CheckPoint CCSE 156-315.81 Questions & Answers

• Question 1:

  Which command shows detailed information about VPN tunnels?

  A. cat $FWDIR/conf/vpn.conf

  B. vpn tu tlist

  C. vpn tu

  D. cpview

  Correct Answer: B

  The command vpn tu tlist shows detailed information about VPN tunnels, such as the peer IP address, encryption domain, IKE phase 1 and phase 2 status, encryption algorithm, and tunnel uptime. The command vpn tu is an interactive tool that allows users to list, delete, or reconnect VPN tunnels. The command cpview is a real-time performance monitoring tool that shows various statistics about the system and network. References: VPN Administration Guide, SK97638 - What is cpview Utility and How to Use it

• Question 2:

  NO: 180

  What command can you use to have cpinfo display all installed hotfixes?

  A. cpinfo -hf

  B. cpinfo all

  C. cpinfo et hf

  D. cpinfo installed_jumbo

  Correct Answer: B

  The command cpinfo -y all can be used to have cpinfo display all installed hotfixes. Cpinfo is a tool that collects diagnostic data from a Check Point gateway or management server. The data includes configuration files, logs, status reports, and more. The -y parameter is used to specify which sections of data to include in the cpinfo output. The value all means to include all sections, including the hotfixes section, which shows the list of hotfixes installed on the system. References: Check Point Security Expert R81 Course, cpinfo Utility

• Question 3:

  : 156

  VPN Link Selection will perform the following when the primary VPN link goes down?

  A. The Firewall will drop the packets.

  B. The Firewall can update the Link Selection entries to start using a different link for the same tunnel.

  C. The Firewall will send out the packet on all interfaces.

  D. The Firewall will inform the client that the tunnel is down.

  Correct Answer: B

  VPN Link Selection is a feature that allows the Security Gateway to select the best link for each VPN tunnel based on the network topology and the Link Selection configuration1. When the primary VPN link goes down, the Firewall can update the Link Selection entries to start using a different link for the same tunnel, as long as the remote peer supports this feature and has multiple IP addresses configured2. This way, the VPN tunnel can be maintained without interruption or renegotiation. The other options are not correct because:

  

  Firewall

  A. The Firewall will not drop the packets, but will try to send them over another link if possible.

  

  Firewall

  C. The Firewall will not send out the packet on all interfaces, but will use the routing table to determine the best interface for each destination.

  

  Firewall

  D. The Firewall will not inform the client that the tunnel is down, but will try to keep the tunnel up by switching to another link. References: IPSec VPN - Link Selection, Outgoing VPN Link Selection on a gateway with multiple external interfaces

• Question 4:

  Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

  A. $FWDIR/database/fwauthd.conf

  B. $FWDIR/conf/fwauth.conf

  C. $FWDIR/conf/fwauthd.conf

  D. $FWDIR/state/fwauthd.conf

  Correct Answer: C

  The configuration file that contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status is $FWDIR/conf/fwauthd.conf. This file is used for configuring authentication services in Check Point Security Servers.

  References: Check Point documentation or training materials related to Security Server configuration.

• Question 5:

  What is mandatory for ClusterXL to work properly?

  A. The number of cores must be the same on every participating cluster node

  B. The Magic MAC number must be unique per cluster node

  C. The Sync interface must not have an IP address configured

  D. If you have "Non-monitored Private" interfaces, the number of those interfaces must be the same on all cluster members

  Correct Answer: B

  For ClusterXL to work properly, one of the mandatory requirements is that the Magic MAC number must be unique per cluster node. The Magic MAC number is a MAC address that is used by ClusterXL to hide the physical MAC addresses of the cluster members from the network. This way, the cluster can present a single virtual MAC address to the network, and avoid ARP issues when a failover occurs. The Magic MAC number is derived from the Cluster Virtual IP address, which must also be unique per cluster.

• Question 6:

  Which encryption algorithm is the least secured?

