100% Success Check Point 156-315.81 Dumps with Excellent Results

Jonnie Karnath2023-04-29T08:56:16+00:00

It is important to note that the Check Point 156-315.81 exam is challenging, and candidates need to have a comprehensive understanding of the topics covered to pass the exam. Certspots is a platform that can help candidates prepare for the 156-315.81 exam. They provide study materials, practice questions, and other resources that can help candidates prepare for the exam. Additionally, Certspots offers a guarantee that their Check Point 156-315.81 dumps will ensure a 100% success rate on the 156-315.81 exam, which can provide candidates with additional confidence as they prepare for the exam.

Page 1 of 17

1. There are 4 ways to use the Management API for creating host object with R81 Management API.

Which one is NOT correct?

Using Web Services

Using Mgmt_cli tool

Using CLISH

Using SmartConsole GUI console

Events are collected with SmartWorkflow from Trouble Ticket systems

2. What is the valid range for VRID value in VRRP configuration?

1 - 254

1 - 255

0 - 254

0 - 255

3. What is the recommended way to have a redundant Sync connection between the cluster nodes?

In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define two Sync interfaces per node. Connect both Sync interfaces without using a switch.

Use a group of bonded interfaces. In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define a Virtual IP for the Sync interface.

In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define two Sync interfaces per node. Use two different Switches to connect both Sync interfaces.

Use a group of bonded interfaces connected to different switches. Define a dedicated sync interface, only one interface per node using the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management.

4. You have pushed policy to GW-3 and now cannot pass traffic through the gateway.

As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?

fw unloadlocal

fw unloadpolicy

fwm unload local

fwm unload policy

5. Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R81.X. The Network Security Developer Team is having an issue testing the API with a newly deployed R81.X Security Management Server Aaron wants to confirm API services are working properly.

What should he do first?

Aaron should check API Server status with "fwm api status" from Expert mode If services are stopped, he should start them with "fwm api start".

Aaron should check API Server status with "cpapi status" from Expert mode. If services are stopped, he should start them with "cpapi start"

Aaron should check API Server status with "api status" from Expert mode If services are stopped, he should start them with "api start"

Aaron should check API Server status with "cpm api status" from Expert mode. If services are stopped, he should start them with "cpi api start".

6. What is false regarding a Management HA environment?

Only one Management Server should be active, while any others be in standby mode

It is not necessary to establish SIC between the primary and secondary management server, since the latter gets the exact same copy of the management database from the prior.

SmartConsole can connect to any management server in Readonly mode.

Synchronization will occur automatically with each Publish event if the Standby servers are available.

7. Which SmartConsole tab is used to monitor network and security performance?

Manage Setting

Security Policies

Gateway and Servers

Logs and Monitor

8. What feature allows Remote-access VPN users to access resources across a site-to-site VPN tunnel?

Specific VPN Communities

Remote Access VPN Switch

Mobile Access VPN Domain

Network Access VPN Domain

9. Can multiple administrators connect to a Security Management Server at the same time?

No, only one can be connected

Yes, all administrators can modify a network object at the same time

Yes, every administrator has their own username, and works in a session that is independent of other administrators.

Yes, but only one has the right to write.

10. What has to be taken into consideration when configuring Management HA?

The Database revisions will not be synchronized between the management servers

SmartConsole must be closed prior to synchronized changes in the objects database

If you wanted to use Full Connectivity Upgrade, you must change the Implied Rules to allow FW1_cpredundant to pass before the Firewall Control Connections.

For Management Server synchronization, only External Virtual Switches are supported. So, if you wanted to employ Virtual Routers instead, you have to reconsider your design.

Page 2 of 17

11. Full synchronization between cluster members is handled by Firewall Kernel.

Which port is used for this?

UDP port 265

TCP port 265

UDP port 256

TCP port 256

12. What are the two types of tests when using the Compliance blade?

Policy-based tests and Global properties

Global tests and Object-based tests

Access Control policy analysis and Threat Prevention policy analysis

Tests conducted based on the loC XMfcfile and analysis of SOLR documents

13. Which is not a blade option when configuring SmartEvent?

Correlation Unit

SmartEvent Unit

SmartEvent Server

Log Server

14. The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Secure Internal Communication (SIC)

Restart Daemons if they fail

Transfers messages between Firewall processes

Pulls application monitoring status

15. What command is used to manually failover a cluster during a zero downtime upgrade?

set cluster member down

cpstop

clusterXL_admin down

set clusterXL down

16. You need to change the MAC-address on eth2 interface of the gateway.

What is the correct way to change MAC-address in Check Point Gaia?

