628 Q&As in UPDATED 156-315.81 Exam Questions Certification Test Engine to PDF
Get The Important Preparation Guide With 156-315.81 Dumps
NEW QUESTION # 186
Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?
- A. Specific VPN Communities
- B. All Site-to-Site VPN Communities
- C. All Connections (Clear or Encrypted)
- D. Accept all encrypted traffic
Answer: A
Explanation:
Explanation
The option that allows traffic to VPN gateways in specific VPN communities is Specific VPN Communities.
This option lets you specify which VPN communities are allowed or denied by the rule. A VPN community is a group of VPN gateways or hosts that share the same VPN policy and keys. You can create different types of VPN communities, such as star, meshed, or remote access, depending on your network topology and security requirements. You can also use tags to group VPN gateways or hosts into logical categories.
NEW QUESTION # 187
Which of the following processes pulls the application monitoring status from gateways?
- A. fwm
- B. cpd
- C. cpwd
- D. cpm
Answer: B
Explanation:
Explanation
The process that pulls the application monitoring status from gateways is cpd1. The cpd process is responsible for the communication between the Security Management Server and the Security Gateway2. It handles tasks such as policy installation, status reporting, logging, and synchronization2. The cpd process also monitors the application status of the Security Gateway, such as CPU, memory, disk space, and processes3. The cpd process sends this information to the Security Management Server, which displays it in SmartConsole and SmartView Monitor3.
References: How to troubleshoot issues with Check Point Application Control and URL Filtering blades - Check Point Software, Processes and Daemons in Gaia OS - Check Point Software, Monitoring Device Status
- Check Point Software
NEW QUESTION # 188
Bob has finished io setup provisioning a secondary security management server. Now he wants to check if the provisioning has been correct. Which of the following Check Point command can be used to check if the security management server has been installed as a primary or a secondary security management server?
- A. cpprod_util MgmtlsPrimary
- B. cpprod_util MgmtlsSecondary
- C. cpprod_util FwlsSecondary
- D. cpprod_util FwlsPrimary
Answer: A
Explanation:
The cpprod_util command is a utility that provides information about the installed Check Point products and their versions. The cpprod_util MgmtIsPrimary option checks if the Security Management Server is installed as a primary or a secondary server in a High Availability cluster2. If the server is primary, the command returns "yes". If the server is secondary, the command returns "no". Therefore, Bob can use this command to verify the provisioning of the secondary Security Management Server.
NEW QUESTION # 189
Which options are given on features, when editing a Role on Gaia Platform?
- A. Read/Write, Read Only, None
- B. Read Only, None
- C. Read/Write, Read Only
- D. Read/Write, None
Answer: A
Explanation:
The options that are given on features, when editing a Role on Gaia Platform are Read/Write, Read Only, and None. These options determine the level of access that a user has to a specific feature or command in Gaia. If a user has Read/Write access to a feature, they can view and modify the settings of that feature. If a user has Read Only access to a feature, they can only view the settings of that feature, but not change them. If a user has None access to a feature, they cannot view or modify the settings of that feature.
NEW QUESTION # 190
Which tool is used to enable ClusterXL?
- A. SmartConsole
- B. cpconfig
- C. SmartUpdate
- D. sysconfig
Answer: B
Explanation:
The tool that is used to enable ClusterXL is cpconfig. ClusterXL is a software-based Load Sharing and High Availability solution that distributes network traffic between clusters of redundant Security Gateways1. ClusterXL can be enabled on Check Point Security Gateways running on Gaia OS, SecurePlatform OS, IPSO OS, or X-Series XOS2.
To enable ClusterXL, the administrator must run the cpconfig command on each cluster member and select the option to enable ClusterXL. This will prompt the administrator to choose the ClusterXL mode (High Availability or Load Sharing) and the Cluster Control Protocol (CCP) mode (Broadcast or Multicast). After enabling ClusterXL, the administrator must reboot the cluster members for the changes to take effect34.
Therefore, the correct answer is B) The tool that is used to enable ClusterXL is cpconfig.
Reference:
1, Introduction to ClusterXL - Check Point Software
2, ClusterXL Requirements and Compatibility - Check Point Software
3, Configuring ClusterXL - Check Point Software
4, How to configure ClusterXL - Check Point Software Technologies
NEW QUESTION # 191
What is the amount of Priority Queues by default?
- A. There are 8 priority queues by default, and up to 8 additional queues can be manually configured
- B. There is no distinct number of queues since it will be changed in a regular basis based on its system requirements.
- C. There are 7 priority queues by default and this number cannot be changed.
- D. There are 8 priority queues and this number cannot be changed.
Answer: A
NEW QUESTION # 192
During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?
- A. Host having a Critical event found by Antivirus
- B. Host having a Critical event found by IPS
- C. Host having a Critical event found by Anti-Bot
- D. Host having a Critical event found by Threat Emulation
Answer: C
Explanation:
The host having a Critical event found by Anti-Bot should be remediated first, as it indicates that the host is infected by a botnet malware that is communicating with a Command and Control server. This poses a serious threat to the network security and data integrity. The other events may indicate potential malware infection or attack attempts, but not necessarily successful ones. Reference: Threat Prevention Administration Guide
NEW QUESTION # 193
You want to gather data and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?
- A. SecuRemote
- B. Sandblast Mobile Protect
- C. Check Point Capsule Cloud
- D. SmartEvent Client Info
Answer: B
Explanation:
Explanation
SandBlast Mobile Protect is a lightweight app for iOS and Android that gathers data and helps analyze threats to devices in your environment.
https://www.checkpoint.com/downloads/products/how-sandblast-mobile-works-solution-brief.pdf
NEW QUESTION # 194
Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic. Assuming acceleration is enabled which path is handling the traffic?
- A. Slow Path
- B. Medium Path
- C. Fast Path
- D. Accelerated Path
Answer: A
Explanation:
When traffic from source 192.168.1.1 is going to www.google.com, and the Application Control Blade on the gateway is inspecting the traffic with acceleration enabled, it is handled by the Slow Path.
A) Slow Path
The Slow Path is responsible for handling traffic that requires full inspection by various security blades, including the Application Control Blade. Acceleration may offload some processing to the Medium Path or Fast Path, but the Slow Path is still involved in deeper inspection.
NEW QUESTION # 195
Fill in the blank: An identity server uses a __________ for user authentication.
- A. One-time password
- B. Shared secret
- C. Certificate
- D. Token
Answer: D
Explanation:
An identity server uses a token for user authentication. A token is a piece of data that contains information about the user's identity, such as their username, email, roles, and claims. A token is digitally signed by the identity server and can be verified by the relying party (the application or service that needs to authenticate the user). A token can be issued in different formats, such as JSON Web Token (JWT) or Security Assertion Markup Language (SAML). A token can also have different lifetimes, such as short-lived access tokens or long-lived refresh tokens.
NEW QUESTION # 196
What component of Management is used tor indexing?
- A. API Server
- B. SOLR
- C. fwm
- D. DBSync
Answer: B
Explanation:
Explanation
The component of Management that is used for indexing is SOLR1. SOLR is an open source enterprise search platform that provides indexing and searching capabilities for various types of data2. Check Point uses SOLR to index logs, objects, policies, and other data that are stored in the Security Management Server or the Multi-Domain Security Management Server3. SOLR enables fast and efficient searches in SmartConsole, SmartLog, SmartView, and other applications3. SOLR also supports advanced features such as full-text search, faceted search, highlighting, spell checking, and geospatial search2. References: Check Point R81.20 Known Limitations - Check Point Software, SOLR - The Enterprise Search Platform, Check Point R81.20 Logging and Monitoring Administration Guide - Check Point Software
NEW QUESTION # 197
Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?
- A. Source Port
- B. Destination Address
- C. TCP Acknowledgment Number
- D. Source Address
Answer: C
Explanation:
The attribute that is not used for identifying a connection by packet acceleration (SecureXL) is TCP Acknowledgment Number. SecureXL identifies connections by using a hash function that takes into account the following attributes: source address, destination address, source port, destination port, protocol, and VPN ID. The TCP Acknowledgment Number is not part of the hash function and does not affect the connection identification. Reference: [SecureXL Mechanism]
https //sc1.checkpoint.com/documents/R77/CP R77_Firewall_WebAdmm/92711.htm
NEW QUESTION # 198
What is not a purpose of the deployment of Check Point API?
- A. Execute an automated script to perform common tasks
- B. Create products that use and enhance the Check Point solution
- C. Integrate Check Point products with 3rd party solution
- D. Create a customized GUI Client for manipulating the objects database
Answer: D
Explanation:
The deployment of Check Point API does not have the purpose of creating a customized GUI Client for manipulating the objects database. The Check Point API is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. The Check Point API can be used to execute an automated script to perform common tasks, create products that use and enhance the Check Point solution, and integrate Check Point products with 3rd party solutions. However, creating a customized GUI Client for manipulating the objects database is not a supported or intended use case of the Check Point API.
NEW QUESTION # 199
Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic.
However, in the Application Control policy layer, the default action is ______ all traffic.
- A. Accept; drop
- B. Drop; accept
- C. Accept; redirect
- D. Redirect; drop
Answer: B
Explanation:
Explanation
In the Network policy layer, the default action for the Implied last rule is drop all traffic. However, in the Application Control policy layer, the default action is accept all traffic. The Implied last rule is a rule that is automatically added at the end of each policy layer and defines what to do with traffic that does not match any of the user-defined rules. The default actions for each policy layer can be changed in the Global Properties or in the layer properties. References: R81 Security Management Administration Guide, page 30.
NEW QUESTION # 200
What are the services used for Cluster Synchronization?
- A. 8116/UDP for Full Sync and Delta Sync
- B. No service needed when using Broadcast Mode
- C. TCP/256 for Full Sync and Delta Sync
- D. 256H-CP tor Full Sync and 8116/UDP for Delta Sync
Answer: D
Explanation:
Cluster Synchronization is a mechanism that allows cluster members to share state information and maintain a consistent security policy. Cluster Synchronization uses two types of synchronization: Full Synchronization and Delta Synchronization. Full Synchronization transfers the entire Security Policy and state tables from one cluster member to another. Delta Synchronization transfers only the changes in the state tables. Cluster Synchronization uses two services for communication: TCP port 256 (CPHA) for Full Synchronization and UDP port 8116 for Delta Synchronization3. Therefore, the correct answer is A.
NEW QUESTION # 201
Which of the following is NOT an alert option?
- A. SNMP
- B. Mail
- C. High alert
- D. User defined alert
Answer: C
Explanation:
High alert is not an alert option in Check Point. Alert options are ways to notify the administrator or other parties when a security event occurs. The available alert options are SNMP, Mail, User defined alert, Log, Popup alert, and User alert. Reference: Training & Certification | Check Point Software, Check Point Resource Library
NEW QUESTION # 202
Which process handles connection from SmartConsole R81?
- A. cpm
- B. cpmd
- C. fwm
- D. cpd
Answer: A
Explanation:
Explanation
The CPM process handles connection from SmartConsole R81. The CPM process is the main process of the Security Management Server and the Multi-Domain Security Management Server. It is responsible for managing the database, handling policy installation, communicating with SmartConsole clients, and providing REST API services. The CPM process runs on port 19009 and uses the CPD process as a proxy for communication with other processes.
References:
Check Point Processes and Daemons, section "CPM"
Check Point R81, section "SmartConsole"
Check Point R81.20, section "REST API"
NEW QUESTION # 203
You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?
