Prepare Confidently for the Check Point 156-215.80 Exam with Practice Questions

Question #1

Which of the following is NOT a valid option when configuring access for Captive Portal?

A. rom the Internet

B. hrough internal interfaces

C. hrough all interfaces

D. ccording to the Firewall Policy

View answer

Correct Answer: A

Question #2

Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?

A. nti-Virus

B. PS

C. nti-Spam

D. nti-bot

View answer

Correct Answer: B

Question #3

You have just installed your Gateway and want to analyze the packet size distribution of your traffic with SmartView Monitor. Unfortunately, you get the message:“There are no machines that contain Firewall Blade and SmartView Monitor”.What should you do to analyze the packet size distribution of your traffic? Give the BEST answer.

A. urchase the SmartView Monitor license for your Security Management Server

B. nable Monitoring on your Security Management Server

C. urchase the SmartView Monitor license for your Security Gateway

D. nable Monitoring on your Security Gateway

View answer

Correct Answer: D

Question #4

Each cluster has ____________interfaces.

A. ive

B. wo

C. hree

D. our

View answer

Correct Answer: C

Question #5

When launching SmartDashboard, what information is required to log into R77?

A. ser Name, Management Server IP, certificate fingerprint file

B. ser Name, Password, Management Server IP

C. assword, Management Server IP

D. assword, Management Server IP, LDAP Server IP

View answer

Correct Answer: B

Question #6

Which of the following is NOT a back up method?

A. ave backup

B. ystem backup

C. napshot

D. igrate

View answer

Correct Answer: A

Question #7

To install a brand new Check Point Cluster, the MegaCorp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster. Which type of cluster is it?

A. ull HA Cluster

B. igh Availability

C. tandalone

D. istributed

View answer

Correct Answer: B

Question #8

What are the three essential components of the Check Point Security Management Architecture?

A. martConsole, Security Management Server, Security Gateway

B. martConsole, SmartUpdate, Security Gateway

C. ecurity Management Server, Security Gateway, Command Line Interface

D. ebUI, SmartConsole, Security Gateway

View answer

Correct Answer: A

Question #9

Which limitation of CoreXL is overcome by using (mitigated by) Multi-Queue?

A. here is no traffic queue to be handled

B. everal NICs can use one traffic queue by one CPU

C. ach NIC has several traffic queues that are handled by multiple CPU cores

D. ach NIC has one traffic queue that is handled by one CPU

View answer

Correct Answer: C

Question #10

Which of these statements describes the Check Point ThreatCloud?

A. locks or limits usage of web applications

B. revents or controls access to web sites based on category

C. revents Cloud vulnerability exploits

D. worldwide collaborative security network

View answer

Correct Answer: D

Question #11

What are the three authentication methods for SIC?

A. asswords, Users, and standards-based SSL for the creation of secure channels

B. ertificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption

C. acket Filtering, certificates, and 3DES or AES128 for encryption

D. ertificates, Passwords, and Tokens

View answer

Correct Answer: B

Question #12

How Capsule Connect and Capsule Workspace differ?

A. apsule Connect provides a Layer3 VPN

B. apsule Workspace can provide access to any application

C. apsule Connect provides Business data isolation

D. apsule Connect does not require an installed application at client

View answer

Correct Answer: A

Question #13

What does ExternalZone represent in the presented rule?

A. he Internet

B. nterfaces that administrator has defined to be part of External Security Zone

C. xternal interfaces on all security gateways

D. xternal interfaces of specific gateways

View answer

Correct Answer: B

Question #14

While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the correct order of steps needed to set up the block?1) Select Active Mode tab in SmartView Tracker.2) Select Tools > Block Intruder.3) Select Log Viewing tab in SmartView Tracker.4) Set Blocking Timeout value to 60 minutes.5) Highlight connection that should be blocked.

A. , 2, 5, 4

B. , 2, 5, 4

C. , 5, 2, 4

D. , 5, 2, 4

View answer

Correct Answer: C

Question #15

Choose what BEST describes a Session.

A. tarts when an Administrator publishes all the changes made on SmartConsole

B. tarts when an Administrator logs in to the Security Management Server through SmartConsole and ends when it is published

C. essions ends when policy is pushed to the Security Gateway

D. essions locks the policy package for editing

View answer

Correct Answer: B

Question #16

What is the Manual Client Authentication TELNET port?

A. 3

B. 64

C. 00

D. 59

View answer

Correct Answer: D

Question #17

How many users can have read/write access in Gaia at one time?

A. nfinite

B. ne

C. hree

D. wo

View answer

Correct Answer: B

Question #18

Which of the following is NOT a license activation method?

A. martConsole Wizard

B. nline Activation

C. icense Activation Wizard

D. ffline Activation

View answer

Correct Answer: A

Question #19

Which command can you use to verify the number of active concurrent connections?

A. w conn all

B. w ctl pst pstat

C. how all connections

D. how connections

View answer

Correct Answer: B

Question #20

The organization's security manager wishes to back up just the Gaia operating system parameters such as interface details, Static routes and Proxy ARP entries. Which command would be BEST suited to accomplish this task?

A. ave configuration

B. ackup

C. igrate export

D. pgrade export

View answer

Correct Answer: B

Question #21

Anti-Spoofing is typically set up on which object type?

A. ecurity Gateway

B. ost

C. ecurity Management object

D. etwork

View answer

Correct Answer: A

Question #22

In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

A. ecurity Policies

B. ogs and Monitor

C. anage and Settings

D. ateway and Servers

View answer

Correct Answer: C

Question #23

Which of the following is NOT an alert option?

