156-315.81 Exam Dumps – Reliable Way to Pass and Get Certified

1. Tom has connected to the R81 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.

What will happen to the changes already made?

2. The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.

What is the most likely reason that the traffic is not accelerated?

3. What is the main difference between Threat Extraction and Threat Emulation?

4. What is the order of NAT priorities?

5. Which command would disable a Cluster Member permanently?

6. The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?

7. There are multiple types of licenses for the various VPN components and types. License type related to management and functioning of Remote Access VPNs are - which of the following license requirement statement is NOT true:

8. When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

9. What two ordered layers make up the Access Control Policy Layer?

10. What Is the difference between Updatable Objects and Dynamic Objects

11. Choose the correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI?

12. Which command shows only the table names of all kernel tables?

13. Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port.





Which CLISH commands are required to be able to change this TCP port?

14. What is the purpose of the CPCA process?

15. Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

16. The Event List within the Event tab contains:

17. Which one of the following is true about Threat Emulation?

18. The Firewall Administrator is required to create 100 new host objects with different IP addresses.

What API command can he use in the script to achieve the requirement?

19. Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU.

After installation, is the administrator required to perform any additional tasks?

20. SandBlast agent extends 0 day prevention to what part of the network?

21. Which utility allows you to configure the DHCP service on Gaia from the command line?

22. What is the amount of Priority Queues by default?

23. What is the mechanism behind Threat Extraction?

24. When using CPSTAT, what is the default port used by the AMON server?

25. Which Correction mechanisms are available with ClusterXL under R81.10?

26. The WebUI offers several methods for downloading hotfixes via CPUSE except:

27. What command is used to manually failover a Multi-Version Cluster during the upgrade?

28. What feature allows Remote-access VPN users to access resources across a site-to-site VPN tunnel?

29. What is the name of the secure application for Mail/Calendar for mobile devices?

30. What is true about the IPS-Blade?

31. Which of the following is NOT an internal/native Check Point command?

32. Fill in the blank: __________ information is included in “Full Log” tracking option, but is not included in “Log” tracking option?

33. Fill in the blanks: Gaia can be configured using the ______ or _____ .

34. Which command lists firewall chain?

35. Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .

36. Which of the following Windows Security Events will not map a username to an IP address in Identity Awareness?

37. Which command is used to obtain the configuration lock in Gaia?

38. In R81 spoofing is defined as a method of:

39. In which formats can Threat Emulation forensics reports be viewed in?

40. The Firewall kernel is replicated multiple times, therefore:

41. SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data.

Which component is NOT part of the SandBlast Mobile solution?

42. Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

43. Which of these is an implicit MEP option?

44. Which command lists all tables in Gaia?

45. What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?

46. Which directory below contains log files?

47. Which software blade does NOT accompany the Threat Prevention policy?

48. Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic.

Assuming acceleration is enabled which path is handling the traffic?

49. What is true about VRRP implementations?

50. Why would an administrator see the message below?

51. Fill in the blank: Identity Awareness AD-Query is using the Microsoft _______________

API to learn users from AD.

52. John is using Management HA.

Which Smartcenter should be connected to for making changes?

53. You find one of your cluster gateways showing “Down” when you run the “cphaprob stat” command. You then run the “clusterXL_admin up” on the down member but unfortunately the member continues to show down.

What command do you run to determine the cause?

54. You can access the ThreatCloud Repository from:

55. Your manager asked you to check the status of SecureXL, and its enabled templates and features.

What command will you use to provide such information to manager?

56. Both ClusterXL and VRRP are fully supported by Gaia R81.10 and available to all Check Point appliances.

Which the following command is NOT related to redundancy and functions?

57. In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:

58. Fill in the blanks. There are ________ types of software containers: ___________.

59. SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run.

The default commands are:

60. Which process handles connection from SmartConsole R81?

61. Which command would you use to set the network interfaces’ affinity in Manual mode?

62. Which is NOT an example of a Check Point API?

63. Bob is asked by Alice to disable the SecureXL mechanism temporary tor further diagnostic by their Check Point partner.

Which of the following Check Point Command is true:

64. As an administrator, you may be required to add the company logo to reports.

To do this, you would save the logo as a PNG file with the name ‘cover-company-logo.png’ and then copy that image file to which directory on the SmartEvent server?

65. In R81, how do you manage your Mobile Access Policy?

66. Which command gives us a perspective of the number of kernel tables?

67. What is the correct command to observe the Sync traffic in a VRRP environment?

68. What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

69. Bob works for a big security outsourcing provider company and as he receives a lot of change requests per day he wants to use for scripting daily tasks the API services (torn Check Point for the GAIA API. Firstly he needs to be aware if the API services are running for iheGAIA operating system.

Which of the following Check Point Command is true?

70. Which of the following process pulls application monitoring status?

71. What is "Accelerated Policy Installation"?

72. Alice & Bob are concurrently logged In via SSH on the same Check Point Security Gateway as user "admin* however Bob was first logged in and acquired the lock Alice Is not aware that Bob is also togged in to the same Security Management Server as she is but she needs to perform very urgent configuration changes - which of the following GAlAclish command is true for overriding Bobs configuration database lock:

73. What are the two types of tests when using the Compliance blade?

74. In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with ____________ will not apply.

75. In a Client to Server scenario, which inspection point is the first point immediately following the tables and rule base check of a packet coming from outside of the network?

76. Which upgrade method you should use upgrading from R80.40 to R81.10 to avoid any downtime?

77. In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

78. In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a

response before the peer host is declared ‘down’, you would set the_________?

79. When attempting to start a VPN tunnel, in the logs the error “no proposal chosen” is seen numerous times. No other VPN-related entries are present.

Which phase of the VPN negotiations has failed?

80. What solution is Multi-queue intended to provide?

81. Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

82. What is a best practice before starting to troubleshoot using the “fw monitor” tool?

83. Office mode means that:

84. Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

85. The ____ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

86. Which of the following technologies extracts detailed information from packets and stores that information in state tables?

87. Which options are given on features, when editing a Role on Gaia Platform?

88. What will be the effect of running the following command on the Security Management Server?

89. There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A’s interface issues were resolved and it became operational.

When it re-joins the cluster, will it become active automatically?

90. R81.10 management server can manage gateways with which versions installed?

91. On R81.10 when configuring Third-Party devices to read the logs using the LEA (Log

Export API) the default Log Server uses port:

92. Which command is used to display status information for various components?

93. How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

94. What are the attributes that SecureXL will check after the connection is allowed by Security Policy?

95. How can you see historical data with cpview?

96. In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

97. To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following command in Expert mode then reboot:

98. Which components allow you to reset a VPN tunnel?

99. View the rule below.





What does the lock-symbol in the left column mean? (Choose the BEST answer.)

100. Which Check Point software blade provides Application Security and identity control?

101. When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

102. Session unique identifiers are passed to the web api using which http header option?

103. By default, the R81 web API uses which content-type in its response?

104. What is the default size of NAT table fwx_alloc?

105. What SmartEvent component creates events?

106. What has to be taken into consideration when configuring Management HA?

107. What CLI utility runs connectivity tests from a Security Gateway to an AD domain controller?

108. Firewall polices must be configured to accept VRRP packets on the GAiA platform if it Firewall software.

The Multicast destination assigned by the internet Assigned Number Authority (IANA) for VRRP is:

109. What is false regarding a Management HA environment?

110. Which process is used mainly for backward compatibility of gateways in R81.X? It provides communication with GUI-client, database manipulation, policy compilation and Management HA synchronization.

111. Hit Count is a feature to track the number of connections that each rule matches, which one is not benefit of Hit Count.

112. Which of the following links will take you to the SmartView web application?

113. In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

114. What is required for a site-to-site VPN tunnel that does not use certificates?

115. To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

116. What is not a purpose of the deployment of Check Point API?

117. Full synchronization between cluster members is handled by Firewall Kernel.

Which port is used for this?

118. What is the command used to activated Multi-Version Cluster mode?

119. Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible.

Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

120. Fill in the blank: The R81 SmartConsole, SmartEvent GUI client, and _______ consolidate

billions of logs and shows then as prioritized security events.

121. What are the steps to configure the HTTPS Inspection Policy?

122. Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called:

123. Which of these statements describes the Check Point ThreatCloud?

124. What API command below creates a new host with the name “New Host” and IP address of “192.168.0.10”?

125. Which packet info is ignored with Session Rate Acceleration?

126. Secure Configuration Verification (SCV), makes sure that remote access client computers are configured in accordance with the enterprise Security Policy. Bob was asked by Alice to implement a specific SCV configuration but therefore Bob needs to edit and configure a specific Check Point file.

Which location file and directory is true?

127. Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.

After installation, is the administrator required to perform any additional tasks?

128. Which one of these features is NOT associated with the Check Point URL Filtering and

Application Control Blade?

129. Which of the following is NOT an option to calculate the traffic direction?

130. By default, which port does the WebUI listen on?

131. Which one of the following is NOT a configurable Compliance Regulation?

132. What traffic does the Anti-bot feature block?

133. The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

134. You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.

What is the first step to run management API commands on GAIA’s shell?

135. Fill in the blank: The “fw monitor” tool can be best used to troubleshoot ____________________.

136. Which NAT rules are prioritized first?

137. If there are two administration logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available or other administrators? (Choose the BEST answer.)

138. After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

139. Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

140. To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection.

Which of the these is NOT a SecureXL template?

141. Which of the following is a new R81 Gateway feature that had not been available in R77.X and older?

142. Which TCP port does the CPM process listen on?

143. Which member of a high-availability cluster should be upgraded first in a Zero downtime upgrade?

144. Capsule Connect and Capsule Workspace both offer secured connection for remote users who are using their mobile devices. However, there are differences between the two.

Which of the following statements correctly identify each product's capabilities?

145. Which features are only supported with R81.10 Gateways but not R77.x?

146. What command is used to manually failover a cluster during a zero downtime upgrade?

147. Post-Automatic/Manual NAT rules

148. Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

149. According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

150. Which command is used to set the CCP protocol to Multicast?

151. You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization.

What service is used by the FWD daemon to do a Full Synchronization?

152. When installing a dedicated R81 SmartEvent server.

What is the recommended size of the root partition?

153. Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?

154. Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

155. Alice works for a big security outsourcing provider company and as she receives a lot of change requests per day she wants to use for scripting daily (asks the API services from Check Point fof the Management API. Firstly she needs to be aware if the API services are running for the management.

Which of the following Check Point Command is true?

156. SecureXL is able to accelerate the Connection Rate using templates.

Which attnbutes are used in the template to identify the connection?

157. When synchronizing clusters, which of the following statements is FALSE?

158. Is it possible to establish a VPN before the user login to the Endpoint Client?

159. GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

160. Vanessa is a Firewall administrator. She wants to test a backup of her company’s production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment.

Which details she need to fill in System Restore window before she can click OK button and test the backup?

161. Tom has been tasked to install Check Point R81 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

162. Automation and Orchestration differ in that:

163. Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R81.X. The Network Security Developer Team is having an issue testing the API with a newly deployed R81.X Security Management Server Aaron wants to confirm API services are working properly.

What should he do first?