CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 71:

  The Correlation Unit performs all but the following actions:

  A. Marks logs that individually are not events, but may be part of a larger pattern to be identified later.

  B. Generates an event based on the Event policy.

  C. Assigns a severity level to the event.

  D. Takes a new log entry that is part of a group of items that together make up an event, and adds it to an ongoing event.

  Correct Answer: C

  The Correlation Unit in Check Point Security Management performs several actions, but it does not assign a severity level to the event. The Correlation Unit is responsible for identifying patterns in logs, marking logs that are part of larger patterns, generating events based on the Event policy, and adding new log entries to ongoing events. However, assigning a severity level to an event is typically done through the Event policy configuration, not by the Correlation Unit.

  References: Check Point Certified Security Expert R81 Study Guide

• Question 72:

  What is the command to see cluster status in cli expert mode?

  A. fw ctl stat

  B. clusterXL stat

  C. clusterXL status

  D. cphaprob stat

  Correct Answer: D

  To see the cluster status in CLI expert mode, you can use the command cphaprob stat. This command displays the status of the Check Point High Availability cluster. It provides information about the state of the cluster members, such as "Active," "Standby," or "Collision."

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 73:

  When simulating a problem on ClusterXL cluster with cphaprob STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?

  A. cphaprob STOP unregister

  B. cphaprob STOP unregister

  C. cphaprob unregister STOP

  D. cphaprob unregister STOP

  Correct Answer: A

  When simulating a problem on a ClusterXL cluster with the command "cphaprob STOP -s problem -t 0 register" to initiate a failover on an active cluster member, you can use the command "cphaprob STOP unregister" to remove the

  problematic state and return the cluster to normal operation.

  Option A correctly identifies the command that allows you to remove the problematic state, making it the verified answer.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 74:

  What is the difference between SSL VPN and IPSec VPN?

  A. IPSec VPN does not require installation of a resilient VPN client.

  B. SSL VPN requires installation of a resident VPN client.

  C. SSL VPN and IPSec VPN are the same.

  D. IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser.

  Correct Answer: D

  The main difference between SSL VPN (Secure Sockets Layer Virtual Private Network) and IPSec VPN (Internet Protocol Security Virtual Private Network) is in the way they operate:

  SSL VPN typically does not require the installation of a resident VPN client. It often relies on a web browser to establish the VPN connection, making it more convenient for remote users who may not want to install dedicated VPN software.

  IPSec VPN, on the other hand, often requires the installation of a resident VPN client on the user's device to establish the VPN connection. This client software is necessary for configuring and managing the VPN connection. Option C, stating

  that SSL VPN and IPSec VPN are the same, is incorrect because they have distinct characteristics as described above.

  Option A is incorrect because it inaccurately suggests that IPSec VPN does not require a resident VPN client, which is not true in most cases. Option B is incorrect because it wrongly claims that SSL VPN requires the installation of a resident

  VPN client.

  References: Check Point Certified Security Expert R81 Study Guide

• Question 75:

  SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

  A. Smart Cloud Services

  B. Load Sharing Mode Services

  C. Threat Agent Solution

  D. Public Cloud Services

  Correct Answer: A

  Check Point SandBlast Zero-Day Protection offers flexibility in implementation to meet individual business needs. One of the deployment options for Check Point SandBlast Zero- Day Protection is:

  Smart Cloud Services (Option A): Smart Cloud Services allow organizations to leverage cloud-based threat intelligence and protection services provided by Check Point. The other options, Load Sharing Mode Services (Option B), Threat

  Agent Solution (Option C), and Public Cloud Services (Option D), may also be components of a security strategy, but they are not specific deployment options for Check Point SandBlast Zero-Day Protection.

  References: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.

• Question 76:

  Which of these is an implicit MEP option?

  A. Primary-backup

  B. Source address based

  C. Round robin

  D. Load Sharing

  Correct Answer: A

  Implicit MEP (Multicast Ethernet Point) options refer to the way multicast traffic is handled within a network. In this case, the question is asking about an implicit MEP option, and the correct answer is:

  A. Primary-backup: This is an implicit MEP option where one switch (primary) forwards multicast traffic while the other switch (backup) does not forward the traffic. It is used to ensure redundancy in case the primary switch fails.

  B. Source address-based, C. Round-robin, and D. Load Sharing are not implicit MEP options; they are different methods of handling multicast traffic and do not describe the concept of primary-backup.

  Therefore, option A is the correct answer as it represents an implicit MEP option.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 77:

  SmartEvent does NOT use which of the following procedures to identify events:

  A. Matching a log against each event definition

  B. Create an event candidate

  C. Matching a log against local exclusions

  D. Matching a log against global exclusions

  Correct Answer: C

  SmartEvent does not use matching a log against local exclusions to identify events. Local exclusions are filters that are applied to logs before they are sent to the SmartEvent server. They are used to reduce the amount of logs that are forwarded by the Security Gateways or Log Servers, and to avoid sending irrelevant or sensitive logs. Local exclusions do not affect the event detection process, which is performed by the SmartEvent Correlation Unit on the SmartEvent server. References: Check Point Security Expert R81 Course, SmartEvent Administration Guide, SK120193 - How to configure Local Log Filtering on Security Gateway / Cluster / VSX

• Question 78:

  What are the blades of Threat Prevention?

  A. IPS, DLP, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction

  B. DLP, AntiVirus, QoS, AntiBot, Sandblast Threat Emulation/Extraction

  C. IPS, AntiVirus, AntiBot

  D. IPS, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction

  Correct Answer: D

  The blades of Threat Prevention in Check Point include:

  Intrusion Prevention System (IPS) AntiVirus AntiBot SandBlast Threat Emulation/Extraction So, the correct answer is D, which includes all the mentioned blades.

  References: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.

• Question 79:

  Security Checkup Summary can be easily conducted within:

  A. Summary

  B. Views

  C. Reports

  D. Checkups

  Correct Answer: B

  Security Checkup Summary can be easily conducted within Views. Views is a feature in SmartConsole that allows you to create customized dashboards and reports based on various security data sources, such as logs, events, audit trails, and more. You can use Views to perform a Security Checkup Summary, which is a comprehensive analysis of your network security posture and potential risks. You can use predefined templates or create your own views to generate the summary. References: Check Point Security Expert R81 Course, Views Administration Guide

• Question 80:

  In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

  A. Mail, Block Source, Block Event Activity, External Script, SNMP Trap

  B. Mail, Block Source, Block Destination, Block Services, SNMP Trap

  C. Mail, Block Source, Block Destination, External Script, SNMP Trap

  D. Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap

  Correct Answer: A

  In SmartEvent, the administrator can configure different types of automatic reactions, which include:

  Mail notifications Blocking the source of the event Blocking the event activity Running an external script Sending an SNMP trap So, the correct answer is "Mail, Block Source, Block Event Activity, External Script, SNMP Trap."

  References: Check Point documentation or training materials related to SmartEvent configuration and automatic reactions.