A. NMP

B. igh alert

C. ail

D. ser defined alert

View answer

Correct Answer: B

Question #24

What is the default time length that Hit Count Data is kept?

A. month

B. weeks

C. 2 months

D. week

View answer

Correct Answer: A

Question #25

What is the purpose of Captive Portal?

A. t provides remote access to SmartConsole

B. t manages user permission in SmartConsole

C. t authenticates users, allowing them access to the Internet and corporate resources

D. t authenticates users, allowing them access to the Gaia OS

View answer

Correct Answer: C

Question #26

You are going to upgrade from R77 to R80. Before the upgrade, you want to back up the system so that, if there are any problems, you can easily restore to the old version with all configuration and management files intact. What is the BEST backup method in this scenario?

A. ackup

B. atabase Revision

C. napshot

D. igrate export

View answer

Correct Answer: C

Question #27

SandBlast has several functional components that work together to ensure that attacks are prevented in real- time. Which the following is NOT part of the SandBlast component?

A. hreat Emulation

B. obile Access

C. ail Transfer Agent

D. hreat Cloud

View answer

Correct Answer: C

Question #28

AdminA and AdminB are both logged in on SmartConsole. What does it mean if AdminB sees a lock icon on a rule? Choose the BEST answer.

A. ule is locked by AdminA, because the save button has not been pressed

B. ule is locked by AdminA, because the rule is currently being edited

C. ule is locked by AdminA, and will be made it available if the session is published

D. ule is locked by AdminA, and if the session is saved, the rule will be made available

View answer

Correct Answer: C

Question #29

John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19.John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The cu

A. ohn should lock and unlock his computer

B. nvestigate this as a network connectivity issue

C. he access should be changed to authenticate the user instead of the PC

D. ohn should install the Identity Awareness Agent

View answer

Correct Answer: C

Question #30

There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?

A. sing Web Services

B. sing Mgmt_cli tool

C. sing CLISH

D. sing SmartConsole GUI console

View answer

Correct Answer: C

Question #31

Which is the correct order of a log flow processed by SmartEvent components:

A. irewall > Correlation Unit > Log Server > SmartEvent Server Database > SmartEvent Client

B. irewall > SmartEvent Server Database > Correlation Unit > Log Server > SmartEvent Client

C. irewall > Log Server > SmartEvent Server Database > Correlation Unit > SmartEvent Client

D. irewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client

View answer

Correct Answer: D

Question #32

What are the three conflict resolution rules in the Threat Prevention Policy Layers?

A. onflict on action, conflict on exception, and conflict on settings

B. onflict on scope, conflict on settings, and conflict on exception

C. onflict on settings, conflict on address, and conflict on exception

D. onflict on action, conflict on destination, and conflict on settings

View answer

Correct Answer: C

Question #33

Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?

A. irewall

B. pplication Control

C. nti-spam and Email Security

D. ntivirus

View answer

Correct Answer: D

Question #34

Gaia can be configured using the __________or ______________ ____________.

A. aiaUI; command line interface

B. ebUI; Gaia Interface

C. ommand line interface; WebUI

D. aia Interface; GaiaUI

View answer

Correct Answer: C

Question #35

Which of the following technologies extracts detailed information from packets and stores that information in state tables?

A. NSPECT Engine

B. tateful Inspection

C. acket Filtering

D. pplication Layer Firewall

View answer

Correct Answer: B

Question #36

The R80 utility fw monitor is used to troubleshoot ______________

A. ser data base corruption

B. DAP conflicts

C. raffic issues

D. hase two key negotiation

View answer

Correct Answer: C

Question #37

Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

A. gmt_cli add-host “Server_1” ip_address “10

B. gmt_cli add host name “Server_1” ip_address “10

C. gmt_cli add object-host “Server_1” ip_address “10

D. gmt_cli add object “Server_1” ip_address “10

View answer

Correct Answer: A

Question #38

John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, gateway policy permits access only from Join's desktop which is assigned an IP address 10.0.0.19 via DHCP.John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but the limits him to operating it only from his desk. The curr

A. ohn should install the identity Awareness Agent

B. he firewall admin should install the Security Policy

C. ohn should lock and unlock the computer

D. nvestigate this as a network connectivity issue

View answer

Correct Answer: C

Question #39

The fw monitor utility is used to troubleshoot which of the following problems?

A. hase two key negotiation

B. ddress translation

C. og Consolidation Engine

D. ser data base corruption

View answer

Correct Answer: B

Question #40

You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

A. liminate all possible contradictory rules such as the Stealth or Cleanup rules

B. reate a separate Security Policy package for each remote Security Gateway

C. reate network objects that restrict all applicable rules to only certain networks

D. un separate SmartConsole instances to login and configure each Security Gateway directly

View answer

Correct Answer: B

Question #41

Which of the following is NOT an authentication scheme used for accounts created through SmartConsole?

A. ecurity questions

B. heck Point password

C. ecurID

D. ADIUS

View answer

Correct Answer: A

Question #42

You are the senior Firewall administrator for Alpha Corp, and have recently returned from a training course on Check Point's new advanced R80 management platform. You are presenting an in-house overview of the new features of Check Point R80 Management to the other administrators in Alpha Corp. How will you describe the new “Publish” button in R80 Management Console?

A. he Publish button takes any changes an administrator has made in their management session, publishes a copy to the Check Point of R80, and then saves it to the R80 database

B. he Publish button takes any changes an administrator has made in their management session and publishes a copy to the Check Point Cloud of R80 and but does not save it to the R80

C. he Publish button saves any changes an administrator has made in their management session

D. he Publish button saves any changes an administrator has made in their management session

View answer

Correct Answer: C

Question #43

The technical-support department has a requirement to access an intranet server. When configuring a User Authentication rule to achieve this, which of the following should you remember?