In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11

In expert-mode run ifconfig eth1 hw 11:11:11:11 11 11

In CLISH run set interface eth2 hw-addr 11 11 11:11:11 11

In expert-mode run: ethtool -4 eth2 mac 11 11:11:11:11:11

17. You have successfully backed up Check Point configurations without the OS information.

What command would you use to restore this backup?

restore_backup

import backup

cp_merge

migrate import

18. A user complains that some Internet resources are not available. The Administrator is having issues seeing it packets are being dropped at the firewall (not seeing drops in logs).

What is the solution to troubleshoot the issue?

run fw unloadlocal" on the relevant gateway and check the ping again

run "cpstop" on the relevant gateway and check the ping again

run ‘’fw log" on the relevant gateway

run ‘’fw ctl zdebug drop" on the relevant gateway

19. Which of the following authentication methods ARE NOT used for Mobile Access?

RADIUS server

Username and password (internal, LDAP)

SecurID

TACACS+

20. Identify the API that is not supported by Check Point currently.

R81 Management API-

Identity Awareness Web Services API

Open REST API

OPSEC SDK

Page 3 of 17

21. What are the three components for Check Point Capsule?

Capsule Docs, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Cloud

22. What is the Implicit Clean-up Rule?

A setting is defined in the Global Properties for all policies.

A setting that is configured per Policy Layer.

Another name for the Clean-up Rule.

Automatically created when the Clean-up Rule is defined.

23. What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

Lagging

Synchronized

Never been synchronized

Collision

24. Check Point ClusterXL Active/Active deployment is used when:

Only when there is Multicast solution set up.

There is Load Sharing solution set up.

Only when there is Unicast solution set up.

There is High Availability solution set up.

25. To optimize Rule Base efficiency, the most hit rules should be where?

Removed from the Rule Base.

Towards the middle of the Rule Base.

Towards the top of the Rule Base.

Towards the bottom of the Rule Base.

26. SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user’s machine via the web browser.

What are the two modes of SNX?

Application and Client Service

Network and Application

Network and Layers

Virtual Adapter and Mobile App

27. Which of the following is a new R81 Gateway feature that had not been available in R77.X and older?

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

Time object to a rule to make the rule active only during specified times.

Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.

28. Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

ffffffff

00000001

00000002

00000003

29. Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

ThreatWiki

Whitelist Files

AppWiki

IPS Protections

30. What is the minimum number of CPU cores required to enable CoreXL?

Page 4 of 17

31. Your manager asked you to check the status of SecureXL, and its enabled templates and features.

What command will you use to provide such information to manager?

fw accel stat

fwaccel stat

fw acces stats

fwaccel stats

32. Pamela is Cyber Security Engineer working for Global Instance Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R81.10. Company’s Developer Team is having random access issue to newly deployed Application Server in DMZ’s Application Server Farm Tier and blames DMZ Security Gateway as root cause. The ticket has been created and issue is at Pamela’s desk for an investigation. Pamela decides to use Check Point’s Packet Analyzer Tool-fw monitor to iron out the issue during approved Maintenance window.

What do you recommend as the best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic?

Pamela should check SecureXL status on DMZ Security gateway and if it’s turned O

She should turn OFF SecureXL before using fw monitor to avoid misleading traffic captures.

Pamela should check SecureXL status on DMZ Security Gateway and if it’s turned OF

She should turn ON SecureXL before using fw monitor to avoid misleading traffic captures.

Pamela should use tcpdump over fw monitor tool as tcpdump works at OS-level and captures entire traffic.

Pamela should use snoop over fw monitor tool as snoop works at NIC driver level and captures entire traffic.

33. What is the benefit of Manual NAT over Automatic NAT?

If you create a new Security Policy, the Manual NAT rules will be transferred to this new policy.

There is no benefit since Automatic NAT has in any case higher priority over Manual NAT

You have the full control about the priority of the NAT rules

On IPSO and GAIA Gateways, it is handled in a stateful manner

34. Which path below is available only when CoreXL is enabled?

Slow path

Firewall path

Medium path

Accelerated path

35. Which of the following is NOT a type of Endpoint Identity Agent?

Terminal

Light

Full

Custom

36. What is correct statement about Security Gateway and Security Management Server failover in Check Point R81.X in terms of Check Point Redundancy driven solution?

