CheckPoint Checkpoint Certifications 156-215.81 Questions & Answers

• Question 91:

  Which statement describes what Identity Sharing is in Identity Awareness?

  A. Management servers can acquire and share identities with Security Gateways

  B. Users can share identities with other users

  C. Security Gateways can acquire and share identities with other Security Gateways

  D. Administrators can share identifies with other administrators

  Correct Answer: C

  Identity Sharing is a feature that allows Security Gateways to acquire and share identities with other Security Gateways, enabling identity-based access control across different network segments or domains. Management servers, users, and administrators do not share identities with Security Gateways. References: Identity Awareness R81.10 Administration Guide, Check Point R81.10

• Question 92:

  In which scenario will an administrator need to manually define Proxy ARP?

  A. When they configure an "Automatic Static NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.

  B. When they configure an "Automatic Hide NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.

  C. When they configure a "Manual Static NAT" which translates to an IP address that does not belong to one of the firewall's interfaces.

  D. When they configure a "Manual Hide NAT" which translates to an IP address that belongs to one of the firewall's interfaces.

  Correct Answer: C

  NAT (Network Address Translation) is a technique that modifies the IP addresses or ports of packets that pass through a security gateway. NAT can be configured in two ways: Automatic or Manual. Automatic NAT means that the NAT rules are generated automatically by the security gateway based on the NAT properties of network objects. Manual NAT means that the NAT rules are defined explicitly by the administrator in the NAT policy. Proxy ARP (Address Resolution Protocol) is a technique that allows a security gateway to answer ARP requests on behalf of other hosts. Proxy ARP is needed when a host on one network segment tries to communicate with a host on another network segment that has a different IP address than its own. In some scenarios, an administrator will need to manually define Proxy ARP for NAT to work properly. One such scenario is when they configure a Manual Static NAT which translates to an IP address that does not belong to one of the firewall's interfaces. References: Check Point R81 Network Address Translation Administration Guide

• Question 93:

  Which encryption algorithm is the least secured?

  A. 3DES

  B. AES-128

  C. DES

  D. AES-256

  Correct Answer: C

  This answer is correct because DES (Data Encryption Standard) is the least secured encryption algorithm among the options given. DES uses a 56-bit key, which is too short and can be easily cracked by brute force attacks. DES also suffers

  from other weaknesses, such as weak keys, complementation property, and linear cryptanalysis. The other answers are not correct because they are more secured encryption algorithms than DES. 3DES (Triple DES) is an improvement over

  DES that applies DES three times with different keys, resulting in a 168-bit key. AES-128 and AES-256 are variants of AES (Advanced Encryption Standard) that use 128-bit and 256-bit keys respectively. AES is considered to be the most

  secure symmetric encryption algorithm and is widely used for data protection.

  What is DES encryption, and why was it replaced?

  Data Encryption Standard - Wikipedia

  What is 3DES encryption?

  [What is AES encryption and how does it work?]

• Question 94:

  Fill in the blank: SmartConsole, SmartEvent GUI client, and ___________ allow viewing of billions of consolidated logs and shows them as prioritized security events.

  A. SmartView Web Application

  B. SmartTracker

  C. SmartMonitor

  D. SmartReporter

  Correct Answer: A

  SmartConsole, SmartEvent GUI client, and SmartView Web Application allow viewing of billions of consolidated logs and shows them as prioritized security events. SmartView Web Application is a web-based interface that provides access to SmartEvent reports and dashboards. References: Check Point R81 Security Management Administration Guide, Check Point R81 SmartEvent Administration Guide

• Question 95:

  In R80 Management, apart from using SmartConsole, objects or rules can also be modified using:

  A. 3rd Party integration of CLI and API for Gateways prior to R80.

  B. A complete CLI and API interface using SSH and custom CPCode integration.

  C. 3rd Party integration of CLI and API for Management prior to R80.

  D. A complete CLI and API interface for Management with 3rd Party integration.

  Correct Answer: B

  In R80 Management, apart from using SmartConsole, objects or rules can also be modified using a complete CLI and API interface using SSH and custom CPCode integration. This allows you to automate tasks, integrate with third-party tools, and create custom scripts . 3rd Party integration of CLI and API for Gateways or Management prior to R80 is not relevant for R80 Management. A complete CLI and API interface for Management with 3rd Party integration is not a specific option. References: [Check Point R81 Security Management Administration Guide], [Check Point Learning and Training Frequently Asked Questions (FAQs)]

• Question 96:

  Which of the following is considered a "Subscription Blade", requiring renewal every 1-3 years?

  A. IPS blade

  B. IPSEC VPN Blade

  C. Identity Awareness Blade

  D. Firewall Blade

  Correct Answer: A

  The following is considered a "Subscription Blade", requiring renewal every 1-3 years: IPS blade. The IPS blade is a software blade that provides protection against network attacks and exploits by inspecting traffic and blocking malicious packets. The IPS blade requires a subscription license that includes updates for the IPS signatures and Geo Protection database. Other subscription blades include Anti-Bot, Anti-Virus, URL Filtering, Application Control, Threat Emulation, and Threat Extraction. References: Check Point Licensing and Contract Operations User Guide

• Question 97:

  What command would show the API server status?

  A. cpm status

  B. api restart

  C. api status

  D. show api status

  Correct Answer: D

  The command api status shows the API server status, including whether it is enabled or not, the port number, and the API version. References: Check Point R81 API Reference Guide

• Question 98:

  Where can administrator edit a list of trusted SmartConsole clients?

  A. cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server.

  B. In cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients.

  C. WebUI client logged to Security Management Server, SmartDashboard: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients, via cpconfig on a Security Gateway.

  D. Only using SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients.

  Correct Answer: B

  The administrator can edit a list of trusted SmartConsole clients in three ways: in cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, and in SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients

• Question 99:

  Which two Identity Awareness daemons are used to support identity sharing?

  A. Policy Activation Point (PAP) and Policy Decision Point (PDP)

  B. Policy Manipulation Point (PMP) and Policy Activation Point (PAP)

  C. Policy Enforcement Point (PEP) and Policy Manipulation Point (PMP)

  D. Policy Decision Point (PDP) and Policy Enforcement Point (PEP)

  Correct Answer: D

  The two Identity Awareness daemons that are used to support identity sharing are Policy Decision Point (PDP) and Policy Enforcement Point (PEP). PDP is a daemon that runs on the Security Management Server or a dedicated Identity Awareness Server and provides identity information to other components. PEP is a daemon that runs on the Security Gateway and enforces identity-based rules based on the information received from the PDP. Identity sharing is a feature that allows PDPs and PEPs to exchange identity information across different domains or networks. References: [Check Point R81 Identity Awareness Administration Guide]

• Question 100:

  When dealing with rule base layers, what two layer types can be utilized?

  A. Ordered Layers and Inline Layers

  B. Inbound Layers and Outbound Layers

  C. R81.10 does not support Layers

  D. Structured Layers and Overlap Layers

  Correct Answer: A

  When dealing with rule base layers, two layer types can be utilized: Ordered Layers and Inline Layers5. Ordered Layers are executed sequentially according to their order in the policy. Inline Layers are embedded in a parent layer and are executed only if the parent rule matches. References: Check Point R81 Firewall Administration Guide, [Check Point R81 Security Management Administration Guide]