be best used to troubleshoot ____________________.

AV issues

VPN errors

Network traffic issues

Authentication issues

104. Fill in the blank: __________ information is included in “Full Log” tracking option, but is not included

in “Log” tracking option?

Destination port

Data type

File attributes

Application

105. If you needed the Multicast MAC address of a cluster, what command would you run?

cphaprob Ca if

cphaconf ccp multicast

cphaconf debug data

cphaprob igmp

106. What are the different command sources that allow you to communicate with the API server?

SmartView Monitor, API_cli Tool, Gaia CLI, Web Services

SmartConsole GUI Console, mgmt_cli Tool, Gaia CLI, Web Services

SmartConsole GUI Console, API_cli Tool, Gaia CLI, Web Services

API_cli Tool, Gaia CLI, Web Services

107. By default, which port does the WebUI listen on?

4434

443

8080

108. What are the main stages of a policy installation?

Initiation, Conversion and FWD REXEC

Verification, Commit, Installation

Initiation, Conversion and Save

Verification Compilation, Transfer and Commit

109. What are the three SecureXL Templates available in R81.20?

PEP Templates. QoS Templates. VPN Templates

Accept Templates. Drop Templates. NAT Templates

Accept Templates. Drop Templates. Reject Templates

Accept Templates. PDP Templates. PEP Templates

110. What is the command to check the status of Check Point processes?

top

cptop

cphaprob list

cpwd_admin list

Page 12 of 19

111. To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?

blada: application control AND action:drop

blade."application control AND action;drop

(blade: application control AND action;drop)

blade;"application control AND action:drop

112. Both ClusterXL and VRRP are fully supported by Gaia R81.20 and available to all Check Point appliances.

Which the following command is NOT related to redundancy and functions?

cphaprob stat

cphaprob Ca if

cphaprob Cl list

cphaprob all show stat

113. Which is the command to identify the NIC driver before considering about the employment of the Multi-Queue feature?

ip show int eth0

show interface eth0 mq

ifconfig -i eth0 verbose

ethtool -i eth0

114. What command can you use to have cpinfo display all installed hotfixes?

cpinfo -hf

cpinfo Cy all

cpinfo Cget hf

cpinfo installed_jumbo

115. According to the policy installation flow the transfer state (CPTA) is responsible for the code generated by the FWM. On the Security Gateway side a process receives them and first stores them Into a temporary directory.

Which process is true for receiving these Tiles;

FWD

CPD

FWM

RAD

116. You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.

What must you do to get SIC to work?

Remove Geo-Protection, as the IP-to-country database is updated externally, and you have no control of this.

Create a rule at the top in the Sydney firewall to allow control traffic from your network

Nothing - Check Point control connections function regardless of Geo-Protection policy

Create a rule at the top in your Check Point firewall to bypass the Geo-Protection

117. Which web services protocol is used to communicate to the Check Point R81 Identity Awareness Web API?

SOAP

REST

XLANG

XML-RPC

118. In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a

response before the peer host is declared ‘down’, you would set the_________?

life sign polling interval

life sign timeout

life_sign_polling_interval

life_sign_timeout

119. Fill in the blank: The R81 feature _____ permits blocking specific IP addresses for a specified time period.

Block Port Overflow

Local Interface Spoofing

Suspicious Activity Monitoring

Adaptive Threat Prevention

120. Mobile Access Gateway can be configured as a reverse proxy for Internal Web Applications Reverse proxy users browse to a URL that is resolved to the Security Gateway IP address.

Which of the following Check Point command is true for enabling the Reverse Proxy:

ReverseCLIProxy

ReverseProxyCLI

ReverseProxy

ProxyReverseCLI

Page 13 of 19

121. When a packet arrives at the gateway, the gateway checks it against the rules in the hop Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet.

Which of the following statements about the order of rule enforcement is true?

If the Action is Accept, the gateway allows the packet to pass through the gateway.

If the Action is Drop, the gateway continues to check rules in the next Policy Layer down.

If the Action is Accept, the gateway continues to check rules in the next Policy Layer down.

If the Action is Drop, the gateway applies the Implicit Clean-up Rule for that Policy Layer.

122. Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

$FWDIR/database/fwauthd.conf

$FWDIR/conf/fwauth.conf

$FWDIR/conf/fwauthd.conf

$FWDIR/state/fwauthd.conf

123. SecureXL is able to accelerate the Connection Rate using templates.

Which attributes are used in the template to identify the connection?

Source address. Destination address. Source Port, Destination port

Source address. Destination address. Destination port

Source address. Destination address. Destination port. Pro^col

Source address. Destination address. Source Port, Destination port. Protocol

124. UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users.

Which action is not supported in UserCheck objects?

Ask

Drop

Inform

Reject

125. Which of the following is NOT supported by CPUSE?

Automatic download of full installation and upgrade packages

Automatic download of hotfixes

Installation of private hotfixes

Offline installations

126. Which of the following is an authentication method used for Identity Awareness?

RSA

SSL

Captive Portal

PKI

127. True or False: In R81, more than one administrator can login to the Security Management Server with write permission at the same time.

False, this feature has to be enabled in the Global Properties.

True, every administrator works in a session that is independent of the other administrators.

True, every administrator works on a different database that is independent of the other administrators.

False, only one administrator can login with write permission.

128. The admin is connected via ssh lo the management server. He wants to run a mgmt_dl command but got a Error 404 message.

To check the listening ports on the management he runs netstat with the results shown below.

What can be the cause for the issue?

Wrong Management API Access setting^for Ihe client IP To correct it go to SmartConsole / Management & Settings / Blades / Management API and press "Advanced Settings..' and choose GUI clients or ALL IP's.

The API didn't run on the default port check it with api status' and add '-port 4434' to the mgmt_clt command.

The management permission in the user profile is mrssing. Go to SmartConsole / Management & Settings I Permissions & Administrators / Permission Profiles. Select the profile of the user and enable 'Management API Login' under Management Permissions

The API is not running, the services shown by netstat are the gaia services. To start the API run 'api start'

129. SandBlast appliances can be deployed in the following modes:

using a SPAN port to receive a copy of the traffic only

detect only

inline/prevent or detect

as a Mail Transfer Agent and as part of the traffic flow only

130. What is the amount of Priority Queues by default?

There are 8 priority queues and this number cannot be changed.

There is no distinct number of queues since it will be changed in a regular basis based on its system requirements.

There are 7 priority queues by default and this number cannot be changed.

There are 8 priority queues by default, and up to 8 additional queues can be manually configured

Page 14 of 19

131. What does Backward Compatibility mean upgrading the Management Server and how can you check it?

The Management Server is able to manage older Gateways. The lowest supported version is documented in the Installation and Upgrade Guide

The Management Server is able to manage older Gateways The lowest supported version is documented in the Release Notes

You will be able to connect to older Management Server with the SmartConsole. The lowest supported version is documented in the Installation and Upgrade Guide

You will be able to connect to older Management Server with the SmartConsole The lowest supported version is documented in the Release Notes

132. What is false regarding a Management HA environment?

Only one Management Server should be active, while any others be in standby mode

It is not necessary to establish SIC between the primary and secondary management server, since the latter gets the exact same copy of the management database from the prior.

SmartConsole can connect to any management server in Readonly mode.

Synchronization will occur automatically with each Publish event if the Standby servers are available.

133. SmartConsole R81 x requires the following ports to be open for SmartEvent.

19009, 19090 & 443

19009, 19004 & 18190

18190 & 443

19009, 18190 & 443

134. When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events.

What is this setting called and what are you defining?

Network, and defining your Class A space

Topology, and you are defining the Internal network

Internal addresses you are defining the gateways

Internal network(s) you are defining your networks

135. When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

RADIUS

Remote Access and RADIUS

AD Query

AD Query and Browser-based Authentication

136. Which statement is WRONG regarding the usage of the Central Deployment in SmartConsole?

You can install Hotfixes with the Central Deployment in SmartConsole

You can install Jumbo Hotfix accumulators with the Central Deployment in SmartConsole.

Only be installed Hotfixes can with the Central Deployment in SmartConsole

You can upgrade your cluster without user intervention with the Central Deployment in SmartConsole from R80.40 to R81.20.

