[2024] 156-315.81 Exam Dumps, Test Engine Practice Test Questions [Q73-Q94]

[2024] 156-315.81 Exam Dumps, Test Engine Praxis Test Fragen [Q73-Q94]

Diesen Beitrag bewerten

[2024] 156-315.81 Exam Dumps, Test Engine Practice Test Questions

Pass 156-315.81 exam [Jan 15, 2024] Updated 582 Questions

NEUE FRAGE 73
Which Queue in the Priority Queue has the maximum priority?

High Priority

Control

Weiterleitung

Heavy Data Queue

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105762

NEUE FRAGE 74
Which of the following process pulls application monitoring status?

fwd

fwm

cpwd

cpd

NEUE FRAGE 75
Which file contains the host address to be published, the MAC address that needs to be associated with the IP Address, and the unique IP of the interface that responds to ARP request?

/opt/CPshrd-R81/conf/local.arp

/var/opt/CPshrd-R81/conf/local.arp

$CPDIR/conf/local.arp

$FWDIR/conf/local.arp

Erläuterung
The file that contains the host address to be published, the MAC address that needs to be associated with the IP address, and the unique IP of the interface that responds to ARP request is $FWDIR/conf/local.arp.
Local.arp is a configuration file that defines static ARP entries for hosts behind NAT devices. This file allows the Security Gateway to respond to ARP requests for NATed hosts with the correct MAC address, and to publish the NATed IP address instead of the real IP address. The other files are either not related or not valid.

NEUE FRAGE 76
What is the biggest benefit of policy layers?

To break one policy into several virtual policies

Policy Layers and Sub-Policies enable flexible control over the security policy

They improve the performance on OS kernel version 3.0

To include Threat Prevention as a sub policy for the firewall policy

“You can organize the Access Control rules in more manageable subsets of rules using Ordered Layers and Inline Layers.” from: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Ordered-Layers-and-Inline-Layers.htm

NEUE FRAGE 77
What is required for a certificate-based VPN tunnel between two gateways with separate management systems?

Mutually Trusted Certificate Authorities

Shared User Certificates

Shared Secret Passwords

Unique Passwords

NEUE FRAGE 78
In R81 spoofing is defined as a method of:

Disguising an illegal IP address behind an authorized IP address through Port Address Translation.

Hiding your firewall from unauthorized users.

Detecting people using false or wrong authentication logins

Making packets appear as if they come from an authorized IP address.

Erläuterung
In R81, spoofing is defined as a method of making packets appear as if they come from an authorized IP address. Spoofing can be used by attackers to bypass security policies or hide their identity. Check Point firewalls use anti-spoofing mechanisms to prevent spoofed packets from entering or leaving the network.
References: Security Gateway R81 Administration Guide:

NEUE FRAGE 79
You are asked to check the status of several user-mode processes on the management server and gateway.
Which of the following processes can only be seen on a Management Server?

fwd

fwm

cpd

cpwd

Erläuterung
User-mode processes are processes that run in the user space of the operating system, as opposed to kernel-mode processes that run in the kernel space. User-mode processes are usually less privileged and have less access to system resources than kernel-mode processes. Check Point products use both user-mode and kernel-mode processes to provide various functionalities and services.
The following are some of the user-mode processes that can be seen on the management server and gateway:
fwd: This process is responsible for policy installation, logging, and communication with other Check Point components. It runs on both the management server and gateway.
cpd: This process is responsible for licensing, certificate management, and communication with SmartConsole. It runs on both the management server and gateway.
cpwd: This process is responsible for monitoring and restarting other processes. It runs on both the management server and gateway.
The following is a user-mode process that can only be seen on the management server:
fwm: This process is responsible for managing the security policy database, compiling the security policy, and generating reports. It runs only on the management server.
Therefore, the correct answer is B.
References: Check Point Processes and Daemons, Check Point Processes Cheat Sheet, Check Point Firewall Security Solution

NEW QUESTION 80
What is false regarding prerequisites for the Central Deployment usage?

The administrator must have write permission on SmartUpdate

Security Gateway must have the latest CPUSE Deployment Agent

No need to establish SIC between gateways and the management server, since the CDT tool will take care about SIC automatically.

The Security Gateway must have a policy installed

Erläuterung
Establishing SIC between gateways and the management server is a prerequisite for Central Deployment usage, as the CDT tool will not take care of this automatically. The administrator must have write permission on SmartUpdate, the Security Gateway must have the latest CPUSE Deployment Agent, and the Security Gateway must have a policy installed.

NEW QUESTION 81
Which SmartEvent component is responsible to collect the logs from different Log Servers?