A. ou can only use the rule for Telnet, FTP, SMPT, and rlogin services

B. he Security Gateway first checks if there is any rule that does not require authentication for this type of connection before invoking the Authentication Security Server

C. nce a user is first authenticated, the user will not be prompted for authentication again until logging out

D. ou can limit the authentication attempts in the User Properties' Authentication tab

View answer

Correct Answer: B

Question #44

Examine the following Rule Base. What can we infer about the recent changes made to the Rule Base?

A. ule 7 was created by the 'admin' administrator in the current session

B. changes have been made by administrators since the last policy installation

C. e rules 1, 5 and 6 cannot be edited by the 'admin' administrator

D. ule 1 and object webserver are locked by another administrator

View answer

Correct Answer: D

Question #45

Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

A. o satellites through center only

B. o center only

C. o center and to other satellites through center

D. o center, or through the center to other satellites, to internet and other VPN targets

View answer

Correct Answer: D

Question #46

Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

A. ne machine, but it needs to be installed using SecurePlatform for compatibility purposes

B. ne machine

C. wo machines

D. hree machines

View answer

Correct Answer: C

Question #47

Which policy type has its own Exceptions section?

A. hread Prevention

B. ccess Control

C. hreat Emulation

D. esktop Security

View answer

Correct Answer: A

Question #48

Which of the following are available SmartConsole clients which can be installed from the R77 Windows CD? Read all answers and select the most complete and valid list.

A. martView Tracker, SmartDashboard, CPINFO, SmartUpdate, SmartView Status

B. martView Tracker, SmartDashboard, SmartLSM, SmartView Monitor

C. martView Tracker, CPINFO, SmartUpdate

D. ecurity Policy Editor, Log Viewer, Real Time Monitor GUI

View answer

Correct Answer: C

Question #49

Which of the following is NOT a component of a Distinguished Name?

A. rganizational Unit

B. ountry

C. ommon Name

D. ser container

View answer

Correct Answer: D

Question #50

Where do we need to reset the SIC on a gateway object?

A. martDashboard > Edit Gateway Object > General Properties > Communication

B. martUpdate > Edit Security Management Server Object > SIC

C. martUpdate > Edit Gateway Object > Communication

D. martDashboard > Edit Security Management Server Object > SIC

View answer

Correct Answer: A

Question #51

What is the default shell of Gaia CLI?

A. erpetual and Trial

B. lug-and-play (Trial) and Evaluation

C. ubscription and Perpetual

D. valuation and Subscription

View answer

Correct Answer: B

Question #52

The R80 feature ____________ permits blocking specific IP addresses for a specified time period.

A. lock Port Overflow

B. ocal Interface Spoofing

C. uspicious Activity Monitoring

D. daptive Threat Prevention

View answer

Correct Answer: C

Question #53

Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

A. he rule base can be built of layers, each containing a set of the security rules

B. imits the upload and download throughput for streaming media in the company to 1 Gbps

C. ime object to a rule to make the rule active only during specified times

D. ub Policies are sets of rules that can be created and attached to specific rules

View answer

Correct Answer: D

Question #54

What are the two types of address translation rules?

A. ranslated packet and untranslated packet

B. ntranslated packet and manipulated packet

C. anipulated packet and original packet

D. riginal packet and translated packet

View answer

Correct Answer: D

Question #55

Packages and licenses are loaded from all of these sources EXCEPT

A. ownload Center Web site

B. serUpdate

C. ser Center

D. heck Point DVD

View answer

Correct Answer: B

Question #56

You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the right protections in place. Check Point has been selected for the security vendor. Which Check Point products protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users

A. PS and Application Control

B. PS, anti-virus and anti-bot

C. PS, anti-virus and e-mail security

D. andBlast

View answer

Correct Answer: D

Question #57

How many packets does the IKE exchange use for Phase 1 Main Mode?

A. 2

B.

C.

D.

View answer

Correct Answer: D

Question #58

Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

A. o to clash-Run cpstop | Run cpstart

B. o to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway

C. dministrator does not need to perform any task

D. o to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway | Install Security Policy

View answer

Correct Answer: B

Question #59

Using ClusterXL, what statement is true about the Sticky Decision Function?

A. an only be changed for Load Sharing implementations

B. ll connections are processed and synchronized by the pivot

C. s configured using cpconfig

D. s only relevant when using SecureXL

View answer

Correct Answer: A

Question #60

You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

A. group with generic user

B. ll users

C. DAP Account Unit Group

D. nternal user Group

View answer

Correct Answer: A

Question #61

You are unable to login to SmartConsole. You login to the management server and run #cpwd_admin list with the following output:What reason could possibly BEST explain why you are unable to connect to SmartConsole?

A. PD is down

B. VR is down

C. PM and FWM are down

D. PSM is down

View answer

Correct Answer: C

Question #62

Which directory holds the SmartLog index files by default?

A. SMARTLOGDIR/data

B. SMARTLOG/dir

C. FWDIR/smartlog

D. FWDIR/log

View answer

Correct Answer: A

Question #63

Vanessa is firewall administrator in her company; her company is using Check Point firewalls on central and remote locations, which are managed centrally by R80 Security Management Server. One central location has an installed R77.30 Gateway on Open server. Remote location is using Check Point UTM-1 570 series appliance with R71. Which encryption is used in Secure Internal Communication (SIC) between central management and firewall on each location?