137. Which Correction mechanisms are available with ClusterXL under R81.20?

Correction Mechanisms are only available of Maestro Hyperscale Orchestrators

Pre-Correction and SDF (Sticky Decision Function)

SDF (Sticky Decision Function) and Flush and ACK

Dispatcher (Early Correction) and Firewall (Late Correction)

138. When using the Mail Transfer Agent, where are the debug logs stored?

$FWDIR/bin/emaild.mta. elg

$FWDIR/log/mtad elg

/var/log/mail.mta elg

$CPDIR/log/emaild elg

139. Fill in the blank: The R81 utility fw monitor is used to troubleshoot ______________________.

User data base corruption

LDAP conflicts

Traffic issues

Phase two key negotiations

140. What destination versions are supported for a Multi-Version Cluster Upgrade?

R81.40 and later

R76 and later

R70 and Later

R81.20 and Later

Page 15 of 19

141. Kurt is planning to upgrade his Security Management Server to R81.X.

What is the lowest supported version of the Security Management he can upgrade from?

R76 Splat

R77.X Gaia

R75 Splat

R75 Gaia

142. Which Queue in the Priority Queue has the maximum priority?

High Priority

Control

Routing

Heavy Data Queue

143. What API command below creates a new host with the name “New Host” and IP address of “192.168.0.10”?

new host name “New Host” ip-address “192.168.0.10”

set host name “New Host” ip-address “192.168.0.10”

create host name “New Host” ip-address “192.168.0.10”

add host name “New Host” ip-address “192.168.0.10”

144. Which firewall daemon is responsible for the FW CLI commands?

fwd

fwm

cpm

cpd

145. There are 4 ways to use the Management API for creating host object with the Management API.

Which one is NOT correct?

Using cpconfig

Using CLISH

Using SmartConsole GUI console

Using Web Services

146. To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab.

How many options are available to calculate the traffic direction?

5 Network; Host; Objects; Services; API

3 Incoming; Outgoing; Network

2 Internal; External

4 Incoming; Outgoing; Internal; Other

147. Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.

After installation, is the administrator required to perform any additional tasks?

After upgrading the hardware, increase the number of kernel instances using cpconfig

Hyperthreading must be enabled in the bios to use CoreXL

Run cprestart from dish

Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores.

148. How do Capsule Connect and Capsule Workspace differ?

Capsule Connect provides a Layer3 VP

Capsule Workspace provides a Desktop with usable applications.

Capsule Workspace can provide access to any application.

Capsule Connect provides Business data isolation.

Capsule Connect does not require an installed application at client.

149. Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.

After installation, is the administrator required to perform any additional tasks?

Run cprestart from clish

After upgrading the hardware, increase the number of kernel instances using cpconfig

Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores

Hyperthreading must be enabled in the bios to use CoreXL

150. When installing a dedicated R81 SmartEvent server.

What is the recommended size of the root partition?

Any size

Less than 20GB

More than 10GB and less than 20GB

At least 20GB

Page 16 of 19

151. You need to change the MAC-address on eth2 interface of the gateway.

What is the correct way to change MAC-address in Check Point Gaia?

In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11

In expert-mode run ifconfig eth1 hw 11:11:11:11 11 11

In CLISH run set interface eth2 hw-addr 11 11 11:11:11 11

In expert-mode run: ethtool -4 eth2 mac 11 11:11:11:11:11

152. The WebUI offers several methods for downloading hotfixes via CPUSE except:

Automatic

Force override

Manually

Scheduled

153. How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

By dropping traffic from websites identified through ThreatCloud Verification and URL Caching

By dropping traffic that is not proven to be from clean websites in the URL Filtering blade

By allowing traffic from websites that are known to run Antivirus Software on servers regularly

By matching logs against ThreatCloud information about the reputation of the website

154. You are working with multiple Security Gateways enforcing an extensive number of rules.

To simplify security administration, which action would you choose?

Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.

Create a separate Security Policy package for each remote Security Gateway.

Create network objects that restricts all applicable rules to only certain networks.

