156-215.81 Online Training

1. URL Filtering cannot be used to:

2. Fill in the blanks: The _______ collects logs and sends them to the _______.

3. To view statistics on detected threats, which Threat Tool would an administrator use?

4. Which statement is TRUE of anti-spoofing?

5. What kind of NAT enables Source Port Address Translation by default?

6. From the Gaia web interface, which of the following operations CANNOT be performed on a Security Management Server?

7. You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don’t have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher.

How can you enable them?

8. Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

9. With URL Filtering, what portion of the traffic is sent to the Check Point Online Web Service for analysis?

10. Administrator Dave logs into R80 Management Server to review and makes some rule changes. He notices that there is a padlock sign next to the DNS rule in the Rule Base.





What is the possible explanation for this?

11. True or False: More than one administrator can log into the Security Management Server with SmartConsole with write permission at the same time.

12. Under which file is the proxy arp configuration stored?

13. In which scenario is it a valid option to transfer a license from one hardware device to another?

14. Check Point licenses come in two forms.

What are those forms?

15. What Check Point technologies deny or permit network traffic?

16. What are the three main components of Check Point security management architecture?

17. To increase security, the administrator has modified the Core protection ‘Host Port Scan’ from ‘Medium’ to ‘High’ Predefined Sensitivity.

Which Policy should the administrator install after Publishing the changes?

18. In HTTPS Inspection policy, what actions are available in the "Actions" column of a rule?

19. Fill in the blank: ____________ is the Gaia command that turns the server off.

20. Name the authentication method that requires token authenticator.

21. Which GUI tool can be used to view and apply Check Point licenses?

22. Fill in the blank: To create policy for traffic to or from a particular location, use the _____________.

23. Which of the following methods can be used to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server?

24. Which part of SmartConsole allows administrators to add, edit delete, and clone objects?

25. What is the purpose of a Clean-up Rule?

26. An administrator can use section titles to more easily navigate between large rule bases.

Which of these statements is FALSE?

27. Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.

After installation, is the administrator required to perform any additional tasks?

28. Full synchronization between cluster members is handled by Firewall Kernel.

Which port is used for this?

29. Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?

30. Stateful Inspection compiles and registers connections where?

31. John is using Management HA.

Which Smartcenter should be connected to for making changes?

32. Which of the following are types of VPN communities?

33. Can you use the same layer in multiple policies or rulebases?

34. After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?

35. Which Threat Prevention profile uses sanitization technology?

36. Of all the Check Point components in your network, which one changes most often and should be backed up most frequently?

37. Fill in the blank: An identity server uses a ___________ for user authentication.

38. Fill in the blank: With the User Directory Software Blade, you can create user definitions on a(n) ___________ Server.

39. Which tool is used to enable cluster membership on a Gateway?

40. What are the three components for Check Point Capsule?

41. Which message indicates IKE Phase 2 has completed successfully?

42. True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway

43. Fill in the blank: SmartConsole, SmartEvent GUI client, and ___________ allow viewing of billions of consolidated logs and shows them as prioritized security events.

44. Most Check Point deployments use Gaia but which product deployment utilizes special Check Point code (with unification in R81.10)?

45. DLP and Geo Policy are examples of what type of Policy?

46. What is the purpose of the CPCA process?

47. What type of NAT is a one-to-one relationship where each host is translated to a unique address?

48. Which Identity Source(s) should be selected in Identity Awareness for when there is a requirement for a higher level of security for sensitive servers?

49. A SAM rule Is implemented to provide what function or benefit?

50. Fill in the blank: The _____ feature allows administrators to share a policy with other policy packages.

51. Using ClusterXL, what statement is true about the Sticky Decision Function?

52. Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance?

53. How are the backups stored in Check Point appliances?

54. Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

55. Which option would allow you to make a backup copy of the OS and Check Point configuration, without stopping Check Point processes?

56. What is the purpose of the Stealth Rule?

57. When configuring Anti-Spoofing, which tracking options can an Administrator select?

58. When an encrypted packet is decrypted, where does this happen?

59. Which type of attack can a firewall NOT prevent?

60. If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsible, which of these steps should NOT be performed:

61. Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.

62. Security Zones do no work with what type of defined rule?

63. Fill in the blanks: A ____ license requires an administrator to designate a gateway for attachment whereas a _____ license is automatically attached to a Security Gateway.

64. A network administrator has informed you that they have identified a malicious host on the network, and instructed you to block it. Corporate policy dictates that firewall policy changes cannot be made at this time.

What tool can you use to block this traffic?

65. View the rule below.





What does the pen-symbol in the left column mean?

66. What is the default shell of Gaia CLI?

67. What is the purpose of Captive Portal?

68. When using Automatic Hide NAT, what is enabled by default?

69. Fill in the blank: Back up and restores can be accomplished through_________.

70. What is the Transport layer of the TCP/IP model responsible for?

71. From SecureXL perspective, what are the tree paths of traffic flow:

72. Choose what BEST describes the reason why querying logs now is very fast.

73. An administrator wishes to enable Identity Awareness on the Check Point firewalls. However they allow users to use company issued or personal laptops.

Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

74. Which of the following is NOT a valid deployment option for R80?

75. You have enabled "Extended Log" as a tracking option to a security rule. However, you are still not seeing any data type information.

What is the MOST likely reason?

76. What is the purpose of the Clean-up Rule?

77. To enforce the Security Policy correctly, a Security Gateway requires:

78. Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the ____________ algorithm.

79. How would you determine the software version from the CLI?

80. Log query results can be exported to what file format?

81. In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

82. You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have received a call by one of the management users stating that they are unable to browse the Internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway.

How do you review the logs to see what the problem may be?

83. In order for changes made to policy to be enforced by a Security Gateway, what action must an administrator perform?

84. The Gateway Status view in SmartConsole shows the overall status of Security Gateways and Software Blades.

What does the Status Attention mean?

85. Which of the following commands is used to verify license installation?

86. URL Filtering employs a technology, which educates users on web usage policy in real time.

What is the name of that technology?

87. Where can administrator edit a list of trusted SmartConsole clients?

88. What are the two types of NAT supported by the Security Gateway?

89. John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole.

To make John’s changes available to other administrators, and to save the database before installing a policy, what must John do?

90. What are the Threat Prevention software components available on the Check Point Security Gateway?

91. Choose what BEST describes users on Gaia Platform.

92. Both major kinds of NAT support Hide and Static NAT. However, one offers more flexibility.

Which statement is true?

93. In ____________ NAT, the ____________ is translated.

94. Which of the following is NOT an authentication scheme used for accounts created through SmartConsole?

95. How do logs change when the "Accounting" tracking option is enabled on a traffic rule?

96. Which of the following situations would not require a new license to be generated and installed?

97. Fill in the blanks: Default port numbers for an LDAP server is ______ for standard connections and _______ SSL connections.

98. The competition between stateful inspection and proxies was based on performance, protocol support, and security.

Considering stateful Inspections and Proxies, which statement is correct?

99. What is the main objective when using Application Control?

100. Which tool is used to enable ClusterXL?

101. Office mode means that:

102. Administrator wishes to update IPS from SmartConsole by clicking on the option “update now” under the IPS tab.

Which device requires internet access for the update to work?

103. Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time.

What is the BEST way to do this with R80 security management?

104. When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

105. Which of the following is NOT a back up method?

106. Which of the following is NOT an advantage to using multiple LDAP servers?

107. Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?

108. The default method for destination NAT is _____________, where NAT occurs on the Inbound interface closest to the client.

109. Choose what BEST describes a Session.

110. Which of the following is NOT a VPN routing option available in a star community?

111. What is the default shell of Gaia CLI?

112. Which of the following licenses are considered temporary?

113. Where can administrator edit a list of trusted SmartConsole clients in R80?

114. Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ________ all traffic. However, in the Application Control policy layer, the default action is ________ all traffic.

115. Vanessa is a Firewall administrator. She wants to test a backup of her company’s production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment.

Which details she need to fill in System Restore window before she can click OK button and test the backup?

116. On the following picture an administrator configures Identity Awareness:





After clicking “Next” the above configuration is supported by:

117. What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.

118. Why would an administrator see the message below?

119. Fill in the blank: The _________ software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities.

120. At what point is the Internal Certificate Authority (ICA) created?

121. In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

122. Fill in the blank: ________information is included in the “Full Log” tracking option, but is not included in the “Log” tracking option?

123. In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

124. Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

125. Fill in the blanks: The Application Layer Firewalls inspect traffic through the ________ layer(s) of the TCP/IP model and up to and including the ________ layer.

126. There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A’s interface issues were resolved and it became operational.

When it re-joins the cluster, will it become active automatically?

127. After the initial installation the First Time Configuration Wizard should be run. Select the BEST answer.

128. In order to modify Security Policies the administrator can use which of the following tools? Select the BEST answer.

129. Which of the following is NOT an element of VPN Simplified Mode and VPN Communities?

130. Fill in the blanks: A Check Point software license consists of a _______ and _______ .

131. Fill in the blank: Once a license is activated, a ________ should be installed.

132. Which policy type is used to enforce bandwidth and traffic control rules?

133. Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in:

134. Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as _______

135. Which Check Point software blade provides protection from zero-day and undiscovered threats?

136. Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

137. Look at the following screenshot and select the BEST answer.

138. Fill in the blanks: A security Policy is created in _________, stored in the _________, and Distributed to the various __________.

139. Look at the screenshot below.





What CLISH command provides this output?

140. Which authentication scheme requires a user to possess a token?

141. If there is an Accept Implied Policy set to “First”, what is the reason Jorge cannot see any logs?

142. The most important part of a site-to-site VPN deployment is the ________.

143. R80 Security Management Server can be installed on which of the following operating systems?

144. What port is used for delivering logs from the gateway to the management server?

145. The organization's security manager wishes to back up just the Gaia operating system parameters.

Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries?

146. Choose what BEST describes users on Gaia Platform.

147. You are going to upgrade from R77 to R80. Before the upgrade, you want to back up the system so that, if there are any problems, you can easily restore to the old version with all configuration and management files intact.

What is the BEST backup method in this scenario?

148. The IT Management team is interested in the new features of the Check Point R80 Management and wants to upgrade but they are concerned that the existing R77.30 Gaia Gateways cannot be managed by R80 because it is so different.

As the administrator responsible for the Firewalls, how can you answer or confirm these concerns?

149. Provide very wide coverage for all products and protocols, with noticeable performance impact.





How could you tune the profile in order to lower the CPU load still maintaining security at good level? Select the BEST answer.

150. Fill in the blank: A _______ is used by a VPN gateway to send traffic as if it were a physical interface.

151. Fill in the blank: The ________ feature allows administrators to share a policy with other policy packages.

152. You want to define a selected administrator's permission to edit a layer. However, when you click the + sign in the “Select additional profile that will be able edit this layer” you do not see anything.

What is the most likely cause of this problem? Select the BEST answer.

153. Which of the following is NOT an alert option?

154. Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.

155. AdminA and AdminB are both logged in on SmartConsole.

What does it mean if AdminB sees a locked icon on a rule? Choose the BEST answer.

156. Which of the following is TRUE about the Check Point Host object?

157. Which of the following is NOT a set of Regulatory Requirements related to Information Security?

158. Which command is used to obtain the configuration lock in Gaia?

159. Joey is using the computer with IP address 192.168.20.13. He wants to access web page “www.CheckPoint.com”, which is hosted on Web server with IP address 203.0.113.111.

How many rules on Check Point Firewall are required for this connection?

160. Fill in the blank: Licenses can be added to the License and Contract repository ________ .

161. Fill in the blank: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.

162. Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

163. Fill in the blank: RADIUS Accounting gets ______ data from requests generated by the accounting client

164. Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows them as prioritized security events.

165. Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?

166. How many users can have read/write access in Gaia at one time?

167. Sally has a Hot Fix Accumulator (HFA) she wants to install on her Security Gateway which operates with GAiA, but she cannot SCP the HFA to the system. She can SSH into the Security Gateway, but she has never been able to SCP files to it.

What would be the most likely reason she cannot do so?

168. John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, gateway policy permits access only from Join's desktop which is assigned an IP address 10.0.0.19 via DHCP.

John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but the limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop. He wants to move around the organization and continue to have access to the HR Web Server.

To make this scenario work, the IT administrator:

1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources.

2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.

John plugged in his laptop to the network on a different network segment and he is not able to connect.

How does he solve this problem?

169. Which feature in R77 permits blocking specific IP addresses for a specified time period?

170. MyCorp has the following NAT rules. You need to disable the NAT function when Alpha-internal networks try to reach the Google DNS (8.8.8.8) server.

What can you do in this case?

171. What is the potential downside or drawback to choosing the Standalone deployment option instead of the Distributed deployment option?

172. Which of the following statements accurately describes the command snapshot?

173. The Captive Portal tool:

174. Where do we need to reset the SIC on a gateway object?

175. Anti-Spoofing is typically set up on which object type?

176. What happens if the identity of a user is known?

177. Message digests use which of the following?

178. When using LDAP as an authentication method for Identity Awareness, the query:

179. You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base.

Which of the following is the most likely cause?

180. What action can be performed from SmartUpdate R77?

181. Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256 for IKE phase 2.

Why is this a problematic setup?

182. Choose the SmartLog property that is TRUE.

183. Which directory holds the SmartLog index files by default?

184. To install a brand new Check Point Cluster, the MegaCorp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster.

Which type of cluster is it?

185. Can a Check Point gateway translate both source IP address and destination IP address in a given packet?

186. Which of the following is NOT defined by an Access Role object?

187. Install the Security Policy.

188. You want to reset SIC between smberlin and sgosaka.





In SmartDashboard, you choose sgosaka, Communication, Reset. On sgosaka, you start cpconfig, choose Secure Internal Communication and enter the new SIC Activation Key. The screen reads The SIC was successfully initialized and jumps back to the menu.

When trying to establish a connection, instead of a working connection, you receive this error message:





What is the reason for this behavior?

189. Which of these components does NOT require a Security Gateway R77 license?

190. What statement is true regarding Visitor Mode?

191. Mesh and Star are two types of VPN topologies.

Which statement below is TRUE about these types of communities?

192. What CLI utility allows an administrator to capture traffic along the firewall inspection chain?

193. Your bank's distributed R77 installation has Security Gateways up for renewal.

Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

194. NAT can NOT be configured on which of the following objects?

195. The fw monitor utility is used to troubleshoot which of the following problems?

196. You are the Security Administrator for MegaCorp. In order to see how efficient your firewall Rule Base is, you would like to see how many often the particular rules match. Where can you see it? Give the BEST answer.

197. Study the Rule base and Client Authentication Action properties screen.









After being authenticated by the Security Gateways, a user starts a HTTP connection to a Web site.

What happens when the user tries to FTP to another site using the command line? The:

198. What are the three tabs available in SmartView Tracker?

199. In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?

200. Which SmartConsole component can Administrators use to track changes to the Rule Base?