156-315.81.20 Dumps Help You Study Objectives

1. Fill in the blanks: A _______ license requires an administrator to designate a gateway for attachment

whereas a ________ license is automatically attached to a Security Gateway.

2. An administrator wishes to enable Identity Awareness on the Check Point firewalls. However, they allow users to use company issued or personal laptops. Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

3. Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically

reset every

4. What are the services used for Cluster Synchronization?

5. In which formats can Threat Emulation forensics reports be viewed in?

6. The customer has about 150 remote access user with a Windows laptops. Not more than 50 Clients will be connected at the same time. The customer want to use multiple VPN Gateways as entry point and a personal firewall.

What will be the best license for him?

7. Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R81.20 SmartConsole application?

8. Security Checkup Summary can be easily conducted within:

9. What is correct statement about Security Gateway and Security Management Server failover in Check Point R81.X in terms of Check Point Redundancy driven solution?

10. You are the administrator for ABC Corp. You have logged into your R81 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.





What does this mean?

11. Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU.

After installation, is the administrator required to perform any additional tasks?

12. How many users can have read/write access in Gaia at one time?

13. The Security Gateway is installed on GAIA R81. The default port for the Web User Interface is ______.

14. You want to verify if your management server is ready to upgrade to R81.20.

What tool could you use in this process?

15. What is the benefit of Manual NAT over Automatic NAT?

16. What mechanism can ensure that the Security Gateway can communicate with the Management Server with ease in situations with overwhelmed network resources?

17. In a Client to Server scenario, which inspection point is the first point immediately following the tables and rule base check of a packet coming from outside of the network?

18. The back-end database for Check Point Management uses:

19. Alice wants to upgrade the current security management machine from R80.40 to R81.20 and she wants to check the Deployment Agent status over the GAIA CLISH.

Which of the following GAIACLISH command is true?

20. Which of the following is NOT an alert option?

21. Which is the correct order of a log flow processed by SmartEvent components?

22. Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

23. What is the difference between SSL VPN and IPSec VPN?

24. Mobile Access Gateway can be configured as a reverse proxy for Internal Web Applications Reverse proxy users browse to a URL that is resolved to the Security Gateway IP address.

Which of the following Check Point command is true for enabling the Reverse Proxy:

25. What is the least amount of CPU cores required to enable CoreXL?

26. If there are two administration logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available or other administrators? (Choose the BEST answer.)

27. Alice & Bob are going to deploy Management Data Plane Separation (MDPS) for all their Check Point Security Gateway(s)/Cluster(s).

Which of the following statement is true?

28. Fill in the blanks: Default port numbers for an LDAP server is ________________ for standard connections and SSL connections.

29. As an administrator, you may be required to add the company logo to reports. To do this, you would save the logo as a PNG file with the name ‘cover-company-logo.png’ and then copy that image file to which directory on the SmartEvent server?

30. In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log.

Which of the following options can you add to each Log, Detailed Log and Extended Log?

31. Which of the following is NOT a type of Endpoint Identity Agent?

32. Which of the following is NOT a VPN routing option available in a star community?

33. Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client communications, database manipulation, policy compilation and Management HA synchronization?

34. SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run.

The default commands are:

35. Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use which operating system?

36. Which of the following is NOT supported by CPUSE?

37. What is the purpose of the CPCA process?

38. Bob works for a big security outsourcing provider company and as he receives a lot of change requests per day he wants to use for scripting daily tasks the API services (torn Check Point for the GAIA API. Firstly he needs to be aware if the API services are running for the GAIA operating system.

Which of the following Check Point Command is true:

39. Which is the command to identify the NIC driver before considering about the employment of the

Multi-Queue feature?

40. CoreXL is NOT supported when one of the following features is enabled: (Choose three)

41. What is not a purpose of the deployment of Check Point API?

42. You have existing dbedit scripts from R77. Can you use them with R81.20?

43. From SecureXL perspective, what are the tree paths of traffic flow:

44. What is a possible command to delete all of the SSH connections of a gateway?

45. When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

46. What is the default shell of Gaia CLI?

47. Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?

48. Fill in the blank: The IPS policy for pre-R81 gateways is installed during the _______ .

49. Which command would you use to set the network interfaces’ affinity in Manual mode?

50. Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

51. What kind of information would you expect to see using the sim affinity command?

52. An established connection is going to www.google.com. The Application Control Blade Is inspecting the traffic. If SecureXL and CoreXL are both enabled, which path is handling the traffic?

53. What traffic does the Anti-bot feature block?

54. Which statement is false in respect of the SmartConsole after upgrading the management server to R81.20?

55. Choose the correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI?

56. Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible.

Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

57. Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using

________ .

58. Pamela is Cyber Security Engineer working for Global Instance Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R81.20. Company’s Developer Team is having random access issue to newly deployed Application Server in DMZ’s Application Server Farm Tier and blames DMZ Security Gateway as root cause. The ticket has been created and issue is at Pamela’s desk for an investigation. Pamela decides to use Check Point’s Packet Analyzer Tool-fw monitor to iron out the issue during approved Maintenance window.

What do you recommend as the best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic?

59. SmartEvent has several components that function together to track security threats.

What is the function of the Correlation Unit as a component of this architecture?

60. What cloud-based SandBlast Mobile application is used to register new devices and users?

61. Check Point APIs allow system engineers and developers to make changes to their organization’s security policy with CLI tools and Web Services for all the following except:

62. When using CPSTAT, what is the default port used by the AMON server?

63. Which SmartConsole tab is used to monitor network and security performance?

64. What scenario indicates that SecureXL is enabled?

65. Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane.

Which is NOT an option to adjust or configure?

66. Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

67. Fill in the blank: The R81 utility fw monitor is used to troubleshoot ______________________.

68. You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization.

What service is used by the FWD daemon to do a Full Synchronization?

69. You want to gather and analyze threats to your mobile device. It has to be a lightweight app.

Which application would you use?

70. In which scenario will an administrator need to manually define Proxy ARP?

71. What component of R81 Management is used for indexing?

72. Installations and upgrades with CPUSE require that the CPUSE agent is up-to-date. Usually the latest build is downloaded automatically.

How can you verify the CPUSE agent build?

73. What is the command to show SecureXL status?

74. What destination versions are supported for a Multi-Version Cluster Upgrade?

75. When an encrypted packet is decrypted, where does this happen?

76. What are the steps to configure the HTTPS Inspection Policy?

77. What is the purpose of Priority Delta in VRRP?

78. Which features are only supported with R81.20 Gateways but not R77.x?

79. Customer’s R81 management server needs to be upgraded to R81.20.

What is the best upgrade method when the management server is not connected to the Internet?

80. What command would show the API server status?

81. Which of the following processes pulls the application monitoring status from gateways?

82. Your manager asked you to check the status of SecureXL, and its enabled templates and features.

What command will you use to provide such information to manager?

83. SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

84. In the R81 SmartConsole, on which tab are Permissions and Administrators defined?

85. SandBlast agent extends 0 day prevention to what part of the network?

86. You have used the "set inactivity-timeout 120" command to prevent the session to be disconnected after 10 minutes of inactivity. However, the Web session is being disconnected after 10 minutes.

Why?

87. What is the main objective when using Application Control?

88. What is the name of the secure application for Mail/Calendar for mobile devices?

89. What is the port used for SmartConsole to connect to the Security Management Server?

90. Which is NOT an example of a Check Point API?

91. Which feature is NOT provided by all Check Point Mobile Access solutions?

92. fwssd is a child process of which of the following Check Point daemons?

93. Which command can you use to verify the number of active concurrent connections?

94. Which web services protocol is used to communicate to the Check Point R81 Identity Awareness Web API?

95. What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

96. The SmartEvent R81 Web application for real-time event monitoring is called:

97. What is the purpose of extended master key extension/session hash?

98. Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

99. The WebUI offers several methods for downloading hotfixes via CPUSE except:

100. Alice & Bob are concurrently logged In via SSH on the same Check Point Security Gateway as user "admin* however Bob was first logged in and acquired the lock Alice Is not aware that Bob is also togged in to the same Security Management Server as she is but she needs to perform very urgent configuration changes - which of the following GAlAclish command is true for overriding Bobs configuration database lock:

101. Which directory below contains log files?

102. What are the correct steps upgrading a HA cluster (M1 is active, M2 is passive) using Multi-Version Cluster (MVC)Upgrade?

103. Which file gives you a list of all security servers in use, including port number?

104. What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

105. Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process:

106. Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?

107. While using the Gaia CLI. what is the correct command to publish changes to the management server?

108. Which software blade does NOT accompany the Threat Prevention policy?

109. A user complains that some Internet resources are not available. The Administrator is having issues seeing it packets are being dropped at the firewall (not seeing drops in logs).

What is the solution to troubleshoot the issue?

110. Which of the following is NOT a type of Check Point API available in R81.x?

111. Which one of the following is true about Capsule Connect?

112. What are the different command sources that allow you to communicate with the API server?

113. What a valid SecureXL paths in R81.20?

114. Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

115. You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.

How many cores can be used in a Cluster for Firewall-kernel on the new device?

116. Fill in the blank: __________ information is included in “Full Log” tracking option, but is not included

in “Log” tracking option?

117. SandBlast appliances can be deployed in the following modes:

118. Alice works for a big security outsourcing provider company and as she receives a lot of change requests per day she wants to use for scripting daily (asks the API services from Check Point fof the Management API. Firstly she needs to be aware if the API services are running for the management.

