CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 11:

  Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

  A. mgmt_cli add-host "Server_1" ip_address "10.15.123.10" --format txt

  B. mgmt_cli add host name "Server_1" ip-address "10.15.123.10" --format json

  C. mgmt_cli add object-host "Server_1" ip-address "10.15.123.10" --format json

  D. mgmt._cli add object "Server-1" ip-address "10.15.123.10" --format json

  Correct Answer: B

  The correct syntax to import a host object using mgmt_cli is mgmt_cli add host name ip-address --format 1. The name and ip-address parameters are mandatory, while the format parameter is optional and can be either json or txt. The other options are incorrect because they either use wrong parameters, wrong hyphens, or wrong object types. References: 1: Check Point Resource Library2

• Question 12:

  : 131

  Which command is used to display status information for various components?

  A. show all systems

  B. show system messages

  C. sysmess all

  D. show sysenv all

  Correct Answer: D

  The command used to display status information for various components is show sysenv all. This command provides comprehensive status information about the system's environment and various components, including hardware and software components. It can be useful for troubleshooting and monitoring the system's health.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.:

• Question 13:

  Customer's R81 management server needs to be upgraded to R81.20. What is the best upgrade method when the management server is not connected to the Internet?

  A. Export R81 configuration, clean install R81.20 and import the configuration

  B. CPUSE offline upgrade

  C. CPUSE online upgrade

  D. SmartUpdate upgrade

  Correct Answer: C

  CPUSE offline upgrade is the best upgrade method when the management server is not connected to the Internet. CPUSE (Check Point Upgrade Service Engine) is a tool that automates the process of upgrading and installing software packages on Check Point devices. CPUSE can work in online mode or offline mode. Online mode requires an Internet connection to download the packages from Check Point servers. Offline mode allows you to download the packages manually from another device and transfer them to the management server using a USB drive or SCP. References: Check Point Security Expert R81 Course, CPUSE Administration Guide

• Question 14:

  Which Check Point daemon monitors the other daemons?

  A. fwm

  B. cpd

  C. cpwd

  D. fwssd

  Correct Answer: C

  The Check Point daemon that monitors the other daemons is cpwd (Check Point Watchdog). It is responsible for monitoring the health and status of various Check Point daemons and processes running on the Security Gateway. If any daemon or process stops responding or encounters an issue, cpwd can restart it to ensure the continued operation of the Security Gateway.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 15:

  To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?

  A. Accept Template

  B. Deny Template

  C. Drop Template

  D. NAT Template

  Correct Answer: B

  SecureXL templates are a mechanism to accelerate the rate of connection establishment by grouping connections that match a particular service and whose sole differentiating element is the source port. SecureXL templates enable even the very first packets of a TCP handshake to be accelerated, without waiting for the Firewall kernel to create a connection entry. The first packets of the first connection on the same service will be forwarded to the Firewall kernel, which will then create a template of the connection. The template will contain all the relevant information for the connection, such as source and destination IP addresses, destination port, NAT information, policy decision, etc. The template will be used by SecureXL to handle subsequent connections on the same service, without involving the Firewall kernel. This reduces the CPU load and increases the throughput. There are three types of SecureXL templates: Accept, Drop, and NAT. Accept templates are used for connections that are allowed by the Firewall policy. Drop templates are used for connections that are blocked by the Firewall policy. NAT templates are used for connections that require NAT translation. Deny templates are not a valid type of SecureXL template. References: SecureXL NAT Templates in R80.20 and lower, Part 3 - SecureXL, Security Gateway Performance Optimization - Part 5 - SecureXL

• Question 16:

  What is the purpose of extended master key extension/session hash?

  A. UDP VOIP protocol extension

  B. In case of TLS1.x it is a prevention of a Man-in-the-Middle attack/disclosure of the client- server communication

  C. Special TCP handshaking extension

  D. Supplement DLP data watermark

  Correct Answer: B

  The extended master key extension/session hash is a feature introduced in TLS 1.3 to prevent a Man-in-the-Middle attack/disclosure of the client-server communication. It works by generating a unique session hash for each connection, which is derived from the master key and other parameters. This session hash is then used to authenticate the application data and the end-of-handshake messages, ensuring that no one can tamper with or eavesdrop on the communication. References: Check Point Security Expert R81 Course, TLS 1.3 RFC

• Question 17:

  Which of the following describes how Threat Extraction functions?

  A. Detect threats and provides a detailed report of discovered threats.

  B. Proactively detects threats.

  C. Delivers file with original content.

  D. Delivers PDF versions of original files with active content removed.

  Correct Answer: D

  Threat Extraction is a software blade that delivers PDF versions of original files with active content removed. Active content, such as macros, scripts, or embedded objects, can be used by attackers to deliver malware or exploit vulnerabilities. Threat Extraction removes or sanitizes the active content from the files and converts them to PDF format, which is safer and more compatible. Threat Extraction can also work together with Threat Emulation to provide both clean and original files to the users. References: Check Point Security Expert R81 Course, Threat Extraction Administration Guide

• Question 18:

  What is considered Hybrid Emulation Mode?

  A. Manual configuration of file types on emulation location.

  B. Load sharing of emulation between an on premise appliance and the cloud.

  C. Load sharing between OS behavior and CPU Level emulation.

  D. High availability between the local SandBlast appliance and the cloud.

  Correct Answer: B

  Hybrid Emulation Mode is a mode of operation that allows load sharing of emulation between an on premise appliance and the cloud. Emulation is a process that analyzes files for malicious behavior by running them in a virtual sandbox. Hybrid Emulation Mode enables you to optimize the performance and scalability of your Threat Emulation solution by distributing the emulation workload between your local SandBlast appliance and the Check Point cloud service. References: Check Point Security Expert R81 Course, Threat Emulation Administration Guide

• Question 19:

  Using ClusterXL, what statement is true about the Sticky Decision Function?

  A. Can only be changed for Load Sharing implementations

  B. All connections are processed and synchronized by the pivot

  C. Is configured using cpconfig

  D. Is only relevant when using SecureXL

  Correct Answer: A

  The Sticky Decision Function in ClusterXL is primarily used in Load Sharing implementations. In Load Sharing, the pivot member is responsible for determining the destination of new connections and ensures that traffic from the same source IP address is directed to the same cluster member. This ensures session stickiness for the same source IP, improving load sharing efficiency.

  References: Check Point Certified Security Expert R81 documentation and learning resources.

• Question 20:

  When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

  A. Threat Emulation

  B. HTTPS

  C. QOS

  D. VoIP

  Correct Answer: D

  When Dynamic Dispatcher is enabled, it dynamically assigns connections, but there are exceptions. The exception mentioned in the question is:

  VoIP (Option D): VoIP connections are an exception when Dynamic Dispatcher is enabled. They are not assigned dynamically but follow a different rule set to ensure quality and reliability for VoIP traffic. The other options, Threat Emulation (Option A), HTTPS (Option B), and QoS (Option C), are dynamically assigned when Dynamic Dispatcher is enabled.

  References: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.