Checkpoint 156-315.81 Practice Test - Questions Answers, Page 35

The most likely reason why you are not seeing any data type information in your logs even though you have enabled Full Log as a tracking option to a security rule is that Data Awareness is not enabled on your Security Gateway. Data Awareness is a feature that allows you to monitor and control data types that are transferred over HTTP, HTTPS, FTP, SMTP, POP3, or IMAP protocols. Data Awareness can identify over 700 data types, such as credit card numbers, social security numbers, bank account numbers, medical records, etc., and provide visibility into the data usage patterns of your users. Data Awareness can also enforce data loss prevention (DLP) policies to prevent sensitive data from leaving your network or entering your network from untrusted sources. To enable Data Awareness on your Security Gateway, you need to activate the Data Awareness Software Blade in SmartConsole and install the policy on the Security Gateway.

The two high availability modes are New and Legacy. High availability (HA) is a feature that allows you to create a cluster of two or more Security Gateways that act as a single entity to provide redundancy and reliability for your network traffic. HA ensures that if one Security Gateway fails or becomes unavailable, another Security Gateway in the cluster takes over its role seamlessly and continues to process the traffic. HA also provides load balancing and synchronization of the cluster members. The New mode is the recommended mode for HA clusters, as it provides better performance, scalability, and stability than the Legacy mode. The New mode uses the ClusterXL mechanism to manage the cluster members and the state synchronization. The Legacy mode uses the High Availability Security Extension (HASE) mechanism to manage the cluster members and the state synchronization. The Legacy mode is supported for backward compatibility with older versions of Check Point products, but it has some limitations and disadvantages compared to the New mode.

The feature that is not provided by all Check Point Mobile Access solutions is support for IPv6. Check Point Mobile Access is a comprehensive solution that provides secure remote access to corporate applications and resources using various methods, such as SSL VPN, IPsec VPN, clientless VPN, and mobile VPN. However, not all of these methods support IPv6, which is the latest version of the Internet Protocol that uses 128-bit addresses.According to the Check Point Mobile Access R81 Administration Guide1, only the following Mobile Access methods support IPv6:

SSL Network Extender (SNX) - a thin client that enables remote users to connect securely to the corporate network using SSL/TLS VPN.

Mobile VPN - a full VPN client that enables remote users to connect securely to the corporate network using IPsec VPN.

Capsule Connect - a mobile VPN app for iOS and Android devices that enables remote users to connect securely to the corporate network using IPsec VPN.

The following Mobile Access methods do not support IPv6:

Clientless VPN - a web-based method that enables remote users to access web applications and services using a web browser without installing any software on their devices.

Endpoint Security VPN - a full VPN client that enables remote users to connect securely to the corporate network using IPsec VPN and also provides endpoint security features such as firewall, anti-virus, anti-malware, etc.

Capsule Workspace - a mobile app for iOS and Android devices that enables remote users to access email, calendar, contacts, and corporate applications securely without requiring a VPN connection.

The type of Endpoint Identity Agent that does not exist is Terminal. Endpoint Identity Agent is a software component that runs on Windows or Mac devices and provides identity information to the Check Point Security Gateway. Endpoint Identity Agent allows the Security Gateway to enforce granular access policies based on user identity and device compliance status. There are three types of Endpoint Identity Agent:

Full Identity Agent - a persistent agent that provides seamless and transparent identity acquisition and SSO (single sign-on) capabilities. It supports various authentication methods, such as Active Directory, LDAP, RADIUS, certificate, etc. It also supports endpoint compliance checks and remediation actions.

Light Identity Agent - a lightweight agent that provides identity acquisition through a web browser. It supports Active Directory authentication only. It does not support SSO or endpoint compliance features.

Custom Identity Agent - a customized agent that provides identity acquisition through an API. It allows third-party applications or systems to integrate with Check Point Identity Awareness and provide user identity information.

Terminal is not a type of Endpoint Identity Agent, but it is a type of Terminal Server Agent. Terminal Server Agent is a software component that runs on Windows Terminal Servers or Citrix Servers and provides identity information for multiple concurrent users who connect to these servers using Remote Desktop Protocol (RDP) or Independent Computing Architecture (ICA) protocol. Terminal Server Agent allows the Security Gateway to enforce granular access policies based on user identity and session information.

