Download Free CheckPoint 156-315.81 Real Exam Questions Download
Latest CheckPoint 156-315.81 Real Exam Dumps PDF
NEW QUESTION # 216
Fill in the blank: A ________ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser.
- A. Direct access
- B. Clientless remote access
- C. Clientless direct access
- D. Client-based remote access
Answer: B
Explanation:
Explanation
A clientless remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. A clientless remote access VPN does not require any software installation or configuration on the user's device. Instead, it uses a web-based portal that acts as a proxy between the user and the corporate resources. The user can access web applications and services through the portal using a standard web browser that supports SSL/TLS encryption. The portal can also provide single sign-on (SSO) capabilities for SAML-enabled applications. A clientless remote access VPN is suitable for scenarios where users need to access mainly web-based resources from unmanaged devices or devices that cannot run VPN clients.
The other options are incorrect because:
A client-based remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by installing a VPN client software on the user's device. A client-based remote access VPN requires software installation and configuration on the user's device. It uses IPsec or SSL/TLS protocols to create a secure tunnel between the user's device and the VPN gateway. The user can access any type of resource through the tunnel using any application that supports TCP/IP protocols.
A client-based remote access VPN is suitable for scenarios where users need to access various types of resources from managed devices or devices that can run VPN clients.
A clientless direct access deployment is not a valid term for a VPN deployment. Direct access is a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols.
Direct access requires software installation and configuration on both the user's device and the direct access server.
A direct access deployment is not a term for a VPN deployment, but a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection.
Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user's device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user's device and the direct access server.
NEW QUESTION # 217
What must you do first if "fwm sic_reset" could not be completed?
- A. Reinitialize SIC on the security gateway then run "fw unloadlocal"
- B. Reset SIC from Smart Dashboard
- C. Change internal CA via cpconfig
- D. Cpstop then find keyword "certificate" in objects_5_0.C and delete the section
Answer: C
NEW QUESTION # 218
Which TCP-port does CPM process listen to?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
Explanation
The CPM process is the core process of the Security Management Server that handles all management operations. It listens to TCP-port 19009 by default.
NEW QUESTION # 219
When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:
- A. VoIP
- B. Threat Emulation
- C. QOS
- D. HTTPS
Answer: A
NEW QUESTION # 220
When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events. What is this setting called and what are you defining?
- A. Internal network(s) you are defining your networks
- B. Topology, and you are defining the Internal network
- C. Internal addresses you are defining the gateways
- D. Network, and defining your Class A space
Answer: A
Explanation:
Explanation
When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events. This setting is called Internal network(s) and you are defining your networks. You can specify one or more networks or IP addresses that are considered internal for SmartEvent.
This helps SmartEvent to determine the direction of the traffic (inbound, outbound, or internal) and generate events accordingly. References: [SmartEvent Administration Guide]
NEW QUESTION # 221
SmartEvent does NOT use which of the following procedures to identify events:
- A. Matching a log against local exclusions
- B. Matching a log against each event definition
- C. Matching a log against global exclusions
- D. Create an event candidate
Answer: A
Explanation:
Explanation
Events are detected by the SmartEvent Correlation Unit. The Correlation Unit task is to scan logs for criteria that match an Event Definition. SmartEvent uses these procedures to identify events:
* Matching a Log Against Global Exclusions
* Matching a Log Against Each Event Definition
* Creating an Event Candidate
* When a Candidate Becomes an Event
References:
NEW QUESTION # 222
What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?
- A. VPN Routing Mode
- B. Stateless Mode
- C. Stateful Mode
- D. Wire Mode
Answer: D
Explanation:
Wire Mode is a VPN-1 NGX feature that enables VPN connections to successfully fail over, bypassing Security Gateway enforcement. This improves performance and reduces downtime. Based on a trusted source and destination, Wire Mode uses internal interfaces and VPN Communities to maintain a private and secure VPN session, without employing Stateful Inspection. Since Stateful Inspection no longer takes place, dynamic-routing protocols that do not survive state verification in non-Wire Mode configurations can now be deployed. The VPN connection is no different from any other connections along a dedicated wire, thus the meaning of "Wire Mode".
NEW QUESTION # 223
Security Checkup Summary can be easily conducted within:
- A. Views
- B. Reports
- C. Summary
- D. Checkups
Answer: A
NEW QUESTION # 224
The admin is connected via ssh lo the management server. He wants to run a mgmt_dl command but got a Error 404 message. To check the listening ports on the management he runs netstat with the results shown below. What can be the cause for the issue?
- A. The management permission in the user profile is mrssing. Go to SmartConsole / Management & Settings I Permissions & Administrators / Permission Profiles. Select the profile of the user and enable 'Management API Login' under Management Permissions
- B. The API didn't run on the default port check it with api status' and add '-port 4434' to the mgmt_clt command.
- C. The API is not running, the services shown by netstat are the gaia services. To start the API run 'api start'
- D. Wrong Management API Access setting^for Ihe client IP To correct it go to SmartConsole / Management & Settings / Blades / Management API and press "Advanced Settings..' and choose GUI clients or ALL IP's.