A. n central firewall AES128 encryption is used for SIC, on Remote firewall 3DES encryption is used for SIC

B. n both firewalls, the same encryption is used for SIC

C. he Firewall Administrator can choose which encryption suite will be used by SI

D. n central firewall AES256 encryption is used for SIC, on Remote firewall AES128 encryption is used for SIC

View answer

Correct Answer: A

Question #64

What is the appropriate default Gaia Portal address?

A. TTP://[IPADDRESS]

B. TTPS://[IPADDRESS]:8080

C. TTPS://[IPADDRESS]:4434

D. TTPS://[IPADDRESS]

View answer

Correct Answer: D

Question #65

How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

A. nstall appliance TE250X on SpanPort on LAN switch in MTA mode

B. nstall appliance TE250X in standalone mode and setup MTA

C. ou can utilize only Check Point Cloud Services for this scenario

D. t is not possible, always Check Point SGW is needed to forward emails to SandBlast appliance

View answer

Correct Answer: C

Question #66

In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?

A. ule 0

B. lank field under Rule Number

C. ule 1

D. leanup Rule

View answer

Correct Answer: A

Question #67

Which of the following commands can be used to remove site-to-site IPSEC Security Associations (SA)?

A. pn tu

B. pn ipsec remove -l

C. pn debug ipsec

D. w ipsec tu

View answer

Correct Answer: A

Question #68

If there are two administrators logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available to other administrators?

A. ublish or discard the session

B. evert the session

C. ave and install the Policy

D. elete older versions of database

View answer

Correct Answer: A

Question #69

Why would an administrator see the message below?

A. new Policy Package created on both the Management and Gateway will be deleted and must be backed up first before proceeding

B. new Policy Package created on the Management is going to be installed to the existing Gateway

C. new Policy Package created on the Gateway is going to be installed on the existing Management

D. new Policy Package created on the Gateway and transferred to the Management will be overwritten by the Policy Package currently on the Gateway but can be restored from a periodic backup on the Gateway

View answer

Correct Answer: B

Question #70

Please choose correct command syntax to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI?

A. ost name myHost12 ip-address 10

B. gmt add host name ip-address 10

C. dd host name emailserver1 ip-address 10

D. gmt add host name emailserver1 ip-address 10

View answer

Correct Answer: C

Question #71

Where would an administrator enable Implied Rules logging?

A. n Smart Log Rules View

B. n SmartDashboard on each rule

C. n Global Properties under Firewall

D. n Global Properties under log and alert

View answer

Correct Answer: B

Question #72

What happens if the identity of a user is known?

A. f the user credentials do not match an Access Role, the traffic is automatically dropped

B. f the user credentials do not match an Access Role, the system displays a sandbox

C. f the user credentials do not match an Access Role, the gateway moves onto the next rule

D. f the user credentials do not match an Access Role, the system displays the Captive Portal

View answer

Correct Answer: C

Question #73

Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

A. ource Address

B. estination Address

C. CP Acknowledgment Number

D. ource Port

View answer

Correct Answer: C

Question #74

What is the potential downside or drawback to choosing the Standalone deployment option instead of the Distributed deployment option?

A. egrades performance as the Security Policy grows in size

B. equires additional Check Point appliances

C. equires additional software subscription

D. ncreases cost

View answer

Correct Answer: A

Question #75

Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e- mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links. Which component of SandBlast protection is her company using on a Gateway?

A. andBlast Threat Emulation

B. andBlast Agent

C. heck Point Protect

D. andBlast Threat Extraction

View answer

Correct Answer: D

Question #76

Your boss wants you to closely monitor an employee suspected of transferring company secrets to the competition. The IT department discovered the suspect installed a WinSCP client in order to use encrypted communication. Which of the following methods is BEST to accomplish this task?

A. se SmartView Tracker to follow his actions by filtering log entries that feature the WinSCP destination port

B. se SmartDashboard to add a rule in the firewall Rule Base that matches his IP address, and those of potential targets and suspicious protocols

C. atch his IP in SmartView Monitor by setting an alert action to any packet that matches your Rule Base and his IP address for inbound and outbound traffic

D. end the suspect an email with a keylogging Trojan attached, to get direct information about his wrongdoings

View answer

Correct Answer: A

Question #77

Which command is used to add users to or from existing roles?

A. dd rba user roles

B. dd rba user

C. dd user roles

D. dd user

View answer

Correct Answer: A

Question #78

As you review this Security Policy, what changes could you make to accommodate Rule 4?

A. emove the service HTTP from the column Service in Rule 4

B. odify the column VPN in Rule 2 to limit access to specific traffic

C. othing at all

D. odify the columns Source or Destination in Rule 4

View answer

Correct Answer: B

Question #79

Which Check Point software blade provides protection from zero-day and undiscovered threats?

A. irewall

B. hreat Emulation

C. pplication Control

D. hreat Extraction

View answer

Correct Answer: B

Question #80

Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?

A. reate a text-file with mgmt_cli script that creates all objects and policies

B. reate a text-file with Gaia CLI -commands in order to create all objects and policies

C. reate a text-file with DBEDIT script that creates all objects and policies

D. se Object Explorer in SmartConsole to create the objects and Manage Policies from the menu to create the policies

View answer

Correct Answer: A

Question #81

How do you configure an alert in SmartView Monitor?

A. n alert cannot be configured in SmartView Monitor

B. y choosing the Gateway, and Configure Thresholds

C. y right-clicking on the Gateway, and selecting Properties

D. y right-clicking on the Gateway, and selecting System Information

View answer

Correct Answer: B

Question #82

You manage a global network extending from your base in Chicago to Tokyo, Calcutta and Dallas. Management wants a report detailing the current software level of each Enterprise class Security Gateway. You plan to take the opportunity to create a proposal outline, listing the most cost-effective way to upgrade your Gateways. Which two SmartConsole applications will you use to create this report and outline?