Based on the image provided by the user, we can infer that rule 1 and object webserver are locked by another administrator. This is because they have red lock icons next to them, which indicate that they are being edited by another administrator in another session. The lock icons prevent other administrators from modifying these objects until the changes are published or discarded by the original administrator. The lock icons also show the name of the administrator who locked the objects when hovered over with the mouse cursor.

The other options are incorrect because:

Rule 7 was not created by the 'admin' administrator in the current session, but by another administrator in another session. This is because it has a blue lock icon next to it, which indicates that it was added by another administrator in another session. The blue lock icon prevents other administrators from deleting this rule until the changes are published or discarded by the original administrator.

8 changes have not been made by administrators since the last policy installation, but in the current session by the 'admin' administrator. This is because there is a yellow number 8 next to the Install Policy button, which indicates that there are 8 unpublished changes in the current session by the 'admin' administrator. These changes will be published or discarded when the 'admin' administrator clicks on Publish or Discard buttons.

The rules 1, 5 and 6 can be edited by the 'admin' administrator, but only after unlocking them from another administrator who locked them in another session. This is because they have red lock icons next to them, which indicate that they are being edited by another administrator in another session. The 'admin' administrator can unlock these rules by right-clicking on them and selecting Unlock from the menu. However, this will discard the changes made by the original administrator who locked them.

In the R81 SmartConsole, Permissions and Administrators are defined on the Manage and Settings tab. The Manage and Settings tab allows administrators to configure various settings and options for the SmartConsole, such as global properties, network objects, services, users and user groups, permissions, licenses, certificates, etc. To define Permissions and Administrators, the administrator can go to the Manage and Settings tab and select Permissions and Administrators from the left pane. This will open a window where the administrator can create, edit, or delete administrators and roles, assign permissions and access profiles, enable multi-domain support, etc.

The other options are incorrect because:

The Security Policies tab allows administrators to create, edit, or delete security policies for different blades, such as Access Control, Threat Prevention, Identity Awareness, Mobile Access, etc. It also allows administrators to install policies on selected gateways or servers.

The Logs and Monitor tab allows administrators to view, filter, analyze, or export logs and reports for different blades, such as Access Control, Threat Prevention, Identity Awareness, Mobile Access, etc. It also allows administrators to monitor the status and performance of gateways and servers.

The Gateways and Servers tab allows administrators to add, edit, or delete gateways and servers that are managed by the Security Management Server or the Multi-Domain Security Management Server. It also allows administrators to view the details and configuration of each gateway or server.

A clientless remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. A clientless remote access VPN does not require any software installation or configuration on the user's device. Instead, it uses a web-based portal that acts as a proxy between the user and the corporate resources. The user can access web applications and services through the portal using a standard web browser that supports SSL/TLS encryption. The portal can also provide single sign-on (SSO) capabilities for SAML-enabled applications. A clientless remote access VPN is suitable for scenarios where users need to access mainly web-based resources from unmanaged devices or devices that cannot run VPN clients.

The other options are incorrect because:

A client-based remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by installing a VPN client software on the user's device. A client-based remote access VPN requires software installation and configuration on the user's device. It uses IPsec or SSL/TLS protocols to create a secure tunnel between the user's device and the VPN gateway. The user can access any type of resource through the tunnel using any application that supports TCP/IP protocols. A client-based remote access VPN is suitable for scenarios where users need to access various types of resources from managed devices or devices that can run VPN clients.

A clientless direct access deployment is not a valid term for a VPN deployment. Direct access is a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user's device and the direct access server.

A direct access deployment is not a term for a VPN deployment, but a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user's device and the direct access server.

The NAT property 'Translate destination or client side' is used to determine whether the destination IP address of a packet should be translated on the client side or the server side of a connection. If this property is not enabled, then the destination IP address is translated on the server side, which means that the gateway takes care of all details necessary for NAT to work. The gateway will send an ARP request for the translated IP address and will reply to any ARP requests for that address. Therefore, there is no need to configure a host route, use the local.arp file, or enable bi-directional NAT for NAT to work correctly.

Reference:R81 Security Management Administration Guide, page 1010.

The Internal Certificate Authority (ICA) is created during the primary Security Management Server installation process. The ICA is responsible for issuing and managing certificates for all Check Point components in the network. The ICA is automatically installed as an integral part of the Security Management Server and can be managed from SmartConsole.

Reference:R81 Security Management Administration Guide, page 113.