Which of the following Central Deployment is NOT a limitation in R81.20 SmartConsole?

Security Gateway Clusters in Load Sharing mode

Security Gateways/Clusters in ClusterXL HA new mode

What is 'Accelerated Policy Installation'?

Starting R81, the Access Control Policy installation process is accelerated thereby reducing the duration of the process significantly

Starting R81, the Desktop Security Policy installation process is accelerated thereby reducing the duration of the process significantly

Starting R81, the QoS Policy installation process is accelerated thereby reducing the duration of the process significantly

Starting R81, the Access Control Policy installation process is accelerated thereby reducing the duration of the process significantly

Starting R81, the Threat Prevention Policy installation process is accelerated thereby reducing the duration of the process significantly

What is Dynamic Balancing?

It is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load

It is a ClusterXL feature that switches an HA cluster into an LS cluster if required to maximize throughput

It is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load

It is a new feature that is capable of dynamically reserve the amount of Hash kernel memory to reflect the resource usage necessary for maximizing the session rate.

It is a CoreXL feature that assigns the SND to network interfaces to balance the RX Cache of the interfaces

What is false regarding prerequisites for the Central Deployment usage?

No need to establish SIC between gateways and the management server, since the CDT tool will take care about SIC automatically.

The administrator must have write permission on SmartUpdate

Security Gateway must have the latest CPUSE Deployment Agent

No need to establish SIC between gateways and the management server, since the CDT tool will take care about SIC automatically.

The Security Gateway must have a policy installed

Main Mode in IKEv1 uses how many packages for negotiation?

depends on the make of the peer gateway

What mechanism can ensure that the Security Gateway can communicate with the Management Server with ease in situations with overwhelmed network resources?

The corresponding feature is new to R81.20 and is called 'Management Data Plane Separation'

The corresponding feature is called 'Dynamic Dispatching'

There is a feature for ensuring stable connectivity to the management server and is done via Priority Queuing.

The corresponding feature is called 'Dynamic Split'

What a valid SecureXL paths in R81.20?

F2F (Slow path), Accelerated Path, Medium Path and F2V

F2F (Slow path). Templated Path. PQX and F2V

F2F (Slow path). PXL, QXL and F2V

F2F (Slow path), Accelerated Path, PQX and F2V

F2F (Slow path), Accelerated Path, Medium Path and F2V

The admin lost access to the Gaia Web Management Interface but he was able to connect via ssh. How can you check if the web service is enabled, running and which port is used?

In dish run >show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode run #netstat -anp | grep httpd2 to see if the httpd2 is up

In expert mode run #netstat -tulnp | grep httpd to see if httpd is up and to get the port number. In dish run >show web daemon-enable to see if the web daemon is enabled.

In dish run >show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode run #netstat -anp | grep httpd to see if the httpd is up

In dish run >show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode run #netstat -anp | grep httpd2 to see if the httpd2 is up

In expert mode run #netstat -tulnp | grep httpd2 to see if httpd2 is up and to get the port number. In dish run >show web daemon-enable to see if the web daemon is enabled.

A user complains that some Internet resources are not available. The Administrator is having issues seeing it packets are being dropped at the firewall (not seeing drops in logs). What is the solution to troubleshoot the issue?

run ''fw ctl zdebug drop' on the relevant gateway

run fw unloadlocal' on the relevant gateway and check the ping again

run 'cpstop' on the relevant gateway and check the ping again

run ''fw log' on the relevant gateway

run ''fw ctl zdebug drop' on the relevant gateway

What are possible Automatic Reactions in SmartEvent?

Mail. SNMP Trap, Block Source. Block Event Activity, External Script

Web Mail. Block Destination, SNMP Trap. SmartTask

Web Mail, Block Service. SNMP Trap. SmartTask, Geo Protection

Web Mail, Forward to SandBlast Appliance, SNMP Trap, External Script

Which of the following statements about SecureXL NAT Templates is true?

NAT Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are enabled by default and work only if Accept Templates are enabled.

DROP Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are disabled by default and work only if NAT Templates are disabled.

NAT Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are disabled by default and work only if Accept Templates are disabled.

ACCEPT Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are disabled by default and work only if NAT Templates are disabled.

Is it possible to establish a VPN before the user login to the Endpoint Client?

yes, you had to enable Machine Authentication in the Gateway object of the Smart Console

yes, you had to set neo_remember_user_password to true in the trac.defaults of the Remote Access Client or you can use the endpoint_vpn_remember_user_password attribute in the trac_client_1 .ttm file located in the SFWDIR/conf directory on the Security Gateway

yes. you had to set neo_always_connected to true in the trac.defaults of the Remote Access Client or you can use the endpoint_vpn_always_connected attribute in the trac_client_1 .ttm file located in the SFWDIR/conf directory on the Security Gateway

yes, you had to enable Machine Authentication in the Gateway object of the Smart Console

After having saved the Clish Configuration with the 'save configuration config.txt' command, where can you find the config.txt file?

You will find it in the home directory of your user account (e.g. /home/admin/)

You can locate the file via SmartConsole > Command Line.

You have to launch the WebUI and go to 'Config' -> 'Export Config File' and specifiy the destination directory of your local file system.

You cannot locate the file in the file system since Clish does not have any access to the bash file system

How can you switch the active log file?

Run fw logswitch on the Management Server

Run fw logswitch on the gateway

Run fwm logswitch on the Management Server

Run fwm logswitch on the gateway

Run fw logswitch on the Management Server

Which of the following Check Point commands is true to enable Multi-Version Cluster (MVC)?

Check Point Security Gateway Cluster Member: set cluster member mvc on

Check Point Security Management HA (Secondary): set cluster member mvc on

Check Point Security Gateway Only: set cluster member mvc on

Check Point Security Management HA (Primary): set cluster member mvc on

Check Point Security Gateway Cluster Member: set cluster member mvc on

What is the amount of Priority Queues by default?

There are 8 priority queues by default, and up to 8 additional queues can be manually configured

There are 8 priority queues and this number cannot be changed.

There is no distinct number of queues since it will be changed in a regular basis based on its system requirements.

There are 7 priority queues by default and this number cannot be changed.

There are 8 priority queues by default, and up to 8 additional queues can be manually configured

You had setup the VPN Community VPN-Stores'with 3 gateways. There are some issues with one remote gateway(1.1.1.1) and an your local gateway. What will be the best log filter to see only the IKE Phase 2 agreed networks for both gateways

action:'Key Install- AND 1.1.1.1 ANDQuick Mode

action:'Key Install' AND 1.1.1.1 AND Main Mode

action:'Key Install- AND 1.1.1.1 ANDQuick Mode

Blade:'VPN' AND VPN-Stores AND Main Mode

Blade:'VPN' AND VPN-Stores AND Quick Mode

What is the purpose of the command 'ps aux | grep twd'?

You can check the Process ID and the processing time of the twd process.

You can convert the log file into Post Script format.

You can list all Process IDs for all running services.

You can check whether the IPS default setting is set to Detect or Prevent mode

What are the services used for Cluster Synchronization?

256H-CP tor Full Sync and 8116/UDP for Delta Sync

8116/UDP for Full Sync and Delta Sync

TCP/256 for Full Sync and Delta Sync

No service needed when using Broadcast Mode

Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

After upgrading the hardware, increase the number of kernel instances using cpconfig

Hyperthreading must be enabled in the bios to use CoreXL

Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores.

What should the admin do in case the Primary Management Server is temporary down?

Use the VIP in SmartConsole you always reach the active Management Server.

The Secondary will take over automatically Change the IP in SmartConsole to logon to the private IP of the Secondary Management Server.

Run the 'promote_util' to activate the Secondary Management server

Logon with SmartConsole to the Secondary Management Server and choose 'Make Active' under Actions in the HA Management Menu

The customer has about 150 remote access user with a Windows laptops. Not more than 50 Clients will be connected at the same time. The customer want to use multiple VPN Gateways as entry point and a personal firewall. What will be the best license for him?

He will need Harmony Endpoint because of the personal firewall.

He will need Capsule Connect using MEP (multiple entry points).

Because the customer uses only Windows clients SecuRemote will be sufficient and no additional license is needed

He will need Harmony Endpoint because of the personal firewall.

Mobile Access license because he needs only a 50 user license, license count is per concurrent user.

What are the three SecureXL Templates available in R81.20?

Accept Templates. Drop Templates. NAT Templates

PEP Templates. QoS Templates. VPN Templates

Accept Templates. Drop Templates. NAT Templates

Accept Templates. Drop Templates. Reject Templates

Accept Templates. PDP Templates. PEP Templates

Which one is not a valid Package Option In the Web GUI for CPUSE?

Database Conversion to R81.20 only

Checkpoint 156-315.81 Practice Test 13 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Checkpoint 156-315.81 Practice Test 13

Question

Checkpoint 156-315.81 Practice Tests

Practice Tests