Check Point 156-315.81.20 CCSE R81.20 Exam Updated Dumps

dumps2024-08-01T10:45:29+08:00

156-315.81.20 exam is one for Check Point CCSE R81.20 certification. There are 100 multiple-choice questions in the real 156-315.81.20 exam, and you have 90 minutes to finish this CCSE R81.20 exam. The required passing score for Check Point Certified Security Expert – R81.20 156-315.81.20 exam is 70%. We provide the updated Check Point 156-315.81.20 exam dumps, which are valuable for you to study all the related topics. Free updated Check Point CCSE R81.20 156-315.81.20 exam dumps are available below.

Page 1 of 19

1. Identify the API that is not supported by Check Point currently.

R81 Management API-

Identity Awareness Web Services API

Open REST API

OPSEC SDK

2. SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data.

Which component is NOT part of the SandBlast Mobile solution?

Management Dashboard

Gateway

Personal User Storage

Behavior Risk Engine

3. What are the different command sources that allow you to communicate with the API server?

SmartView Monitor, API_cli Tool, Gaia CLI, Web Services

SmartConsole GUI Console, mgmt_cli Tool, Gaia CLI, Web Services

SmartConsole GUI Console, API_cli Tool, Gaia CLI, Web Services

API_cli Tool, Gaia CLI, Web Services

4. What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

Anti-Bot is the only countermeasure against unknown malware

Anti-Bot is the only protection mechanism which starts a counter-attack against known Command & Control Centers

Anti-Bot is the only signature-based method of malware protection.

Anti-Bot is a post-infection malware protection to prevent a host from establishing a connection to a Command & Control Center.

5. Which TCP-port does CPM process listen to?

18191

18190

8983

19009

6. Which method below is NOT one of the ways to communicate using the Management API’s?

Typing API commands using the “mgmt_cli” command

Typing API commands from a dialog box inside the SmartConsole GUI application

Typing API commands using Gaia’s secure shell(clish)19+

Sending API commands over an http connection using web-services

7. Your manager asked you to check the status of SecureXL, and its enabled templates and features.

What command will you use to provide such information to manager?

fw accel stat

fwaccel stat

fw acces stats

fwaccel stats

8. SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user’s machine via the web browser.

What are the two modes of SNX?

Application and Client Service

Network and Application

Network and Layers

Virtual Adapter and Mobile App

9. Which command would disable a Cluster Member permanently?

clusterXL_admin down

cphaprob_admin down

clusterXL_admin down-p

set clusterXL down-p

10. Which two of these Check Point Protocols are used by SmartEvent Processes?

ELA and CPD

FWD and LEA

FWD and CPLOG

ELA and CPLOG

Page 2 of 19

11. Fill in the blank: The tool _____ generates a R81 Security Gateway configuration report.

infoCP

infoview

cpinfo

fw cpinfo

12. Which of these statements describes the Check Point ThreatCloud?

Blocks or limits usage of web applications

Prevents or controls access to web sites based on category

Prevents Cloud vulnerability exploits

A worldwide collaborative security network

13. Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically

reset every

15 sec

60 sec

5 sec

30 sec

14. Which command will allow you to see the interface status?

cphaprob interface

cphaprob CI interface

cphaprob Ca if

cphaprob stat

15. Which command can you use to enable or disable multi-queue per interface?

cpmq set

Cpmqueue set

Cpmq config

St cpmq enable

16. To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab.

How many options are available to calculate the traffic direction?

5 Network; Host; Objects; Services; API

3 Incoming; Outgoing; Network

2 Internal; External

4 Incoming; Outgoing; Internal; Other

17. There are 4 ways to use the Management API for creating host object with R81 Management API.

Which one is NOT correct?

Using Web Services

Using Mgmt_cli tool

Using CLISH

Using SmartConsole GUI console

Events are collected with SmartWorkflow from Trouble Ticket systems

18. CoreXL is supported when one of the following features is enabled:

Route-based VPN

IPS

IPv6

Overlapping NAT

19. You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don’t have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher.

How can you enable them?

fw ctl multik dynamic_dispatching on

fw ctl multik dynamic_dispatching set_mode 9

fw ctl multik set_mode 9

fw ctl multik pq enable

20. Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

TCP port 19009

TCP Port 18190

TCP Port 18191

TCP Port 18209

Page 3 of 19

21. Which command is used to set the CCP protocol to Multicast?

cphaprob set_ccp multicast

cphaconf set_ccp multicast

cphaconf set_ccp no_broadcast

cphaprob set_ccp no_broadcast

22. Which packet info is ignored with Session Rate Acceleration?

source port ranges

source ip

source port

same info from Packet Acceleration is used

23. Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?