SmartEvent Server

SmartEvent Database

SmartEvent Collector

SmartEvent Correlation Unit

Erläuterung
https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_LoggingAndMo nitoring_AdminGuide/Topics-LMG/SmartEvent-Architecture.htm?tocpath=Event%20Analysis%7C_____3

NEW QUESTION 82
Which process is used mainly for backward compatibility of gateways in R81.X? It provides communication with GUI-client, database manipulation, policy compilation and Management HA synchronization.

cpm

fwd

cpd

fwm
D18912E1457D5D1DDCBD40AB3BF70D5D

Erläuterung
The process that is used mainly for backward compatibility of gateways in R81.X is fwm. The fwm daemon handles communication with GUI-client, database manipulation, policy compilation and Management HA synchronization for legacy gateways that do not support the cpm daemon. The cpm daemon is the new Check Point Management Server daemon that handles these tasks for R80 and higher gateways. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The fwd daemon is the Firewall Daemon that handles communication between Security Gateways and Security Management Servers2. References: 2: Check Point Software, Getting Started, Processes.

NEUE FRAGE 83
How to can you make sure that the old logs will be available after updating the Management to version R81.10 using the Advanced Upgrade Method?

Use the WebUI -> Maintenance > System Backup and store the backup on a remote FTP server

The logs will be included running SFWDIR/scripts/migrate_server export -v R81.10 <path/filename>

Use the WebUI to save a snapshot before updating the Management -> Maintenance > Snapshot Management

Use the migrate_server tool with the option ‘-I’ for the logs and ‘-x’ for the index

Erläuterung
The best way to make sure that the old logs will be available after updating the Management to version R81.10 using the Advanced Upgrade Method is to use the migrate_server tool with the option ‘-l’ for the logs and ‘-x’ for the index. This option will export both logs and index files from an existing Security Management Server or Multi-Domain Server to a specified directory or file. The exported data can then be imported to a new server using a similar command with ‘-i’ option. References: [Check Point R81 Installation and Upgrade Guide]

NEUE FRAGE 84
Which path below is available only when CoreXL is enabled?

Slow path

Firewall path

Medium path

Accelerated path

Erläuterung
According to the Check Point R81 training course, the medium path is available only when CoreXL is enabled. CoreXL is a performance-enhancing technology that allows multiple CPU cores to process traffic simultaneously. The medium path handles packets that require deeper inspection or content awareness, such as IPS, Anti-Virus, or URL Filtering. The other paths are either available regardless of CoreXL or not valid terms. References: Certified Security Expert (CCSE) R81.20 Course Overview

NEUE FRAGE 85
In a Client to Server scenario, which inspection point is the first point immediately following the tables and rule base check of a packet coming from outside of the network?

Big l

Little o

Little i

Big O

Erläuterung
The inspection point Big l is the first point immediately following the tables and rule base check of a packet coming from outside of the network. It is also the last point before the packet leaves the Security Gateway to the internal network1. The other inspection points are either before or after the rule base check, or in a different direction of traffic flow2. References: Check Point R81 Security Gateway Architecture and Packet Flow, 156-315.81 Checkpoint Exam Info and Free Practice Test – ExamTopics

NEUE FRAGE 86
An administrator would like to troubleshoot why templating is not working for some traffic. How can he determine at which rule templating is disabled?

He can use the fw accel stat command on the gateway.

He can use the fw accel statistics command on the gateway.

He can use the fwaccel stat command on the Security Management Server.

He can use the fwaccel stat command on the gateway

Erläuterung
The fwaccel stat command on the gateway shows the status of SecureXL acceleration, including the number of accelerated and non-accelerated connections, and the reason for non-acceleration. The reason for non-acceleration can be either a rule that disables templating, or a feature that is not supported by SecureXL.
To determine which rule disables templating, the administrator can use the -s option to show the rule numbers and names. For example:

NEUE FRAGE 87
Which Correction mechanisms are available with ClusterXL under R81.10?