Answer: D
NEW QUESTION # 225
Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?
- A. Synchronized
- B. Never been synchronized
- C. Collision
- D. Lagging
Answer: C
NEW QUESTION # 226
Which command would disable a Cluster Member permanently?
- A. set clusterXL down-p
- B. cphaprob_admin down
- C. clusterXL_admin down
- D. clusterXL_admin down-p
Answer: D
Explanation:
Explanation
The clusterXL_admin down -p command disables a Cluster Member permanently, meaning that it will not rejoin the cluster even after a reboot. The other commands either disable a Cluster Member temporarily or are invalid. References: [ClusterXL Administration Guide]
NEW QUESTION # 227
By default, the R81 web API uses which content-type in its response?
- A. XML
- B. Text
- C. Java Script
- D. JSON
Answer: D
Explanation:
Explanation
By default, the R81 web API uses JSON as the content-type in its response. JSON stands for JavaScript Object Notation and is a lightweight data-interchange format that is easy to read and write. XML, Java Script, and Text are not the default content-types for the R81 web API. References: : Check Point Software, Getting Started, Web API; : JSON.org, Introducing JSON.
NEW QUESTION # 228 
You are the administrator for ABC Corp. You have logged into your R81 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.
What does this mean?
- A. This rule No. 6 has been marked for deletion in your Management session.
- B. This rule No. 6 has been marked for editing in your Management session.
- C. This rule No. 6 has been marked for deletion in another Management session.
- D. This rule No. 6 has been marked for editing in another Management session.
Answer: B
Explanation:
Explanation
You are the administrator for ABC Corp. You have logged into your R81 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.
This means that rule No.6 has been marked for editing in your Management session. In R81, every administrator works in a session that is independent of other administrators. Changes made by one administrator are not visible to others until they are published. When you edit a rule, it is marked with a pencil icon to indicate that it has been modified in your session. You can also lock a rule to prevent other administrators from editing it until you unlock it or publish your session. References: R81 Security Management Administration Guide, page 43.
NEW QUESTION # 229
Which of the following is an authentication method used for Identity Awareness?
- A. Captive Portal
- B. RSA
- C. PKI
- D. SSL
Answer: A
Explanation:
Explanation
Captive Portal is one of the authentication methods used for Identity Awareness, which is a feature of Check Point that enables you to identify users and apply security policy rules based on their identity. Captive Portal redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity.
The references are:
Machine Authentication & Identity Awareness - Check Point CheckMates
Check Point Certified Security Expert R81.20, slide 13
Check Point R81 Identity Awareness Administration Guide, page 9
NEW QUESTION # 230
In order for changes made to policy to be enforced by a Security Gateway, what action must an administrator perform?
- A. Save changes
- B. Install policy
- C. Install database
- D. Publish changes
Answer: B
Explanation:
Explanation
In order for changes made to policy to be enforced by a Security Gateway, an administrator must perform the action of installing policy. Installing policy is the process of transferring the policy package from the Security Management Server to the Security Gateway. Publishing changes is the process of saving changes to the database and making them available to other administrators. Saving changes is the process of saving changes to a session without publishing them2. References: Check Point R81 Security Management Guide
NEW QUESTION # 231
In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a response before the peer host is declared 'down', you would set the_________?
- A. life_sign_polling_interval
- B. life_sign_timeout
- C. life sign timeout
- D. life sign polling interval
Answer: B
Explanation:
Explanation
In Advanced Permanent Tunnel Configuration, the life_sign_timeout parameter sets the amount of time the tunnel test runs without a response before the peer host is declared 'down'. The life_sign_polling_interval parameter sets the interval between each tunnel test packet sent to the peer host.
Reference: https://sc1.checkpoint.com/documents/R77/CP_R77_VPN_AdminGuide/html_frameset.htm?topic=documents/R77/CP_R77_VPN_AdminGuide/14018 : Advanced Permanent Tunnel Configuration
NEW QUESTION # 232
Which Check Point feature enables application scanning and the detection?
- A. Application Library
- B. AppWiki
- C. Application Dictionary
- D. CPApp
Answer: B
Explanation:
Explanation
AppWiki is the Check Point feature that enables application scanning and the detection. AppWiki is an easy to use tool that lets you search and filter Check Point's Web 2.0 Applications Database to find out information about internet applications, including social network widgets; filter by a category, tag, or risk level; and search for a keyword or application1. AppWiki helps you to identify and control the applications on your network, and to apply granular policies based on the application type, risk, and characteristics1. AppWiki is integrated with the Check Point Application Control Software Blade, which provides the industry's strongest application security and identity control to organizations of all sizes1.
References: 1: AppWiki | Check Point Software
NEW QUESTION # 233
In R81.10 a new feature dynamic log distribution was added. What is this for?
Answer:
Explanation:
Configure the Security Gateway to distribute logs between multiple active Log Servers to support a better rate of Logs and Log Servers redundancy In case of a Management High Availability the management server stores the logs dynamically on the member with the most available disk space in /var/log Synchronize the log between the primary and secondary management server in case of a Management High Availability To save disk space in case of a firewall cluster local logs are distributed between the cluster members.
Explanation
https://resources.checkpoint.com/datasheet/certified-security-expert-ccse-r8120-course-overview Dynamic log distribution is a feature that allows you to configure the Security Gateway to distribute logs between multiple active Log Servers to support a better rate of Logs and Log Servers redundancy. This means that each log is sent to only one Log Server and the load is balanced between the primary Log Servers. If all the primary Log Servers are disconnected, the logs are distributed between the backup Log Servers. If no Log Servers are connected, the gateway writes the logs locally. This feature improves the performance and reliability of logging and reduces the network traffic and disk space consumption. You can enable this feature on the SmartConsole -> Gateways & Servers -> Logs -> Dynamic Log Distribution1.
The other options are incorrect because they do not describe the dynamic log distribution feature. Option B is wrong because the Management High Availability does not store the logs dynamically on the member with the most available disk space, but rather synchronizes the logs between the members using the cpd process2.
Option C is wrong because the dynamic log distribution feature does not synchronize the logs between the primary and secondary management server, but rather distributes the logs between the Log Servers. Option D is wrong because the dynamic log distribution feature does not save disk space in case of a firewall cluster, but rather distributes the logs between the Log Servers. The firewall cluster members do not store local logs, but rather send them to the Log Servers3.
NEW QUESTION # 234
Mobile Access Gateway can be configured as a reverse proxy for Internal Web Applications Reverse proxy users browse to a URL that is resolved to the Security Gateway IP address. Which of the following Check Point command is true for enabling the Reverse Proxy:
- A. ReverseCLIProxy
- B. ProxyReverseCLI
- C. ReverseProxy
- D. ReverseProxyCLI
Answer: C
Explanation:
Explanation
Mobile Access Gateway can be configured as a reverse proxy for internal web applications. Reverse proxy users browse to a URL that is resolved to the Security Gateway IP address. The Security Gateway then forwards the requests to the internal web servers and returns the responses to the users. To enable reverse proxy mode on the Mobile Access Gateway, the administrator needs to run the ReverseProxy command on the command line interface of the Security Gateway5. Therefore, the correct answer is C.
References: 5: Reverse Proxy Mode
NEW QUESTION # 235
An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server.
While configuring the VPN community to specify the pre-shared secret the administrator found that the check box to enable pre-shared secret and cannot be enabled.
Why does it not allow him to specify the pre-shared secret?
- A. Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS.
- B. The Security Gateways are pre-R75.40.
- C. Pre-shared can only be used while creating a VPN between a third party vendor and Check Point Security Gateway.
- D. IPsec VPN blade should be enabled on both Security Gateway.
Answer: A
Explanation:
Explanation
When two Security Gateways are managed by the same Security Management Server, they use certificate based authentication to establish a VPN tunnel. This is because the Security Management Server acts as an internal certificate authority (ICA) that can issue and revoke certificates for the Security Gateways. The Security Management Server also maintains a trust relationship with the Security Gateways, which is based on a one-time password (OTP) that is used to initialize secure internal communication (SIC). Therefore, there is no need to use a pre-shared secret for authentication between two Security Gateways managed by the same SMS.
NEW QUESTION # 236
Why would an administrator see the message below?
- A. A new Policy Package created on the Gateway and transferred to the Management will be overwritten by the Policy Package currently on the Gateway but can be restored from a periodic backup on the Gateway.
- B. A new Policy Package created on both the Management and Gateway will be deleted and must be backed up first before proceeding.
- C. A new Policy Package created on the Management is going to be installed to the existing Gateway.
- D. A new Policy Package created on the Gateway is going to be installed on the existing Management.
Answer: C
Explanation:
Explanation
A Policy Package is a set of rules and settings that define how a Security Gateway enforces security on traffic that passes through it. A Policy Package can be created on either the Management Server or the Security Gateway, but it must be installed on both to take effect. When a new Policy Package is created on the Management Server, it must be installed on an existing Security Gateway that has a different Policy Package installed. The message below warns the administrator that installing a new Policy Package will overwrite the existing one on the Security Gateway.
https://www.bing.com/images/blob?bcid=qMoRhR0dzSkGmg
The message also advises the administrator to back up their existing configuration before proceeding with the installation.
NEW QUESTION # 237
In R81, where do you manage your Mobile Access Policy?
- A. Through the Mobile Console
- B. Access Control Policy
- C. From the Dedicated Mobility Tab
- D. Shared Gateways Policy
Answer: A
Explanation:
Explanation
In R81, you manage your Mobile Access Policy from the Mobile Console. The Mobile Console is a separate web-based interface that allows you to configure and monitor Mobile Access features, such as VPN, portal, applications, users, devices, and certificates. The Mobile Console can be accessed from any browser by entering https://<Management_Server_IP>/mobileconsole. References: [Mobile Console]
NEW QUESTION # 238
......
PDF (New 2024) Actual CheckPoint 156-315.81 Exam Questions: https://testinsides.vcedumps.com/156-315.81-examcollection.html