Synchronized

Never been synchronized

Lagging

Collision

24. During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity.

Which of those hosts should you try to remediate first?

Host having a Critical event found by Threat Emulation

Host having a Critical event found by IPS

Host having a Critical event found by Antivirus

Host having a Critical event found by Anti-Bot

25. In R81 spoofing is defined as a method of:

Disguising an illegal IP address behind an authorized IP address through Port Address Translation.

Hiding your firewall from unauthorized users.

Detecting people using false or wrong authentication logins

Making packets appear as if they come from an authorized IP address.

26. Connections to the Check Point R81 Web API use what protocol?

HTTPS

RPC

VPN

SIC

27. Which command lists all tables in Gaia?

fw tab Ct

fw tab Clist

fw-tab Cs

fw tab -1

28. What is true about the IPS-Blade?

In R81, IPS is managed by the Threat Prevention Policy

In R81, in the IPS Layer, the only three possible actions are Basic, Optimized and Strict

In R81, IPS Exceptions cannot be attached to “all rules”

In R81, the GeoPolicy Exceptions and the Threat Prevention Exceptions are the same

29. Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Detects and blocks malware by correlating multiple detection engines before users are affected.

Configure rules to limit the available network bandwidth for specified users or groups.

Use UserCheck to help users understand that certain websites are against the company’s security policy.

Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.

30. What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Stateful Mode

VPN Routing Mode

Wire Mode

Stateless Mode

Page 4 of 19

31. What Factor preclude Secure XL Templating?

Source Port Ranges/Encrypted Connections

IPS

ClusterXL in load sharing Mode

CoreXL

32. In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

fw ctl sdstat

fw ctl affinity Cl Ca Cr Cv

fw ctl multik stat

cpinfo

33. Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______.

TCP Port 18190

TCP Port 18209

TCP Port 19009

TCP Port 18191

34. The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Secure Internal Communication (SIC)

Restart Daemons if they fail

Transfers messages between Firewall processes

Pulls application monitoring status

35. What is not a component of Check Point SandBlast?

Threat Emulation

Threat Simulator

Threat Extraction

Threat Cloud

36. Full synchronization between cluster members is handled by Firewall Kernel.

Which port is used for this?

UDP port 265

TCP port 265

UDP port 256

TCP port 256

37. Fill in the blank: The command ___________________ provides the most complete restoration of a R81 configuration.

upgrade_import

cpconfig

fwm dbimport -p <export file>

cpinfo Crecover

38. Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic.

The cpm process:

Allow GUI Client and management server to communicate via TCP Port 19001

Allow GUI Client and management server to communicate via TCP Port 18191

Performs database tasks such as creating, deleting, and modifying objects and compiling policy.

Performs database tasks such as creating, deleting, and modifying objects and compiling as well as policy code generation.

39. Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Dynamic ID

RADIUS

Username and Password

Certificate

40. Which of the SecureXL templates are enabled by default on Security Gateway?

Drop

NAT

None

Page 5 of 19

41. What happen when IPS profile is set in Detect Only Mode for troubleshooting?

It will generate Geo-Protection traffic

Automatically uploads debugging logs to Check Point Support Center

It will not block malicious traffic

Bypass licenses requirement for Geo-Protection control

42. What is true about VRRP implementations?

VRRP membership is enabled in cpconfig

VRRP can be used together with ClusterXL, but with degraded performance

You cannot have a standalone deployment

You cannot have different VRIDs in the same physical network

43. The Security Gateway is installed on GAIA R81. The default port for the Web User Interface is ______.

TCP 18211

TCP 257

TCP 4433

TCP 443

44. Fill in the blank: The R81 feature _____ permits blocking specific IP addresses for a specified time period.

Block Port Overflow

Local Interface Spoofing

Suspicious Activity Monitoring

Adaptive Threat Prevention

45. In a Client to Server scenario, which inspection point is the first point immediately following the tables and rule base check of a packet coming from outside of the network?

Big l

Little o

Little i

Big O

46. What is the mechanism behind Threat Extraction?

This a new mechanism which extracts malicious files from a document to use it as a counter-attack against its sender.

This is a new mechanism which is able to collect malicious files out of any kind of file types to destroy it prior to sending it to the intended recipient.

This is a new mechanism to identify the IP address of the sender of malicious codes and put it into the SAM database (Suspicious Activity Monitoring).

Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.

47. You want to gather and analyze threats to your mobile device. It has to be a lightweight app.

Which application would you use?