Security Gateway failover is an automatic procedure but Security Management Server failover is a manual procedure.

Security Gateway failover as well as Security Management Server failover is a manual procedure.

Security Gateway failover is a manual procedure but Security Management Server failover is an automatic procedure.

Security Gateway failover as well as Security Management Server failover is an automatic procedure.

37. SmartConsole R81 x requires the following ports to be open for SmartEvent.

19009, 19090 & 443

19009, 19004 & 18190

18190 & 443

19009, 18190 & 443

38. Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

assign privileges to users.

edit the home directory of the user.

add users to your Gaia system.

assign user rights to their home directory in the Security Management Server.

39. You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization.

What service is used by the FWD daemon to do a Full Synchronization?

TCP port 443

TCP port 257

TCP port 256

UDP port 8116

40. Which is the command to identify the NIC dnver before considering about the employment of the Multi-Queue feature?

show interface eth0 mq

ethtool A eth0

ifconfig -i eth0 verbose

ip show Int eth0

Page 5 of 17

41. Which of the following technologies extracts detailed information from packets and stores that information in state tables?

INSPECT Engine

Stateful Inspection

Packet Filtering

Application Layer Firewall

42. Post-Automatic/Manual NAT rules

1, 2, 3, 4

1, 4, 2, 3

3, 1, 2, 4

4, 3, 1, 2

43. Which of the following describes how Threat Extraction functions?

Detect threats and provides a detailed report of discovered threats.

Proactively detects threats.

Delivers file with original content.

Delivers PDF versions of original files with active content removed.

44. The Check Point history feature in R81 provides the following:

View install changes and install specific version

View install changes

Policy Installation Date, view install changes and install specific version

Policy Installation Date only

45. What is required for a certificate-based VPN tunnel between two gateways with separate management systems?

Mutually Trusted Certificate Authorities

Shared User Certificates

Shared Secret Passwords

Unique Passwords

46. When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

None, Security Management Server would be installed by itself.

SmartConsole

SecureClient

Security Gateway

SmartEvent

47. What is the base level encryption key used by Capsule Docs?

RSA 2048

RSA 1024

SHA-256

AES

48. What is the purpose of a SmartEvent Correlation Unit?

The SmartEvent Correlation Unit is designed to check the connection reliability from SmartConsole to the SmartEvent Server.

The SmartEvent Correlation Unit’s task it to assign severity levels to the identified events.

The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events.

The SmartEvent Correlation Unit is designed to check the availability of the SmartReporter Server.

49. After having saved the Clish Configuration with the "save configuration config.txt" command, where can you find the config.txt file?

You will find it in the home directory of your user account (e.g. /home/admin/)

You can locate the file via SmartConsole > Command Line.

You have to launch the WebUI and go to "Config" -> "Export Config File" and specifiy the destination directory of your local file system.

You cannot locate the file in the file system since Clish does not have any access to the bash file system

50. Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible.

Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

fw tab -t connections -s

fw tab -t connections

fw tab -t connections -c

fw tab -t connections -f

Page 6 of 17

51. Which Check Point software blade provides Application Security and identity control?

Identity Awareness

Data Loss Prevention

URL Filtering

Application Control

52. ESTION NO: 10

Which two of these Check Point Protocols are used by SmartEvent Processes?

ELA and CPD

FWD and LEA

FWD and CPLOG

ELA and CPLOG

53. Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called:

cpexport

sysinfo

cpsizeme

cpinfo

54. What is the purpose of the CPCA process?

Monitoring the status of processes.

Sending and receiving logs.

Communication between GUI clients and the SmartCenter server.

Generating and modifying certificates.

55. Choose the correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI?

mgmt_cli add host name “myHost12 ip” address 10.50.23.90

mgmt_cli add host name ip-address 10.50.23.90

mgmt_cli add host “emailserver1” address 10.50.23.90

mgmt_cli add host name “emailserver1” ip-address 10.50.23.90

56. The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?

field_name:string

name field:string

name_field:string

field name:string

57. Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .

The license is attached to the wrong Security Gateway.

The existing license expires.

The license is upgraded.

The IP address of the Security Management or Security Gateway has changed.

58. SandBlast offers flexibility in implementation based on their individual business needs.

What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Smart Cloud Services

Load Sharing Mode Services

Threat Agent Solution

Public Cloud Services

59. Main Mode in IKEv1 uses how many packages for negotiation?

depends on the make of the peer gateway

60. When synchronizing clusters, which of the following statements is FALSE?

The state of connections using resources is maintained in a Security Server, so their connections cannot be synchronized.

