CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 61:

  SandBlast appliances can be deployed in the following modes:

  A. using a SPAN port to receive a copy of the traffic only

  B. detect only

  C. inline/prevent or detect

  D. as a Mail Transfer Agent and as part of the traffic flow only

  Correct Answer: C

  SandBlast appliances can be deployed in the following modes:

  C. Inline/prevent or detect

  SandBlast appliances can be deployed in an inline mode where they actively inspect and prevent or detect malicious traffic. In this mode, the appliance sits in the network traffic path and can take actions to block or detect threats in real-time.

  References: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on SandBlast.

• Question 62:

  What is the port used for SmartConsole to connect to the Security Management Server?

  A. CPMI port 18191/TCP

  B. CPM port/TCP port 19009

  C. SIC port 18191/TCP

  D. https port 4434/TCP

  Correct Answer: A

  The port used for SmartConsole to connect to the Security Management Server is CPMI port 18191/TCP. CPMI stands for Check Point Management Interface, which is a proprietary protocol that enables secure communication between the SmartConsole and the Security Management Server. CPMI uses SSL encryption and authentication to protect the data exchange. References: Check Point Security Expert R81 Course, SK52421 - Ports used by Check Point software

• Question 63:

  For Management High Availability, which of the following is NOT a valid synchronization status?

  A. Collision

  B. Down

  C. Lagging

  D. Never been synchronized

  Correct Answer: B

  For Management High Availability, the valid synchronization status options are:

  A. Collision

  B. Down

  C. Lagging

  D. Never been synchronized

  In this context, "Down" indicates that the synchronization is not functioning correctly or that the standby management server is not reachable. This is a valid synchronization status, so the answer is not B.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 64:

  What information is NOT collected from a Security Gateway in a Cpinfo?

  A. Firewall logs

  B. Configuration and database files

  C. System message logs

  D. OS and network statistics

  Correct Answer: A

  In a Cpinfo (Checkpoint information) command, various information is collected from a Security Gateway. However, firewall logs are NOT collected from a Security Gateway in a Cpinfo.

  A. Firewall logs

  The Cpinfo command typically collects information such as configuration and database files, system message logs, OS and network statistics, but it does not include firewall logs. Firewall logs are usually obtained separately using other

  methods or tools.

  References: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on Cpinfo.

• Question 65:

  Which statements below are CORRECT regarding Threat Prevention profiles in Smart Dashboard?

  A. You can assign only one profile per gateway and a profile can be assigned to one rule Only.

  B. You can assign multiple profiles per gateway and a profile can be assigned to one rule only.

  C. You can assign multiple profiles per gateway and a profile can be assigned to one or more rules.

  D. You can assign only one profile per gateway and a profile can be assigned to one or more rules.

  Correct Answer: C

  In SmartDashboard, Threat Prevention profiles can be assigned to one or more rules. This means that you can have multiple profiles assigned to a single gateway, and each of these profiles can be associated with one or more rules. This allows for granular control over threat prevention settings for different rules or scenarios.

  References: Check Point Certified Security Expert R81 documentation and learning resources.

• Question 66:

  What API command below creates a new host with the name "New Host" and IP address of "192.168.0.10"?

  A. new host name "New Host" ip-address "192.168.0.10"

  B. set host name "New Host" ip-address "192.168.0.10"

  C. create host name "New Host" ip-address "192.168.0.10"

  D. add host name "New Host" ip-address "192.168.0.10"

  Correct Answer: D

  The API command to create a new host with the name "New Host" and IP address "192.168.0.10" is:

  

  This command adds a host object with the specified name and IP address to the Check Point configuration. References: Check Point documentation or training materials related to API commands.

• Question 67:

  You are asked to check the status of several user-mode processes on the management server and gateway. Which of the following processes can only be seen on a Management Server?

  A. fwd

  B. fwm

  C. cpd

  D. cpwd

  Correct Answer: B

  User-mode processes are processes that run in the user space of the operating system, as opposed to kernel-mode processes that run in the kernel space. User-mode processes are usually less privileged and have less access to system

  resources than kernel-mode processes. Check Point products use both user-mode and kernel-mode processes to provide various functionalities and services.

  The following are some of the user-mode processes that can be seen on the management server and gateway:

  fwd: This process is responsible for policy installation, logging, and communication with other Check Point components. It runs on both the management server and gateway. cpd: This process is responsible for licensing, certificate

  management, and communication with SmartConsole. It runs on both the management server and gateway. cpwd: This process is responsible for monitoring and restarting other processes. It runs on both the management server and

  gateway.

  The following is a user-mode process that can only be seen on the management server:

  fwm: This process is responsible for managing the security policy database, compiling the security policy, and generating reports. It runs only on the management server.

  Therefore, the correct answer is B.

  References: Check Point Processes and Daemons, Check Point Processes Cheat Sheet, Check Point Firewall Security Solution

• Question 68:

  You want to store the GAIA configuration in a file for later reference. What command should you use?

  A. write mem

  B. show config

  C. save config

  D. save configuration

  Correct Answer: D

  The correct command to store the GAIA configuration in a file is save configuration 1. This will create a file with the current system level configuration in the home directory of the current user1. The other commands are incorrect because they either do not exist or do not save the configuration to a file. References: 1: Backing up Gaia system level configuration(https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doG oviewsolutiondetails=andsolutionid=sk102234)

• Question 69:

  SandBlast has several functional components that work together to ensure that attacks are prevented in real-time. Which the following is NOT part of the SandBlast component?

  A. Threat Emulation

  B. Mobile Access

  C. Mail Transfer Agent

  D. Threat Cloud

  Correct Answer: B

  Mobile Access is not part of the SandBlast component. Mobile Access is a software blade that provides secure remote access to corporate resources from various devices, such as smartphones, tablets, and laptops. Mobile Access supports different connectivity methods, such as SSL VPN, IPsec VPN, and Mobile Enterprise Application Store (MEAS). Mobile Access also integrates with Mobile Threat Prevention (MTP) to protect mobile devices from malware and network attacks. References: Check Point Security Expert R81 Course, Mobile Access Administration Guide, SandBlast Mobile Datasheet

• Question 70:

  Which of the following will NOT affect acceleration?

  A. Connections destined to or originated from the Security gateway

  B. A 5-tuple match

  C. Multicast packets

  D. Connections that have a Handler (ICMP, FTP, H.323, etc.)

  Correct Answer: B

  Check Point's SecureXL technology, which is responsible for acceleration, has certain limitations and conditions under which acceleration may not occur. In this context, the question is asking about factors that will NOT affect acceleration.

  Option B, "A 5-tuple match," will not affect acceleration. A 5-tuple match refers to the matching of source IP, source port, destination IP, destination port, and protocol. SecureXL can accelerate traffic that matches these criteria, but it's not a

  factor that hinders acceleration.

  Options A, C, and D can all affect acceleration:

  Option A mentions "Connections destined to or originated from the Security gateway," which implies that SecureXL acceleration can apply to these connections. Option C mentions "Multicast packets," and SecureXL may have limitations in

  handling multicast traffic efficiently.

  Option D mentions "Connections that have a Handler (ICMP, FTP, H.323, etc.)," and certain protocols (such as FTP) may require special handling and might not be fully accelerated by SecureXL.

  References: Check Point Certified Security Expert R81 Study Guide