Run separate SmartConsole instances to login and configure each Security Gateway directly.

155. What are valid authentication methods for mutual authenticating the VPN gateways?

PKI Certificates and Kerberos Tickets

PKI Certificates and DynamicID OTP

Pre-Shared Secrets and Kerberos Ticket

Pre-shared Secret and PKI Certificates

156. Bob works for a big security outsourcing provider company and as he receives a lot of change requests per day he wants to use for scripting daily tasks the API services (torn Check Point for the GAIA API. Firstly he needs to be aware if the API services are running for the GAIA operating system.

Which of the following Check Point Command is true:

gala_dlish status

status gaiaapi

api_gala status

gala_api status

157. Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______.

TCP Port 18190

TCP Port 18209

TCP Port 19009

TCP Port 18191

158. Which blades and or features are not supported in R81?

SmartEvent Maps

SmartEvent

Identity Awareness

SmartConsole Toolbars

159. Packet acceleration (SecureXL) identities connections by several attributes.

Which of the attributes is NOT used for identifying connection?

Source Port

TCP Acknowledgment Number

Source Address

Destination Address

160. What is the Implicit Clean-up Rule?

A setting is defined in the Global Properties for all policies.

A setting that is configured per Policy Layer.

Another name for the Clean-up Rule.

Automatically created when the Clean-up Rule is defined.

Page 17 of 19

161. Which of the SecureXL templates are enabled by default on Security Gateway?

Drop

NAT

None

162. Which of the following cannot be configured in an Access Role Object?

Networks

Machines

Users

Time

163. Automation and Orchestration differ in that:

Automation relates to codifying tasks, whereas orchestration relates to codifying processes.

Automation involves the process of coordinating an exchange of information through web service interactions such as XML and JSON, but orchestration does not involve processes.

Orchestration is concerned with executing a single task, whereas automation takes a series of tasks and puts them all together into a process workflow.

Orchestration relates to codifying tasks, whereas automation relates to codifying processes.

164. What is the default shell for the command line interface?

Expert

Clish

Admin

Normal

165. What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

Anti-Bot is the only countermeasure against unknown malware

Anti-Bot is the only protection mechanism which starts a counter-attack against known Command & Control Centers

Anti-Bot is the only signature-based method of malware protection.

Anti-Bot is a post-infection malware protection to prevent a host from establishing a connection to a Command & Control Center.

166. Which one of the following is true about Threat Extraction?

Always delivers a file to user

Works on all MS Office, Executables, and PDF files

Can take up to 3 minutes to complete

Delivers file only if no threats found

167. Which of the following process pulls application monitoring status?

fwd

fwm

cpwd

cpd

168. What is true of the API server on R81.20?

By default the API-server is activated and does not have hardware requirements.

By default the API-server is not active and should be activated from the WebU

By default the API server is active on management and stand-alone servers with 16GB of RAM (or more).

By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more).

169. Identity Awareness lets an administrator easily configure network access and auditing based on three items. Choose the correct statement.

Network location, the identity of a user and the identity of a machine.

Geographical location, the identity of a user and the identity of a machine.

Network location, the identity of a user and the active directory membership.

Network location, the telephone number of a user and the UID of a machine.

170. How long may verification of one file take for Sandblast Threat Emulation?

up to 1 minutes

within seconds cleaned file will be provided

up to 5 minutes

up to 3 minutes

Page 18 of 19

171. The fwd process on the Security Gateway sends logs to the fwd process on the Management Server, where it is forwarded to___________via____________

cpd, fwm

cpm, cpd

fwm, cpd

cpwd, fwssd

172. During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity.

Which of those hosts should you try to remediate first?

Host having a Critical event found by Threat Emulation

Host having a Critical event found by IPS

Host having a Critical event found by Antivirus

Host having a Critical event found by Anti-Bot

173. You have used the "set inactivity-timeout 120" command to prevent the session to be disconnected after 10 minutes of inactivity. However, the Web session is being disconnected after 10 minutes.

Why?

The idle timeout for the web session is specified with the "set web session-timeout" command.

The number specified is the amount of the idle timeout in seconds rather than in minutes. So you have to use the command "set inactivity-timeout 600" instead.