Only cluster members running on the same OS platform can be synchronized.

In the case of a failover, accounting information on the failed member may be lost despite a properly working synchronization.

Client Authentication or Session Authentication connections through a cluster member will be lost if the cluster member fails.

Page 7 of 17

61. In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

Pentagon

Combined

Meshed

Star

62. Which member of a high-availability cluster should be upgraded first in a Zero downtime upgrade?

The Standby Member

The Active Member

The Primary Member

The Secondary Member

63. Ken wants to obtain a configuration lock from other administrator on R81 Security Management Server. He can do this via WebUI or via CLI.

Which command should he use in CLI? (Choose the correct answer.)

remove database lock

The database feature has one command lock database override.

override database lock

The database feature has two commands lock database override and unlock database. Both will work.

64. Bob needs to know if Alice was configuring the new virtual cluster interface correctly.

Which of the following Check Point commands is true?

cphaprob-aif

cp hap rob state

cphaprob list

probcpha -a if

65. Which command shows the current connections distributed by CoreXL FW instances?

fw ctl multik stat

fw ctl affinity -l

fw ctl instances -v

fw ctl iflist

66. Office mode means that:

SecurID client assigns a routable MAC address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

Users authenticate with an Internet browser and use secure HTTPS connection.

Local ISP (Internet service Provider) assigns a non-routable IP address to the remote user.

Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

67. Which one of the following is NOT a configurable Compliance Regulation?

GLBA

CJIS

SOCI

NCIPA

68. fwssd is a child process of which of the following Check Point daemons?

fwd

cpwd

fwm

cpd

69. Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?

enable DLP and select.exe and .bat file type

enable .exe & .bat protection in IPS Policy

create FW rule for particular protocol

tecli advanced attributes set prohibited_file_types exe.bat

70. What is the responsibility of SOLR process on R81.10 management server?

Validating all data before it’s written into the database

It generates indexes of data written to the database

Communication between SmartConsole applications and the Security Management Server

Writing all information into the database

Page 8 of 17

71. How many versions, besides the destination version, are supported in a Multi-Version Cluster Upgrade?

72. How can SmartView application accessed?

http://<Security Management IP Address>/smartview

http://<Security Management IP Address>:4434/smartview/

https://<Security Management IP Address>/smartview/

https://<Security Management host name>:4434/smartview/

73. Which command lists firewall chain?

fwctl chain

fw list chain

fw chain module

fw tab -t chainmod

74. Which blades and or features are not supported in R81?

SmartEvent Maps

SmartEvent

Identity Awareness

SmartConsole Toolbars

75. In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log.

Which of the following options can you add to each Log, Detailed Log and Extended Log?

Accounting

Suppression

Accounting/Suppression

Accounting/Extended

76. You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.

What must you do to get SIC to work?

Remove Geo-Protection, as the IP-to-country database is updated externally, and you have no control of this.

Create a rule at the top in the Sydney firewall to allow control traffic from your network

Nothing - Check Point control connections function regardless of Geo-Protection policy

Create a rule at the top in your Check Point firewall to bypass the Geo-Protection

77. Alice & Bob are concurrently logged In via SSH on the same Check Point Security Gateway as user "admin* however Bob was first logged in and acquired the lock Alice Is not aware that Bob is also togged in to the same Security Management Server as she is but she needs to perform very urgent configuration changes - which of the following GAlAclish command is true for overriding Bobs configuration database lock:

lock database override

unlock override database

unlock database override

database unlock override

78. Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?

Auditor

Read Only All

Super User

Full Access

79. What are possible Automatic Reactions in SmartEvent?

Mail. SNMP Trap, Block Source. Block Event Activity, External Script

Web Mail. Block Destination, SNMP Trap. SmartTask

Web Mail, Block Service. SNMP Trap. SmartTask, Geo Protection

Web Mail, Forward to SandBlast Appliance, SNMP Trap, External Script

80. How many policy layers do Access Control policy support?

Page 9 of 17

81. The admin is connected via ssh lo the management server. He wants to run a mgmt_dl command but got a Error 404 message.

To check the listening ports on the management he runs netstat with the results shown below.

What can be the cause for the issue?

Wrong Management API Access setting^for Ihe client IP To correct it go to SmartConsole / Management & Settings / Blades / Management API and press "Advanced Settings..' and choose GUI clients or ALL IP's.

The API didn't run on the default port check it with api status' and add '-port 4434' to the mgmt_clt command.

