156-315.80 Online Training Archives

Exam4Training has always verified and updated Check Point 156-315.80 Check Point Certified Security Expert – R80 Online Training which helps you to prepare your exam with less effort in very short time. It has latest and relevant study guide material which is useful for you to get prepare for Check Point 156-315.80 with ease.With the refreshed Check Point 156-315.80 Check Point Certified Security Expert – R80 Online Training given by Exam4Training, you can pass Check Point Certified Security Expert – R80 exam with no issue.Exam4Training give all the CCSE 156-315.80 questions you require to pass 156-315.80 exam in the first attempt.

Page 1 of 10

1. What state is the Management HA in when both members have different policies/databases?

Synchronized

Never been synchronized

Lagging

Collision

2. Which of the following is NOT a component of Check Point Capsule?

Capsule Docs

Capsule Cloud

Capsule Enterprise

Capsule Workspace

3. In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

Pentagon

Combined

Meshed

Star

4. How many interfaces can you configure to use the Multi-Queue feature?

10 interfaces

3 interfaces

4 interfaces

5 interfaces

5. Which firewall daemon is responsible for the FW CLI commands?

fwd

fwm

cpm

cpd

6. According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

Firewall

VPN

IPS

HTTPS

7. Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

All Connections (Clear or Encrypted)

Accept all encrypted traffic

Specific VPN Communities

All Site-to-Site VPN Communities

8. Which is the correct order of a log flow processed by SmartEvent components?

Firewall > Correlation Unit > Log Server > SmartEvent Server Database > SmartEvent Client

Firewall > SmartEvent Server Database > Correlation Unit > Log Server > SmartEvent Client

Firewall > Log Server > SmartEvent Server Database > Correlation Unit > SmartEvent Client

Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client

9. What is the base level encryption key used by Capsule Docs?

RSA 2048

RSA 1024

SHA-256

AES

10. Which SmartConsole tab is used to monitor network and security performance?

Manage Setting

Security Policies

Gateway and Servers

Logs and Monitor

Page 2 of 10

11. What traffic does the Anti-bot feature block?

Command and Control traffic from hosts that have been identified as infected

Command and Control traffic to servers with reputation for hosting malware

Network traffic that is directed to unknown or malicious servers

Network traffic to hosts that have been identified as infected

12. Matt wants to upgrade his old Security Management server to R80.x using the Advanced Upgrade with Database Migration .

What is one of the requirements for a successful upgrade?

Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine

Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine

Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR/log directory on the source machine

Size of the /var/log folder of the target machine must be at least 25GB or more

13. On the following picture an administrator configures Identity Awareness:

After clicking “Next” the above configuration is supported by:

Kerberos SSO which will be working for Active Directory integration

Based on Active Directory integration which allows the Security Gateway to correlate Active Directory users and machines to IP addresses in a method that is completely transparent to the user.

Obligatory usage of Captive Portal.

The ports 443 or 80 what will be used by Browser-Based and configured Authentication.

14. Which of the following is NOT a valid type of SecureXL template?

Accept Template

Deny template

Drop Template

NAT Template

15. CoreXL is NOT supported when one of the following features is enabled: (Choose three)

Route-based VPN

IPS

IPv6

Overlapping NAT

16. Which of the following is NOT an alert option?

SNMP

High alert

Mail

User defined alert

17. What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

SmartCenter Server cannot reach this Security Gateway.

There is a blade reporting a problem.

VPN software blade is reporting a malfunction.

Security Gateway’s MGNT NIC card is disconnected.

18. Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

TCP port 19009

TCP Port 18190

TCP Port 18191

TCP Port 18209

19. How can SmartView application accessed?

http://<Security Management IP Address>/smartview

http://<Security Management IP Address>:4434/smartview/

https://<Security Management IP Address>/smartview/

https://<Security Management host name>:4434/smartview/

20. What is the SandBlast Agent designed to do?

Performs OS-level sandboxing for SandBlast Cloud architecture

Ensure the Check Point SandBlast services is running on the end user’s system

If malware enters an end user’s system, the SandBlast Agent prevents the malware from spreading with the network

Clean up email sent with malicious attachments

Page 3 of 10

21. In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a

response before the peer host is declared ‘down’, you would set the_________?

life sign polling interval

life sign timeout

life_sign_polling_interval

life_sign_timeout

22. How many images are included with Check Point TE appliance in Recommended Mode?

2(OS) images

images are chosen by administrator during installation

as many as licensed for

the most new image

23. The Firewall kernel is replicated multiple times, therefore:

The Firewall kernel only touches the packet if the connection is accelerated

The Firewall can run different policies per core

The Firewall kernel is replicated only with new connections and deletes itself once the connection times out

The Firewall can run the same policy on all cores.

