CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 51:

  In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with ____________ will not apply.

  A. ffff

  B. 1

  C. 2

  D. 3

  Correct Answer: B

  In the Check Point Firewall Kernel Module, each kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with 1 will not apply, as they are related to NAT, VPN, or other features that are not supported in Wire Mode. Wire Mode is a mode of operation that allows transparent traffic forwarding without any inspection or modification by the firewall. References: Check Point Security Expert R81 Course, Wire Mode Configuration Guide

• Question 52:

  You need to see which hotfixes are installed on your gateway, which command would you use?

  A. cpinfo all

  B. cpinfo hotfix

  C. cpinfo hotfix

  D. cpinfo all

  Correct Answer: D

  The command cpinfo all displays information about all the hotfixes that are installed on the gateway1. This command also shows the hotfix ID, description, installation date, and status for each hotfix2. The other commands are not valid options for this task. The command cpinfo all shows the hardware information of the gateway3. The commands cpinfo hotfix and cpinfo hotfix do not exist and will return an error message. References: Hotfix installer - Configuration Manager, How to keep your Security Gateways up to date, Solved: Does it always need to have the higher hotfix vers...

• Question 53:

  What component of R81 Management is used for indexing?

  A. DBSync

  B. API Server

  C. fwm

  D. SOLR

  Correct Answer: D

  The component of R81 Management that is used for indexing is SOLR. SOLR is an open-source enterprise search platform that provides fast and scalable indexing and searching capabilities. SOLR is used by SmartConsole to index the objects and rules in the security policy, as well as the logs and events in SmartLog and SmartEvent. SOLR enables quick and easy access to the relevant information in the management database. References: Check Point Security Expert R81 Course, SOLR Troubleshooting

• Question 54:

  Please choose correct command to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI?

  A. host name myHost12 ip-address 10.50.23.90

  B. mgmt: add host name ip-address 10.50.23.90

  C. add host name emailserver1 ip-address 10.50.23.90

  D. mgmt: add host name emailserver1 ip-address 10.50.23.90

  Correct Answer: D

  The correct command to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI is mgmt: add host name emailserver1 ip-address 10.50.23.90. This command will create a new host object in the Security Management Server database, with the specified name and IP address. The mgmt: prefix indicates that the command is executed on the Security Management Server, and not on the local GAiA machine. The other commands are either missing the mgmt: prefix, or have incorrect syntax or parameters.

• Question 55:

  Which one of the following is true about Capsule Connect?

  A. It is a full layer 3 VPN client

  B. It offers full enterprise mobility management

  C. It is supported only on iOS phones and Windows PCs

  D. It does not support all VPN authentication methods

  Correct Answer: A

  Capsule Connect is a full layer 3 VPN client that provides secure and seamless remote access to corporate networks from iOS and Android devices. It supports all VPN authentication methods, such as certificates, passwords, tokens, and challenge- response. It also supports split tunneling and seamless roaming. References: Capsule Connect Datasheet, Capsule Connect Administration Guide

• Question 56:

  John is using Management HA. Which Smartcenter should be connected to for making changes?

  A. secondary Smartcenter

  B. active Smartenter

  C. connect virtual IP of Smartcenter HA

  D. primary Smartcenter

  Correct Answer: B

  Management HA is a feature that allows the Security Management server to have one or more backup Standby Security Management servers that are ready to take over in case of failure1. The Active Security Management server is the one that handles all the management operations, such as policy installation, object creation, configuration backup, etc. The Standby Security Management servers are synchronized with the Active Security Management server and store the same data, such as databases, certificates, CRLs, etc. The Standby Security Management servers can also perform some operations, such as fetching a Security Policy or retrieving a CRL1. To make changes to the system, such as editing objects or policies, the administrator needs to connect to the Active Security Management server. This is because the Active Security Management server is the only one that can modify the data and synchronize it with the Standby Security Management servers. The administrator can use SmartConsole to connect to the Active Security Management server by entering its IP address or hostname1. The administrator can also use SmartDashboard to connect to the Active Security Management server by selecting Policy > Management High Availability. This shows information about the Security Management server that includes its peers - displayed with the name, status and type of Security Management server1. The other options are incorrect because:

  A. secondary Smartcenter: This is a synonym for a Standby Security Management server, which cannot be used to make changes to the system. C. connect virtual IP of Smartcenter HA: This is not a valid option because there is no virtual IP for Smartcenter HA. Each Security Management server has its own IP address and hostname.