  A. AES-128

  B. AES-256

  C. DES

  D. 3DES

  Correct Answer: C

  DES (Data Encryption Standard) is a symmetric block cipher that uses a 56-bit key to encrypt and decrypt 64-bit blocks of data. It was developed by IBM in 1975 and adopted by the US government as a standard for encryption. However, DES has been proven to be insecure and vulnerable to various attacks, such as brute force, differential cryptanalysis, and linear cryptanalysis. A brute force attack can break DES in a matter of hours using modern hardware. Differential cryptanalysis can reduce the number of keys to be searched by a factor of four, and linear cryptanalysis can reduce it by a factor of two. Therefore, DES is the least secure encryption algorithm among the options given. References: Types of Encryption, Secure Organization's Data With These Encryption Algorithms, Comparative study of symmetric cryptographic algorithms

• Question 7:

  SmartConsole R81 requires the following ports to be open for SmartEvent R81 management:

  A. 19090,22

  B. 19190,22

  C. 18190,80

  D. 19009,443

  Correct Answer: D

  To use SmartConsole R81 for managing SmartEvent R81, you need to have the following ports open:

  Port 19009 for communication over HTTPS (443)

  Port 19009 for communication over HTTP (80)

  These ports are necessary for the SmartConsole to communicate with SmartEvent for management and monitoring purposes.

  References: Check Point Certified Security Expert R81 documentation and learning resources.

• Question 8:

  Which directory below contains log files?

  A. /opt/CPSmartlog-R81/log

  B. /opt/CPshrd-R81/log

  C. /opt/CPsuite-R81/fw1/log

  D. /opt/CPsuite-R81/log

  Correct Answer: C

  The directory /opt/CPsuite-R81/fw1/log contains the log files for the Security Gateway, such as firewall, VPN, IPS, and anti-virus logs1. These log files can be viewed and analyzed using SmartConsole or SmartView2. The other directories are not correct because:

  A. The directory /opt/CPSmartlog-R81/log contains the log files for the SmartLog server, which is a separate component that indexes and searches the logs from multiple Security Gateways3. B. The directory /opt/CPshrd-R81/log contains the log files for the shared components of the Check Point suite, such as cpwd, cpca, cpd, and cpwatchdog4. D. The directory /opt/CPsuite-R81/log does not exist by default and is not used for logging purposes. References: Logging and Monitoring R81 Administration Guide, SmartConsole R81 Help, SmartLog R81 Help, Check Point Processes and Daemons

• Question 9:

  Which of the following links will take you to the SmartView web application?

  A. https:///smartviewweb/

  B. https:///smartview/

  C. https://smartviewweb

  D. https:///smartview

  Correct Answer: B

  The SmartView web application is a web-based interface that allows you to view and analyze logs and events from your Security Gateways and Management Servers1. To access the SmartView web application, you need to use the following

  link:

  https:///smartview/. This link will prompt you to enter your credentials and then take you to the SmartView dashboard. The other options are not correct because:

  A. The link https:///smartviewweb/ is missing a slash (/) between the host name and smartviewweb. C. The link https://smartviewweb is missing a slash (/)

  after the host name and before smartviewweb. D. The link https:///smartview is missing a slash (/) at the end.

  References: Views and Reports Tutorial R80

• Question 10:

  Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic. Assuming acceleration is enabled which path is handling the traffic?

  A. Slow Path

  B. Medium Path

  C. Fast Path

  D. Accelerated Path

  Correct Answer: A

  When traffic from source 192.168.1.1 is going to www.google.com, and the Application Control Blade on the gateway is inspecting the traffic with acceleration enabled, it is handled by the Slow Path.

  A. Slow Path

  The Slow Path is responsible for handling traffic that requires full inspection by various security blades, including the Application Control Blade. Acceleration may offload some processing to the Medium Path or Fast Path, but the Slow Path is still involved in deeper inspection.

  References: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on traffic acceleration and processing paths.