Correction Mechanisms are only available of Maestro Hyperscale Orchestrators

Pre-Correction and SDF (Sticky Decision Function)

SDF (Sticky Decision Function) and Flush and ACK

Dispatcher (Early Correction) and Firewall (Late Correction)

Erläuterung
SDF (Sticky Decision Function) and Flush and ACK are the two correction mechanisms that are available with ClusterXL under R81.10. According to the ClusterXL R81.10 Administration Guide1, correction mechanisms are methods that ClusterXL uses to prevent or recover from out-of-state situations, which occur when different Cluster Members have different information about the connections that they handle1. ClusterXL supports two types of correction mechanisms: SDF and Flush and ACK1.
SDF (Sticky Decision Function) is a mechanism that ensures that packets of the same connection are always handled by the same Cluster Member, regardless of the load balancing algorithm. SDF uses a hash table that maps each connection to a specific Cluster Member, based on the 5-tuple of source IP, destination IP, source port, destination port, and protocol. SDF prevents out-of-state situations by avoiding the switch of Cluster Members for existing connections1.
Flush and ACK is a mechanism that synchronizes the connection tables of different Cluster Members when an out-of-state situation is detected. Flush and ACK works as follows:
When a Cluster Member receives a packet that belongs to an unknown connection, it sends a Flush message to all other Cluster Members, asking them to delete the connection from their tables.
When a Cluster Member receives a Flush message, it checks if it has the connection in its table. If it does, it deletes the connection and sends an ACK message to the sender of the Flush message, indicating that it has performed the deletion.
When a Cluster Member receives an ACK message, it creates a new connection entry in its table for the packet that triggered the Flush message, and processes the packet normally.
If a Cluster Member does not receive any ACK message within a timeout period, it assumes that no other Cluster Member has the connection, and creates a new connection entry in its table for the packet that triggered the Flush message1.
References: : ClusterXL R81.10 Administration Guide

NEUE FRAGE 88
The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Secure Internal Communication (SIC)

Restart Daemons if they fail

Transfers messages between Firewall processes

Pulls application monitoring status

Erläuterung
The CPD daemon is a Firewall Kernel Process that does not pull application monitoring status. The CPD daemon is responsible for Secure Internal Communication (SIC), restarting daemons if they fail, transferring messages between Firewall processes, and managing policy installation. References: CPD process

NEUE FRAGE 89
Which web services protocol is used to communicate to the Check Point R81 Identity Awareness Web API?

SOAP

REST

XLANG

XML-RPC

Erläuterung
The Check Point R81 Identity Awareness Web API uses the REST web services protocol to communicate with external identity sources. REST stands for Representational State Transfer, and it is an architectural style for designing web services that use HTTP methods to access and manipulate resources. The Identity Awareness Web API allows external identity sources to send identity and session information to the Security Gateway, which can then use this information for policy enforcement.

NEUE FRAGE 90
According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

Firewall

VPN

IPS

HTTPS

NEUE FRAGE 91
Which command is used to obtain the configuration lock in Gaia?

Lock database override

Unlock database override

Unlock database lock

Lock database user

Erläuterung
Obtaining a Configuration Lock

NEUE FRAGE 92
What needs to be configured if the NAT property ‘Translate destination or client side’ is not enabled in Global Properties?

A host route to route to the destination IP.

Use the file local.arp to add the ARP entries for NAT to work.

Nothing, the Gateway takes care of all details necessary.

Enabling ‘Allow bi-directional NAT’ for NAT to work correctly.

Erläuterung
The NAT property ‘Translate destination or client side’ is used to determine whether the destination IP address of a packet should be translated on the client side or the server side of a connection. If this property is not enabled, then the destination IP address is translated on the server side, which means that the gateway takes care of all details necessary for NAT to work. The gateway will send an ARP request for the translated IP address and will reply to any ARP requests for that address. Therefore, there is no need to configure a host route, use the local.arp file, or enable bi-directional NAT for NAT to work correctly. References: R81 Security Management Administration Guide, page 1010.

NEUE FRAGE 93
Bob needs to know if Alice was configuring the new virtual cluster interface correctly. Which of the following Check Point commands is true?

cphaprob-aif

cp hap rob state

cphaprob list

probcpha -a if

Erläuterung
You can use the cphaprob -a if command to check the status of the virtual cluster interface1. This command displays the state, virtual IP address, and physical IP address of each cluster interface2. It also shows the load balancing method, the load on each interface, and the active member for each interface2. This command can help you verify that Alice configured the virtual cluster interface correctly and that it is working properly. To run this command, you need to access the cluster member in Clish and run cphaprob -a if1.
References: How to configure ClusterXL in Load Sharing Unicast mode – Check Point Software, cphaprob -a if – Check Point Software

NEUE FRAGE 94
Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Run cprestart from clish

After upgrading the hardware, increase the number of kernel instances using cpconfig

Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores

Hyperthreading must be enabled in the bios to use CoreXL

Erläuterung
After installing a new multicore CPU to replace the existing single core CPU, the administrator is required to perform one additional task, which is to increase the number of kernel instances using cpconfig. This is because by default, only one kernel instance is enabled on a Security Gateway. To take advantage of multiple cores, the administrator needs to configure more kernel instances according to the number of cores available on the CPU. References: Configuring CoreXL

Laden …