PASS 156-315.81 exam with CheckPoint Real Exam Questions - 100% Valid!
Actual 156-315.81 Exam Recently Updated Questions with Free Demo
NEW QUESTION # 50
Joey wants to upgrade from R75.40 to R81 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.
What is one of the requirements for his success?
- A. Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR/log directory on the source machine
- B. Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine
- C. Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine
- D. Size of the /var/log folder of the target machine must be at least 25GB or more
Answer: B
Explanation:
One of the requirements for Joey's success in upgrading from R75.40 to R81 version of Security management using Advanced Upgrade with Database Migration method is that the size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine. Advanced Upgrade with Database Migration method is a procedure that allows administrators to upgrade their Security Management Server to a newer version by migrating their database from an older version to a new machine with a fresh installation of the newer version. One of the steps in this procedure is to copy the /var/log folder from the source machine to the target machine, which contains important log files and configuration files. To ensure that there is enough disk space on the target machine for this operation, it is required that the size of the /var/log folder on the target machine must be at least 25% of the size of the /var/log folder on the source machine.
NEW QUESTION # 51
After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?
- A. Security Gateway IP-address cannot be changed without re-establishing the trust.
- B. The Security Gateway name cannot be changed in command line without re-establishing trust.
- C. The Security Management Server name cannot be changed in SmartConsole without re-establishing trust.
- D. The Security Management Server IP-address cannot be changed without re-establishing the trust.
Answer: A
Explanation:
After trust has been established between the Check Point components, the Security Gateway IP address cannot be changed without re-establishing the trust. This is because the trust is based on the Secure Internal Communication (SIC) mechanism, which uses certificates to authenticate and encrypt the communication. The certificates are issued by the Internal Certificate Authority (ICA) of the Security Management Server / Domain Management Server, and contain the name and IP address of the component. Therefore, if the IP address of a component is changed, the certificate will become invalid and the trust will be lost. To restore the trust, the certificate must be renewed or reissued by the ICA12.
However, there are some exceptions to this rule. The Security Gateway name can be changed in command line without re-establishing trust, as long as the IP address remains the same. This is because the SIC mechanism does not rely on the hostname, but on the IP address and the SIC name (which is usually derived from the hostname, but can be manually changed). The Security Management Server name can be changed in SmartConsole without re-establishing trust, as long as the IP address remains the same. This is because SmartConsole uses a different mechanism to connect to the Security Management Server, which does not depend on the SIC certificate. The Security Management Server IP address can be changed without re-establishing trust, as long as some steps are followed to update the Check Point Registry file on the managed Security Gateways / Cluster Members / VSX Virtual Devices. This is because the Registry file contains the IP address of the ICA, which is used for certificate renewal. If the Registry file is not updated, then the certificate renewal will fail and the trust will be lost3.
NEW QUESTION # 52
To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:
- A. fw ctl Dyn_Dispatch enable
- B. fw ctl multik set_mode 4
- C. fw ctl Dyn_Dispatch on
- D. fw ctl multik set_mode 1
Answer: B
Explanation:
Explanation
Dynamic Dispatch is a feature that enhances CoreXL performance by dynamically assigning new connections to CoreXL FW instances based on their CPU utilization1. To enable Dynamic Dispatch on Security Gateway without enabling Firewall Priority Queues (FPQ), you need to run the command fw ctl multik set_mode 4 in Expert mode and reboot2. This command will set the CoreXL mode to Dynamic Dispatcher without FPQ. The other options are not correct because:
A: fw ctl Dyn_Dispatch on: This command does not exist and will return an error message.
B: fw ctl Dyn_Dispatch enable: This command does not exist and will return an error message.
D: fw ctl multik set_mode 1: This command will set the CoreXL mode to Static Dispatcher without FPQ, which is the default mode2. This mode will use a static hash function to assign new connections to CoreXL FW instances based on their IP addresses and protocol.
References: CoreXL Dynamic Dispatcher, To fully enable Dynamic Dispatcher on a Security Gateway, Running Dynamic Dispatch / Dynamic Split / Dynamic Balancing on VSEC/IaaS in Vmware, Dynamic Balancing for CoreXL
NEW QUESTION # 53
Ken wants to obtain a configuration lock from other administrator on R81 Security Management Server. He can do this via WebUI or via CLI.