24. In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log .

Which of the following options can you add to each Log, Detailed Log and Extended Log?

Accounting

Suppression

Accounting/Suppression

Accounting/Extended

25. Which blades and or features are not supported in R80?

SmartEvent Maps

SmartEvent

Identity Awareness

SmartConsole Toolbars

26. View the rule below .

What does the lock-symbol in the left column mean? (Choose the BEST answer.)

The current administrator has read-only permissions to Threat Prevention Policy.

Another user has locked the rule for editing.

Configuration lock is present. Click the lock symbol to gain read-write access.

The current administrator is logged in as read-only because someone else is editing the policy.

27. How many layers make up the TCP/IP model?

28. UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users .

Which action is not supported in UserCheck objects?

Ask

Drop

Inform

Reject

29. Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Detects and blocks malware by correlating multiple detection engines before users are affected.

Configure rules to limit the available network bandwidth for specified users or groups.

Use UserCheck to help users understand that certain websites are against the company’s security policy.

Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.

30. In R80 spoofing is defined as a method of:

Disguising an illegal IP address behind an authorized IP address through Port Address Translation.

Hiding your firewall from unauthorized users.

Detecting people using false or wrong authentication logins

Making packets appear as if they come from an authorized IP address.

Page 4 of 10

31. Which Check Point software blade provides Application Security and identity control?

Identity Awareness

Data Loss Prevention

URL Filtering

Application Control

32. In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with __________________ will not apply.

ffff

33. How many policy layers do Access Control policy support?

34. By default, the R80 web API uses which content-type in its response?

Java Script

XML

Text

JSON

35. Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

assign privileges to users.

edit the home directory of the user.

add users to your Gaia system.

assign user rights to their home directory in the Security Management Server.

36. You need to change the MAC-address on eth2 interface of the gateway .

What is the correct way to change MAC-address in Check Point Gaia?

In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11

In expert-mode run ifconfig eth1 hw 11:11:11:11 11 11

In CLISH run set interface eth2 hw-addr 11 11 11:11:11 11

In expert-mode run: ethtool -4 eth2 mac 11 11:11:11:11:11

37. What is the command used to activated Multi-Version Cluster mode?

set cluster member mvc on in Clish

set mvc on on Clish

set cluster MVC on in Expert Mode

set cluster mvc on in Expert Mode

38. You want to store the GAIA configuration in a file for later reference .

What command should you use?

write mem <filename>

show config Cf <filename>

save config Co <filename>

save configuration <filename>

39. Fill in the blank: __________ information is included in “Full Log” tracking option, but is not included in “Log” tracking option?

Destination port

Data type

File attributes

Application

40. When gathering information about a gateway using CPINFO, what information is included or excluded when using the “-x” parameter?

Includes the registry

Gets information about the specified Virtual System

Does not resolve network addresses

Output excludes connection table

Page 5 of 10

41. What information is NOT collected from a Security Gateway in a Cpinfo?

Firewall logs

Configuration and database files

System message logs

OS and network statistics

42. Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

15 sec

60 sec

5 sec

30 sec

43. What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Stateful Mode

VPN Routing Mode

Wire Mode

Stateless Mode

44. The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?

field_name:string

name field:string

name_field:string

field name:string

45. Which 3 types of tracking are available for Threat Prevention Policy?

SMS Alert, Log, SNMP alert

Syslog, None, User-defined scripts

None, Log, Syslog

Alert, SNMP trap, Mail

46. Which TCP-port does CPM process listen to?

18191

18190

8983

19009

47. Which is NOT an example of a Check Point API?

Gateway API

Management API

OPSEC SDK

Threat Prevention API

48. Joey want to configure NTP on R80 Security Management Server. He decided to do this via WebUI .

What is the correct address to access the Web UI for Gaia platform via browser?

https://<Device_IP_Adress>

http://<Device IP_Address>:443

https://<Device_IP_Address>:10000

https://<Device_IP_Address>:4434

49. What solution is Multi-queue intended to provide?

Improve the efficiency of traffic handling by SecureXL SNDs

Reduce the confusion for traffic capturing in FW Monitor

Improve the efficiency of CoreXL Kernel Instances

Reduce the performance of network interfaces

50. To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:

fw ctl Dyn_Dispatch on

fw ctl Dyn_Dispatch enable

fw ctl multik set_mode 4

fw ctl multik set_mode 1

Page 6 of 10

51. How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

By dropping traffic from websites identified through ThreatCloud Verification and URL Caching

By dropping traffic that is not proven to be from clean websites in the URL Filtering blade

By allowing traffic from websites that are known to run Antivirus Software on servers regularly

By matching logs against ThreatCloud information about the reputation of the website

52. Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Dynamic ID

RADIUS

Username and Password

Certificate

53. Packet acceleration (SecureXL) identifies connections by several attributes- Which of the attributes is NOT used for identifying connection?