- A. fw ctl multik dynamic_dispatching set_mode 9
- B. fw ctl multik set_mode 9
- C. fw ctl multik dynamic_dispatching on
- D. fw ctl multik pq enable
Answer: B
Explanation:
Explanation
To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. You can enable them by using the command fw ctl multik set_mode 9. This command sets the SecureXL mode to 9, which means that Priority Queues are enabled and Dynamic Dispatcher is fully enabled. References: SecureXL Mechanism
NEW QUESTION # 204
Hit Count is a feature to track the number of connections that each rule matches, which one is not benefit of Hit Count.
- A. Analyze a Rule Base - You can delete rules that have no matching connections
- B. Automatically rearrange Access Control Policy based on Hit Count Analysis
- C. Better understand the behavior of the Access Control Policy
- D. Improve Firewall performance - You can move a rule that has hot count to a higher position in the Rule Base
Answer: B
Explanation:
Hit Count is a feature to track the number of connections that each rule matches, which can help to optimize the Rule Base efficiency and analyze the network traffic behavior. The benefit that is not provided by Hit Count is automatically rearrange Access Control Policy based on Hit Count Analysis. Hit Count does not change the order of the rules automatically, but it allows the administrator to manually move the rules up or down based on the hit count statistics. The administrator can also use the SmartOptimize feature to get suggestions for improving the Rule Base order and performance. Reference: R81 Security Management Administration Guide, page 97.
NEW QUESTION # 205
Which command is used to obtain the configuration lock in Gaia?
- A. Unlock database override
- B. Lock database user
- C. Unlock database lock
- D. Lock database override
Answer: D
Explanation:
Which command is used to obtain the configuration lock in Gaia? The command that is used to obtain the configuration lock in Gaia is lock database override. This command allows a user to take over the configuration lock from another user who is currently logged in with read/write access. The other user will be forced to logout and will lose any unsaved changes. This command should be used with caution and only when necessary. Reference: Gaia Administration Guide R81, page 15.
NEW QUESTION # 206
Matt wants to upgrade his old Security Management server to R81.x using the Advanced Upgrade with Database Migration. What is one of the requirements for a successful upgrade?
- A. Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine
- B. Size of the /var/log folder of the target machine must be at least 25GB or more
- C. Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR/log directory on the source machine
- D. Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine
Answer: A
Explanation:
One of the requirements for a successful upgrade using the Advanced Upgrade with Database Migration is that the size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine. This is to ensure that there is enough space to copy the log files from the source machine to the target machine during the upgrade process. Reference: Advanced Upgrade with Database Migration
NEW QUESTION # 207
If an administrator wants to add manual NAT for addresses now owned by the Check Point firewall, what else is necessary to be completed for it to function properly?
- A. Add the proxy ARP configurations in a file called $FWDIR/conf/local.arp
- B. Nothing - the proxy ARP is automatically handled in the R81 version
- C. Add the proxy ARP configurations in a file called $CPDIR/conf/local.arp
- D. Add the proxy ARP configurations in a file called /etc/conf/local.arp
Answer: C
NEW QUESTION # 208
......
CheckPoint 156-315.81 exam is divided into two parts: a written exam and a practical lab exam. The written exam consists of 90 multiple-choice questions that cover topics such as firewall technology, VPNs, network security, and threat prevention. The practical lab exam is a hands-on test that evaluates the candidate's ability to configure and troubleshoot Check Point security solutions.
The Check Point Certified Security Expert R81 Certification Exam, also known as CheckPoint 156-315.81, is a certification exam that tests the knowledge and skills of professionals in managing and securing Check Point products. Check Point Certified Security Expert R81 certification exam is designed for security experts, network administrators, and IT professionals who want to validate their expertise in Check Point's latest security technology.
Prepare With Top Rated High-quality 156-315.81 Dumps For Success in Exam: https://examcollection.guidetorrent.com/156-315.81-dumps-questions.html