The management permission in the user profile is mrssing. Go to SmartConsole / Management & Settings I Permissions & Administrators / Permission Profiles. Select the profile of the user and enable 'Management API Login' under Management Permissions

The API is not running, the services shown by netstat are the gaia services. To start the API run 'api start'

82. SandBlast agent extends 0 day prevention to what part of the network?

Web Browsers and user devices

DMZ server

Cloud

Email servers

83. In which formats can Threat Emulation forensics reports be viewed in?

TXT, XML and CSV

PDF and TXT

PDF, HTML, and XML

PDF and HTML

84. When an encrypted packet is decrypted, where does this happen?

Security policy

Inbound chain

Outbound chain

Decryption is not supported

85. Installations and upgrades with CPUSE require that the CPUSE agent is up-to-date. Usually the latest build is downloaded automatically.

How can you verify the CPUSE agent build?

In WebUI Status and Actions page or by running the following command in CLISH: show installer status build

In WebUI Status and Actions page or by running the following command in CLISH: show installer status version

In the Management Server or Gateway object in SmartConsole or by running the following command in CLISH: show installer status build

In the Management Server or Gateway object in SmartConsole or by running the following command in CLISH: show installer agent

86. SmartEvent uses it's event policy to identify events.

How can this be customized?

By modifying the firewall rulebase

By creating event candidates

By matching logs against exclusions

By matching logs against event rules

87. After the initial installation on Check Point appliance, you notice that the Management-interface and default gateway are incorrect.

Which commands could you use to set the IP to 192.168.80.200/24 and default gateway to 192.168.80.1.

set interface Mgmt ipv4-address 192.168.80.200 mask-length 24set static-route default nexthop gateway address 192.168.80.1 onsave config

set interface Mgmt ipv4-address 192.168.80.200 255.255.255.0add static-route 0.0.0.0. 0.0.0.0 gw 192.168.80.1 onsave config

set interface Mgmt ipv4-address 192.168.80.200 255.255.255.0set static-route 0.0.0.0. 0.0.0.0 gw 192.168.80.1 onsave config

set interface Mgmt ipv4-address 192.168.80.200 mask-length 24add static-route default nexthop gateway address 192.168.80.1 onsave config

88. What happen when IPS profile is set in Detect Only Mode for troubleshooting?

It will generate Geo-Protection traffic

Automatically uploads debugging logs to Check Point Support Center

It will not block malicious traffic

Bypass licenses requirement for Geo-Protection control

89. On the following picture an administrator configures Identity Awareness:

After clicking “Next” the above configuration is supported by:

Kerberos SSO which will be working for Active Directory integration

Based on Active Directory integration which allows the Security Gateway to correlate Active Directory users and machines to IP addresses in a method that is completely transparent to the user.

Obligatory usage of Captive Portal.

The ports 443 or 80 what will be used by Browser-Based and configured Authentication.

90. What is the default shell of Gaia CLI?

Monitor

Read-only

Bash

Page 10 of 17

91. What API command below creates a new host with the name “New Host” and IP address of “192.168.0.10”?

new host name “New Host” ip-address “192.168.0.10”

set host name “New Host” ip-address “192.168.0.10”

create host name “New Host” ip-address “192.168.0.10”

add host name “New Host” ip-address “192.168.0.10”

92. What solution is Multi-queue intended to provide?

Improve the efficiency of traffic handling by SecureXL SNDs

Reduce the confusion for traffic capturing in FW Monitor

Improve the efficiency of CoreXL Kernel Instances

Reduce the performance of network interfaces

93. What API command below creates a new host object with the name "My Host" and IP address of "192 168 0 10"?

set host name "My Host" ip-address "192.168.0.10"

new host name "My Host" ip-address "192 168.0.10"

create host name "My Host" ip-address "192.168 0.10"

mgmt.cli -m <mgmt ip> add host name "My Host" ip-address "192.168.0 10"

94. What are the main stages of a policy installations?

Verification & Compilation, Transfer and Commit

Verification & Compilation, Transfer and Installation

Verification, Commit, Installation

Verification, Compilation & Transfer, Installation

95. Which command would disable a Cluster Member permanently?

clusterXL_admin down

cphaprob_admin down

clusterXL_admin down-p

set clusterXL down-p

96. What does Backward Compatibility mean upgrading the Management Server and how can you check it?

The Management Server is able to manage older Gateways. The lowest supported version is documented in the Installation and Upgrade Guide

The Management Server is able to manage older Gateways The lowest supported version is documented in the Release Notes

You will be able to connect to older Management Server with the SmartConsole. The lowest supported version is documented in the Installation and Upgrade Guide

You will be able to connect to older Management Server with the SmartConsole The lowest supported version is documented in the Release Notes

97. Customer’s R81 management server needs to be upgraded to R81.10.

What is the best upgrade method when the management server is not connected to the Internet?