SmartEvent Client Info

SecuRemote

Check Point Protect

Check Point Capsule Cloud

48. Which view is NOT a valid CPVIEW view?

IDA

RAD

PDP

VPN

49. Which of the following is a new R81 Gateway feature that had not been available in R77.X and older?

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

Time object to a rule to make the rule active only during specified times.

Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.

50. fwssd is a child process of which of the following Check Point daemons?

fwd

cpwd

fwm

cpd

Page 6 of 19

51. Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Symmetric routing

Failovers

Asymmetric routing

Anti-Spoofing

52. CPM process stores objects, policies, users, administrators, licenses and management data in a database. The database is:

MySQL

Postgres SQL

MarisDB

SOLR

53. If you needed the Multicast MAC address of a cluster, what command would you run?

cphaprob Ca if

cphaconf ccp multicast

cphaconf debug data

cphaprob igmp

54. Which is NOT an example of a Check Point API?

Gateway API

Management API

OPSC SDK

Threat Prevention API

55. What are the three components for Check Point Capsule?

Capsule Docs, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Cloud

56. Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?

logd

fwd

fwm

cpd

57. The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via which 2 processes?

fwd via cpm

fwm via fwd

cpm via cpd

fwd via cpd

58. You have successfully backed up Check Point configurations without the OS information.

What command would you use to restore this backup?

restore_backup

import backup

cp_merge

migrate import

59. The Firewall Administrator is required to create 100 new host objects with different IP addresses.

What API command can he use in the script to achieve the requirement?

add host name <New HostName> ip-address <ip address>

add hostname <New HostName> ip-address <ip address>

set host name <New HostName> ip-address <ip address>

set hostname <New HostName> ip-address <ip address>

60. Tom has been tasked to install Check Point R81 in a distributed deployment.

Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

One machine, but it needs to be installed using SecurePlatform for compatibility purposes.

One machine

Two machines

Three machines

Page 7 of 19

61. You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or _____ action for the file types.

Inspect/Bypass

Inspect/Prevent

Prevent/Bypass

Detect/Bypass

62. When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

None, Security Management Server would be installed by itself.

SmartConsole

SecureClient

Security Gateway

SmartEvent

63. On R81.20 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

18210

18184

257

18191

64. How many images are included with Check Point TE appliance in Recommended Mode?

2(OS) images

images are chosen by administrator during installation

as many as licensed for

the newest image

65. What is the least amount of CPU cores required to enable CoreXL?

66. You are working with multiple Security Gateways enforcing an extensive number of rules.

To simplify security administration, which action would you choose?

Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.

Create a separate Security Policy package for each remote Security Gateway.

Create network objects that restricts all applicable rules to only certain networks.

Run separate SmartConsole instances to login and configure each Security Gateway directly.

67. Which of the following authentication methods ARE NOT used for Mobile Access?

RADIUS server

Username and password (internal, LDAP)

SecurID

TACACS+

68. What is the correct command to observe the Sync traffic in a VRRP environment?

fw monitor Ce “accept[12:4,b]=224.0.0.18;”

fw monitor Ce “accept port(6118;”

fw monitor Ce “accept proto=mcVRRP;”

fw monitor Ce “accept dst=224.0.0.18;”

69. What has to be taken into consideration when configuring Management HA?

The Database revisions will not be synchronized between the management servers

SmartConsole must be closed prior to synchronized changes in the objects database

If you wanted to use Full Connectivity Upgrade, you must change the Implied Rules to allow FW1_cpredundant to pass before the Firewall Control Connections.

For Management Server synchronization, only External Virtual Switches are supported. So, if you wanted to employ Virtual Routers instead, you have to reconsider your design.

70. What is the difference between an event and a log?

Events are generated at gateway according to Event Policy

A log entry becomes an event when it matches any rule defined in Event Policy

Events are collected with SmartWorkflow form Trouble Ticket systems

Log and Events are synonyms

Page 8 of 19

71. What are the attributes that SecureXL will check after the connection is allowed by Security Policy?

Source address, Destination address, Source port, Destination port, Protocol

Source MAC address, Destination MAC address, Source port, Destination port, Protocol

Source address, Destination address, Source port, Destination port

Source address, Destination address, Destination port, Protocol

72. Which statement is NOT TRUE about Delta synchronization?

Using UDP Multicast or Broadcast on port 8161

Using UDP Multicast or Broadcast on port 8116

Quicker than Full sync

Transfers changes in the Kernel tables between cluster members.

73. The Event List within the Event tab contains:

a list of options available for running a query.

the top events, destinations, sources, and users of the query results, either as a chart or in a tallied list.

events generated by a query.

the details of a selected event.

