CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 31:

  Which of the following is NOT a type of Check Point API available in R81.x?

  A. Identity Awareness Web Services

  B. OPSEC SDK

  C. Mobile Access

  D. Management

  Correct Answer: C

  Check Point API is a set of web services that enable the usage of functions and commands in a dynamic and automated fashion. Check Point API is available in different types, each serving a different purpose and functionality. According to the Check Point Resource Library1, the following are the types of Check Point API available in R81.x: Identity Awareness Web Services: This type of API allows external applications to send identity and location information to the Security Gateway, which can then use this information for policy enforcement. Identity Awareness Web Services can be used for scenarios such as guest registration, captive portal, identity agents, etc. OPSEC SDK: This type of API provides a framework for developing applications that interact with Check Point products using the OPSEC (Open Platform for Security) protocol. OPSEC SDK can be used for scenarios such as log export, event management, anti-virus integration, etc. Management: This type of API allows external applications to perform management operations on the Check Point Management server using RESTful web services. Management API can be used for scenarios such as policy installation, object creation, configuration backup, etc. Mobile Access is not a type of Check Point API, but rather a feature that provides secure remote access to corporate resources from various devices. Mobile Access uses SSL VPN technology and supports different authentication methods and access scenarios. References: What is an API Gateway?, How to use Check Point API with Postman quick guide, Home - Check Point Developers, Introduction to RESTful APIs and JSON format, Checkpoint API tutorial, part 1 - getting started

• Question 32:

  As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

  A. That is used to deploy the mobile device as a generator of one-time passwords for authenticating to an RSA Authentication Manager.

  B. Fill Layer4 VPN SL VPN that gives users network access to all mobile applications.

  C. Full Layer3 VPN PSec VPN that gives users network access to all mobile applications.

  D. You can make sure that documents are sent to the intended recipients only.

  Correct Answer: C

  The feature that provides Full Layer3 VPN PSec VPN, giving users network access to all mobile applications, is the correct answer.

  Capsule Connect/VPN is used to establish secure VPN connections for mobile devices, and the Full Layer3 VPN (IPSec VPN) option provides comprehensive network access.

  References: Check Point documentation or training materials related to Mobile Access Methods and VPN configurations.

• Question 33:

  Which of the following is NOT a component of Check Point Capsule?

  A. Capsule Docs

  B. Capsule Cloud

  C. Capsule Enterprise

  D. Capsule Workspace

  Correct Answer: C

  Check Point Capsule is a suite of solutions designed to provide comprehensive mobile security and secure access. The components of Check Point Capsule include:

  Capsule Docs (Option A): A component that secures document sharing and protects sensitive data.

  Capsule Cloud (Option B): A component that provides cloud-based security services.

  Capsule Workspace (Option D): A component that provides secure workspace on mobile devices.

  Option C, "Capsule Enterprise," is not a recognized component of Check Point Capsule based on the available information. Therefore, it is the correct answer as the component that is NOT part of Check Point Capsule.

  References: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.

• Question 34:

  What scenario indicates that SecureXL is enabled?

  A. Dynamic objects are available in the Object Explorer

  B. SecureXL can be disabled in cpconfig

  C. fwaccel commands can be used in clish

  D. Only one packet in a stream is seen in a fw monitor packet capture

  Correct Answer: C

  SecureXL is a technology that accelerates the performance of the Check Point Security Gateway by offloading CPU-intensive operations from the Firewall kernel to the SecureXL device. SecureXL can handle various types of traffic, such as

  TCP, UDP, ICMP, non-IP, VPN, NAT, etc. SecureXL can also work with various features, such as CoreXL, ClusterXL, QoS, etc.

  One way to indicate that SecureXL is enabled is to use the fwaccel commands in clish. Clish is a command-line shell that provides a user-friendly interface for configuring and managing Check Point products. The fwaccel commands are used

  to control and monitor SecureXL operations, such as enabling or disabling SecureXL, viewing SecureXL statistics, managing SecureXL templates, etc. For example, the command fwaccel stat shows the status of SecureXL, such as whether it

  is on or off, how many packets are accelerated or not accelerated, etc.

  The other options are not valid indicators of SecureXL being enabled:

  A. Dynamic objects are available in the Object Explorer: Dynamic objects are objects that represent IP addresses that change over time, such as VPN clients, DHCP clients, etc. Dynamic objects are available in the Object Explorer regardless

  of whether SecureXL is enabled or not.

  B. SecureXL can be disabled in cpconfig: Cpconfig is a command-line tool that allows you to configure various settings of Check Point products, such as administrator password, GUI clients, SNMP extension, etc. SecureXL can be disabled in

  cpconfig only if it was enabled before. Therefore, this option does not indicate that SecureXL is enabled.

  D. Only one packet in a stream is seen in a fw monitor packet capture: Fw monitor is a command-line tool that allows you to capture and analyze network traffic passing through the Security Gateway. Fw monitor shows the traffic at different

  inspection points in the Firewall kernel. If SecureXL is enabled, some packets may be accelerated by SecureXL and bypass the Firewall kernel inspection. Therefore, fw monitor may not see all packets in a stream. However, this does not

  mean that only one packet in a stream will be seen by fw monitor. Some packets may still go through the Firewall kernel inspection and be seen by fw monitor. Therefore, this option does not indicate that SecureXL is enabled.