  D. primary Smartcenter: This is a synonym for the Active Security Management server, but it is not the correct term to use. The term primary implies that there is only one Active Security Management server, which is not true. The administrator can put the Active Security Management server on standby and promote a Standby Security Management server to active at any time1. References: How to Configure Management HA

• Question 57:

  Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R81.20 SmartConsole application?

  A. IPS, Anti-Bot, URL Filtering, Application Control, Threat Emulation.

  B. Firewall, IPS, Threat Emulation, Application Control.

  C. IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction.

  D. Firewall, IPS, Anti-Bot, Anti-Virus, Threat Emulation.

  Correct Answer: C

  The Threat Prevention profile in Check Point R81.20 SmartConsole application allows you to enforce the following software blades: IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction. These software blades provide comprehensive protection against various types of threats, such as network attacks, malware, ransomware, phishing, and zero-day exploits. You can configure the profile settings for each software blade, such as the action to take, the protection scope, and the exceptions. References: Check Point Security Expert R81 Course, Threat Prevention Administration Guide

• Question 58:

  From SecureXL perspective, what are the tree paths of traffic flow:

  A. Initial Path; Medium Path; Accelerated Path

  B. Layer Path; Blade Path; Rule Path

  C. Firewall Path; Accept Path; Drop Path

  D. Firewall Path; Accelerated Path; Medium Path

  Correct Answer: D

  SecureXL is a technology that improves the performance of Security Gateway by offloading the processing of some packets from the Firewall kernel to the SecureXL device driver1. SecureXL can handle packets in three different paths,

  depending on the type and state of the packet2:

  Firewall Path: This is the slowest path, where packets are processed by the Firewall kernel and all the inspection blades. This path is used for packets that require full inspection, such as the first packet of a connection, packets that match a

  rule with a UTM blade, or packets that are not eligible for acceleration. Accelerated Path: This is the fastest path, where packets are processed by the SecureXL device driver and bypass the Firewall kernel. This path is used for packets that

  belong to an established connection that is marked for acceleration, and do not require any further inspection by the Firewall or other blades. Medium Path: This is a hybrid path, where packets are processed by both the SecureXL device

  driver and the Firewall kernel, but skip some inspection steps. This path is used for packets that belong to an established connection that is not marked for acceleration, but do not require full inspection by all the blades.

  The other options are not correct because:

  A. Initial Path; Medium Path; Accelerated Path: There is no such thing as Initial Path in SecureXL terminology. The initial packet of a connection is always handled by the Firewall Path. B. Layer Path; Blade Path; Rule Path: These are not paths of traffic flow, but components of the unified policy in R80 and above versions. The Layer Path refers to the order of layers in the policy, the Blade Path refers to the order of blades within a layer, and the Rule Path refers to the order of rules within a blade3. C. Firewall Path; Accept Path; Drop Path: These are not paths of traffic flow, but possible actions that the Firewall can take on a packet. The Firewall Path is one of the paths of traffic flow, but the Accept Path and Drop Path are not. The Accept Path means that the packet is allowed to pass through the Firewall, and the Drop Path means that the packet is blocked by the Firewall4. References: Part 3 - SecureXL, What is CoreXL and SecureXL, SecureXL Fast Accelerator (fw fast_accel) for R80.20 and above, QUANTUM 7000 SECURITY GATEWAY

• Question 59:

  Both ClusterXL and VRRP are fully supported by Gaia R81.20 and available to all Check Point appliances. Which the following command is NOT related to redundancy and functions?

  A. cphaprob stat

  B. cphaprob if

  C. cphaprob list

  D. cphaprob all show stat

  Correct Answer: D

  The command cphaprob all show stat is not related to redundancy and functions. This command does not exist in ClusterXL or VRRP. The other commands are valid commands for checking the status of cluster members, interfaces, and synchronization. ClusterXL and VRRP are both high availability solutions that provide redundancy and load balancing for Check Point gateways. References: Check Point Security Expert R81 Course, ClusterXL Administration Guide, VRRP Administration Guide

• Question 60:

  Which web services protocol is used to communicate to the Check Point R81 Identity Awareness Web API?

  A. SOAP

  B. REST

  C. XLANG

  D. XML-RPC

  Correct Answer: B

  The Check Point R81 Identity Awareness Web API uses the REST web services protocol to communicate with external identity sources. REST stands for Representational State Transfer, and it is an architectural style for designing web services that use HTTP methods to access and manipulate resources. The Identity Awareness Web API allows external identity sources to send identity and session information to the Security Gateway, which can then use this information for policy enforcement.