Source Address

Destination Address

TCP Acknowledgment Number

Source Port

54. You have enabled “Full Log” as a tracking option to a security rule. However, you are still not seeing any data type information .

What is the MOST likely reason?

Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database.

Data Awareness is not enabled.

Identity Awareness is not enabled.

Logs are arriving from Pre-R80 gateways.

55. SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

ping, traceroute, netstat, and route

ping, nslookup, Telnet, and route

ping, whois, nslookup, and Telnet

ping, traceroute, netstat, and nslookup

56. After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

cvpnd_restart

cvpnd restart

cvpnrestart

57. As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

That is used to deploy the mobile device as a generator of one-time passwords for authenticating to an RSA Authentication Manager.

Fill Layer4 VPN CSSL VPN that gives users network access to all mobile applications.

Full Layer3 VPN CIPSec VPN that gives users network access to all mobile applications.

You can make sure that documents are sent to the intended recipients only.

58. Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R80.X The Network Security Developer Team is having an issue testing the API with a newly deployed R80.X Security Management Server Aaron wants to confirm API services are working properly .

What should he do first?

Aaron should check API Server status with "fwm api status" from Expert mode If services are stopped, he should start them with "fwm api start".

Aaron should check API Server status with "cpapi status" from Expert mode. If services are stopped, he should start them with "cpapi start"

Aaron should check API Server status with "api status" from Expert mode If services are stopped, he should start them with "api start"

Aaron should check API Server status with "cpm api status" from Expert mode. If services are stopped, he should start them with "cpi api start".

59. The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Secure Internal Communication (SIC)

Restart Daemons if they fail

Transfers messages between Firewall processes

Pulls application monitoring status

60. Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic. However, in the Application Control policy layer, the default action is ______ all traffic.

Accept; redirect

Accept; drop

Redirect; drop

Drop; accept

Page 7 of 10

61. Post-Automatic/Manual NAT rules

1, 2, 3, 4

1, 4, 2, 3

3, 1, 2, 4

4, 3, 1, 2

62. In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

fw ctl sdstat

fw ctl affinity Cl Ca Cr Cv

fw ctl multik stat

cpinfo

63. What is not a purpose of the deployment of Check Point API?

Execute an automated script to perform common tasks

Create a customized GUI Client for manipulating the objects database

Create products that use and enhance the Check Point solution

Integrate Check Point products with 3rd party solution

64. What is the default size of NAT table fwx_alloc?

20000

35000

25000

10000

65. How would you enable VMAC Mode in ClusterXL?

Cluster Object -> Edit -> ClusterXL and VRRP -> Use Virtual MAC

fw ctl set int vmac_mode 1

cphaconf vmac_mode set 1

Cluster Object -> Edit -> Cluster Members -> Edit -> Use Virtual MAC

66. In what way are SSL VPN and IPSec VPN different?

SSL VPN is using HTTPS in addition to IKE, whereas IPSec VPN is clientless

SSL VPN adds an extra VPN header to the packet, IPSec VPN does not

IPSec VPN does not support two factor authentication, SSL VPN does support this

IPSec VPN uses an additional virtual adapter; SSL VPN uses the client network adapter only.

67. Which statement is correct about the Sticky Decision Function?

It is not supported with either the Performance pack of a hardware based accelerator card

Does not support SPI’s when configured for Load Sharing

It is automatically disabled if the Mobile Access Software Blade is enabled on the cluster

It is not required L2TP traffic

68. What is true about the IPS-Blade?

In R80, IPS is managed by the Threat Prevention Policy

In R80, in the IPS Layer, the only three possible actions are Basic, Optimized and Strict

In R80, IPS Exceptions cannot be attached to “all rules”

In R80, the GeoPolicy Exceptions and the Threat Prevention Exceptions are the same

69. Session unique identifiers are passed to the web api using which http header option?

X-chkp-sid

Accept-Charset

Proxy-Authorization

Application

70. Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

Application Control

Threat Emulation

Anti-Virus

Advanced Networking Blade

Page 8 of 10

71. Which of these is an implicit MEP option?

Primary-backup

Source address based

Round robin

Load Sharing

72. What SmartEvent component creates events?

Consolidation Policy

Correlation Unit

SmartEvent Policy

SmartEvent GUI

73. Which one of the following is true about Threat Emulation?

Takes less than a second to complete

Works on MS Office and PDF files only

Always delivers a file

Takes minutes to complete (less than 3 minutes)

