CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 551:

  Besides fw monitor, what is another command that can be used to capture packets?

  A. arp

  B. traceroute

  C. tcpdump

  D. ping

  Correct Answer: C

  Tcpdump is a tool that captures and analyzes network traffic on a given interface2. It can be used to troubleshoot connectivity or performance issues, or to inspect the content of the packets2. To use tcpdump, you need to access the Security Gateway in expert mode and run tcpdump -i [options] [filter]2. You can specify various options and filters to customize the output, such as source or destination IP address, port number, protocol, packet size, etc2. You can also save the captured packets to a file for later analysis by using the -w option2. For more information about tcpdump, you can run man tcpdump or visit the official website3.

• Question 552:

  Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible. Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

  A. fw tab -t connections -s

  B. fw tab -t connections

  C. fw tab -t connections -c

  D. fw tab -t connections -f

  Correct Answer: B

  The command that may impact performance briefly and should not be used during heavy traffic times of day is fw tab -t connections. This command displays all the entries in the connections table, which can be very large and consume a lot of CPU resources. The other commands are less intensive and can be used safely. The command fw tab -t connections -s displays only the statistics of the connections table, such as number of entries, peak size, etc. The command fw tab -t connections -c clears all the entries in the connections table. The command fw tab -t connections -f displays only the entries that match a filter expression. References: [fw tab Command]

• Question 553:

  Using AD Query, the security gateway connections to the Active Directory Domain Controllers using what protocol?

  A. Windows Management Instrumentation (WMI)

  B. Hypertext Transfer Protocol Secure (HTTPS)

  C. Lightweight Directory Access Protocol (LDAP)

  D. Remote Desktop Protocol (RDP)

  Correct Answer: A

  Windows Management Instrumentation (WMI) is a protocol that allows remote management and monitoring of Windows systems. It is used by AD Query to connect to the Active Directory Domain Controllers and query them for user and computer information. AD Query uses WMI to get real-time updates on user logon events, group membership changes, and computer status changes. WMI is not the same as LDAP, which is a protocol for accessing and modifying directory services. HTTPS and RDP are also different protocols that are not used by AD Query. References: Check Point R81 Identity Awareness Administration Guide, page 17

• Question 554:

  In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

  A. Pentagon

  B. Combined

  C. Meshed

  D. Star

  Correct Answer: D

  A star VPN community is a type of VPN community that allows a central gateway to create VPN tunnels with multiple satellite gateways or hosts, but does not allow satellite gateways or hosts to create VPN tunnels with each other. This type of community is suitable for hub-and-spoke topologies, where the central gateway acts as the hub and the satellite gateways or hosts act as the spokes. The central gateway can initiate or terminate VPN traffic to any satellite member, but the satellite members can only initiate or terminate VPN traffic to the central gateway.

• Question 555:

  What is the command switch to specify the Gaia API context?

  A. You have to specify it in the YAML file api.yml which is located underneath the /etc. directory of the security management server

  B. You have to change to the zsh-Shell which defaults to the Gaia API context.

  C. No need to specify a context, since it defaults to the Gaia API context.

  D. mgmt_cli --context gaia_api

  Correct Answer: D

  The command switch to specify the Gaia API context is mgmt_cli --context gaia_api . This switch allows the user to execute Gaia OS commands through the management API. The Gaia API context is different from the default management API context, which is used to execute commands related to the security policy and objects1. References: Check Point R81 Management API Reference Guide

• Question 556:

  When Configuring Endpoint Compliance Settings for Applications and Gateways within Mobile Access, which of the three approaches will allow you to configure individual policies for each application?

  A. Basic Approach

  B. Strong Approach

  C. Very Advanced Approach

  D. Medium Approach

  Correct Answer: C

  The approach that will allow you to configure individual policies for each application when configuring Endpoint Compliance Settings for Applications and Gateways within Mobile Access is Very Advanced Approach. This approach lets you define compliance rules for each application separately and assign different actions for each rule. You can also create custom messages and notifications for each application. The other approaches are either less granular or not applicable in this scenario. The Basic Approach lets you define compliance rules for all applications globally and assign a single action for all rules. The Medium Approach lets you define compliance rules for all applications globally and assign different actions for each rule. The Strong Approach is not a valid option for Endpoint Compliance Settings. References: [Endpoint Compliance Settings]

• Question 557:

  Fill in the blank: A ________ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser.

  A. Clientless remote access

  B. Clientless direct access

  C. Client-based remote access

  D. Direct access

  Correct Answer: A

  A clientless remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. A clientless remote access VPN does not require any software installation or configuration on the user's device. Instead, it uses a web-based portal that acts as a proxy between the user and the corporate resources. The user can access web applications and services through the portal using a standard web browser that supports SSL/TLS encryption. The portal can also provide single sign-on (SSO) capabilities for SAML-enabled applications. A clientless remote access VPN is suitable for scenarios where users need to access mainly web-based resources from unmanaged devices or devices that cannot run VPN clients. The other options are incorrect because: A client-based remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by installing a VPN client software on the user's device. A client-based remote access VPN requires software installation and configuration on the user's device. It uses IPsec or SSL/TLS protocols to create a secure tunnel between the user's device and the VPN gateway. The user can access any type of resource through the tunnel using any application that supports TCP/IP protocols. A client-based remote access VPN is suitable for scenarios where users need to access various types of resources from managed devices or devices that can run VPN clients. A clientless direct access deployment is not a valid term for a VPN deployment. Direct access is a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user's device and the direct access server. A direct access deployment is not a term for a VPN deployment, but a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user's device and the direct access server.

• Question 558:

  According to the policy installation flow the transfer state (CPTA) is responsible for the code generated by the FWM. On the Security Gateway side a process receives them and first stores them Into a temporary directory. Which process is true for receiving these Tiles;

  A. FWD

  B. CPD

  C. FWM

  D. RAD

  Correct Answer: A

  FWD is a process that runs on both Security Management Server and Security Gateway. On Security Management Server, FWD handles logging and communication with SmartConsole. On Security Gateway, FWD receives policy files from FWM (the policy compiler process on Security Management Server) and stores them in a temporary directory before installing them on the firewall kernel7. Therefore, FWD is responsible for receiving policy files from FWM on Security Gateway side. The correct answer is A. References: 7: Check Point Processes and Daemons

• Question 559:

  What is the correct Syntax for adding an access-rule via R80 API?

  A. add access-rule layer "Network" action "Allow"

  B. add access-rule layer "Network" position 1 name "Rule 1" service. 1 "SMTP" service.2 "hup"

  C. add access-rule and follow the wizard

  D. add rule position 1 name "Rule 1" policy-package "Standard" add service "http"

  Correct Answer: B

  The correct syntax for adding an access-rule via R80 API is to use the add access-rule command with the layer, position, name, and service parameters. The layer parameter specifies the name of the access control policy layer where the rule will be added. The position parameter specifies the ordinal number in which to place the rule in the rulebase. The name parameter specifies the name of the rule. The service parameter specifies one or more services that match this rule. References: [Check Point Security Expert R81 API Reference Guide], page 18.

• Question 560:

  There are 4 ways to use the Management API for creating host object with the Management API. Which one is NOT correct?

  A. Using cpconfig

  B. Using CLISH

  C. Using SmartConsole GUI console

  D. Using Web Services

  Correct Answer: A