Probably, you have forgotten to make sure that nobody is accessing the management server via the SmartConsole which locks the management database.

The number of minutes is correct. Probably, you have forgotten to save this setting with the "save config" command.

174. Which command shows actual allowed connections in state table?

fw tab Ct StateTable

fw tab Ct connections

fw tab Ct connection

fw tab connections

175. Which of the following statements is TRUE about R81 management plug-ins?

The plug-in is a package installed on the Security Gateway.

Installing a management plug-in requires a Snapshot, just like any upgrade process.

A management plug-in interacts with a Security Management Server to provide new features and support for new products.

Using a plug-in offers full central management only if special licensing is applied to specific features of the plug-in.

176. In which scenario will an administrator need to manually define Proxy ARP?

When they configure an "Automatic Static NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.

When they configure an "Automatic Hide NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.

When they configure a "Manual Static NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.

When they configure a "Manual Hide NAT" which translates to an IP address that belongs to one of the firewall’s interfaces.

177. The essential means by which state synchronization works to provide failover in the event an active member goes down, ____________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.

ccp

cphaconf

cphad

cphastart

178. Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

50%

75%

80%

15%

179. Vanessa is a Firewall administrator. She wants to test a backup of her company’s production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment.

Which details she need to fill in System Restore window before she can click OK button and test the backup?

Server, SCP, Username, Password, Path, Comment, Member

Server, TFTP, Username, Password, Path, Comment, All Members

Server, Protocol, Username, Password, Path, Comment, All Members

Server, Protocol, username Password, Path, Comment, Member

180. Which command would you use to set the network interfaces’ affinity in Manual mode?

sim affinity -m

sim affinity -l

sim affinity -a

sim affinity -s

Page 19 of 19

181. If an administrator wants to add manual NAT for addresses now owned by the Check Point firewall, what else is necessary to be completed for it to function properly?

Nothing - the proxy ARP is automatically handled in the R81 version

Add the proxy ARP configurations in a file called /etc/conf/local.arp

Add the proxy ARP configurations in a file called $FWDIR/conf/local.arp

Add the proxy ARP configurations in a file called $CPDIR/conf/local.arp

182. What API command below creates a new host object with the name "My Host" and IP address of "192 168 0 10"?

set host name "My Host" ip-address "192.168.0.10"

new host name "My Host" ip-address "192 168.0.10"

create host name "My Host" ip-address "192.168 0.10"

mgmt.cli -m add host name "My Host" ip-address "192.168.0 10"

183. Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?

logd

fwd

fwm

cpd

184. What a valid SecureXL paths in R81.20?

F2F (Slow path). Templated Path. PQX and F2V

F2F (Slow path). PXL, QXL and F2V

F2F (Slow path), Accelerated Path, PQX and F2V

F2F (Slow path), Accelerated Path, Medium Path and F2V

185. What is the main difference between Threat Extraction and Threat Emulation?

Threat Emulation never delivers a file and takes more than 3 minutes to complete.

Threat Extraction always delivers a file and takes less than a second to complete.

Threat Emulation never delivers a file that takes less than a second to complete.

Threat Extraction never delivers a file and takes more than 3 minutes to complete.

186. Which command can you use to enable or disable multi-queue per interface?

cpmq set

Cpmqueue set

Cpmq config

St cpmq enable

TAGS:

156-315.81.20, 156-315.81.20 exam dumps

Notify of

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

Get 156-315.81.20 Dumps Full Version

Q&As: 617
Versions: PDF and Software Download Now

About Dumpsinfo

Dumpsinfo is a good platform providing the latest exam information and dumps questions for all IT certification exams. You can study all the latest exam dumps questions online.

[email protected]

Mon - Sat 9:00am - 6:00pm

156-315.81.20 Dumps Help You Study Objectives

Related

Posts

156-215.81.20 Dumps Questions – Effective Way to Get Certified

156-836 Online Dumps Boost Your Career

Advance Your Career by Using Online 156-586 Dumps

Check Point 156-585 Exam Questions Simulate Actual 156-585 Exam

About Us

EMAIL

Services

Opening Hours