CheckPoint Checkpoint Certifications 156-315.81 Questions & Answers

• Question 81:

  What is a best practice before starting to troubleshoot using the "fw monitor" tool?

  A. Run the command: fw monitor debug on

  B. Clear the connections table

  C. Disable CoreXL

  D. Disable SecureXL

  Correct Answer: D

  A best practice before starting to troubleshoot using the fw monitor tool is to disable SecureXL. SecureXL is a performance acceleration solution that optimizes the packet flow through the Security Gateway. However, SecureXL can also bypass some inspection points and cause some packets to be invisible to fw monitor. Therefore, disabling SecureXL can ensure that fw monitor captures all the relevant packets for troubleshooting purposes. References: Check Point Security Expert R81 Course, fw monitor, SecureXL

• Question 82:

  What is the purpose of Priority Delta in VRRP?

  A. When a box up, Effective Priority = Priority + Priority Delta

  B. When an Interface is up, Effective Priority = Priority + Priority Delta

  C. When an Interface fail, Effective Priority = Priority ?Priority Delta

  D. When a box fail, Effective Priority = Priority ?Priority Delta

  Correct Answer: C

  Each instance of VRRP running on a supported interface may monitor the link state of other interfaces. The monitored interfaces do not have to be running VRRP. If a monitored interface loses its link state, then VRRP will decrement its priority over a VRID by the specified delta value and then will send out a new VRRP HELLO packet. If the new effective priority is less than the priority a backup platform has, then the backup platform will begin to send out its own HELLO packet. Once the master sees this packet with a priority greater than its own, then it releases the VIP.

  References:

• Question 83:

  How often does Threat Emulation download packages by default?

  A. Once a week

  B. Once an hour

  C. Twice per day

  D. Once per day

  Correct Answer: D

  Threat Emulation downloads packages by default once per day. The packages contain updates for the Threat Emulation engine, signatures, and images. The download frequency can be changed in the Threat Prevention policy settings. References: Threat Emulation Administration Guide, Threat Prevention R81 Release Notes

• Question 84:

  With Mobile Access enabled, administrators select the web-based and native applications that can be accessed by remote users and define the actions that users can perform the applications. Mobile Access encrypts all traffic using:

  A. HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender.

  B. HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, they need to install the SSL Network Extender.

  C. HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, no additional software is required.

  D. HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, no additional software is required.

  Correct Answer: A

  Mobile Access encrypts all traffic using HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender, which is a lightweight VPN client that creates a secure SSL tunnel to the Mobile Access gateway. The SSL Network Extender supports various types of native applications, such as email clients, file sharing, and remote desktop. References: Mobile Access Administration Guide, SSL Network Extender

• Question 85:

  Fill in the blank: The command ___________________ provides the most complete restoration of a R81 configuration.

  A. upgrade_import

  B. cpconfig

  C. fwm dbimport -p

  D. cpinfo ecover

  Correct Answer: A

• Question 86:

  What processes does CPM control?

  A. Object-Store, Database changes, CPM Process and web-services

  B. web-services, CPMI process, DLEserver, CPM process

  C. DLEServer, Object-Store, CP Process and database changes

  D. web_services, dle_server and object_Store

  Correct Answer: D

  CPM stands for Check Point Management, which is a process that runs on the Security Management server and controls the management operations, such as policy installation, object creation, configuration backup, etc. CPM also controls

  other processes that are related to the management functions, such as:

  web_services: This process is responsible for providing web services for the communication between SmartConsole and the Security Management server. It handles requests from SmartConsole clients and forwards them to CPM or other

  processes.

  dle_server: This process is responsible for managing the log files and indexes. It handles queries from SmartLog and SmartEvent and provides log data to CPM or other processes. object_Store: This process is responsible for storing and

  retrieving objects from the database. It handles requests from CPM or other processes and provides object data.

  Therefore, the correct answer is D.

  The other options are incorrect because:

  A. Object-Store, Database changes, CPM Process and web-services: This option includes some processes that are controlled by CPM, such as Object-Store, CPM Process, and web-services, but it also includes Database changes, which is not a process but an action performed by CPM or other processes. B. web-services, CPMI process, DLEserver, CPM process: This option includes some processes that are controlled by CPM, such as web-services, DLEserver, and CPM process, but it also includes CPMI process, which is not a process but a protocol used by CPM or other processes to communicate with each other. C. DLEServer, Object-Store, CP Process and database changes: This option includes some processes that are controlled by CPM, such as DLEServer and Object-Store, but it also includes CP Process and database changes, which are not processes but a generic term for any Check Point process and an action performed by CPM or other processes respectively. References: Check Point Processes and Daemons, Check Point Processes Cheat Sheet, Check Point Firewall Security Solution

• Question 87:

  Which of the following authentication methods ARE NOT used for Mobile Access?

  A. RADIUS server

  B. Username and password (internal, LDAP)

  C. SecurID

  D. TACACS+

  Correct Answer: D

  TACACS+ is not an authentication method that is used for Mobile Access. Mobile Access supports the following authentication methods: username and password (internal, LDAP, or RADIUS), certificate, SecurID, DynamicID, and SMS2. TACACS+ is a protocol that provides access control for routers, network access servers, and other network devices, but it is not supported by Mobile Access3. References: Check Point R81 Mobile Access Administration Guide, TACACS+ -Wikipedia

• Question 88:

  Tom has been tasked to install Check Point R81 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

  A. One machine, but it needs to be installed using SecurePlatform for compatibility purposes.

  B. One machine

  C. Two machines

  D. Three machines

  Correct Answer: C

  Tom will need two machines to install Check Point R81 in a distributed deployment, if he does not include a SmartConsole machine in his calculations. A distributed deployment consists of a Security Management Server that manages one or more Security Gateways. Therefore, Tom will need one machine for the Security Management Server and another machine for the Security Gateway. The other options are either too few or too many machines for a distributed deployment. References: Check Point R81 Installation and Upgrade Guide

• Question 89:

  SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data. Which component is NOT part of the SandBlast Mobile solution?

  A. Management Dashboard

  B. Gateway

  C. Personal User Storage

  D. Behavior Risk Engine

  Correct Answer: C

  SandBlast Mobile has four components: Management Dashboard, Gateway, Behavior Risk Engine, and On-Device Network Protection. Personal User Storage is not part of the SandBlast Mobile solution. References: SandBlast Mobile Architecture

• Question 90:

  Which view is NOT a valid CPVIEW view?

  A. IDA

  B. RAD

  C. PDP

  D. VPN

  Correct Answer: C

  PDP is not a valid CPVIEW view. CPVIEW is a command-line tool that shows the status of different system parameters, such as CPU, memory, disk, network, and firewall. The valid views are IDA, RAD, VPN, FW, QoS, and others. PDP is a process that handles identity awareness and authentication. References: Check Point R81 Gaia Administration Guide, Check Point Identity Awareness Administration Guide R81