156-315.81 Practice Test Questions

422 Questions


While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?


A. Security Gateway is not part of the Domain


B. SmartConsole machine is not part of the domain


C. Identity Awareness is not enabled on Global properties


D. Security Management Server is not part of the domain





B.
  SmartConsole machine is not part of the domain

Explanation: The verified answer is B. SmartConsole machine is not part of the domain.
The Identity Awareness wizard uses the SmartConsole machine to detect the windows domain by querying the Active Directory server using DCOM protocol1. If the SmartConsole machine is not part of the domain, the query will fail and the wizard will not automatically detect the domain. The user will have to manually enter the domain name and credentials to proceed with the configuration.
The Security Gateway, the Security Management Server, and the Identity Awareness global properties do not affect the domain detection by the wizard. However, they are required for other aspects of the Identity Awareness blade, such as AD Query, Identity Collector, and Browser-Based Authentication2.

What command is used to manually failover a Multi-Version Cluster during the upgrade?


A. clusterXL_admin down in Expert Mode


B. clusterXL_admin down in Clish


C. set cluster member state down in Clish


D. set cluster down in Expert Mode





B.
  clusterXL_admin down in Clish

Firewall polices must be configured to accept VRRP packets on the GAiA platform if it Firewall software. The Multicast destination assigned by the internet Assigned Number Authority (IANA) for VRRP is:


A. 224.0.0.18


B. 224 00 5


C. 224.0.0.102


D. 224.0.0.22





A.
  224.0.0.18

Explanation: The multicast destination assigned by the Internet Assigned Numbers Authority (IANA) for VRRP is 224.0.0.18. This is a reserved multicast address that is used by VRRP routers to communicate with each other and announce their priority and state. Firewall policies must be configured to accept VRRP packets on the Gaia platform if it runs Firewall software. Otherwise, VRRP packets will be dropped by default.

Which of the following is NOT a method used by Identity Awareness for acquiring identity?


A. Remote Access


B. Active Directory Query


C. Cloud IdP (IdentityProvider)


D. RADIUS





A.
  Remote Access

Which of the following is true regarding the Proxy ARP feature for Manual NAT?


A. The local.arp file must always be configured


B. Automatic proxy ARP configuration can be enabled


C. fw ctl proxy should be configured


D. Translate Destination on Client Side should be configured





B.
  Automatic proxy ARP configuration can be enabled

Explanation: The verified answer is B. Automatic proxy ARP configuration can be enabled.
Proxy ARP is a feature that allows a gateway to respond to ARP requests on behalf of another IP address that is not on the same network segment. Proxy ARP is required for manual NAT rules when the NATed IP addresses are not routed to the gateway1.
By default, proxy ARP for manual NAT rules has to be configured manually by editing the local.arp file or using the CLISH commands on the gateway2. However, since R80.10, there is an option to enable automatic proxy ARP configuration for manual NAT rules by modifying the files $CPDIR/tmp/.CPprofile.sh and $CPDIR/tmp/.CPprofile.csh on the gateway3.
fw ctl proxy is a command that displays the proxy ARP table on the gateway, but it does not configure proxy ARP4.
Translate Destination on Client Side is a NAT option that determines whether the destination IP address is translated before or after the routing decision. It does not affect proxy ARP.

What are valid authentication methods for mutual authenticating the VPN gateways?


A. PKI Certificates and Kerberos Tickets


B. PKI Certificates and DynamicID OTP


C. Pre-Shared Secrets and Kerberos Ticket


D. Pre-shared Secret and PKI Certificates





D.
  Pre-shared Secret and PKI Certificates

Explanation: The valid authentication methods for mutual authenticating the VPN gateways are Pre-shared Secret and PKI Certificates. Pre-shared Secret is a method that uses a secret key that is known only to the two VPN gateways. PKI Certificates is a method that uses digital certificates that are issued by a trusted Certificate Authority (CA) and contain the public key of each VPN gateway. Both methods ensure that the VPN gateways can verify each other’s identity before establishing a secure VPN tunnel.

Which of the following is NOT a valid type of SecureXL template?


A. Accept Template


B. Deny template


C. Drop Template


D. NAT Template





B.
  Deny template

Which Check Point software blade provides protection from zero-day and undiscovered threats?


A. Firewall


B. Threat Emulation


C. Application Control


D. Threat Extraction





B.
  Threat Emulation

What Is the difference between Updatable Objects and Dynamic Objects


A. Dynamic Objects ate maintained automatically by the Threat Cloud. Updatable Objects are created and maintained locally. In both cases there is no need to install policy for the changes to take effect.


B. Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally For Dynamic Objects there is no need to install policy for the changes to take effect.


C. Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally In both cases there is no need to install policy for the changes to take effect.


D. Dynamic Objects are maintained automatically by the Threat Cloud. For Dynamic Objects there rs no need to install policy for the changes to take effect. Updatable Objects are created and maintained locally.





B.
  Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally For Dynamic Objects there is no need to install policy for the changes to take effect.

Explanation: Updatable Objects are a Threat Cloud Service that provides network objects that represent external services, such as Office 365, AWS, GEO locations, and more. These objects are updated automatically by Check Point and do not require policy installation for the changes to take effect. Dynamic Objects are created and maintained locally by the administrator and can be used to define temporary or changing network objects, such as IP addresses, ports, or ranges. Dynamic Objects also do not require policy installation for the changes to take effect. References: Updatable Objects, Updateable Objects and NAT, R80.20 Updatable Domain Objects and CLI Commands.

What are possible Automatic Reactions in SmartEvent?


A. Mail. SNMP Trap, Block Source. Block Event Activity, External Script


B. Web Mail. Block Destination, SNMP Trap. SmartTask


C. Web Mail, Block Service. SNMP Trap. SmartTask, Geo Protection


D. Web Mail, Forward to SandBlast Appliance, SNMP Trap, External Script





A.
  Mail. SNMP Trap, Block Source. Block Event Activity, External Script

Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?


A. fwm


B. cpd


C. cpwd


D. cpm





C.
  cpwd

Explanation: The Check Point WatchDog daemon (cpwd) invokes and monitors critical processes and attempts to restart them if they fail. The cpwd daemon is responsible for starting processes such as cpd, cpm, fwm, fwd, and others. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The cpm daemon is the Check Point Management Server daemon that handles database operations and policy installation. The fwm daemon is the Firewall Management daemon that handles communication between Security Gateways and Security Management Servers. References: : Check Point Software, Getting Started, WatchDog Daemon; : Check Point Software, Getting Started, Processes.

Fill in the blank: The IPS policy for pre-R81 gateways is installed during the _______ .


A. Firewall policy install


B. Threat Prevention policy install


C. Anti-bot policy install


D. Access Control policy install





C.
  Anti-bot policy install


Page 7 out of 36 Pages
Previous