A. martView Tracker and SmartView Monitor

B. martLSM and SmartUpdate

C. martDashboard and SmartView Tracker

D. martView Monitor and SmartUpdate

View answer

Correct Answer: D

Question #83

The command ______________ provides the most complete restoration of an R80 configuration.

A. pgrade_import

B. pconfig

C. wm dbimport -p

D. pinfo -recover

View answer

Correct Answer: A

Question #84

Which command can you use to enable or disable multi-queue per interface?

A. pmq set

B. pmqueue set

C. pmq config

D. et cpmq enable

View answer

Correct Answer: A

Question #85

Which is a suitable command to check whether Drop Templates are activated or not?

A. w ctl get int activate_drop_templates

B. waccel stat

C. waccel stats

D. w ctl templates –d

View answer

Correct Answer: B

Question #86

Where does the security administrator activate Identity Awareness within SmartDashboard?

A. ateway Object > General Properties

B. ecurity Management Server > Identity Awareness

C. olicy > Global Properties > Identity Awareness

D. DAP Server Object > General Properties

View answer

Correct Answer: A

Question #87

A ______________ is used by a VPN gateway to send traffic as if it was a physical interface.

A. PN Tunnel Interface

B. PN community

C. PN router

D. PN interface

View answer

Correct Answer: A

Question #88

Which SmartConsole component can Administrators use to track changes to the Rule Base?

A. ebUI

B. martView Tracker

C. martView Monitor

D. martReporter

View answer

Correct Answer: B

Question #89

You find a suspicious connection from a problematic host. You decide that you want to block everything from that whole network, not just the problematic host. You want to block this for an hour while you investigate further, but you do not want to add any rules to the Rule Base. How do you achieve this?

A. se dbedit to script the addition of a rule directly into the Rule Bases_5_0

B. elect Block intruder from the Tools menu in SmartView Tracker

C. reate a Suspicious Activity Rule in Smart Monitor

D. dd a temporary rule using SmartDashboard and select hide rule

View answer

Correct Answer: C

Question #90

What are the two high availability modes?

A. oad Sharing and Legacy

B. raditional and New

C. ctive and Standby

D. ew and Legacy

View answer

Correct Answer: D

Question #91

Which the following type of authentication on Mobile Access can NOT be used as the first authentication method?

A. ynamic ID

B. ADIUS

C. sername and Password

D. ertificate

View answer

Correct Answer: A

Question #92

Which of the following is NOT an option for internal network definition of Anti-spoofing?

A. pecific – derived from a selected object

B. oute-based – derived from gateway routing table

C. etwork defined by the interface IP and Net Mask

D. ot-defined

View answer

Correct Answer: B

Question #93

The most important part of a site-to-site VPN deployment is the ______________ .

A. nternet

B. emote users

C. ncrypted VPN tunnel

D. PN gateways

View answer

Correct Answer: C

Question #94

An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets o

A. he setting Log does not capture this level of detail for GRE

B. he log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt

C. he Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker

D. he Log Server is failing to log GRE traffic properly because it is VPN traffic

View answer

Correct Answer: C

Question #95

Which NAT rules are prioritized first?

A. ost-Automatic/Manual NAT rules

B. anual/Pre-Automatic NAT

C. utomatic Hide NAT

D. utomatic Static NAT

View answer

Correct Answer: B

Question #96

What must a Security Administrator do to comply with a management requirement to log all traffic accepted through the perimeter Security Gateway?

A. n Global Properties > Reporting Tools check the box Enable tracking all rules (including rules marked as None in the Track column)

B. nstall the View Implicit Rules package using SmartUpdate

C. efine two log servers on the R77 Gateway object

D. heck the Log Implied Rules Globally box on the R77 Gateway object

View answer

Correct Answer: A

Question #97

As a Security Administrator, you must refresh the Client Authentication authorized time-out every time a new user connection is authorized. How do you do this? Enable the Refreshable Timeout setting:

A. n the user object's Authentication screen

B. n the Gateway object's Authentication screen

C. n the Limit tab of the Client Authentication Action Properties screen

D. n the Global Properties Authentication screen

View answer

Correct Answer: C

Question #98

Which default Gaia user has full read/write access?

A. onitor

B. ltuser

C. dministrator

D. uperuser

View answer

Correct Answer: C

Question #99

The ____________ collects logs and sends them to the _____________.

A. og server; security management server

B. og server; Security Gateway

C. ecurity management server; Security Gateway

D. ecurity Gateways; log server

View answer

Correct Answer: D

Question #100

When using GAiA, it might be necessary to temporarily change the MAC address of the interface eth 0 to 00:0C:29:12:34:56. After restarting the network the old MAC address should be active. How do you configure this change?

A. s expert user, issue these commands: # IP link set eth0 down # IP link set eth0 addr 00:0C:29:12:34:56 # IP link set eth0 up

B. dit the file /etc/sysconfig/netconf

C. s expert user, issue the command:# IP link set eth0 addr 00:0C:29:12:34:56

D. pen the WebUI, select Network > Connections > eth0

View answer

Correct Answer: C

Question #101

The Gaia operating system supports which routing protocols?

A. GP, OSPF, RIP

B. GP, OSPF, EIGRP, PIM, IGMP

C. GP, OSPF, RIP, PIM, IGMP

D. GP, OSPF, RIP, EIGRP

View answer

Correct Answer: A

Question #102

Which command is used to obtain the configuration lock in Gaia?

A. ock database override

B. nlock database override

C. nlock database lock

D. ock database user

View answer

Correct Answer: A

Question #103

Which rule is responsible for the user authentication failure?

A. ule 4

B. ule 6

C. ule 3

D. ule 5

View answer

Correct Answer: C

Question #104

Which utility shows the security gateway general system information statistics like operating system information and resource usage, and individual software blade statistics of VPN, Identity Awareness and DLP?

A. pconfig

B. w ctl pstat

C. pview

D. w ctl multik stat

View answer

Correct Answer: C

Question #105

The Application Layer Firewalls inspect traffic through the ___________layer(s) of the TCP/IP model and up to and including the_____________ layer.

A. ower; Application

B. irst two; Internet

C. irst two; Transport

D. pper; Application

View answer

Correct Answer: A

Question #106

Review the following screenshot and select the BEST answer.

A. ata Center Layer is an inline layer in the Access Control Policy

B. y default all layers are shared with all policies

C. f a connection is dropped in Network Layer, it will not be matched against the rules in Data Center Layer

D. f a connection is accepted in Network-layer, it will not be matched against the rules in Data Center Layer

View answer

Correct Answer: C

Question #107

With the User Directory Software Blade, you can create R80 user definitions on a(an) ________Server.

A. T domain

B. MTP

C. DAP

D. ecurID

View answer

Correct Answer: C

Question #108

Which of the following is NOT an attribute of packer acceleration?

A. ource address

B. rotocol

C. estination port

D. pplication Awareness

View answer

Correct Answer: D

Question #109

What are types of Check Point APIs available currently as part of R80.10 code?

A. ecurity Gateway API, Management API, Threat Prevention API and Identity Awareness Web Services API

B. anagement API, Threat Prevention API, Identity Awareness Web Services API and OPSEC SDK API

C. SE API, OPSEC SDK API, Threat Prevention API and Policy Editor API

D. PMI API, Management API, Threat Prevention API and Identity Awareness Web Services API

View answer

Correct Answer: B

Question #110

Which of the following is NOT a SecureXL traffic flow?

A. edium Path

B. ccelerated Path

C. igh Priority Path

D. low Path

View answer

Correct Answer: C

Question #111

Mesh and Star are two types of VPN topologies. Which statement below is TRUE about these types of communities?

A. star community requires Check Point gateways, as it is a Check Point proprietary technology

B. n a star community, satellite gateways cannot communicate with each other

C. n a mesh community, member gateways cannot communicate directly with each other

D. n a mesh community, all members can create a tunnel with any other member

View answer

Correct Answer: D

Question #112

The Administrator wishes to update IPS protections from SmartConsole by clicking on the option “Update Now” under the Updates tab in Threat Tools. Which device requires internet access for the update to work?

A. ecurity Gateway only

B. nly the device where SmartConsole is installed

C. nly the Security Management Server

D. ither the Security Management Server or device where SmartConsole is installed

View answer

Correct Answer: B

Question #113

Which tool CANNOT be launched from SmartUpdate R77?

A. P Appliance Voyager

B. napshot

C. AiA WebUI

D. pinfo

View answer

Correct Answer: B

Question #114

What port is used for delivering logs from the gateway to the management server?

A. ort 258

B. ort 18209

C. ort 257

D. ort 981

View answer

Correct Answer: C

Question #115

The Security Gateway is installed on GAiA R80. The default port for the WEB User Interface is ______________ .

A. CP 18211

B. CP 257

C. CP 4433

D. CP 443

View answer

Correct Answer: D

Question #116

What action can be performed from SmartUpdate R77?

A. pgrade_export

B. w stat -1

C. pinfo

D. emote_uninstall_verifier

View answer

Correct Answer: C

Question #117

Match the following commands to their correct function. Each command has one function only listed.

A. 1>F6; C2>F4; C3>F2; C4>F5

B. 1>F2; C2>F1; C3>F6; C4>F4

C. 1>F2; C2>F4; C3>F1; C4>F5

D. 1>F4; C2>F6; C3>F3; C4>F5

View answer

Correct Answer: A

Question #118

What is the default method for destination NAT?

A. estination side

B. ource side

C. erver side

D. lient side

View answer

Correct Answer: D

Question #119

Which of the following is NOT a set of Regulatory Requirements related to Information Security?

A. SO 37001

B. arbanes Oxley (SOX)

C. IPAA

D. CI

View answer

Correct Answer: A

Question #120

What is NOT an advantage of Packet Filtering?

A. ow Security and No Screening above Network Layer

B. pplication Independence

C. igh Performance

D. calability

View answer

Correct Answer: A

Question #121

When defining QoS global properties, which option below is not valid?

A. eight

B. uthenticated timeout

C. chedule

D. ate

View answer

Correct Answer: C

Question #122

What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.

A. earch detailed is missing the subnet mask

B. here is no object on the database with that name or that IP address

C. here is no object on the database with that IP address

D. bject does not have a NAT IP address

View answer

Correct Answer: B

Question #123

In which deployment is the security management server and Security Gateway installed on the same appliance?

A. ridge Mode

B. emote

C. tandalone

D. istributed

View answer

Correct Answer: C

Question #124

Which of these components does NOT require a Security Gateway R77 license?

A. ecurity Management Server

B. heck Point Gateway

C. martConsole

D. martUpdate upgrading/patching

View answer

Correct Answer: C

Question #125

In what way are SSL VPN and IPSec VPN different?

A. SL VPN is using HTTPS in addition to IKE, whereas IPSec VPN is clientless

B. SL VPN adds an extra VPN header to the packet, IPSec VPN does not

C. PSec VPN does not support two factor authentication, SSL VPN does support this

D. PSec VPN uses an additional virtual adapter, SSL VPN uses the client network adapter only

View answer

Correct Answer: D

Question #126

When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

A. one, Security Management Server would be installed by itself

B. martConsole

C. ecureClient

D. ecurity Gateway

View answer

Correct Answer: D

Question #127

Administrator Kofi has just made some changes on his Management Server and then clicks on the Publish button in SmartConsole but then gets the error message shown in the screenshot below.Where can the administrator check for more information on these errors?

A. he Log and Monitor section in SmartConsole

B. he Validations section in SmartConsole

C. he Objects section in SmartConsole

D. he Policies section in SmartConsole

View answer

Correct Answer: B

Question #128

When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?

A. f the Action is Accept, the gateway allows the packet to pass through the gateway

B. f the Action is Drop, the gateway continues to check rules in the next Policy Layer down

C. f the Action is Accept, the gateway continues to check rules in the next Policy Layer down

D. f the Action is Drop, the gateway applies the Implicit Clean-up Rule for that Policy Layer

View answer

Correct Answer: C

Question #129

Choose the SmartLog property that is TRUE.

A. martLog has been an option since release R71

B. martLog is not a Check Point product

C. martLog and SmartView Tracker are mutually exclusive

D. martLog is a client of SmartConsole that enables enterprises to centrally track log records and security activity with Google-like search

View answer

Correct Answer: D

Question #130

The tool ___________ generates an R80 Security Gateway configuration report.

A. nfoCP

B. nfoview

C. pinfo

D. w cpinfo

View answer

Correct Answer: C

Question #131

The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic method. How many times per day will CPUSE agent check for hotfixes and automatically download them?

A. ix times per day

B. even times per day

C. very two hours

D. very three hours

View answer

Correct Answer: D

Question #132

Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256 for IKE phase 2. Why is this a problematic setup?

A. he two algorithms do not have the same key length and so don't work together

B. ll is fine as the longest key length has been chosen for encrypting the data and a shorter key length for higher performance for setting up the tunnel

C. nly 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in phase 2 only costs performance and does not add security due to a shorter key in phase 1

D. ll is fine and can be used as is

View answer

Correct Answer: C

Question #133

How do you configure the Security Policy to provide uses access to the Captive Portal through an external (Internet) interface?

A. hange the gateway settings to allow Captive Portal access via an external interface

B. o action is necessary

C. hange the Identity Awareness settings under Global Properties to allow Captive Policy access on all interfaces

D. hange the Identity Awareness settings under Global Properties to allow Captive Policy access for an external interface

View answer

Correct Answer: A

Question #134

Provide very wide coverage for all products and protocols, with noticeable performance impact.How could you tune the profile in order to lower the CPU load still maintaining security at good level?

A. et High Confidence to Low and Low Confidence to Inactive

B. et the Performance Impact to Medium or lower

C. he problem is not with the Threat Prevention Profile

D. et the Performance Impact to Very Low Confidence to Prevent

View answer

Correct Answer: B

Question #135

Which policy type is used to enforce bandwidth and traffic control rules?

A. hreat Emulation

B. ccess Control

C. oS

D. hreat Prevention

View answer

Correct Answer: C

Question #136

What port is used for communication to the User Center with SmartUpdate?

A. PMI 200

B. CP 8080

C. TTP 80

D. TTPS 443

View answer

Correct Answer: D

Question #137

Review the rules. Assume domain UDP is enabled in the implied rules.What happens when a user from the internal network tries to browse to the internet using HTTP? The user:

A. an connect to the Internet successfully after being authenticated

B. s prompted three times before connecting to the Internet successfully

C. an go to the Internet after Telnetting to the client authentication daemon port 259

D. an go to the Internet, without being prompted for authentication

View answer

Correct Answer: D

Question #138

RADIUS protocol uses ___________ to communicate with the gateway.

A. DP

B. DP

C. CP

D. TTP

View answer

Correct Answer: A

Question #139

Your company enforces a strict change control policy. Which of the following would be MOST effective for quickly dropping an attacker's specific active connection?

A. hange the Rule Base and install the Policy to all Security Gateways

B. lock Intruder feature of SmartView Tracker

C. ntrusion Detection System (IDS) Policy install

D. AM – Suspicious Activity Rules feature of SmartView Monitor

View answer

Correct Answer: B

Question #140

Which component functions as the Internal Certificate Authority for R77?

A. ecurity Gateway

B. anagement Server

C. olicy Server

D. martLSM

View answer

Correct Answer: B

Question #141

What is the default shell for the command line interface?

A. xpert

B. lish

C. dmin

D. ormal

View answer

Correct Answer: B

Question #142

A(n) ______________ rule is created by an administrator and is located before the first and before last rules in the Rule Base.

A. irewall drop

B. xplicit

C. mplicit accept

D. mplicit drop

E. mplied

View answer

Correct Answer: E

Question #143

Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server Operating System. He can do this via WebUI or via CLI. Which command should he use in CLI?

A. emove database lock

B. he database feature has one command: lock database override

C. verride database lock

D. he database feature has two commands: lock database override and unlock database

View answer

Correct Answer: D

Question #144

You are the administrator for Alpha Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.What does this mean?

A. he rule No

B. he rule No

C. he rule No

D. he rule No

View answer

Correct Answer: C

Question #145

Look at the screenshot below. What CLISH command provides this output?

A. how configuration all

B. how confd configuration

C. how confd configuration all

D. how configuration

View answer

Correct Answer: D

Question #146

Which options are given on features, when editing a Role on Gaia Platform?

A. ead/Write, Read Only

B. ead/Write, Read Only, None

C. ead/Write, None

D. ead Only, None

View answer

Correct Answer: B

Question #147

Joey is using the computer with IP address 192.168.20.13. He wants to access web page “www.CheckPoint.com”, which is hosted on Web server with IP address 203.0.113.111. How many rules on Check Point Firewall are required for this connection?

A. wo rules – first one for the HTTP traffic and second one for DNS traffic

B. nly one rule, because Check Point firewall is a Packet Filtering firewall

C. wo rules – one for outgoing request and second one for incoming replay

D. nly one rule, because Check Point firewall is using Stateful Inspection technology

View answer

Correct Answer: D

Question #148

Two administrators Dave and Jon both manage R80 Management as administrators for ABC Corp. Jon logged into the R80 Management and then shortly after Dave logged in to the same server. They are both in the Security Policies view. From the screenshots below, why does Dave not have the rule no.6 in his SmartConsole view even though Jon has it his in his SmartConsole view?

A. on is currently editing rule no

B. ave is currently editing rule no

C. ave is currently editing rule no

D. on is currently editing rule no

View answer

Correct Answer: D

Question #149

What is the difference between an event and a log?

A. vents are generated at gateway according to Event Policy

B. log entry becomes an event when it matches any rule defined in Event Policy

C. vents are collected with SmartWorkflow from Trouble Ticket systems

D. ogs and Events are synonyms

View answer

Correct Answer: B

Question #150

In order to modify Security Policies the administrator can use which of the following tools?

A. ommand line of the Security Management Server or mgmt_cli

B. martConsole and WebUI on the Security Management Server

C. gmt_cli or WebUI on Security Gateway and SmartConsole on the Security Management Server

D. martConsole or mgmt_cli on any computer where SmartConsole is installed

View answer

Correct Answer: D

Question #151

The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

A. ecure Internal Communication (SIC)

B. estart Daemons if they fail

C. ransfer messages between Firewall processes

D. ulls application monitoring status

View answer

Correct Answer: D

Question #152

You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the most likely cause?

A. he POP3 rule is disabled

B. OP3 is accepted in Global Properties

C. he POP3 rule is hidden

D. OP3 is one of 3 services (POP3, IMAP, and SMTP) accepted by the default mail object in R77

View answer

Correct Answer: C

Question #153

A client has created a new Gateway object that will be managed at a remote location. When the client attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install On check box. What should you look for?

A. ecure Internal Communications (SIC) not configured for the object

B. Gateway object created using the Check Point > Externally Managed VPN Gateway option from theNetwork Objects dialog box

C. nti-spoofing not configured on the interfaces on the Gateway object

D. Gateway object created using the Check Point > Secure Gateway option in the network objects, dialog box, but still needs to configure the interfaces for the Security Gateway object

View answer

Correct Answer: B

Question #154

Which of the following authentication methods can be configured in the Identity Awareness setup wizard?

A. heck Point Password

B. ACACS

C. DAP

D. indows password

View answer

Correct Answer: C

Question #155

Jennifer McHanry is CEO of ACME. She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory domain, she cannot identify seamlessly with AD Query. However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R77 Firewall Rule Base.To make this scenario work, the IT administrator must:1) Enable Ide

A. ave the security administrator select the Action field of the Firewall Rule “Redirect HTTP connections to an authentication (captive) portal”

B. ave the security administrator reboot the firewall

C. ave the security administrator select Any for the Machines tab in the appropriate Access Role

D. nstall the Identity Awareness agent on her iPad

View answer

Correct Answer: A

Question #156

When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times. No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

A. KE Phase 1

B. PSEC Phase 2

C. PSEC Phase 1

D. KE Phase 2

View answer

Correct Answer: A

Question #157

To enforce the Security Policy correctly, a Security Gateway requires:

A. routing table

B. hat each Security Gateway enforces at least one rule

C. Demilitarized Zone

D. Security Policy install

View answer

Correct Answer: B

Question #158

Office mode means that:

A. ecurID client assigns a routable MAC address

B. sers authenticate with an Internet browser and use secure HTTPS connection

C. ocal ISP (Internet service Provider) assigns a non-routable IP address to the remote user

D. llows a security gateway to assign a remote client an IP address

View answer

Correct Answer: D

Question #159

Which of the following is TRUE regarding Gaia command line?

A. onfiguration changes should be done in mgmt_cli and use CLISH for monitoring

B. onfiguration changes should be done in expert-mode and CLISH is used for monitoring

C. onfiguration changes should be done in mgmt-cli and use expert-mode for OS-level tasks

D. ll configuration changes should be made in CLISH and expert-mode should be used for OS-level tasks

View answer

Correct Answer: D

Question #160

Choose the Best place to find a Security Management Server backup file named backup_fw, on a Check Point Appliance.

A. var/log/Cpbackup/backups/backup/backup_fw

B. var/log/Cpbackup/backups/backup/backup_fw

C. var/log/Cpbackup/backups/backups/backup_fw

D. var/log/Cpbackup/backups/backup_fw

View answer

Correct Answer: D

Question #161

When you upload a package or license to the appropriate repository in SmartUpdate, where is the package or license stored

A. ecurity Gateway

B. heck Point user center

C. ecurity Management Server

D. martConsole installed device

View answer

Correct Answer: C

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Prepare Confidently for the Check Point 156-215.80 Exam with Practice Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Prepare Confidently for the Check Point 156-215.80 Exam with Practice Questions

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now