  Therefore, the correct answer is C.

  References: How to enable/disable Check Point SecureXL via CLI, Part 3 - SecureXL, What is SecureXL?, Clish - Command Line Interface Shell, sk30583: What is FW Monitor?

• Question 35:

  Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client communications, database manipulation, policy compilation and Management HA synchronization?

  A. cpwd

  B. fwd

  C. cpd

  D. fwm

  Correct Answer: D

  Firewall Management (fwm) is available on any management product, including Multi- Domain and on products that requite direct GUI access, such as SmartEvent, It provides the following: ?GUI Client communication ?Database manipulation ?Policy Compilation ?Management HA sync

• Question 36:

  Which command shows the current connections distributed by CoreXL FW instances?

  A. fw ctl multik stat

  B. fw ctl affinity -l

  C. fw ctl instances -v

  D. fw ctl iflist

  Correct Answer: A

  CoreXL is a performance-enhancing technology that enables the processing CPU cores to concurrently perform multiple tasks on Security Gateways with multiple CPU cores. CoreXL replicates the Firewall kernel multiple times, creating multiple Firewall instances that run on different CPU cores. These Firewall instances handle traffic concurrently, and each Firewall instance is a complete and independent Firewall inspection kernel. To show the current connections distributed by CoreXL FW instances, you can use the command fw ctl multik stat on the Security Gateway. This command will display information such as the number of connections, packets, bytes, drops, and errors handled by each CoreXL FW instance, as well as the CPU utilization and affinity of each instance. The other options are not correct because:

  B. fw ctl affinity -l: This command will show the CPU affinity of all processes and IRQs on the Security Gateway. It will not show the current connections distributed by CoreXL FW instances. C. fw ctl instances -v: This command will show the details of all CoreXL FW instances on the Security Gateway, such as their ID, type, state, priority, and interfaces. It will not show the current connections distributed by CoreXL FW instances.

  D. fw ctl iflist: This command will show the list of all interfaces on the Security Gateway, along with their names References: Part 3 - SecureXL, What is CoreXL and SecureXL, SecureXL Fast Accelerator (fw fast_accel) for R80.20 and above

• Question 37:

  SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

  A. Analyzes each log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server.

  B. Correlates all the identified threats with the consolidation policy.

  C. Collects syslog data from third party devices and saves them to the database.

  D. Connects with the SmartEvent Client when generating threat reports.

  Correct Answer: A

  The Correlation Unit in SmartEvent architecture has the function of analyzing each log entry as it arrives at the log server according to the Event Policy. When it identifies a threat pattern, it forwards an event to the SmartEvent Server. This is an essential function in threat detection and analysis, as it helps in identifying and alerting about security threats based on the configured policies.

  Option A correctly describes the function of the Correlation Unit, making it the verified answer.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 38:

  How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

  A. Install appliance TE250X on SpanPort on LAN switch in MTA mode.

  B. Install appliance TE250X in standalone mode and setup MTA.

  C. You can utilize only Check Point Cloud Services for this scenario.

  D. It is not possible, always Check Point SGW is needed to forward emails to SandBlast appliance.

  Correct Answer: C

  To deploy a TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway, you can utilize Check Point Cloud Services. In this scenario, you can leverage cloud-based email security services provided by Check Point without the need for an on-premises Security Gateway.

  Option C correctly states that you can use only Check Point Cloud Services for this scenario, making it the verified answer.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 39:

  How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

  A. cphaprob set int fwha_vmac_global_param_enabled 1

  B. clusterXL set int fwha_vmac_global_param_enabled 1

  C. fw ctl set int fwha_vmac_global_param_enabled 1

  D. cphaconf set int fwha_vmac_global_param_enabled 1

  Correct Answer: C

  To enable VMAC mode on a cluster member, you need to set the value of the global kernel parameter fwha_vmac_global_param_enabled to 1. This can be done on- the-fly using the command fw ctl set int fwha_vmac_global_param_enabled 1 on all cluster members. This command does not require a reboot or a policy installation. VMAC mode allows the cluster to use a virtual MAC address for its virtual IP addresses, which reduces the number of gratuitous ARP packets sent upon failover and avoids ARP cache issues on some routers and switches. References: How to enable ClusterXL Virtual MAC (VMAC) mode

• Question 40:

  You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the FWD daemon to do a Full Synchronization?

  A. TCP port 443

  B. TCP port 257

  C. TCP port 256

  D. UDP port 8116

  Correct Answer: C

  The FWD daemon uses TCP port 256 to do a Full Synchronization between gateway cluster members. This port is also used for other synchronization types, such as Delta Synchronization and Accelerated Synchronization. The FWD daemon is responsible for synchronizing the connections table, NAT table, and VPN keys between cluster members. References: ClusterXL Administration Guide, SK25977 - Ports Used by Check Point Software