Which command should he use in CLI? (Choose the correct answer.)
- A. remove database lock
- B. The database feature has two commands lock database override and unlock database. Both will work.
- C. The database feature has one command lock database override.
- D. override database lock
Answer: B
NEW QUESTION # 54
Which of these statements describes the Check Point ThreatCloud?
- A. Blocks or limits usage of web applications
- B. A worldwide collaborative security network
- C. Prevents Cloud vulnerability exploits
- D. Prevents or controls access to web sites based on category
Answer: B
Explanation:
The Check Point ThreatCloud is a worldwide collaborative security network that collects and analyzes threat data from millions of sensors, security gateways, and other sources, and delivers real-time threat intelligence and protection to Check Point products. Reference: Check Point ThreatCloud
NEW QUESTION # 55
In CoreXL, the Firewall kernel is replicated multiple times. Each replicated copy or instance can perform the following:
- A. The Firewall kernel only touches the packet if the connection is accelerated
- B. The Firewall can run different policies per core
- C. The Firewall kernel is replicated only with new connections and deletes itself once the connection times out
- D. The Firewall can run the same policy on all cores
Answer: D
Explanation:
Explanation
CoreXL is a performance-enhancing technology that enables the Security Gateway to utilize multiple CPU cores for processing traffic. CoreXL creates multiple instances of the Firewall kernel, each running on a separate CPU core. Each Firewall instance can handle traffic concurrently and independently, applying the same security policy to the packets that are assigned to it. CoreXL does not allow different policies per core, as this would create inconsistency and complexity in the security enforcement.
The references are:
Best Practices - Security Gateway Performance
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 16 Check Point R81 Quantum Security Gateway Guide, page 42
NEW QUESTION # 56
Hit Count is a feature to track the number of connections that each rule matches, which one is not benefit of Hit Count.
- A. Analyze a Rule Base - You can delete rules that have no matching connections
- B. Improve Firewall performance - You can move a rule that has hot count to a higher position in the Rule Base
- C. Better understand the behavior of the Access Control Policy
- D. Automatically rearrange Access Control Policy based on Hit Count Analysis
Answer: D
NEW QUESTION # 57
What is the limitation of employing Sticky Decision Function?
- A. With SDF enabled, you can only have three Sync interfaces at most
- B. With SDF enabled, the involved VPN Gateways only supports IKEv1
- C. With SDF enabled, only ClusterXL in legacy mode is supported
- D. Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF
Answer: D
Explanation:
Sticky Decision Function (SDF) is a feature that ensures that VPN traffic is handled by the same core on a Security Gateway with multiple CPU cores. This improves the performance and stability of VPN tunnels by avoiding out-of-order packets and reducing encryption overhead. However, the limitation of employing SDF is that acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF. This means that SDF may reduce the overall throughput and scalability of the Security Gateway. Therefore, SDF should be used only when necessary and only on gateways that are dedicated to VPN traffic. Reference: R81 Performance Tuning Administration Guide
NEW QUESTION # 58
When users connect to the Mobile Access portal they are unable to open File Shares.
Which log file would you want to examine?
- A. cvpnd.elg
- B. vpnd.elg
- C. httpd.elg
- D. fw.elg
Answer: A
Explanation:
Explanation
When users connect to the Mobile Access portal they are unable to open File Shares.
The log file that you would want to examine is cvpnd.elg. This log file contains information about the Mobile Access VPN daemon, which handles the connections from the Mobile Access portal to the internal resources, such as File Shares, Web Applications, etc. The log file is located in the directory $FWDIR/log/ on the Security Gateway. You can use the command fw log -f cvpnd.elg to view the log file in real time.
References: R81 Mobile Access Administration Guide, page 255.
NEW QUESTION # 59
fwssd is a child process of which of the following Check Point daemons?
- A. fwm
- B. fwd
- C. cpwd
- D. cpd
Answer: B
Explanation:
fwssd is a child process of fwd, which is the firewall daemon that handles policy installation, logging, and state synchronization. cpwd is the watchdog process that monitors and restarts other processes. fwm is the management server process that handles communication with GUI clients. cpd is the infrastructure daemon that handles SIC, licensing, and policy code generation. References: Check Point Processes Cheat Sheet - LazyAdmins, Check Point R81 Gaia Administration Guide, Certified Security Expert (CCSE) R81.20 Course Overview
NEW QUESTION # 60
How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?
- A. You can utilize only Check Point Cloud Services for this scenario.
- B. Install appliance TE250X in standalone mode and setup MTA.
- C. Install appliance TE250X on SpanPort on LAN switch in MTA mode.
- D. It is not possible, always Check Point SGW is needed to forward emails to SandBlast appliance.
Answer: A
NEW QUESTION # 61
Which statement is true regarding redundancy?
- A. System Administrators know when their cluster has failed over and can also see why it failed over by using the cphaprob -f if command.
- B. ClusterXL offers three different Load Sharing solutions: Unicast, Broadcast, and Multicast.
- C. Machines in a ClusterXL High Availability configuration must be synchronized.
- D. Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.
Answer: D
Explanation:
The statement that is true regarding redundancy is Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments. ClusterXL and VRRP are two technologies that provide high availability and load sharing for Security Gateways. They are both supported by Gaia OS and can be deployed on various platforms5. The other statements are either false or incomplete regarding redundancy. References: Check Point R81 ClusterXL Administration Guide, Check Point R81 Gaia Administration Guide
NEW QUESTION # 62
In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a response before the peer host is declared 'down', you would set the_________?
- A. life sign polling interval
- B. life_sign_timeout
- C. life sign timeout
- D. life_sign_polling_interval
Answer: B
Explanation:
Explanation
In Advanced Permanent Tunnel Configuration, the life_sign_timeout parameter sets the amount of time the tunnel test runs without a response before the peer host is declared 'down'. The life_sign_polling_interval parameter sets the interval between each tunnel test packet sent to the peer host.
Reference: https://sc1.checkpoint.com/documents/R77/CP_R77_VPN_AdminGuide/html_frameset.htm?topic=documents/R77/CP_R77_VPN_AdminGuide/14018
Advanced Permanent Tunnel Configuration
NEW QUESTION # 63
Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?
- A. tecli advanced attributes set prohibited_file_types exe.bat
- B. enable .exe & .bat protection in IPS Policy
- C. create FW rule for particular protocol
- D. enable DLP and select.exe and .bat file type
Answer: D
Explanation:
Explanation
The best way to block .exe and .bat file types using Threat Emulation technologies is to enable DLP and select .exe and .bat file type. DLP stands for Data Loss Prevention, and it is a feature that allows administrators to define rules and actions to protect sensitive data from unauthorized access or transfer. One of the DLP rule conditions is File Type, which can be used to block or alert on specific file types, such as .exe and .bat, that may contain malicious code or scripts. The other options are either not related to Threat Emulation technologies, or not effective in blocking .exe and .bat file types.
NEW QUESTION # 64
Which command is used to display status information for various components?
- A. sysmess all
- B. show system messages
- C. show all systems
- D. show sysenv all
Answer: D
Explanation:
The command used to display status information for various components is show sysenv all. This command provides comprehensive status information about the system's environment and various components, including hardware and software components. It can be useful for troubleshooting and monitoring the system's health.
NEW QUESTION # 65
IF the first packet of an UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), what message is sent back through the kernel?
- A. TCP RST
- B. TCP FIN
- C. ICMP unreachable
- D. Nothing
Answer: D
Explanation:
If the first packet of a UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), nothing is sent back through the kernel. This is because UDP is a connectionless protocol that does not require an acknowledgement from the receiver. Therefore, if a UDP packet is dropped by the Firewall, the sender will not receive any feedback or notification. References: UDP Protocol
NEW QUESTION # 66
......
156-315.81 Free Sample Questions to Practice One Year Update: https://www.pass4guide.com/156-315.81-exam-guide-torrent.html
Free CheckPoint 156-315.81 Exam Questions: https://drive.google.com/open?id=1DePFq9azqLf1ehWdpc4a29tljC3IJoSd