74. Which statement is correct about the Sticky Decision Function?

It is not supported with either the Performance pack of a hardware based accelerator card

Does not support SPI’s when configured for Load Sharing

It is automatically disabled if the Mobile Access Software Blade is enabled on the cluster

It is not required L2TP traffic

75. Which statement is true regarding redundancy?

System Administrators know when their cluster has failed over and can also see why it failed over by using the cphaprob Cf if command.

ClusterXL offers three different Load Sharing solutions: Unicast, Broadcast, and Multicast.

Machines in a ClusterXL High Availability configuration must be synchronized.

Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.

76. Post-Automatic/Manual NAT rules

1,2,3,4

1,4,2,3

3,1,2,4

4,3,1,2

77. In R81, how do you manage your Mobile Access Policy?

Through the Unified Policy

Through the Mobile Console

From SmartDashboard

From the Dedicated Mobility Tab

78. R81.20 management server can manage gateways with which versions installed?

Versions R77 and higher

Versions R76 and higher

Versions R75.20 and higher

Versions R75 and higher

79. Which command can you use to verify the number of active concurrent connections?

fw conn all

fw ctl pstat

show all connections

show connections

80. Which of the following statements is TRUE about R81 management plug-ins?

The plug-in is a package installed on the Security Gateway.

Installing a management plug-in requires a Snapshot, just like any upgrade process.

A management plug-in interacts with a Security Management Server to provide new features and support for new products.

Using a plug-in offers full central management only if special licensing is applied to specific features of the plug-in.

Page 9 of 19

81. How can SmartView application accessed?

http://<Security Management IP Address>/smartview

http://<Security Management IP Address>:4434/smartview/

https://<Security Management IP Address>/smartview/

https://<Security Management host name>:4434/smartview/

82. What command verifies that the API server is responding?

api stat

api status

show api_status

app_get_status

83. Where you can see and search records of action done by R81 SmartConsole administrators?

In SmartView Tracker, open active log

In the Logs & Monitor view, select “Open Audit Log View”

In SmartAuditLog View

In Smartlog, all logs

84. Fill in the blank: The R81 utility fw monitor is used to troubleshoot ______________________.

User data base corruption

LDAP conflicts

Traffic issues

Phase two key negotiations

85. The Firewall kernel is replicated multiple times, therefore:

The Firewall kernel only touches the packet if the connection is accelerated

The Firewall can run different policies per core

The Firewall kernel is replicated only with new connections and deletes itself once the connection times out

The Firewall can run the same policy on all cores.

86. Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane.

Which is NOT an option to adjust or configure?

Severity

Automatic reactions

Policy

Threshold

87. To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following command in Expert mode then reboot:

fw ctl multik set_mode 1

fw ctl Dynamic_Priority_Queue on

fw ctl Dynamic_Priority_Queue enable

fw ctl multik set_mode 9

88. Advanced Security Checkups can be easily conducted within:

Reports

Advanced

Checkups

Views

Summary

89. What is the limitation of employing Sticky Decision Function?

With SDF enabled, the involved VPN Gateways only supports IKEv1

Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF

With SDF enabled, only ClusterXL in legacy mode is supported

With SDF enabled, you can only have three Sync interfaces at most

90. Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal website, file share and emails?

Check Point Remote User

Check Point Capsule Workspace

Check Point Mobile Web Portal

Check Point Capsule Remote

Page 10 of 19

91. Which of the following process pulls application monitoring status?

fwd

fwm

cpwd

cpd

92. To fully enable Dynamic Dispatcher on a Security Gateway:

run fw ctl multik set_mode 9 in Expert mode and then Reboot.

Using cpconfig, update the Dynamic Dispatcher value to “full” under the CoreXL menu.

Edit/proc/interrupts to include multik set_mode 1 at the bottom of the file, save, and reboot.

run fw multik set_mode 1 in Expert mode and then reboot.

93. Session unique identifiers are passed to the web api using which http header option?

X-chkp-sid

Accept-Charset

Proxy-Authorization

Application

94. Which command shows actual allowed connections in state table?

fw tab Ct StateTable

fw tab Ct connections

fw tab Ct connection

fw tab connections

95. What SmartEvent component creates events?

Consolidation Policy

Correlation Unit

SmartEvent Policy

SmartEvent GUI

96. Which command collects diagnostic data for analyzing customer setup remotely?

cpinfo

migrate export

sysinfo

cpview

97. Which features are only supported with R81.20 Gateways but not R77.x?

Access Control policy unifies the Firewall, Application Control & URL Filtering, Data Awareness, and Mobile Access Software Blade policies.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

Time object to a rule to make the rule active only during specified times.

