Check Point Certified Security Expert 156-315.80 Real Dumps

dumps2021-09-27T07:35:18+08:00

It is easy for the candidates to pass Check Point Certified Security Expert 156-315.80 exam now. The latest Check Point certification 156-315.80 real dumps are online. All the 156-315.80 real dumps are the latest material for all the candidates to test all related topics. Free Check Point CCSE 156-315.80 real dumps are available below.

Page 1 of 10

1. What level of CPU load on a Secure Network Distributor would indicate that another may be necessary?

Idle <20%

USR <20%

SYS <20%

Wait <20%

2. Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

To satellites through center only

To center only

To center and to other satellites through center

To center, or through the center to other satellites, to Internet and other VPN targets

3. Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

50%

75%

80%

15%

4. On R80.10 the IPS Blade is managed by:

Threat Protection policy

Anti-Bot Blade

Threat Prevention policy

Layers on Firewall policy

5. You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.

What must you do to get SIC to work?

Remove Geo-Protection, as the IP-to-country database is updated externally, and you have no control of this.

Create a rule at the top in the Sydney firewall to allow control traffic from your network

Nothing - Check Point control connections function regardless of Geo-Protection policy

Create a rule at the top in your Check Point firewall to bypass the Geo-Protection

6. When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

None, Security Management Server would be installed by itself.

SmartConsole

SecureClient

Security Gateway

SmartEvent

7. What is the best method to upgrade a Security Management Server to R80.x when it is not connected to the Internet?

CPUSE offline upgrade only

Advanced upgrade or CPUSE offline upgrade

Advanced Upgrade only

SmartUpdate offline upgrade

8. What are the attributes that SecureXL will check after the connection is allowed by Security Policy?

Source address, Destination address, Source port, Destination port, Protocol

Source MAC address, Destination MAC address, Source port, Destination port, Protocol

Source address, Destination address, Source port, Destination port

Source address, Destination address, Destination port, Protocol

9. SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

This statement is true because SecureXL does improve all traffic.

This statement is false because SecureXL does not improve this traffic but CoreXL does.

This statement is true because SecureXL does improve this traffic.

This statement is false because encrypted traffic cannot be inspected.

10. The back end database for Check Point R80 Management uses:

DBMS

MongoDB

PostgreSQL

MySQL

11. What is UserCheck?

Messaging tool used to verify a user’s credentials.

Communication tool used to inform a user about a website or application they are trying to access.

Administrator tool used to monitor users on their network.

Communication tool used to notify an administrator when a new user is created.

12. Capsule Connect and Capsule Workspace both offer secured connection for remote users who are using their mobile devices. However, there are differences between the two.

Which of the following statements correctly identify each product's capabilities?

Workspace supports ios operating system, Android, and WP8, whereas Connect supports ios operating system and Android only

For compliance/host checking, Workspace offers the MDM cooperative enforcement, whereas Connect offers both jailbreak/root detection and MDM cooperative enforcement.

For credential protection, Connect uses One-time Password login support and has no SSO support, whereas Workspace offers both One-Time Password and certain SSO login support.

Workspace can support any application, whereas Connect has a limited number of application types which it will support.

13. What Factor preclude Secure XL Templating?

Source Port Ranges/Encrypted Connections

IPS

ClusterXL in load sharing Mode

CoreXL

14. What is the purpose of the CPCA process?

Monitoring the status of processes.

Sending and receiving logs.

Communication between GUI clients and the SmartCenter server.

Generating and modifying certificates.

15. Fill in the blank: The tool _____ generates a R80 Security Gateway configuration report.

infoCP

infoview

cpinfo

fw cpinfo

16. Fill in the blank: The “fw monitor” tool can be best used to troubleshoot ____________________.

AV issues

VPN errors

Network traffic issues

Authentication issues

17. What is a best practice before starting to troubleshoot using the “fw monitor” tool?

Run the command: fw monitor debug on

Clear the connections table

Disable CoreXL

Disable SecureXL

18. What kind of information would you expect to see using the sim affinity command?

The VMACs used in a Security Gateway cluster

The involved firewall kernel modules in inbound and outbound packet chain

Overview over SecureXL templated connections

Network interfaces and core distribution used for CoreXL

19. CoreXL is supported when one of the following features is enabled:

Route-based VPN

IPS

IPv6

Overlapping NAT

20. What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

CCP and 18190

CCP and 257

CCP and 8116

CPC and 8116

Page 2 of 10

21. Which of the following Windows Security Events will not map a username to an IP address in Identity Awareness?

Kerberos Ticket Renewed

Kerberos Ticket Requested

Account Logon

Kerberos Ticket Timed Out

22. SmartEvent has several components that function together to track security threats .

What is the function of the Correlation Unit as a component of this architecture?

Analyzes each log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server.

Correlates all the identified threats with the consolidation policy.

Collects syslog data from third party devices and saves them to the database.

Connects with the SmartEvent Client when generating threat reports.

23. True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway.

True, CLI is the prefer method for Licensing

False, Central License are handled via Security Management Server

False, Central Licenses are installed via Gaia on Security Gateways

True, Central License can be installed with CPLIC command on a Security Gateway

24. Which directory below contains log files?

/opt/CPSmartlog-R80/log

/opt/CPshrd-R80/log

/opt/CPsuite-R80/fw1/log

/opt/CPsuite-R80/log

25. An administrator would like to troubleshoot why templating is not working for some traffic .

How can he determine at which rule templating is disabled?

He can use the fw accel stat command on the gateway.

He can use the fw accel statistics command on the gateway.

He can use the fwaccel stat command on the Security Management Server.

He can use the fwaccel stat command on the gateway

26. Which command is used to obtain the configuration lock in Gaia?

Lock database override

Unlock database override

Unlock database lock

Lock database user

27. Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

Yes, but they need to have a mutually trusted certificate authority

Yes, but they have to have a pre-shared secret key

No, they cannot share certificate authorities

No, Certificate based VPNs are only possible between Check Point devices

28. To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?

blada: application control AND action:drop

blade."application control AND action;drop

(blade: application control AND action;drop)

blade;"application control AND action:drop

29. What is the port used for SmartConsole to connect to the Security Management Server?

CPMI port 18191/TCP

CPM port/TCP port 19009

SIC port 18191/TCP

https port 4434/TCP

30. Which command gives us a perspective of the number of kernel tables?

fw tab -t

fw tab -s

fw tab -n

fw tab -k

31. After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?

Security Gateway IP-address cannot be changed without re-establishing the trust.

The Security Gateway name cannot be changed in command line without re-establishing trust.

The Security Management Server name cannot be changed in SmartConsole without re-establishing trust.

The Security Management Server IP-address cannot be changed without re-establishing the trust.

32. What are the steps to configure the HTTPS Inspection Policy?

Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard

Go to Application&url filtering blade > Advanced > Https Inspection > Policy

Go to Manage&Settings > Blades > HTTPS Inspection > Policy

Go to Application&url filtering blade > Https Inspection > Policy

33. Which feature is NOT provided by all Check Point Mobile Access solutions?

Support for IPv6

Granular access control

Strong user authentication

Secure connectivity

34. Using ClusterXL, what statement is true about the Sticky Decision Function?

Can only be changed for Load Sharing implementations

All connections are processed and synchronized by the pivot

Is configured using cpconfig

Is only relevant when using SecureXL

35. Which one of the following is true about Threat Extraction?

Always delivers a file to user

Works on all MS Office, Executables, and PDF files

Can take up to 3 minutes to complete

Delivers file only if no threats found

36. When installing a dedicated R80 SmartEvent server .

What is the recommended size of the root partition?

Any size

Less than 20GB

More than 10GB and less than 20GB

At least 20GB

37. Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R80.10 SmartConsole application?

IPS, Anti-Bot, URL Filtering, Application Control, Threat Emulation.

Firewall, IPS, Threat Emulation, Application Control.

IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction.

Firewall, IPS, Anti-Bot, Anti-Virus, Threat Emulation.

38. The essential means by which state synchronization works to provide failover in the event an active member goes down, ____________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.

ccp

cphaconf

cphad

cphastart

39. When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

ThreatCloud is a database-related application which is located on-premise to preserve privacy of company-related data

ThreatCloud is a collaboration platform for all the CheckPoint customers to form a virtual cloud consisting of a combination of all on-premise private cloud environments

ThreatCloud is a collaboration platform for Check Point customers to benefit from VMWare ESXi infrastructure which supports the Threat Emulation Appliances as virtual machines in the EMC Cloud

ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary

40. Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?

Synchronized

Never been synchronized

Lagging

Collision

Page 3 of 10

41. What is the main difference between Threat Extraction and Threat Emulation?

Threat Emulation never delivers a file and takes more than 3 minutes to complete.

Threat Extraction always delivers a file and takes less than a second to complete.

Threat Emulation never delivers a file that takes less than a second to complete.

Threat Extraction never delivers a file and takes more than 3 minutes to complete.

42. What is considered Hybrid Emulation Mode?

Manual configuration of file types on emulation location.

Load sharing of emulation between an on premise appliance and the cloud.

Load sharing between OS behavior and CPU Level emulation.

High availability between the local SandBlast appliance and the cloud.

43. Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

ThreatWiki

Whitelist Files

AppWiki

IPS Protections

44. Which of the following authentication methods ARE NOT used for Mobile Access?

RADIUS server

Username and password (internal, LDAP)

SecurID

TACACS+

45. Why would an administrator see the message below?

A new Policy Package created on both the Management and Gateway will be deleted and must be backed up first before proceeding.

A new Policy Package created on the Management is going to be installed to the existing Gateway.

A new Policy Package created on the Gateway is going to be installed on the existing Management.

A new Policy Package created on the Gateway and transferred to the Management will be overwritten by the Policy Package currently on the Gateway but can be restored from a periodic backup on the Gateway.

46. Fill in the blank: The R80 utility fw monitor is used to troubleshoot ______________________.

User data base corruption

LDAP conflicts

Traffic issues

Phase two key negotiations

47. Please choose the path to monitor the compliance status of the Check Point R80.10 based management.

Gateways & Servers --> Compliance View

Compliance blade not available under R80.10

Logs & Monitor --> New Tab --> Open compliance View

Security & Policies --> New Tab --> Compliance View

48. SmartConsole R80 x requires the following ports to be open for SmartEvent.

19009, 19090 & 443

19009, 19004 & 18190

18190 & 443

19009, 18190 & 443

49. With Mobile Access enabled, administrators select the web-based and native applications that can be accessed by remote users and define the actions that users can perform the applications.

Mobile Access encrypts all traffic using:

HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender.

HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, they need to install the SSL Network Extender.

HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, no additional software is required.

HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, no additional software is required.

50. Fill in the blanks: A _______ license requires an administrator to designate a gateway for attachment whereas a ________ license is automatically attached to a Security Gateway.

Formal; corporate

Local; formal

Local; central

Central; local

51. Choose the correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI?

mgmt_cli add host name “myHost12 ip” address 10.50.23.90

mgmt_cli add host name ip-address 10.50.23.90

mgmt_cli add host “emailserver1” address 10.50.23.90

mgmt_cli add host name “emailserver1” ip-address 10.50.23.90

52. In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

Security Policies

Logs and Monitor

Manage and Settings

Gateways and Servers

53. Office mode means that:

SecurID client assigns a routable MAC address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

Users authenticate with an Internet browser and use secure HTTPS connection.

Local ISP (Internet service Provider) assigns a non-routable IP address to the remote user.

Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

54. Advanced Security Checkups can be easily conducted within:

Reports

Advanced

Checkups

Views

Summary

55. The Firewall Administrator is required to create 100 new host objects with different IP addresses .

What API command can he use in the script to achieve the requirement?

add host name <New HostName> ip-address <ip address>

add hostname <New HostName> ip-address <ip address>

set host name <New HostName> ip-address <ip address>

set hostname <New HostName> ip-address <ip address>

56. Customer’s R80 management server needs to be upgraded to R80.10 .

What is the best upgrade method when the management server is not connected to the Internet?

Export R80 configuration, clean install R80.10 and import the configuration

CPUSE offline upgrade

CPUSE online upgrade

SmartUpdate upgrade

57. Automation and Orchestration differ in that:

Automation relates to codifying tasks, whereas orchestration relates to codifying processes.

Automation involves the process of coordinating an exchange of information through web service interactions such as XML and JSON, but orchestration does not involve processes.

Orchestration is concerned with executing a single task, whereas automation takes a series of tasks and puts them all together into a process workflow.

Orchestration relates to codifying tasks, whereas automation relates to codifying processes.

58. By default, which port does the WebUI listen on?

4434

443

8080

59. What is mandatory for ClusterXL to work properly?

The number of cores must be the same on every participating cluster node

The Magic MAC number must be unique per cluster node

The Sync interface must not have an IP address configured

If you have “Non-monitored Private” interfaces, the number of those interfaces must be the same on all cluster members

60. What is the command to see cluster status in cli expert mode?

fw ctl stat

clusterXL stat

clusterXL status

cphaprob stat

Page 4 of 10

61. What CLI command compiles and installs a Security Policy on the target’s Security Gateways?

fwm compile

fwm load

fwm fetch

fwm install

62. What are the three components for Check Point Capsule?

Capsule Docs, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Cloud

63. Which encryption algorithm is the least secured?

AES-128

AES-256

DES

3DES

64. To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

fw ctl set int fwha vmac global param enabled

fw ctl get int vmac global param enabled; result of command should return value 1

cphaprob-a if

fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1

65. GAiA Software update packages can be imported and installed offline in situation where:

Security Gateway with GAiA does NOT have SFTP access to Internet

Security Gateway with GAiA does NOT have access to Internet.

Security Gateway with GAiA does NOT have SSH access to Internet.

The desired CPUSE package is ONLY available in the Check Point CLOU

66. Fill in the blank: The R80 feature _____ permits blocking specific IP addresses for a specified time period.

Block Port Overflow

Local Interface Spoofing

Suspicious Activity Monitoring

Adaptive Threat Prevention

67. Which packet info is ignored with Session Rate Acceleration?

source port ranges

source ip

source port

same info from Packet Acceleration is used

68. The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule based and checked for viruses. But it is not accelerated .

What is the most likely reason that the traffic is not accelerated?

The connection is destined for a server within the network

The connection required a Security server

The packet is the second in an established TCP connection

The packets are not multicast

69. Full synchronization between cluster members is handled by Firewall Kernel .

Which port is used for this?

UDP port 265

TCP port 265

UDP port 256

TCP port 256

70. You find one of your cluster gateways showing “Down” when you run the “cphaprob stat” command. You then run the “clusterXL_admin up” on the down member but unfortunately the member continues to show down .

What command do you run to determine the cause?

cphaprob Cf register

cphaprob Cd Cs report

cpstat Cf all

cphaprob Ca list

71. What is the correct order of the default “fw monitor” inspection points?

i, I, o, O

1, 2, 3, 4

i, o, I, O

I, i, O, o

72. Which command shows detailed information about VPN tunnels?

cat $FWDIR/conf/vpn.conf

vpn tu tlist

vpn tu

cpview

73. What is the difference between an event and a log?

Events are generated at gateway according to Event Policy

A log entry becomes an event when it matches any rule defined in Event Policy

Events are collected with SmartWorkflow form Trouble Ticket systems

Log and Events are synonyms

74. If SecureXL is disabled which path is used to process traffic?

Passive path

Medium path

Firewall path

Accelerated path

75. To fully enable Dynamic Dispatcher on a Security Gateway:

run fw ctl multik set_mode 9 in Expert mode and then Reboot.

Using cpconfig, update the Dynamic Dispatcher value to “full” under the CoreXL menu.

Edit/proc/interrupts to include multik set_mode 1 at the bottom of the file, save, and reboot.

run fw multik set_mode 1 in Expert mode and then reboot.

76. When using CPSTAT, what is the default port used by the AMON server?

18191

18192

18194

18190

77. What are the two high availability modes?

Load Sharing and Legacy

Traditional and New

Active and Standby

New and Legacy

78. What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?

4 Interfaces C an interface leading to the organization, a second interface leading to the internet, a third interface for synchronization, a fourth interface leading to the Security Management Server.

3 Interfaces C an interface leading to the organization, a second interface leading to the Internet, a third interface for synchronization.

1 Interface C an interface leading to the organization and the Internet, and configure for synchronization.

2 Interfaces C a data interface leading to the organization and the Internet, a second interface for synchronization.

79. What are the methods of SandBlast Threat Emulation deployment?

Cloud, Appliance and Private

Cloud, Appliance and Hybrid

Cloud, Smart-1 and Hybrid

Cloud, OpenServer and Vmware

80. Which method below is NOT one of the ways to communicate using the Management API’s?

Typing API commands using the “mgmt_cli” command

Typing API commands from a dialog box inside the SmartConsole GUI application

Typing API commands using Gaia’s secure shell(clish)19+

Sending API commands over an http connection using web-services

Page 5 of 10

81. Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?

Auditor

Read Only All

Super User

Full Access

82. Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or via CLI.

Which command should he use in CLI? (Choose the correct answer.)

remove database lock

The database feature has one command lock database override.

override database lock

The database feature has two commands lock database override and unlock database. Both will work.

83. Which command shows actual allowed connections in state table?

fw tab Ct StateTable

fw tab Ct connections

fw tab Ct connection

fw tab connections

84. What command is used to manually failover a Multi-Version Cluster during the upgrade?

clusterXL_admin down in Expert Mode

clusterXL_admin down in Clish

set cluster member state down in Clish

set cluster down in Expert Mode

85. Where you can see and search records of action done by R80 SmartConsole administrators?

In SmartView Tracker, open active log

In the Logs & Monitor view, select “Open Audit Log View”

In SmartAuditLog View

In Smartlog, all logs

86. Which statement is true regarding redundancy?

System Administrators know when their cluster has failed over and can also see why it failed over by using the cphaprob Cf if command.

ClusterXL offers three different Load Sharing solutions: Unicast, Broadcast, and Multicast.

Machines in a ClusterXL High Availability configuration must be synchronized.

Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.

87. Which command can you use to enable or disable multi-queue per interface?

cpmq set

Cpmqueue set

Cpmq config

St cpmq enable

88. In R80, where do you manage your Mobile Access Policy?

Access Control Policy

Through the Mobile Console

Shared Gateways Policy

From the Dedicated Mobility Tab

89. What is the least amount of CPU cores required to enable CoreXL?

90. In terms of Order Rule Enforcement, when a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom.

Which of the following statements is correct?

If the Action of the matching rule is Accept the gateway will drop the packet

If the Action of the matching rule is Drop, the gateway continues to check rules in the next Policy Layer down

If the Action of the matching rule is Drop the gateway stops matching against later rules in the Policy Rule Base and drops the packet

If the rule does not matched in the Network policy it will continue to other enabled polices

91. In the Check Point Security Management Architecture, which component(s) can store logs?

SmartConsole

Security Management Server and Security Gateway

Security Management Server

SmartConsole and Security Management Server

92. Which statements below are CORRECT regarding Threat Prevention profiles in SmartDashboard?

You can assign only one profile per gateway and a profile can be assigned to one rule Only.

You can assign multiple profiles per gateway and a profile can be assigned to one rule only.

You can assign multiple profiles per gateway and a profile can be assigned to one or more rules.

You can assign only one profile per gateway and a profile can be assigned to one or more rules.

93. In the Firewall chain mode FFF refers to:

Stateful Packets

No Match

All Packets

Stateless Packets

94. What statement best describes the Proxy ARP feature for Manual NAT in R80.10?

Automatic proxy ARP configuration can be enabled

Translate Destination on Client Side should be configured

fw ctl proxy should be configured

local.arp file must always be configured

95. You are asked to check the status of several user-mode processes on the management server and gateway .

Which of the following processes can only be seen on a Management Server?

fwd

fwm

cpd

cpwd

96. You are working with multiple Security Gateways enforcing an extensive number of rules.

To simplify security administration, which action would you choose?

Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.

Create a separate Security Policy package for each remote Security Gateway.

Create network objects that restricts all applicable rules to only certain networks.

Run separate SmartConsole instances to login and configure each Security Gateway directly.

97. Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

mgmt_cli add-host “Server_1” ip_address “10.15.123.10” --format txt

mgmt_cli add host name “Server_1” ip-address “10.15.123.10” --format json

mgmt_cli add object-host “Server_1” ip-address “10.15.123.10” --format json

mgmt._cli add object “Server-1” ip-address “10.15.123.10” --format json

98. What is the default shell of Gaia CLI?

Monitor

Read-only

Bash

99. The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.

What is the most likely reason that the traffic is not accelerated?

There is a virus found. Traffic is still allowed but not accelerated.

The connection required a Security server.

Acceleration is not enabled.

The traffic is originating from the gateway itself.

100. Which path below is available only when CoreXL is enabled?

Slow path

Firewall path

Medium path

Accelerated path

Page 6 of 10

101. During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity .

Which of those hosts should you try to remediate first?

Host having a Critical event found by Threat Emulation

Host having a Critical event found by IPS

Host having a Critical event found by Antivirus

Host having a Critical event found by Anti-Bot

102. Which GUI client is supported in R80?

SmartProvisioning

SmartView Tracker

SmartView Monitor

SmartLog

103. Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic.

Assuming acceleration is enabled which path is handling the traffic?

Slow Path

Medium Path

Fast Path

Accelerated Path

104. As an administrator, you may be required to add the company logo to reports.

To do this, you would save the logo as a PNG file with the name ‘cover-company-logo.png’ and then copy that image file to which directory on the SmartEvent server?

SFWDIR/smartevent/conf

$RTDIR/smartevent/conf

$RTDIR/smartview/conf

$FWDIR/smartview/conf

105. On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

18210

18184

257

18191

106. Vanessa is a Firewall administrator. She wants to test a backup of her company’s production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment.

Which details she need to fill in System Restore window before she can click OK button and test the backup?

Server, SCP, Username, Password, Path, Comment, Member

Server, TFTP, Username, Password, Path, Comment, All Members

Server, Protocol, Username, Password, Path, Comment, All Members

Server, Protocol, username Password, Path, Comment, Member

107. Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or ______ .

On all satellite gateway to satellite gateway tunnels

On specific tunnels for specific gateways

On specific tunnels in the community

On specific satellite gateway to central gateway tunnels

108. In R80.10, how do you manage your Mobile Access Policy?

Through the Unified Policy

Through the Mobile Console

From SmartDashboard

From the Dedicated Mobility Tab

109. Which Check Point daemon monitors the other daemons?

fwm

cpd

cpwd

fwssd

110. True or False: In R80, more than one administrator can login to the Security Management Server with write permission at the same time.

False, this feature has to be enabled in the Global Properties.

True, every administrator works in a session that is independent of the other administrators.

True, every administrator works on a different database that is independent of the other administrators.

False, only one administrator can login with write permission.

111. Which process handles connection from SmartConsole R80?

fwm

cpmd

cpm

cpd

112. What state is the Management HA in when both members have different policies/databases?

Synchronized

Never been synchronized

Lagging

Collision

113. Which of the following is NOT a component of Check Point Capsule?

Capsule Docs

Capsule Cloud

Capsule Enterprise

Capsule Workspace

114. In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

Pentagon

Combined

Meshed

Star

115. How many interfaces can you configure to use the Multi-Queue feature?

10 interfaces

3 interfaces

4 interfaces

5 interfaces

116. Which firewall daemon is responsible for the FW CLI commands?

fwd

fwm

cpm

cpd

117. According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

Firewall

VPN

IPS

HTTPS

118. Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

All Connections (Clear or Encrypted)

Accept all encrypted traffic

Specific VPN Communities

All Site-to-Site VPN Communities

119. Which is the correct order of a log flow processed by SmartEvent components?

Firewall > Correlation Unit > Log Server > SmartEvent Server Database > SmartEvent Client

Firewall > SmartEvent Server Database > Correlation Unit > Log Server > SmartEvent Client

Firewall > Log Server > SmartEvent Server Database > Correlation Unit > SmartEvent Client

Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client

120. What is the base level encryption key used by Capsule Docs?

RSA 2048

RSA 1024

SHA-256

AES

Page 7 of 10

121. Which SmartConsole tab is used to monitor network and security performance?

Manage Setting

Security Policies

Gateway and Servers

Logs and Monitor

122. What traffic does the Anti-bot feature block?

Command and Control traffic from hosts that have been identified as infected

Command and Control traffic to servers with reputation for hosting malware

Network traffic that is directed to unknown or malicious servers

Network traffic to hosts that have been identified as infected

123. Matt wants to upgrade his old Security Management server to R80.x using the Advanced Upgrade with Database Migration .

What is one of the requirements for a successful upgrade?

Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine

Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine

Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR/log directory on the source machine

Size of the /var/log folder of the target machine must be at least 25GB or more

124. On the following picture an administrator configures Identity Awareness:

After clicking “Next” the above configuration is supported by:

Kerberos SSO which will be working for Active Directory integration

Based on Active Directory integration which allows the Security Gateway to correlate Active Directory users and machines to IP addresses in a method that is completely transparent to the user.

Obligatory usage of Captive Portal.

The ports 443 or 80 what will be used by Browser-Based and configured Authentication.

125. Which of the following is NOT a valid type of SecureXL template?

Accept Template

Deny template

Drop Template

NAT Template

126. CoreXL is NOT supported when one of the following features is enabled: (Choose three)

Route-based VPN

IPS

IPv6

Overlapping NAT

127. Which of the following is NOT an alert option?

SNMP

High alert

Mail

User defined alert

128. What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

SmartCenter Server cannot reach this Security Gateway.

There is a blade reporting a problem.

VPN software blade is reporting a malfunction.

Security Gateway’s MGNT NIC card is disconnected.

129. Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

TCP port 19009

TCP Port 18190

TCP Port 18191

TCP Port 18209

130. How can SmartView application accessed?

http://<Security Management IP Address>/smartview

http://<Security Management IP Address>:4434/smartview/

https://<Security Management IP Address>/smartview/

https://<Security Management host name>:4434/smartview/

131. What is the SandBlast Agent designed to do?

Performs OS-level sandboxing for SandBlast Cloud architecture

Ensure the Check Point SandBlast services is running on the end user’s system

If malware enters an end user’s system, the SandBlast Agent prevents the malware from spreading with the network

Clean up email sent with malicious attachments

132. In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a

response before the peer host is declared ‘down’, you would set the_________?

life sign polling interval

life sign timeout

life_sign_polling_interval

life_sign_timeout

133. How many images are included with Check Point TE appliance in Recommended Mode?

2(OS) images

images are chosen by administrator during installation

as many as licensed for

the most new image

134. The Firewall kernel is replicated multiple times, therefore:

The Firewall kernel only touches the packet if the connection is accelerated

The Firewall can run different policies per core

The Firewall kernel is replicated only with new connections and deletes itself once the connection times out

The Firewall can run the same policy on all cores.

135. In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log .

Which of the following options can you add to each Log, Detailed Log and Extended Log?

Accounting

Suppression

Accounting/Suppression

Accounting/Extended

136. Which blades and or features are not supported in R80?

SmartEvent Maps

SmartEvent

Identity Awareness

SmartConsole Toolbars

137. View the rule below .

What does the lock-symbol in the left column mean? (Choose the BEST answer.)

The current administrator has read-only permissions to Threat Prevention Policy.

Another user has locked the rule for editing.

Configuration lock is present. Click the lock symbol to gain read-write access.

The current administrator is logged in as read-only because someone else is editing the policy.

138. How many layers make up the TCP/IP model?

139. UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users .

Which action is not supported in UserCheck objects?

Ask

Drop

Inform

Reject

140. Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Detects and blocks malware by correlating multiple detection engines before users are affected.

Configure rules to limit the available network bandwidth for specified users or groups.

Use UserCheck to help users understand that certain websites are against the company’s security policy.

Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.

Page 8 of 10

141. In R80 spoofing is defined as a method of:

Disguising an illegal IP address behind an authorized IP address through Port Address Translation.

Hiding your firewall from unauthorized users.

Detecting people using false or wrong authentication logins

Making packets appear as if they come from an authorized IP address.

142. Which Check Point software blade provides Application Security and identity control?

Identity Awareness

Data Loss Prevention

URL Filtering

Application Control

143. In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with __________________ will not apply.

ffff

144. How many policy layers do Access Control policy support?

145. By default, the R80 web API uses which content-type in its response?

Java Script

XML

Text

JSON

146. Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

assign privileges to users.

edit the home directory of the user.

add users to your Gaia system.

assign user rights to their home directory in the Security Management Server.

147. You need to change the MAC-address on eth2 interface of the gateway .

What is the correct way to change MAC-address in Check Point Gaia?

In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11

In expert-mode run ifconfig eth1 hw 11:11:11:11 11 11

In CLISH run set interface eth2 hw-addr 11 11 11:11:11 11

In expert-mode run: ethtool -4 eth2 mac 11 11:11:11:11:11

148. What is the command used to activated Multi-Version Cluster mode?

set cluster member mvc on in Clish

set mvc on on Clish

set cluster MVC on in Expert Mode

set cluster mvc on in Expert Mode

149. You want to store the GAIA configuration in a file for later reference .

What command should you use?

write mem <filename>

show config Cf <filename>

save config Co <filename>

save configuration <filename>

150. Fill in the blank: __________ information is included in “Full Log” tracking option, but is not included in “Log” tracking option?

Destination port

Data type

File attributes

Application

151. When gathering information about a gateway using CPINFO, what information is included or excluded when using the “-x” parameter?

Includes the registry

Gets information about the specified Virtual System

Does not resolve network addresses

Output excludes connection table

152. What information is NOT collected from a Security Gateway in a Cpinfo?

Firewall logs

Configuration and database files

System message logs

OS and network statistics

153. Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

15 sec

60 sec

5 sec

30 sec

154. What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Stateful Mode

VPN Routing Mode

Wire Mode

Stateless Mode

155. The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?

field_name:string

name field:string

name_field:string

field name:string

156. Which 3 types of tracking are available for Threat Prevention Policy?

SMS Alert, Log, SNMP alert

Syslog, None, User-defined scripts

None, Log, Syslog

Alert, SNMP trap, Mail

157. Which TCP-port does CPM process listen to?

18191

18190

8983

19009

158. Which is NOT an example of a Check Point API?

Gateway API

Management API

OPSEC SDK

Threat Prevention API

159. Joey want to configure NTP on R80 Security Management Server. He decided to do this via WebUI .

What is the correct address to access the Web UI for Gaia platform via browser?

https://<Device_IP_Adress>

http://<Device IP_Address>:443

https://<Device_IP_Address>:10000

https://<Device_IP_Address>:4434

160. What solution is Multi-queue intended to provide?

Improve the efficiency of traffic handling by SecureXL SNDs

Reduce the confusion for traffic capturing in FW Monitor

Improve the efficiency of CoreXL Kernel Instances

Reduce the performance of network interfaces

Page 9 of 10

161. To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:

fw ctl Dyn_Dispatch on

fw ctl Dyn_Dispatch enable

fw ctl multik set_mode 4

fw ctl multik set_mode 1

162. How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

By dropping traffic from websites identified through ThreatCloud Verification and URL Caching

By dropping traffic that is not proven to be from clean websites in the URL Filtering blade

By allowing traffic from websites that are known to run Antivirus Software on servers regularly

By matching logs against ThreatCloud information about the reputation of the website

163. Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Dynamic ID

RADIUS

Username and Password

Certificate

164. Packet acceleration (SecureXL) identifies connections by several attributes- Which of the attributes is NOT used for identifying connection?

Source Address

Destination Address

TCP Acknowledgment Number

Source Port

165. You have enabled “Full Log” as a tracking option to a security rule. However, you are still not seeing any data type information .

What is the MOST likely reason?

Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database.

Data Awareness is not enabled.

Identity Awareness is not enabled.

Logs are arriving from Pre-R80 gateways.

166. SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

ping, traceroute, netstat, and route

ping, nslookup, Telnet, and route

ping, whois, nslookup, and Telnet

ping, traceroute, netstat, and nslookup

167. After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

cvpnd_restart

cvpnd restart

cvpnrestart

168. As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

That is used to deploy the mobile device as a generator of one-time passwords for authenticating to an RSA Authentication Manager.

Fill Layer4 VPN CSSL VPN that gives users network access to all mobile applications.

Full Layer3 VPN CIPSec VPN that gives users network access to all mobile applications.

You can make sure that documents are sent to the intended recipients only.

169. Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R80.X The Network Security Developer Team is having an issue testing the API with a newly deployed R80.X Security Management Server Aaron wants to confirm API services are working properly .

What should he do first?

Aaron should check API Server status with "fwm api status" from Expert mode If services are stopped, he should start them with "fwm api start".

Aaron should check API Server status with "cpapi status" from Expert mode. If services are stopped, he should start them with "cpapi start"

Aaron should check API Server status with "api status" from Expert mode If services are stopped, he should start them with "api start"

Aaron should check API Server status with "cpm api status" from Expert mode. If services are stopped, he should start them with "cpi api start".

170. The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Secure Internal Communication (SIC)

Restart Daemons if they fail

Transfers messages between Firewall processes

Pulls application monitoring status

171. Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic. However, in the Application Control policy layer, the default action is ______ all traffic.

Accept; redirect

Accept; drop

Redirect; drop

Drop; accept

172. Post-Automatic/Manual NAT rules

1, 2, 3, 4

1, 4, 2, 3

3, 1, 2, 4

4, 3, 1, 2

173. In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

fw ctl sdstat

fw ctl affinity Cl Ca Cr Cv

fw ctl multik stat

cpinfo

174. What is not a purpose of the deployment of Check Point API?

Execute an automated script to perform common tasks

Create a customized GUI Client for manipulating the objects database

Create products that use and enhance the Check Point solution

Integrate Check Point products with 3rd party solution

175. What is the default size of NAT table fwx_alloc?

20000

35000

25000

10000

176. How would you enable VMAC Mode in ClusterXL?

Cluster Object -> Edit -> ClusterXL and VRRP -> Use Virtual MAC

fw ctl set int vmac_mode 1

cphaconf vmac_mode set 1

Cluster Object -> Edit -> Cluster Members -> Edit -> Use Virtual MAC

177. In what way are SSL VPN and IPSec VPN different?

SSL VPN is using HTTPS in addition to IKE, whereas IPSec VPN is clientless

SSL VPN adds an extra VPN header to the packet, IPSec VPN does not

IPSec VPN does not support two factor authentication, SSL VPN does support this

IPSec VPN uses an additional virtual adapter; SSL VPN uses the client network adapter only.

178. Which statement is correct about the Sticky Decision Function?

It is not supported with either the Performance pack of a hardware based accelerator card

Does not support SPI’s when configured for Load Sharing

It is automatically disabled if the Mobile Access Software Blade is enabled on the cluster

It is not required L2TP traffic

179. What is true about the IPS-Blade?

In R80, IPS is managed by the Threat Prevention Policy

In R80, in the IPS Layer, the only three possible actions are Basic, Optimized and Strict

In R80, IPS Exceptions cannot be attached to “all rules”

In R80, the GeoPolicy Exceptions and the Threat Prevention Exceptions are the same

180. Session unique identifiers are passed to the web api using which http header option?

X-chkp-sid

Accept-Charset

Proxy-Authorization

Application

Page 10 of 10

181. Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

Application Control

Threat Emulation

Anti-Virus

Advanced Networking Blade

182. Which of these is an implicit MEP option?

Primary-backup

Source address based

Round robin

Load Sharing

Check Point Certified Security Expert 156-315.80 Real Dumps

Check Point Certified Security Expert 156-315.80 Real Dumps

Share this post

Leave a Reply Cancel reply

Related Posts