CheckPoint CCSA 156-215.81 Questions & Answers

• Question 1:

  Which of the following is NOT a component of a Distinguished Name?

  A. Common Name

  B. Country

  C. User container

  D. Organizational Unit

  Correct Answer: C

  A Distinguished Name (DN) is a unique identifier for an entry in an LDAP directory. A DN consists of a sequence of relative distinguished names (RDNs) separated by commas. Each RDN is composed of an attribute type and an attribute value, such as cn=John Smith or ou=Sales. A DN can have different components depending on the structure and schema of the LDAP directory, but some common components are: Common Name (cn), Country? Organizational Unit (ou), Organization (o), State or Province (st), and Locality (l). User container is not a component of a DN. References: Check Point R81 Identity Awareness Administration Guide

• Question 2:

  What is NOT an advantage of Packet Filtering?

  A. Application Independence

  B. High Performance

  C. Scalability

  D. Low Security and No Screening above Network Layer

  Correct Answer: D

  Packet filtering is a technique that controls the flow of network data by examining the headers of packets and applying a set of rules to accept or reject them. Packet filtering has some advantages, such as efficiency, cost-effectiveness, ease of use, and transparency. However, it also has some disadvantages, such as low security and no screening above the network layer. Packet filtering firewalls cannot inspect the payload of packets or the application layer protocols, which makes them vulnerable to attacks that exploit higher-level vulnerabilitie

• Question 3:

  In the Check Point Security Management Architecture, which component(s) can store logs?

  A. SmartConsole

  B. Security Management Server and Security Gateway

  C. Security Management Server

  D. SmartConsole and Security Management Server

  Correct Answer: B

  The Security Management Server and the Security Gateway are the components that can store logs in the Check Point Security Management Architecture. The Security Management Server stores logs in a database and can also forward them to external log servers. The Security Gateway can store logs locally in a buffer or a local log file, and can also send them to the Security Management Server or a log server. References: Check Point Security Management Administration Guide R81, p. 11-12

• Question 4:

  How is communication between different Check Point components secured in R80? As with all questions, select the best answer.

  A. By using IPSEC

  B. By using SIC

  C. By using ICA

  D. By using 3DES

  Correct Answer: B

  The communication between different Check Point components is secured in R80 by using SIC. SIC stands for Secure Internal Communication and it is a mechanism that ensures the authenticity and confidentiality of communication between Check Point components, such as Security Gateways, Security Management Servers, Log Servers, etc. SIC uses certificates issued by the Internal CA (ICA) and encryption algorithms such as AES-25634. References: Check Point R81 Quantum Security Gateway Guide, Check Point R81 Quantum Security Management Administration Guide

• Question 5:

  Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance?

  A. Application Control

  B. Threat Emulation

  C. Logging and Status

  D. Monitoring

  Correct Answer: D

  The Check Point software blade that monitors Check Point devices and provides a picture of network and security performance is Monitoring. The Monitoring Software Blade presents a complete picture of network and security performance, enabling fast responses to changes in traffic patterns or security events. It centrally monitors Check Point devices and alerts security administrators to changes to gateways, endpoints, tunnels, remote users and security activities. References: Monitoring Software Blade, Check Point Integrated Security Architecture, Support, Support Requests, Training, Documentation, and Knowledge base for Check Point products and services

• Question 6:

  When installing a dedicated R80 SmartEvent server, what is the recommended size of the root partition?

  A. Any size

  B. Less than 20GB

  C. More than 10GB and less than 20 GB

  D. At least 20GB

  Correct Answer: D

  The correct answer is D because the recommended size of the root partition for a dedicated R80 SmartEvent server is at least 20GB. Any size, less than 20GB, or more than 10GB and less than 20GB are not sufficient for the SmartEvent server.

  References: Check Point R80.40 Installation and Upgrade Guide

• Question 7:

  Fill in the blank: Once a certificate is revoked from the Security GateWay by the Security Management Server, the certificate information is _______.

  A. Sent to the Internal Certificate Authority.

  B. Sent to the Security Administrator.

  C. Stored on the Security Management Server.

  D. Stored on the Certificate Revocation List.

  Correct Answer: D

  Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is stored on the Certificate Revocation List (CRL)1, p. 47. The CRL is a list of certificates that have been revoked before their expiration date. , Free Check Point CCSA Sample Questions and Study Guide

• Question 8:

  Which icon in the WebUI indicates that read/write access is enabled?

  A. Pencil

  B. Padlock

  C. Book

  D. Eyeglasses

  Correct Answer: A

  The icon in the WebUI that indicates that read/write access is enabled is the Pencil icon . The Pencil icon appears next to the name of the device when it is in Read/Write mode, which allows making changes to the configuration. The Padlock icon indicates that read- only access is enabled, which prevents making changes to the configuration. The Book icon indicates that online help is available, which provides information and guidance on using the WebUI. The Eyeglasses icon indicates that a view-only mode is enabled, which allows viewing the configuration without logging in. References: Gaia R81.10 Administration Guide, WebUI Overview

• Question 9:

  By default, which port does the WebUI listen on?

  A. 8080

  B. 80

  C. 4434

  D. 443

  Correct Answer: B

  By default, the WebUI listens on port 80. The WebUI is a web-based interface that allows administrators to configure and monitor Gaia OS settings and features from a web browser. The WebUI uses the HTTP protocol to communicate with the Gaia machine, which by default uses port 80 as the standard port number. The other port numbers are not used by the WebUI by default, but they can be changed by modifying the Gaia configuration file or using CLISH commands.

• Question 10:

  Can you use the same layer in multiple policies or rulebases?

  A. Yes - a layer can be shared with multiple policies and rules.

  B. No - each layer must be unique.

  C. No - layers cannot be shared or reused, but an identical one can be created.

  D. Yes - but it must be copied and pasted with a different name.

  Correct Answer: A

  You can use the same layer in multiple policies or rulebases. A layer is a set of rules that can be shared, reused, or inherited by different policies. This allows you to create modular and flexible security policies that can be applied to different scenarios.References: [Layers], [Policy Layers and Sub-Policies]