98. Which CLI command will reset the IPS pattern matcher statistics?

ips reset pmstat

ips pstats reset

ips pmstats refresh

ips pmstats reset

99. When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.

SecureID

SecurID

Complexity

TacAcs

100. Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

50%

75%

80%

15%

Page 11 of 19

101. SmartEvent has several components that function together to track security threats.

What is the function of the Correlation Unit as a component of this architecture?

Analyzes each log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server.

Correlates all the identified threats with the consolidation policy.

Collects syslog data from third party devices and saves them to the database.

Connects with the SmartEvent Client when generating threat reports.

102. SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

This statement is true because SecureXL does improve all traffic.

This statement is false because SecureXL does not improve this traffic but CoreXL does.

This statement is true because SecureXL does improve this traffic.

This statement is false because encrypted traffic cannot be inspected.

103. Which command gives us a perspective of the number of kernel tables?

fw tab -t

fw tab -s

fw tab -n

fw tab -k

104. When simulating a problem on ClusterXL cluster with cphaprob Cd STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?

cphaprob Cd STOP unregister

cphaprob STOP unregister

cphaprob unregister STOP

cphaprob Cd unregister STOP

105. How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Install appliance TE250X on SpanPort on LAN switch in MTA mode.

Install appliance TE250X in standalone mode and setup MT

You can utilize only Check Point Cloud Services for this scenario.

It is not possible, always Check Point SGW is needed to forward emails to SandBlast appliance.

106. What is the main difference between Threat Extraction and Threat Emulation?

Threat Emulation never delivers a file and takes more than 3 minutes to complete.

Threat Extraction always delivers a file and takes less than a second to complete.

Threat Emulation never delivers a file that takes less than a second to complete.

Threat Extraction never delivers a file and takes more than 3 minutes to complete.

107. When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

Threat Emulation

HTTPS

QOS

VoIP

108. SandBlast offers flexibility in implementation based on their individual business needs.

What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Smart Cloud Services

Load Sharing Mode Services

Threat Agent Solution

Public Cloud Services

109. Which of the following is NOT a component of Check Point Capsule?

Capsule Docs

Capsule Cloud

Capsule Enterprise

Capsule Workspace

110. What is the purpose of Priority Delta in VRRP?

When a box up, Effective Priority = Priority + Priority Delta

When an Interface is up, Effective Priority = Priority + Priority Delta

When an Interface fail, Effective Priority = Priority C Priority Delta

When a box fail, Effective Priority = Priority C Priority Delta

Page 12 of 19

111. Which statements below are CORRECT regarding Threat Prevention profiles in Smart Dashboard?

You can assign only one profile per gateway and a profile can be assigned to one rule Only.

You can assign multiple profiles per gateway and a profile can be assigned to one rule only.

You can assign multiple profiles per gateway and a profile can be assigned to one or more rules.

You can assign only one profile per gateway and a profile can be assigned to one or more rules.

112. Using ClusterXL, what statement is true about the Sticky Decision Function?

Can only be changed for Load Sharing implementations

All connections are processed and synchronized by the pivot

Is configured using cpconfig

Is only relevant when using SecureXL

113. What is the name of the secure application for Mail/Calendar for mobile devices?

Capsule Workspace

Capsule Mail

Capsule VPN

Secure Workspace

114. Where do you create and modify the Mobile Access policy in R81?

SmartConsole

SmartMonitor

SmartEndpoint

SmartDashboard

115. SmartConsole R81 requires the following ports to be open for SmartEvent R81 management:

19090,22

19190,22

18190,80

19009,443

116. Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

$FWDIR/database/fwauthd.conf

$FWDIR/conf/fwauth.conf

$FWDIR/conf/fwauthd.conf

$FWDIR/state/fwauthd.conf

117. What API command below creates a new host with the name “New Host” and IP address of “192.168.0.10”?

new host name “New Host” ip-address “192.168.0.10”

set host name “New Host” ip-address “192.168.0.10”

create host name “New Host” ip-address “192.168.0.10”

add host name “New Host” ip-address “192.168.0.10”

118. As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

That is used to deploy the mobile device as a generator of one-time passwords for authenticating to an RSA Authentication Manager.

Fill Layer4 VPN CSSL VPN that gives users network access to all mobile applications.

Full Layer3 VPN CIPSec VPN that gives users network access to all mobile applications.

You can make sure that documents are sent to the intended recipients only.

119. You find one of your cluster gateways showing “Down” when you run the “cphaprob stat” command. You then run the “clusterXL_admin up” on the down member but unfortunately the member continues to show down.

What command do you run to determine the cause?

cphaprob Cf register

cphaprob Cd Cs report

cpstat Cf all

cphaprob Ca list

120. In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Mail, Block Source, Block Event Activity, External Script, SNMP Trap

Mail, Block Source, Block Destination, Block Services, SNMP Trap

Mail, Block Source, Block Destination, External Script, SNMP Trap

Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap

Page 13 of 19

121. Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

mgmt_cli add-host “Server_1” ip_address “10.15.123.10” --format txt

mgmt_cli add host name “Server_1” ip-address “10.15.123.10” --format json

mgmt_cli add object-host “Server_1” ip-address “10.15.123.10” --format json

mgmt._cli add object “Server-1” ip-address “10.15.123.10” --format json

122. What are the steps to configure the HTTPS Inspection Policy?

Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard

Go to Application&url filtering blade > Advanced > Https Inspection > Policy

Go to Manage&Settings > Blades > HTTPS Inspection > Policy

Go to Application&url filtering blade > Https Inspection > Policy

123. You want to store the GAIA configuration in a file for later reference.

What command should you use?

write mem <filename>

show config Cf <filename>

save config Co <filename>

save configuration <filename>

124. How do Capsule Connect and Capsule Workspace differ?

Capsule Connect provides a Layer3 VP

Capsule Workspace provides a Desktop with usable applications.

Capsule Workspace can provide access to any application.

Capsule Connect provides Business data isolation.

Capsule Connect does not require an installed application at client.

125. John detected high load on sync interface.

Which is most recommended solution?

For short connections like http service C delay sync for 2 seconds

Add a second interface to handle sync traffic

For short connections like http service C do not sync

For short connections like icmp service C delay sync for 2 seconds

126. Which of these is an implicit MEP option?

Primary-backup

Source address based

Round robin

Load Sharing

127. You have existing dbedit scripts from R77. Can you use them with R81.20?

dbedit is not supported in R81.20

dbedit is fully supported in R81.20

You can use dbedit to modify threat prevention or access policies, but not create or modify layers

dbedit scripts are being replaced by mgmt_cli in R81.20

128. Which Remote Access Client does not provide an Office-Mode Address?

SecuRemote

Endpoint Security Suite

Endpoint Security VPN

Check Point Mobile

129. What is the command to see cluster status in cli expert mode?

fw ctl stat

clusterXL stat

clusterXL status

cphaprob stat

130. Which Check Point daemon monitors the other daemons?

fwm

cpd

cpwd

fwssd

Page 14 of 19

131. Which command is used to display status information for various components?

show all systems

show system messages

sysmess all

show sysenv all

132. What are the blades of Threat Prevention?

IPS, DLP, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction

DLP, AntiVirus, QoS, AntiBot, Sandblast Threat Emulation/Extraction

IPS, AntiVirus, AntiBot

IPS, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction

133. For Management High Availability, which of the following is NOT a valid synchronization status?

Collision

Down

Lagging

Never been synchronized

134. Can multiple administrators connect to a Security Management Server at the same time?

No, only one can be connected

Yes, all administrators can modify a network object at the same time

Yes, every administrator has their own username, and works in a session that is independent of other administrators.

Yes, but only one has the right to write.

135. Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client communications, database manipulation, policy compilation and Management HA synchronization?

cpwd

fwd

cpd

fwm

136. To add a file to the Threat Prevention Whitelist, what two items are needed?

File name and Gateway

Object Name and MD5 signature

MD5 signature and Gateway

IP address of Management Server and Gateway

137. Under which file is the proxy arp configuration stored?

$FWDIR/state/proxy_arp.conf on the management server

$FWDIR/conf/local.arp on the management server

$FWDIR/state/_tmp/proxy.arp on the security gateway

$FWDIR/conf/local.arp on the gateway

138. What information is NOT collected from a Security Gateway in a Cpinfo?

Firewall logs

Configuration and database files

System message logs

OS and network statistics

139. SandBlast appliances can be deployed in the following modes:

using a SPAN port to receive a copy of the traffic only

detect only

inline/prevent or detect

as a Mail Transfer Agent and as part of the traffic flow only

140. Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic.

Assuming acceleration is enabled which path is handling the traffic?

Slow Path

Medium Path

Fast Path

Accelerated Path

Page 15 of 19

141. The Correlation Unit performs all but the following actions:

Marks logs that individually are not events, but may be part of a larger pattern to be identified later.

Generates an event based on the Event policy.

Assigns a severity level to the event.

Takes a new log entry that is part of a group of items that together make up an event, and adds it to an ongoing event.

142. What is the difference between SSL VPN and IPSec VPN?

IPSec VPN does not require installation of a resilient VPN client.

SSL VPN requires installation of a resident VPN client.

SSL VPN and IPSec VPN are the same.

IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser.

143. Which of the following will NOT affect acceleration?

Connections destined to or originated from the Security gateway

A 5-tuple match

Multicast packets

Connections that have a Handler (ICMP, FTP,

323, etc.)

144. The following command is used to verify the CPUSE version:

HostName:0>show installer status build

[Expert@HostName:0]#show installer status

[Expert@HostName:0]#show installer status build

HostName:0>show installer build

145. How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

cphaprob set int fwha_vmac_global_param_enabled 1

clusterXL set int fwha_vmac_global_param_enabled 1

fw ctl set int fwha_vmac_global_param_enabled 1

cphaconf set int fwha_vmac_global_param_enabled 1

146. To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection.

Which of the these is NOT a SecureXL template?

Accept Template

Deny Template

Drop Template

NAT Template

147. Which of the following is NOT a type of Check Point API available in R81.x?

Identity Awareness Web Services

OPSEC SDK

Mobile Access

Management

148. When an encrypted packet is decrypted, where does this happen?

Security policy

Inbound chain

Outbound chain

Decryption is not supported

149. John is using Management HA.

Which Smartcenter should be connected to for making changes?

secondary Smartcenter

active Smartenter

connect virtual IP of Smartcenter HA

primary Smartcenter

150. You are asked to check the status of several user-mode processes on the management server and gateway.

Which of the following processes can only be seen on a Management Server?

fwd

fwm

cpd

cpwd

Page 16 of 19

151. What scenario indicates that SecureXL is enabled?

Dynamic objects are available in the Object Explorer

SecureXL can be disabled in cpconfig

fwaccel commands can be used in clish

Only one packet in a stream is seen in a fw monitor packet capture

152. What processes does CPM control?

Object-Store, Database changes, CPM Process and web-services

web-services, CPMI process, DLEserver, CPM process

DLEServer, Object-Store, CP Process and database changes

web_services, dle_server and object_Store

153. Which encryption algorithm is the least secured?

AES-128

AES-256

DES

3DES

154. What is the command to check the status of the SmartEvent Correlation Unit?

fw ctl get int cpsead_stat

cpstat cpsead

fw ctl stat cpsemd

cp_conf get_stat cpsemd

155. You need to see which hotfixes are installed on your gateway, which command would you use?

cpinfo Ch all

cpinfo Co hotfix

cpinfo Cl hotfix

cpinfo Cy all

156. VPN Link Selection will perform the following when the primary VPN link goes down?

The Firewall will drop the packets.

The Firewall can update the Link Selection entries to start using a different link for the same tunnel.

The Firewall will send out the packet on all interfaces.

The Firewall will inform the client that the tunnel is down.

157. Which of the following links will take you to the SmartView web application?

https://<Security Management Server host name>/smartviewweb/

https://<Security Management Server IP Address>/smartview/

https://<Security Management Server host name>smartviewweb

https://<Security Management Server IP Address>/smartview

158. Which directory below contains log files?

/opt/CPSmartlog-R81/log

/opt/CPshrd-R81/log

/opt/CPsuite-R81/fw1/log

/opt/CPsuite-R81/log

159. Which GUI client is supported in R81?

SmartProvisioning

SmartView Tracker

SmartView Monitor

SmartLog

160. From SecureXL perspective, what are the tree paths of traffic flow:

Initial Path; Medium Path; Accelerated Path

Layer Path; Blade Path; Rule Path

Firewall Path; Accept Path; Drop Path

Firewall Path; Accelerated Path; Medium Path

Page 17 of 19

161. To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:

fw ctl Dyn_Dispatch on

fw ctl Dyn_Dispatch enable

fw ctl multik set_mode 4

fw ctl multik set_mode 1

162. What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

CCP and 18190

CCP and 257

CCP and 8116

CPC and 8116

163. Which command shows the current connections distributed by CoreXL FW instances?

fw ctl multik stat

fw ctl affinity -l

fw ctl instances -v

fw ctl iflist

164. What is the purpose of extended master key extension/session hash?

UDP VOIP protocol extension

In case of TLS1.x it is a prevention of a Man-in-the-Middle attack/disclosure of the client-server communication

Special TCP handshaking extension

Supplement DLP data watermark

165. In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module.

For Wire Mode configuration, chain modules marked with ____________ will not apply.

ffff

166. Which one of the following is true about Capsule Connect?

It is a full layer 3 VPN client

It offers full enterprise mobility management

It is supported only on iOS phones and Windows PCs

It does not support all VPN authentication methods

167. How often does Threat Emulation download packages by default?

Once a week

Once an hour

Twice per day

Once per day

168. You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization.

What service is used by the FWD daemon to do a Full Synchronization?

TCP port 443

TCP port 257

TCP port 256

UDP port 8116

169. Which statement is true about ClusterXL?

Supports Dynamic Routing (Unicast and Multicast)

Supports Dynamic Routing (Unicast Only)

Supports Dynamic Routing (Multicast Only)

Does not support Dynamic Routing

170. Which command shows detailed information about VPN tunnels?

cat $FWDIR/conf/vpn.conf

vpn tu tlist

vpn tu

cpview

Page 18 of 19

171. Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R81.20 SmartConsole application?

IPS, Anti-Bot, URL Filtering, Application Control, Threat Emulation.

Firewall, IPS, Threat Emulation, Application Control.

IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction.

Firewall, IPS, Anti-Bot, Anti-Virus, Threat Emulation.

172. When gathering information about a gateway using CPINFO, what information is included or excluded when using the “-x” parameter?

Includes the registry

Gets information about the specified Virtual System

Does not resolve network addresses

Output excludes connection table

173. What component of R81 Management is used for indexing?

DBSync

API Server

fwm

SOLR

174. After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

cvpnd_restart

cvpnd restart

cvpnrestart

175. SandBlast has several functional components that work together to ensure that attacks are prevented in real-time.

Which the following is NOT part of the SandBlast component?

Threat Emulation

Mobile Access

Mail Transfer Agent

Threat Cloud

176. With Mobile Access enabled, administrators select the web-based and native applications that can be accessed by remote users and define the actions that users can perform the applications.

Mobile Access encrypts all traffic using:

HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender.

HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, they need to install the SSL Network Extender.

HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, no additional software is required.

HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, no additional software is required.

177. What is the benefit of “tw monitor” over “tcpdump”?

“fw monitor” reveals Layer 2 information, while “tcpdump” acts at Layer 3.

“fw monitor” is also available for 64-Bit operating systems.

With “fw monitor”, you can see the inspection points, which cannot be seen in “tcpdump”

“fw monitor” can be used from the CLI of the Management Server to collect information from multiple gateways.

178. Which of the following describes how Threat Extraction functions?

Detect threats and provides a detailed report of discovered threats.

Proactively detects threats.

Delivers file with original content.

Delivers PDF versions of original files with active content removed.

179. Security Checkup Summary can be easily conducted within:

Summary

Views

Reports

Checkups

180. What command can you use to have cpinfo display all installed hotfixes?

cpinfo -hf

cpinfo Cy all

cpinfo Cget hf

cpinfo installed_jumbo

Page 19 of 19

181. What is the port used for SmartConsole to connect to the Security Management Server?

CPMI port 18191/TCP

CPM port/TCP port 19009

SIC port 18191/TCP

https port 4434/TCP

182. What is considered Hybrid Emulation Mode?

Manual configuration of file types on emulation location.

Load sharing of emulation between an on premise appliance and the cloud.

Load sharing between OS behavior and CPU Level emulation.

High availability between the local SandBlast appliance and the cloud.

183. When setting up an externally managed log server, what is one item that will not be configured on the R81 Security Management Server?

SIC

NAT

FQDN

184. Customer’s R81 management server needs to be upgraded to R81.20.

What is the best upgrade method when the management server is not connected to the Internet?

Export R81 configuration, clean install R81.20 and import the configuration

CPUSE offline upgrade

CPUSE online upgrade

SmartUpdate upgrade

185. When installing a dedicated R81 SmartEvent server.

What is the recommended size of the root partition?

Any size

Less than 20GB

More than 10GB and less than 20GB

At least 20GB

186. As an administrator, you may be required to add the company logo to reports.

To do this, you would save the logo as a PNG file with the name ‘cover-company-logo.png’ and then copy that image file to which directory on the SmartEvent server?

SFWDIR/smartevent/conf

$RTDIR/smartevent/conf

$RTDIR/smartview/conf

$FWDIR/smartview/conf

Check Point 156-315.81.20 CCSE R81.20 Exam Updated Dumps

Check Point 156-315.81.20 CCSE R81.20 Exam Updated Dumps

Share this post

Leave a Reply Cancel reply

Related Posts