Export R81 configuration, clean install R81.10 and import the configuration

CPUSE offline upgrade

CPUSE online upgrade

SmartUpdate upgrade

98. Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?

logd

fwd

fwm

cpd

99. For Management High Availability, which of the following is NOT a valid synchronization status?

Collision

Down

Lagging

Never been synchronized

100. Using ClusterXL, what statement is true about the Sticky Decision Function?

Can only be changed for Load Sharing implementations

All connections are processed and synchronized by the pivot

Is configured using cpconfig

Is only relevant when using SecureXL

Page 11 of 17

101. Which Check Point daemon monitors the other daemons?

fwm

cpd

cpwd

fwssd

102. One of major features in R81 SmartConsole is concurrent administration.

Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?

A lock icon shows that a rule or an object is locked and will be available.

AdminA and AdminB are editing the same rule at the same time.

A lock icon next to a rule informs that any Administrator is working on this particular rule.

AdminA, AdminB and AdminC are editing three different rules at the same time.

103. In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories.

Which of the following is NOT an objects category?

Limit

Resource

Custom Application / Site

Network Object

104. Which command shows actual allowed connections in state table?

fw tab Ct StateTable

fw tab Ct connections

fw tab Ct connection

fw tab connections

105. Kurt is planning to upgrade his Security Management Server to R81.X.

What is the lowest supported version of the Security Management he can upgrade from?

R76 Splat

R77.X Gaia

R75 Splat

R75 Gaia

106. What is the command to see cluster status in cli expert mode?

fw ctl stat

clusterXL stat

clusterXL status

cphaprob stat

107. What Factor preclude Secure XL Templating?

Source Port Ranges/Encrypted Connections

IPS

ClusterXL in load sharing Mode

CoreXL

108. When installing a dedicated R81 SmartEvent server.

What is the recommended size of the root partition?

Any size

Less than 20GB

More than 10GB and less than 20GB

At least 20GB

109. What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

SmartCenter Server cannot reach this Security Gateway.

There is a blade reporting a problem.

VPN software blade is reporting a malfunction.

Security Gateway’s MGNT NIC card is disconnected.

110. CoreXL is NOT supported when one of the following features is enabled: (Choose three)

Route-based VPN

IPS

IPv6

Overlapping NAT

Page 12 of 17

111. When users connect to the Mobile Access portal they are unable to open File Shares.

Which log file would you want to examine?

cvpnd.elg

httpd.elg

vpnd.elg

fw.elg

112. Alice works for a big security outsourcing provider company and as she receives a lot of change requests per day she wants to use for scripting daily (asks the API services from Check Point fof the Management API. Firstly she needs to be aware if the API services are running for the management.

Which of the following Check Point Command is true?

api mgmt status

api status

status api

status mgmt apt

113. Which view is NOT a valid CPVIEW view?

IDA

RAD

PDP

VPN

114. An administrator would like to troubleshoot why templating is not working for some traffic.

How can he determine at which rule templating is disabled?

He can use the fw accel stat command on the gateway.

He can use the fw accel statistics command on the gateway.

He can use the fwaccel stat command on the Security Management Server.

He can use the fwaccel stat command on the gateway

115. What is the command to check the status of Check Point processes?

top

cptop

cphaprob list

cpwd_admin list

116. Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________ .

Sent to the Internal Certificate Authority.

Sent to the Security Administrator.

Stored on the Security Management Server.

Stored on the Certificate Revocation List.