74. SandBlast agent extends 0 day prevention to what part of the network?

Web Browsers and user devices

DMZ server

Cloud

Email servers

75. After verifying that API Server is not running, how can you start the API Server?

Run command "set api start" in CLISH mode

Run command "mgmt__cli set api start" in Expert mode

Run command "mgmt api start" in CLISH mode

Run command "api start" in Expert mode

76. While using the Gaia CLI. what is the correct command to publish changes to the management server?

json publish

mgmt publish

mgmt_cli commit

commit

77. Which Remote Access Client does not provide an Office-Mode Address?

SecuRemote

Endpoint Security Suite

Endpoint Security VPN

Check Point Mobile

78. Check Point security components are divided into the following components:

GUI Client, Security Gateway, WebUI Interface

GUI Client, Security Management, Security Gateway

Security Gateway, WebUI Interface, Consolidated Security Logs

Security Management, Security Gateway, Consolidate Security Logs

79. Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

Time object to a rule to make the rule active only during specified times.

Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.

80. What processes does CPM control?

Object-Store, Database changes, CPM Process and web-services

web-services, CPMI process, DLEserver, CPM process

DLEServer, Object-Store, CP Process and database changes

web_services, dle_server and object_Store

Page 9 of 10

81. Which of the following is NOT a VPN routing option available in a star community?

To satellites through center only.

To center, or through the center to other satellites, to Internet and other VPN targets.

To center and to other satellites through center.

To center only.

82. Please choose correct command to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI?

host name myHost12 ip-address 10.50.23.90

mgmt: add host name ip-address 10.50.23.90

add host name emailserver1 ip-address 10.50.23.90

mgmt: add host name emailserver1 ip-address 10.50.23.90

83. Which is NOT a SmartEvent component?

SmartEvent Server

Correlation Unit

Log Consolidator

Log Server

84. Where do you create and modify the Mobile Access policy in R80?

SmartConsole

SmartMonitor

SmartEndpoint

SmartDashboard

85. What will be the effect of running the following command on the Security Management Server?

Remove the installed Security Policy.

Remove the local ACL lists.

No effect.

Reset SIC on all gateways.

86. When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events .

What is this setting called and what are you defining?

Network, and defining your Class A space

Topology, and you are defining the Internal network

Internal addresses you are defining the gateways

Internal network(s) you are defining your networks

87. You have existing dbedit scripts from R77. Can you use them with R80.10?

dbedit is not supported in R80.10

dbedit is fully supported in R80.10

You can use dbedit to modify threat prevention or access policies, but not create or modify layers

dbedit scripts are being replaced by mgmt_cli in R80.10

88. To optimize Rule Base efficiency, the most hit rules should be where?

Removed from the Rule Base.

Towards the middle of the Rule Base.

Towards the top of the Rule Base.

Towards the bottom of the Rule Base.

89. In which formats can Threat Emulation forensics reports be viewed in?

TXT, XML and CSV

PDF and TXT

PDF, HTML, and XML

PDF and HTML

90. What is the minimum amount of RAM needed for a Threat Prevention Appliance?

6 GB

8GB with Gaia in 64-bit mode

4 GB

It depends on the number of software blades enabled

Page 10 of 10

91. Which software blade does NOT accompany the Threat Prevention policy?

Anti-virus

IPS

Threat Emulation

Application Control and URL Filtering

92. Which of the following is NOT a type of Endpoint Identity Agent?

Terminal

Light

Full

Custom

93. You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or _____ action for the file types.

Inspect/Bypass

Inspect/Prevent

Prevent/Bypass

Detect/Bypass

94. Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

ffffffff

00000001

00000002

00000003

95. What command can you use to have cpinfo display all installed hotfixes?

cpinfo -hf

cpinfo Cy all

cpinfo Cget hf

cpinfo installed_jumbo

96. Which NAT rules are prioritized first?

Post-Automatic/Manual NAT rules

Manual/Pre-Automatic NAT

Automatic Hide NAT

Automatic Static NAT

97. What is not a component of Check Point SandBlast?

Threat Emulation

Threat Simulator

Threat Extraction

Threat Cloud

98. What destination versions are supported for a Multi-Version Cluster Upgrade?

R80.40 and later

R76 and later

R70 and Later

R80.10 and Later

99. There are 4 ways to use the Management API for creating host object with R80 Management API .

Which one is NOT correct?

Using Web Services

Using Mgmt_cli tool

Using CLISH

Using SmartConsole GUI console

Events are collected with SmartWorkflow from Trouble Ticket systems

100. You have pushed policy to GW-3 and now cannot pass traffic through the gateway.

As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?

fw unloadlocal

fw unloadpolicy

fwm unload local

fwm unload policy