You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

fw ctl multik dynamic_dispatching on

fw ctl multik dynamic_dispatching set_mode 9

Which packet info is ignored with Session Rate Acceleration?

same info from Packet Acceleration is used

During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

Host having a Critical event found by Anti-Bot

Host having a Critical event found by Threat Emulation

Host having a Critical event found by IPS

Host having a Critical event found by Antivirus

Host having a Critical event found by Anti-Bot

In R81 spoofing is defined as a method of:

Making packets appear as if they come from an authorized IP address.

Disguising an illegal IP address behind an authorized IP address through Port Address Translation.

Hiding your firewall from unauthorized users.

Detecting people using false or wrong authentication logins

Making packets appear as if they come from an authorized IP address.

What is true about the IPS-Blade?

In R81, IPS is managed by the Threat Prevention Policy

In R81, in the IPS Layer, the only three possible actions are Basic, Optimized and Strict

In R81, IPS Exceptions cannot be attached to ''all rules''

In R81, the GeoPolicy Exceptions and the Threat Prevention Exceptions are the same

Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Detects and blocks malware by correlating multiple detection engines before users are affected.

Configure rules to limit the available network bandwidth for specified users or groups.

Use UserCheck to help users understand that certain websites are against the company's security policy.

Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.

What Factor preclude Secure XL Templating?

Source Port Ranges/Encrypted Connections

In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

fw ctl affinity --l --a --r --v

The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Pulls application monitoring status

Secure Internal Communication (SIC)

Transfers messages between Firewall processes

Pulls application monitoring status

Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process:

Performs database tasks such as creating, deleting, and modifying objects and compiling policy.

Allow GUI Client and management server to communicate via TCP Port 19001

Allow GUI Client and management server to communicate via TCP Port 18191

Performs database tasks such as creating, deleting, and modifying objects and compiling policy.

Performs database tasks such as creating, deleting, and modifying objects and compiling as well as policy code generation.

What happen when IPS profile is set in Detect Only Mode for troubleshooting?

It will not block malicious traffic

It will generate Geo-Protection traffic

Automatically uploads debugging logs to Check Point Support Center

It will not block malicious traffic

Bypass licenses requirement for Geo-Protection control

What is true about VRRP implementations?

You cannot have a standalone deployment

VRRP membership is enabled in cpconfig

VRRP can be used together with ClusterXL, but with degraded performance

You cannot have a standalone deployment

You cannot have different VRIDs in the same physical network

What is the mechanism behind Threat Extraction?

Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.

This a new mechanism which extracts malicious files from a document to use it as a counter-attack against its sender.

This is a new mechanism which is able to collect malicious files out of any kind of file types to destroy it prior to sending it to the intended recipient.

This is a new mechanism to identify the IP address of the sender of malicious codes and put it into the SAM database (Suspicious Activity Monitoring).

Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.

Which of the following is a new R81 Gateway feature that had not been available in R77.X and older?

Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

Time object to a rule to make the rule active only during specified times.

Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.

What are the three components for Check Point Capsule?

Capsule Workspace, Capsule Docs, Capsule Cloud

Capsule Docs, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Cloud

Checkpoint 156-315.81 Practice Test 2 - Free Online Exam Prep & Questions

There are 4 ways to use the Management API for creating host object with R81 Management API. Which one is NOT correct?

A.

Using Web Services

B.

Using Mgmt_cli tool

C.

Using CLISH

D.

Using SmartConsole GUI console

E.

Events are collected with SmartWorkflow from Trouble Ticket systems

Checkpoint 156-315.81 Practice Test 2

Question

Checkpoint 156-315.81 Practice Tests

Practice Tests