117. What are the modes of SandBlast Threat Emulation deployment?

Cloud, Smart-1 and Hybrid

Cloud. OpenServer and Vmware

Cloud, Appliance and Private

Cloud, Appliance and Hybrid

118. Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

mgmt_cli add-host “Server_1” ip_address “10.15.123.10” --format txt

mgmt_cli add host name “Server_1” ip-address “10.15.123.10” --format json

mgmt_cli add object-host “Server_1” ip-address “10.15.123.10” --format json

mgmt._cli add object “Server-1” ip-address “10.15.123.10” --format json

119. What is the valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration?

1-254

1-255

0-254

0 C 255

120. Which of the following is NOT a type of Check Point API available in R81.x?

Identity Awareness Web Services

OPSEC SDK

Mobile Access

Management

Page 13 of 17

121. What are types of Check Point APIs available currently as part of R81.10 code?

Security Gateway API Management API, Threat Prevention API and Identity Awareness Web Services API

Management API, Threat Prevention API, Identity Awareness Web Services API and OPSEC SDK API

OSE API, OPSEC SDK API, Threat Extraction API and Policy Editor API

CPMI API, Management API, Threat Prevention API and Identity Awareness Web Services API

122. With SecureXL enabled, accelerated packets will pass through the following:

Network Interface Card, OSI Network Layer, OS IP Stack, and the Acceleration Device

Network Interface Card, Check Point Firewall Kernal, and the Acceleration Device

Network Interface Card and the Acceleration Device

Network Interface Card, OSI Network Layer, and the Acceleration Device

123. Which is NOT a SmartEvent component?

SmartEvent Server

Correlation Unit

Log Consolidator

Log Server

124. If there are two administration logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available or other administrators? (Choose the BEST answer.)

Publish or discard the session.

Revert the session.

Save and install the Policy.

Delete older versions of database.

125. Which one of the following is true about Threat Extraction?

Always delivers a file to user

Works on all MS Office, Executables, and PDF files

Can take up to 3 minutes to complete

Delivers file only if no threats found

126. Which of these is an implicit MEP option?

Primary-backup

Source address based

Round robin

Load Sharing

127. In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

fw ctl sdstat

fw ctl affinity Cl Ca Cr Cv

fw ctl multik stat

cpinfo

128. Please choose correct command to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI?

host name myHost12 ip-address 10.50.23.90

mgmt: add host name ip-address 10.50.23.90

add host name emailserver1 ip-address 10.50.23.90

mgmt: add host name emailserver1 ip-address 10.50.23.90

129. In a Client to Server scenario, which inspection point is the first point immediately following the tables and rule base check of a packet coming from outside of the network?

Big l

Little o

Little i

Big O

130. What will be the effect of running the following command on the Security Management Server?

Remove the installed Security Policy.

Remove the local ACL lists.

No effect.

Reset SIC on all gateways.

Page 14 of 17

131. If you needed the Multicast MAC address of a cluster, what command would you run?

cphaprob Ca if

cphaconf ccp multicast

cphaconf debug data

cphaprob igmp

132. IF the first packet of an UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), what message is sent back through the kernel?

Nothing

TCP FIN

TCP RST

ICMP unreachable

133. You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.

What is the first step to run management API commands on GAIA’s shell?

mgmt_admin@teabag > id.txt

mgmt_login

mgmt_cli login user “admin” password “teabag” > id.txt

134. While using the Gaia CLI. what is the correct command to publish changes to the management server?

json publish

mgmt publish

mgmt_cli commit

commit

135. When setting up an externally managed log server, what is one item that will not be configured on the R81 Security Management Server?

SIC

NAT

FQDN

136. Where do you create and modify the Mobile Access policy in R81?

SmartConsole

SmartMonitor

SmartEndpoint

SmartDashboard

137. SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

This statement is true because SecureXL does improve all traffic.

This statement is false because SecureXL does not improve this traffic but CoreXL does.

This statement is true because SecureXL does improve this traffic.

This statement is false because encrypted traffic cannot be inspected.

138. Fill in the blanks. There are ________ types of software containers: ___________.

Three; security management, Security Gateway, and endpoint security

Three; Security Gateway, endpoint security, and gateway management

Two; security management and endpoint security

Two; endpoint security and Security Gateway

139. What SmartEvent component creates events?

Consolidation Policy

Correlation Unit

SmartEvent Policy

SmartEvent GUI

140. John is using Management HA.

Which Security Management Server should he use for making changes?

secondary Smartcenter

active SmartConsole

connect virtual IP of Smartcenter HA

primary Log Server

Page 15 of 17

141. Which command lists all tables in Gaia?

fw tab Ct

fw tab Clist

fw-tab Cs

fw tab -1

142. Which of the following links will take you to the SmartView web application?

https://<Security Management Server host name>/smartviewweb/

https://<Security Management Server IP Address>/smartview/

https://<Security Management Server host name>smartviewweb

https://<Security Management Server IP Address>/smartview

143. SecureXL is able to accelerate the Connection Rate using templates.

Which attnbutes are used in the template to identify the connection?

Source address . Destination address. Source Port, Destination port

Source address . Destination address. Destination port

Source address . Destination address. Destination port. Pro^col

Source address . Destination address. Source Port, Destination port. Protocol

144. As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

That is used to deploy the mobile device as a generator of one-time passwords for authenticating to an RSA Authentication Manager.

Fill Layer4 VPN CSSL VPN that gives users network access to all mobile applications.

Full Layer3 VPN CIPSec VPN that gives users network access to all mobile applications.

You can make sure that documents are sent to the intended recipients only.

145. Which of the following Central Deployment is NOT a limitation in R81.10 SmartConsole?

Security Gateway Clusters in Load Sharing mode

Dedicated Log Server

Dedicated SmartEvent Server

Security Gateways/Clusters in ClusterXL HA new mode

146. Fill in the blank: An identity server uses a __________ for user authentication.

Shared secret

Certificate

One-time password

Token

147. Which web services protocol is used to communicate to the Check Point R81 Identity Awareness Web API?

SOAP

REST

XLANG

XML-RPC

148. SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data.

Which component is NOT part of the SandBlast Mobile solution?

Management Dashboard

Gateway

Personal User Storage

Behavior Risk Engine

149. Which of these statements describes the Check Point ThreatCloud?

Blocks or limits usage of web applications

Prevents or controls access to web sites based on category

Prevents Cloud vulnerability exploits

A worldwide collaborative security network

150. During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

Dropped without sending a negative acknowledgment

Dropped without logs and without sending a negative acknowledgment

Dropped with negative acknowledgment

Dropped with logs and without sending a negative acknowledgment

Page 16 of 17

151. Tom has been tasked to install Check Point R81 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

One machine, but it needs to be installed using SecurePlatform for compatibility purposes.

One machine

Two machines

Three machines

152. In the Check Point Security Management Architecture, which component(s) can store logs?

SmartConsole

Security Management Server and Security Gateway

Security Management Server

SmartConsole and Security Management Server

153. Fill in the blanks: A _______ license requires an administrator to designate a gateway for attachment whereas a ________ license is automatically attached to a Security Gateway.

Formal; corporate

Local; formal

Local; central

Central; local

154. When defining QoS global properties, which option below is not valid?

Weight

Authenticated timeout

Schedule

Rate

155. Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

$FWDIR/database/fwauthd.conf

$FWDIR/conf/fwauth.conf

$FWDIR/conf/fwauthd.conf

$FWDIR/state/fwauthd.conf

156. What is the benefit of “tw monitor” over “tcpdump”?

“fw monitor” reveals Layer 2 information, while “tcpdump” acts at Layer 3.

“fw monitor” is also available for 64-Bit operating systems.

With “fw monitor”, you can see the inspection points, which cannot be seen in “tcpdump”

“fw monitor” can be used from the CLI of the Management Server to collect information from multiple gateways.

157. Under which file is the proxy arp configuration stored?

$FWDIR/state/proxy_arp.conf on the management server

$FWDIR/conf/local.arp on the management server

$FWDIR/state/_tmp/proxy.arp on the security gateway

$FWDIR/conf/local.arp on the gateway

158. According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

Firewall

VPN

IPS

HTTPS

159. During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity.

Which of those hosts should you try to remediate first?

Host having a Critical event found by Threat Emulation

Host having a Critical event found by IPS

Host having a Critical event found by Antivirus

Host having a Critical event found by Anti-Bot

160. SandBlast agent extends 0 day prevention to what part of the network?

Web Browsers and user devices

DMZ server

Cloud

Email servers

Page 17 of 17

161. Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

All Connections (Clear or Encrypted)

Accept all encrypted traffic

Specific VPN Communities

All Site-to-Site VPN Communities

162. Which of the following is a task of the CPD process?

Invoke and monitor critical processes and attempts to restart them if they fail

Transfers messages between Firewall processes

Log forwarding

Responsible for processing most traffic on a security gateway

Facebook Twitter LinkedIn Google + Email

100% Success Check Point 156-315.81 Dumps with Excellent Results

100% Success Check Point 156-315.81 Dumps with Excellent Results

Author

LEAVE A COMMENT Cancel reply

Related Posts

Tested 156-835 Exam Dumps – Fosters Your Exam Passing Skills

100% Success Check Point 156-215.81 Dumps with Excellent Results

Check Point 156-560 Exam Dumps Opportunity To acquire Highest Result 2023