Which of the following Check Point Command is true:

119. Which of the following technologies extracts detailed information from packets and stores that information in state tables?

120. What is the Implicit Clean-up Rule?

121. In the Firewall chain mode FFF refers to:

122. What does the "unknown" SIC status shown on SmartConsole mean?

123. Which command is used to add users to or from existing roles?

124. When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.

125. Automation and Orchestration differ in that:

126. What is required for a site-to-site VPN tunnel that does not use certificates?

127. What order should be used when upgrading a Management High Availability Cluster?

128. Which command shows actual allowed connections in state table?

129. What is the command used to activated Multi-Version Cluster mode?

130. Fill in the blank: The command ___________________ provides the most complete restoration of a R81 configuration.

131. The Firewall Administrator is required to create 100 new host objects with different IP addresses.

What API command can he use in the script to achieve the requirement?

132. Which TCP port does the CPM process listen on?

133. Which Check Point software blade provides Application Security and identity control?

134. You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.

What is the first step to run management API commands on GAIA’s shell?

135. When using the Mail Transfer Agent, where are the debug logs stored?

136. Where you can see and search records of action done by R81 SmartConsole administrators?

137. John is using Management HA.

Which Security Management Server should he use for making changes?

138. GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

139. From SecureXL perspective, what are the three paths of traffic flow:

140. To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?

141. Which method below is NOT one of the ways to communicate using the Management API’s?

142. Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal website, file share and emails?

143. Ken wants to obtain a configuration lock from other administrator on R81 Security Management Server. He can do this via WebUI or via CLI.

Which command should he use in CLI? (Choose the correct answer.)

144. What happen when IPS profile is set in Detect Only Mode for troubleshooting?

145. The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.

What is the most likely reason that the traffic is not accelerated?

146. Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .

147. Which of these statements describes the Check Point ThreatCloud?

148. In R81 spoofing is defined as a method of:

149. After finishing installation admin John likes to use top command in expert mode. John has to set the expert-password and was able to use top command. A week later John has to use the top command again, He detected that the expert password is no longer valid.

What is the most probable reason for this behavior?

150. What are the main stages of a policy installation?

151. Which Check Point daemon monitors the other daemons?

152. What is the valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration?

153. What is the command switch to specify the Gaia API context?

154. To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection.

Which of the these is NOT a SecureXL template?

155. On R81.20 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

156. What are the three components for Check Point Capsule?

157. Gaia has two default user accounts that cannot be deleted.

What are those user accounts?

158. For best practices, what is the recommended time for automatic unlocking of locked admin accounts?

159. 1.Identify the API that is not supported by Check Point currently.

160. When installing a dedicated R81 SmartEvent server.

What is the recommended size of the root partition?

161. Fill in the blank: Authentication rules are defined for ________ .

162. Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R81.X The Network Security Developer Team is having an issue testing the API with a newly deployed R81.X Security Management Server Aaron wants to confirm API services are working properly.

What should he do first?

163. You have successfully backed up Check Point configurations without the OS information.

What command would you use to restore this backup?

164. Which statement is true regarding redundancy?

165. Which of the following is NOT a method used by identity Awareness for acquiring identity?

166. Which utility allows you to configure the DHCP service on Gaia from the command line?

167. Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______ .

168. What are the two ClusterXL Deployment options?

169. To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:

170. Which of the following is an authentication method used for Identity Awareness?

171. Which command is used to set the CCP protocol to Multicast?

172. Alice knows about the Check Point Management HA installation from Bob and needs to know which Check Point Security Management Server is currently capable of issuing and managing certificate. Alice uses the Check Point command "cpconfig'' to run the Check Point Security Management Server configuration tool on both Check Point Management HA instances "Primary & Secondary"

Which configuration option does she need to look for:

173. According to the policy installation flow the transfer state (CPTA) is responsible for the code generated by the FWM. On the Security Gateway side a process receives them and first stores them Into a temporary directory.

Which process is true for receiving these Tiles;

174. SmartConsole R81 x requires the following ports to be open for SmartEvent.

175. What is the responsibility of SOLR process on R81.20 management server?

176. Native Applications require a thin client under which circumstances?

177. Which view is NOT a valid CPVIEW view?

178. Which TCP-port does CPM process listen to?

179. The Firewall kernel is replicated multiple times, therefore:

180. The Check Point installation history feature in provides the following:

181. You have used the SmartEvent GUI to create a custom Event policy.

What is the best way to display the correlated Events generated by SmartEvent Policies?

182. Besides fw monitor, what is another command that can be used to capture packets?

183. Session unique identifiers are passed to the web api using which http header option?

184. You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don’t have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher.

How can you enable them?

185. Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port.

Which CLISH commands are required to be able to change this TCP port?

186. In the Check Point Security Management Architecture, which component(s) can store logs?

187. Which command is used to display status information for various components?

188. During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are: