Checkpoint 156-315.80 today updated questions - Verified by Checkpoint Experts

Check Point Certified Security Expert (CCSE) R80 Questions and Answers

Question 1

What is the command to see cluster status in cli expert mode?

Options:

fw ctl stat

clusterXL stat

clusterXL status

cphaprob stat

Question 2

Which firewall daemon is responsible for the FW CLI commands?

Options:

fwd

fwm

cpm

cpd

Question 3

Which of the following will NOT affect acceleration?

Options:

Connections destined to or originated from the Security gateway

A 5-tuple match

Multicast packets

Connections that have a Handler (ICMP, FTP, H.323, etc.)

Question 4

SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Options:

Analyzes each log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server.

Correlates all the identified threats with the consolidation policy.

Collects syslog data from third party devices and saves them to the database.

Connects with the SmartEvent Client when generating threat reports.

Question 5

Tom has connected to the R80 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.

What will happen to the changes already made?

Options:

Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.

Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.

Tom’s changes will be lost since he lost connectivity and he will have to start again.

Tom will have to reboot his SmartConsole computer, clear to cache, and restore changes.

Question 6

Office mode means that:

Options:

SecurID client assigns a routable MAC address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

Users authenticate with an Internet browser and use secure HTTPS connection.

Local ISP (Internet service Provider) assigns a non-routable IP address to the remote user.

Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

Question 7

Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

Options:

To satellites through center only

To center only

To center and to other satellites through center

To center, or through the center to other satellites, to Internet and other VPN targets

Question 8

In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

Options:

Security Policies

Logs and Monitor

Manage and Settings

Gateways and Servers

Question 9

John detected high load on sync interface. Which is most recommended solution?

Options:

For FTP connections – do not sync

Add a second interface to handle sync traffic

For short connections like http service – do not sync

For short connections like icmp service – delay sync for 2 seconds

Question 10

SmartEvent does NOT use which of the following procedures to identify events:

Options:

Matching a log against each event definition

Create an event candidate

Matching a log against local exclusions

Matching a log against global exclusions

Question 11

With SecureXL enabled, accelerated packets will pass through the following:

Options:

Network Interface Card, OSI Network Layer, OS IP Stack, and the Acceleration Device

Network Interface Card, Check Point Firewall Kernal, and the Acceleration Device

Network Interface Card and the Acceleration Device

Network Interface Card, OSI Network Layer, and the Acceleration Device

Question 12

NO: 219

What cloud-based SandBlast Mobile application is used to register new devices and users?

Options:

Check Point Protect Application

Management Dashboard

Behavior Risk Engine

Check Point Gateway

Question 13

Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

Options:

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

Time object to a rule to make the rule active only during specified times.

Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.

Question 14

What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

Options:

Lagging

Synchronized

Never been synchronized

Collision

Question 15

SmartEvent uses it's event policy to identify events. How can this be customized?

Options:

By modifying the firewall rulebase

By creating event candidates

By matching logs against exclusions

By matching logs against event rules

Question 16

In the Check Point Security Management Architecture, which component(s) can store logs?

Options:

SmartConsole

Security Management Server and Security Gateway

Security Management Server

SmartConsole and Security Management Server

Question 17

What ports are used for SmartConsole to connect to the Security Management Server?

Options:

CPMl (18190)

CPM (19009), CPMl (18190) https (443)

CPM (19009). CPMl (18190) CPD (18191)

ICA_Pull (18210), CPMl (18190) https (443)

Question 18

Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ________ .

Options:

User Directory

Captive Portal and Transparent Kerberos Authentication

Captive Portal

UserCheck

Question 19

Fill in the blanks: Gaia can be configured using the ______ or _____ .

Options:

GaiaUI; command line interface

WebUI; Gaia Interface

Command line interface; WebUI

Gaia Interface; GaiaUI

Question 20

You want to verify if your management server is ready to upgrade to R80.10. What tool could you use in this process?

Options:

migrate export

upgrade_tools verify

pre_upgrade_verifier

migrate import

Question 21

What CLI command compiles and installs a Security Policy on the target’s Security Gateways?

Options:

fwm compile

fwm load

fwm fetch

fwm install

Question 22

At what point is the Internal Certificate Authority (ICA) created?

Options:

Upon creation of a certificate.

During the primary Security Management Server installation process.

When an administrator decides to create one.

When an administrator initially logs into SmartConsole.

Question 23

SandBlast agent extends 0 day prevention to what part of the network?

Options:

Web Browsers and user devices

DMZ server

Cloud

Email servers

Question 24

What will be the effect of running the following command on the Security Management Server?

Options:

Remove the installed Security Policy.

Remove the local ACL lists.

No effect.

Reset SIC on all gateways.

Question 25

The Correlation Unit performs all but the following actions:

Options:

Marks logs that individually are not events, but may be part of a larger pattern to be identified later.

Generates an event based on the Event policy.

Assigns a severity level to the event.

Takes a new log entry that is part of a group of items that together make up an event, and adds it to an ongoing event.

Question 26

What is the mechanism behind Threat Extraction?

Options:

This a new mechanism which extracts malicious files from a document to use it as a counter-attack against its sender.

This is a new mechanism which is able to collect malicious files out of any kind of file types to destroy it prior to sending it to the intended recipient.

This is a new mechanism to identify the IP address of the sender of malicious codes and put it into the SAM database (Suspicious Activity Monitoring).

Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.

Question 27

What is the best sync method in the ClusterXL deployment?

Options:

Use 1 cluster + 1st sync

Use 1 dedicated sync interface

Use 3 clusters + 1st sync + 2nd sync + 3rd sync

Use 2 clusters +1st sync + 2nd sync

Question 28

When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.

Options:

SecureID

SecurID

Complexity

TacAcs

Question 29

What has to be taken into consideration when configuring Management HA?

Options:

The Database revisions will not be synchronized between the management servers

SmartConsole must be closed prior to synchronized changes in the objects database

If you wanted to use Full Connectivity Upgrade, you must change the Implied Rules to allow FW1_cpredundant to pass before the Firewall Control Connections.

For Management Server synchronization, only External Virtual Switches are supported. So, if you wanted to employ Virtual Routers instead, you have to reconsider your design.

Question 30

Which feature is NOT provided by all Check Point Mobile Access solutions?

Options:

Support for IPv6

Granular access control

Strong user authentication

Secure connectivity

Question 31

SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

Options:

19090,22

19190,22

18190,80

19009,443

Question 32

When attempting to start a VPN tunnel, in the logs the error “no proposal chosen” is seen numerous times. No other VPN-related entries are present.

Which phase of the VPN negotiations has failed?

Options:

IKE Phase 1

IPSEC Phase 2

IPSEC Phase 1

IKE Phase 2

Question 33

NO: 155

You need to see which hotfixes are installed on your gateway, which command would you use?

Options:

cpinfo –h all

cpinfo –o hotfix

cpinfo –l hotfix

cpinfo –y all

Question 34

Firewall polices must be configured to accept VRRP packets on the GAiA platform if it Firewall software. The Multicast destination assigned by the internet Assigned Number Authority (IANA) for VRRP is:

Options:

224.0.0.18

224 00 5

224.0.0.102

224.0.0.22

Question 35

Which encryption algorithm is the least secured?

Options:

AES-128

AES-256

DES

3DES

Question 36

To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Options:

fw ctl set int fwha vmac global param enabled

fw ctl get int vmac global param enabled; result of command should return value 1

cphaprob-a if

fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1

Question 37

Fill in the blank: The R80 utility fw monitor is used to troubleshoot ______________________.

Options:

User data base corruption

LDAP conflicts

Traffic issues

Phase two key negotiations

Question 38

What is UserCheck?

Options:

Messaging tool used to verify a user’s credentials.

Communication tool used to inform a user about a website or application they are trying to access.

Administrator tool used to monitor users on their network.

Communication tool used to notify an administrator when a new user is created.

Question 39

If you needed the Multicast MAC address of a cluster, what command would you run?

Options:

cphaprob –a if

cphaconf ccp multicast

cphaconf debug data

cphaprob igmp

Question 40

What scenario indicates that SecureXL is enabled?

Options:

Dynamic objects are available in the Object Explorer

SecureXL can be disabled in cpconfig

fwaccel commands can be used in clish

Only one packet in a stream is seen in a fw monitor packet capture

Question 41

What is the command to check the status of the SmartEvent Correlation Unit?

Options:

fw ctl get int cpsead_stat

cpstat cpsead

fw ctl stat cpsemd

cp_conf get_stat cpsemd

Question 42

Fill in the blank: The command ___________________ provides the most complete restoration of a R80 configuration.

Options:

upgrade_import

cpconfig

fwm dbimport -p

cpinfo –recover

Question 43

In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Options:

Mail, Block Source, Block Event Activity, External Script, SNMP Trap

Mail, Block Source, Block Destination, Block Services, SNMP Trap

Mail, Block Source, Block Destination, External Script, SNMP Trap

Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap

Question 44

When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

Options:

ThreatCloud is a database-related application which is located on-premise to preserve privacy of company-related data

ThreatCloud is a collaboration platform for all the CheckPoint customers to form a virtual cloud consisting of a combination of all on-premise private cloud environments

ThreatCloud is a collaboration platform for Check Point customers to benefit from VMWare ESXi infrastructure which supports the Threat Emulation Appliances as virtual machines in the EMC Cloud

ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary

Question 45

Which 3 types of tracking are available for Threat Prevention Policy?

Options:

SMS Alert, Log, SNMP alert

Syslog, None, User-defined scripts

None, Log, Syslog

Alert, SNMP trap, Mail

Question 46

What is the base level encryption key used by Capsule Docs?

Options:

RSA 2048

RSA 1024

SHA-256

AES

Question 47

SmartEvent Security Checkups can be run from the following Logs and Monitor activity:

Options:

Reports

Advanced

Checkups

Views

Question 48

What are the different command sources that allow you to communicate with the API server?

Options:

SmartView Monitor, API_cli Tool, Gaia CLI, Web Services

SmartConsole GUI Console, mgmt_cli Tool, Gaia CLI, Web Services

SmartConsole GUI Console, API_cli Tool, Gaia CLI, Web Services

API_cli Tool, Gaia CLI, Web Services

Question 49

: 131

Which command is used to display status information for various components?

Options:

show all systems

show system messages

sysmess all

show sysenv all

Question 50

Please choose correct command to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI?

Options:

host name myHost12 ip-address 10.50.23.90

mgmt: add host name ip-address 10.50.23.90

add host name emailserver1 ip-address 10.50.23.90

mgmt: add host name emailserver1 ip-address 10.50.23.90

Question 51

Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the

inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire

mode configuration, chain modules marked with _______ will not apply.

Options:

ffffffff

00000001

00000002

00000003

Question 52

Which file gives you a list of all security servers in use, including port number?

Options:

$FWDIR/conf/conf.conf

$FWDIR/conf/servers.conf

$FWDIR/conf/fwauthd.conf

$FWDIR/conf/serversd.conf

Question 53

What is the main difference between Threat Extraction and Threat Emulation?

Options:

Threat Emulation never delivers a file and takes more than 3 minutes to complete.

Threat Extraction always delivers a file and takes less than a second to complete.

Threat Emulation never delivers a file that takes less than a second to complete.

Threat Extraction never delivers a file and takes more than 3 minutes to complete.

Question 54

Which tool is used to enable ClusterXL?

Options:

SmartUpdate

cpconfig

SmartConsole

sysconfig

Question 55

What are the steps to configure the HTTPS Inspection Policy?

Options:

Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard

Go to Application&url filtering blade > Advanced > Https Inspection > Policy

Go to Manage&Settings > Blades > HTTPS Inspection > Policy

Go to Application&url filtering blade > Https Inspection > Policy

Question 56

What destination versions are supported for a Multi-Version Cluster Upgrade?

Options:

R80.40 and later

R76 and later

R70 and Later

R80.10 and Later

Question 57

What is the best method to upgrade a Security Management Server to R80.x when it is not connected to the Internet?

Options:

CPUSE offline upgrade only

Advanced upgrade or CPUSE offline upgrade

Advanced Upgrade only

SmartUpdate offline upgrade

Question 58

What is correct statement about Security Gateway and Security Management Server failover in Check Point R80.X in terms of Check Point Redundancy driven solution?

Options:

Security Gateway failover is an automatic procedure but Security Management Server failover is a manual procedure.

Security Gateway failover as well as Security Management Server failover is a manual procedure.

Security Gateway failover is a manual procedure but Security Management Server failover is an automatic procedure.

Security Gateway failover as well as Security Management Server failover is an automatic procedure.

Question 59

Which features are only supported with R80.10 Gateways but not R77.x?

Options:

Access Control policy unifies the Firewall, Application Control & URL Filtering, Data Awareness, and Mobile Access Software Blade policies.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

Time object to a rule to make the rule active only during specified times.

Question 60

You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.

What does this mean?

Options:

This rule No. 6 has been marked for deletion in your Management session.

This rule No. 6 has been marked for deletion in another Management session.

This rule No. 6 has been marked for editing in your Management session.

This rule No. 6 has been marked for editing in another Management session.

Question 61

Which statement is most correct regarding about “CoreXL Dynamic Dispatcher”?

Options:

The CoreXL FW instanxces assignment mechanism is based on Source MAC addresses, Destination MAC addresses

The CoreXL FW instances assignment mechanism is based on the utilization of CPU cores

The CoreXL FW instances assignment mechanism is based on IP Protocol type

The CoreXl FW instances assignment mechanism is based on Source IP addresses, Destination IP addresses, and the IP ‘Protocol’ type

Question 62

Which NAT rules are prioritized first?

Options:

Post-Automatic/Manual NAT rules

Manual/Pre-Automatic NAT

Automatic Hide NAT

Automatic Static NAT

Question 63

CoreXL is supported when one of the following features is enabled:

Options:

Route-based VPN

IPS

IPv6

Overlapping NAT

Question 64

Which of the following is NOT a VPN routing option available in a star community?

Options:

To satellites through center only.

To center, or through the center to other satellites, to Internet and other VPN targets.

To center and to other satellites through center.

To center only.

Question 65

How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

Options:

By dropping traffic from websites identified through ThreatCloud Verification and URL Caching

By dropping traffic that is not proven to be from clean websites in the URL Filtering blade

By allowing traffic from websites that are known to run Antivirus Software on servers regularly

By matching logs against ThreatCloud information about the reputation of the website

Question 66

GAiA Software update packages can be imported and installed offline in situation where:

Options:

Security Gateway with GAiA does NOT have SFTP access to Internet

Security Gateway with GAiA does NOT have access to Internet.

Security Gateway with GAiA does NOT have SSH access to Internet.

The desired CPUSE package is ONLY available in the Check Point CLOUD.

Question 67

The Firewall kernel is replicated multiple times, therefore:

Options:

The Firewall kernel only touches the packet if the connection is accelerated

The Firewall can run different policies per core

The Firewall kernel is replicated only with new connections and deletes itself once the connection times out

The Firewall can run the same policy on all cores.

Question 68

After finishing installation admin John likes to use top command in expert mode. John has to set the expert-password and was able to use top command. A week later John has to use the top command again, He detected that the expert password is no longer valid. What is the most probable reason for this behavior?

Options:

“write memory” was not issued on clish

changes are only possible via SmartConsole

“save config” was not issued in expert mode

“save config” was not issued on clish

Question 69

If a “ping”-packet is dropped by FW1 Policy –on how many inspection Points do you see this packet in “fw monitor”?

Options:

“i", “l” and “o”

I don’t see it in fw monitor

“i" only

“i" and “l”

Load More 156-315.80 Questions

Winter Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: suredis

Checkpoint 156-315.80 Check Point Certified Security Expert (CCSE) R80 Exam Practice Test

Check Point Certified Security Expert (CCSE) R80 Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation: