CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 101:

  Which of the following process pulls application monitoring status?

  A. fwd

  B. fwm

  C. cpwd

  D. cpd

  Correct Answer: D

  The process that pulls application monitoring status is cpd. cpd is a daemon that runs on Check Point products and performs various tasks related to management communication, policy installation, license verification, logging, etc. cpd also monitors the status of other processes and applications on the system and reports it to the management server. cpd uses SNMP to collect information from various sources, such as blades, gateways, servers, etc. You can view the application monitoring status in SmartConsole by using the Gateways and Servers tab in the Logs and Monitor view. References: Check Point Processes and Daemons

• Question 102:

  Which command collects diagnostic data for analyzing customer setup remotely?

  A. cpinfo

  B. migrate export

  C. sysinfo

  D. cpview

  Correct Answer: A

  CPInfo is an auto-updatable utility that collects diagnostics data on a customer's machine at the time of execution and uploads it to Check Point servers (it replaces the standalone cp_uploader utility for uploading files to Check Point servers).

  The CPInfo output file allows analyzing customer setups from a remote location. Check Point support engineers can open the CPInfo file in a demo mode, while viewing actual customer Security Policies and Objects. This allows the in-depth

  analysis of customer's configuration and environment settings.

  References:

• Question 103:

  Where you can see and search records of action done by R81 SmartConsole administrators?

  A. In SmartView Tracker, open active log

  B. In the Logs and Monitor view, select "Open Audit Log View"

  C. In SmartAuditLog View

  D. In Smartlog, all logs

  Correct Answer: B

  The Audit Log is a feature that records all the actions performed by R81 SmartConsole administrators, such as logging in, logging out, publishing, installing policy, creating objects, modifying rules, etc. You can see and search records of

  action done by R81 SmartConsole administrators by following these steps:

  In SmartConsole, go to Logs and Monitor view.

  In the left pane, select Open Audit Log View.

  In the right pane, you will see a table that shows all the audit log records. You can filter, sort, group, or search the records by using the toolbar options. You can also double-click on a record to see more details in a pop-up window.

  References: R81 Logging and Monitoring Administration Guide

• Question 104:

  The Firewall kernel is replicated multiple times, therefore: A. The Firewall kernel only touches the packet if the connection is accelerated

  B. The Firewall can run different policies per core

  C. The Firewall kernel is replicated only with new connections and deletes itself once the connection times out

  D. The Firewall can run the same policy on all cores.

  Correct Answer: D

  On a Security Gateway with CoreXL enabled, the Firewall kernel is replicated multiple times. Each replicated copy, or instance, runs on one processing core. These instances handle traffic concurrently, and each instance is a complete and

  independent inspection kernel. When CoreXL is enabled, all the kernel instances in the Security Gateway process traffic through the same interfaces and apply the same security policy.

  References:

• Question 105:

  What happen when IPS profile is set in Detect Only Mode for troubleshooting?

  A. It will generate Geo-Protection traffic

  B. Automatically uploads debugging logs to Check Point Support Center

  C. It will not block malicious traffic

  D. Bypass licenses requirement for Geo-Protection control

  Correct Answer: C

  It is recommended to enable Detect-Only for Troubleshooting on the profile during the initial installation of IPS. This option overrides any protections that are set to Prevent so that they will not block any traffic. During this time you can analyze

  the alerts that IPS generates to see how IPS will handle network traffic, while avoiding any impact on the flow of traffic.

  References:

• Question 106:

  What is the difference between an event and a log?

  A. Events are generated at gateway according to Event Policy

  B. A log entry becomes an event when it matches any rule defined in Event Policy

  C. Events are collected with SmartWorkflow form Trouble Ticket systems

  D. Log and Events are synonyms

  Correct Answer: B

  The difference between an event and a log is that a log entry becomes an event when it matches any rule defined in Event Policy. A log entry is a record of a network activity that is generated by a Security Gateway or a Management Server. An event is a log entry that meets certain criteria and triggers an action or a notification. The other options are either not true or not accurate definitions of events and logs. References: Check Point R81 Logging and Monitoring Administration Guide

• Question 107:

  Fill in the blank: The tool _____ generates a R81 Security Gateway configuration report.

  A. infoCP

  B. infoview

  C. cpinfo

  D. fw cpinfo

  Correct Answer: C

  The cpinfo tool generates a R81 Security Gateway configuration report that includes information about the hardware, operating system, product version, patches, and configuration settings. References: cpinfo - Check Point Support Center

• Question 108:

  Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______ .

  A. TCP Port 18190

  B. TCP Port 18209

  C. TCP Port 19009

  D. TCP Port 18191

  Correct Answer: D

  Check Point Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC using TCP port 18191 by default. CDT is a tool that allows you to perform simultaneous configuration changes on multiple gateways or clusters using predefined commands or scripts. References: Check Point Central Deployment Tool (CDT)

• Question 109:

  Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process:

  A. Allow GUI Client and management server to communicate via TCP Port 19001

  B. Allow GUI Client and management server to communicate via TCP Port 18191

  C. Performs database tasks such as creating, deleting, and modifying objects and compiling policy.

  D. Performs database tasks such as creating, deleting, and modifying objects and compiling as well as policy code generation.

  Correct Answer: C

• Question 110:

  Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

  A. Symmetric routing

  B. Failovers

  C. Asymmetric routing

  D. Anti-Spoofing

  Correct Answer: C

  Sticky Decision Function (SDF) is required to prevent asymmetric routing in an Active-Active cluster. Asymmetric routing occurs when packets from a source to a destination follow a different path than packets from the destination to the source. This can cause problems with stateful inspection and NAT. SDF ensures that packets from the same connection are handled by the same cluster member1. References: Check Point R81 ClusterXL Administration Guide