CheckPoint Checkpoint Certifications 156-215.81 Questions & Answers

• Question 81:

  If an administrator wants to restrict access to a network resource only allowing certain users to access it, and only when they are on a specific network what is the best way to accomplish this?

  A. Create an inline layer where the destination is the target network resource Define sub- rules allowing only specific sources to access the target resource

  B. Use a "New Legacy User at Location", specifying the LDAP user group that the users belong to, at the desired location

  C. Create a rule allowing only specific source IP addresses access to the target network resource.

  D. Create an Access Role object, with specific users or user groups specified, and specific networks defined Use this access role as the "Source" of an Access Control rule

  Correct Answer: D

  The best way to restrict access to a network resource only allowing certain users to access it, and only when they are on a specific network, is to create an Access Role object, with specific users or user groups specified, and specific networks defined. Then, use this access role as the "Source" of an Access Control rule. This allows for granular control over network traffic based on user identity and location.

  References: Check Point R81 Security Gateway Administration Guide, page 13.

• Question 82:

  Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in:

  A. Since they both are logged in on different interfaces, they will both be able to make changes.

  B. When Joe logs in. Bob will be logged out automatically.

  C. The database will be locked by Bob and Joe will not be able to make any changes.

  D. Bob will receive a prompt that Joe has logged in.

  Correct Answer: A

  Since Bob and Joe both have Administrator Roles on their Gaia Platform and they both are logged in on different interfaces, they will both be able to make changes. Gaia allows multiple administrators to log in simultaneously and perform different tasks without locking the database or logging out each other. References: Gaia R81.20 Administration Guide, page 18.

• Question 83:

  What is the user ID of a user that have all the privileges of a root user?

  A. User ID 1

  B. User ID 2

  C. User ID 0

  D. User ID 99

  Correct Answer: C

  The user ID (UID) of a user that has all the privileges of a root user is 0. The root user is the superuser account that can perform any action on the system, such as changing file ownership, binding to network ports below 1024, or executing any command. The root user is identified by the UID 0, not by the name "root", which is just a convention. It is possible to have another user account with the name "root", but not with the same UID 0.

• Question 84:

  View the rule below. What does the pen-symbol in the left column mean?

  

  A. Those rules have been published in the current session.

  B. Rules have been edited by the logged in administrator, but the policy has not been published yet.

  C. Another user has currently locked the rules for editing.

  D. The configuration lock is present. Click the pen symbol in order to gain the lock.

  Correct Answer: B

  The pen-symbol in the left column means that the rules have been edited by the logged in administrator, but the policy has not been published yet. It indicates that the changes are not yet effective and can be discarded.References: Policy Editor, Publishing Changes

• Question 85:

  At what point is the Internal Certificate Authority (ICA) created?

  A. During the primary Security Management Server installation process.

  B. Upon creation of a certificate

  C. When an administrator decides to create one

  D. When an administrator initially logs into SmartConsole.

  Correct Answer: A

  The Internal Certificate Authority (ICA) is created during the primary Security Management Server installation process. The ICA is a component that issues and manages certificates for Check Point products. The ICA is automatically installed and initialized when installing the Security Management Server. References: Check Point R81 Security Management Administration Guide, page 26.

• Question 86:

  True or False: The destination server for Security Gateway logs depends on a Security Management Server configuration.

  A. False, log servers are configured on the Log Server General Properties

  B. True, all Security Gateways will only forward logs with a SmartCenter Server configuration

  C. True, all Security Gateways forward logs automatically to the Security Management Server

  D. False, log servers are enabled on the Security Gateway General Properties

  Correct Answer: B

  The destination server for Security Gateway logs depends on a Security Management Server configuration. This is true because the Security Management Server defines the log servers that receive logs from the Security Gateways. The log servers can be either the Security Management Server itself or a dedicated Log Server.

  References: Check Point R81 Logging and Monitoring Administration Guide, Check Point R81 Quantum Security Gateway Guide

• Question 87:

  A layer can support different combinations of blades What are the supported blades:

  A. Firewall. URLF, Content Awareness and Mobile Access

  B. Firewall (Network Access Control). Application and URL Filtering. Content Awareness and Mobile Access

  C. Firewall. NAT, Content Awareness and Mobile Access

  D. Firewall (Network Access Control). Application and URL Filtering and Content Awareness

  Correct Answer: D

  A layer can support different combinations of blades, but the supported blades are Firewall (Network Access Control), Application and URL Filtering, and Content Awareness. These blades provide granular control over network traffic based on

  applications, users, content, and risk. Mobile Access is not a supported blade in a layer.

  References:Check Point R81 Security Management Administration Guide, page 101. Check Point R81 Security Gateway Administration Guide, page 11.

• Question 88:

  Which two of these Check Point Protocols are used by ?

  A. ELA and CPD

  B. FWD and LEA

  C. FWD and CPLOG

  D. ELA and CPLOG

  Correct Answer: B

  The two Check Point Protocols that are used by are FWD and LEA. FWD is the Firewall Daemon that handles communication between different Check Point components, such as Security Management Server, Security Gateway, SmartConsole, etc. LEA is the Log Export API that allows external applications to retrieve logs from the Security Gateway or Security Management Server. Therefore, the correct answer is B. FWD and LEA. References: Border Gateway Protocol - Check Point Software, Check Point IPS Datasheet, List of valid protocols for services? - Check Point CheckMates

• Question 89:

  What is the BEST command to view configuration details of all interfaces in Gaia CLISH?

  A. ifconfig -a

  B. show interfaces

  C. show interfaces detail

  D. show configuration interface

  Correct Answer: D

  The BEST command to view configuration details of all interfaces in Gaia CLISH is show configuration interface. This command displays the interface name, IP address, netmask, state, MTU, and other parameters for each interface. ifconfig a, show interfaces, and show interfaces detail are not valid commands in Gaia CLISH. References: How to configure static routes in CLISH on Gaia OS and IPSO OS, GAIA CLISH Commands - Fir3net, Gaia Administration Guide R80 Check Point Software, Gaia Clish commands including User Defined (Extended) commands

• Question 90:

  Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.

  A. On all satellite gateway to satellite gateway tunnels

  B. On specific tunnels for specific gateways

  C. On specific tunnels in the community

  D. On specific satellite gateway to central gateway tunnels

  Correct Answer: C

  Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or on specific tunnels in the community. This option allows the administrator to select which tunnels should be permanent and which

  should be established on demand. The other options are not valid, as they do not match the available choices in the VPN community settings.

  References: [VPN Administration Guide], [Check Point R81.10]