Passing CheckPoint 156-215.81 Exam Using 2024 Practice Tests

156-215.81 Study Guide Brilliant 156-215.81 Exam Dumps PDF

NEW QUESTION # 131
When a SAM rule is required on Security Gateway to quickly block suspicious connections which are not restricted by the Security Policy, what actions does the administrator need to take?

• A. The administrator must work on the firewall CLI (for example with SSH and PuTTY) and the command
  'sam block' must be used with the right parameters.
• B. SmartView Monitor should be opened and then the SAM rule/s can be applied immediately. Installing policy is not required.
• C. The administrator should open the LOGS & MONITOR view and find the relevant log. Right clicking on the log entry will show the Create New SAM rule option.
• D. The policy type SAM must be added to the Policy Package and a new SAM rule must be applied.
  Simply Publishing the changes applies the SAM rule on the firewall.

Answer: B

Explanation:
Explanation
When a SAM rule is required on Security Gateway to quickly block suspicious connections which are not restricted by the Security Policy, the administrator needs to take the following action: SmartView Monitor should be opened and then the SAM rule/s can be applied immediately. Installing policy is not required. SAM stands for Suspicious Activity Monitoring and is a feature that allows administrators to block or limit connections from specific sources or destinations without modifying the security policy. SAM rules can be created from SmartView Monitor or SmartEvent based on real-time network activity or security events.
References: [Check Point R81 SmartView Monitor Administration Guide]

NEW QUESTION # 132
In SmartEvent, a correlation unit (CU) is used to do what?

• A. Send SAM block rules to the firewalls during a DOS attack.
• B. Analyze log entries and identify events.
• C. Receive firewall and other software blade logs in a region and forward them to the primary log server.
• D. Collect security gateway logs, Index the logs and then compress the logs.

Answer: B

Explanation:
Explanation
A correlation unit (CU) is a component of SmartEvent that analyzes log entries on log servers and identifies events based on predefined or custom rules1. A CU receives logs from one or more log servers and forwards them to the SmartEvent server, where they are stored in the events database

NEW QUESTION # 133
Katie has been asked to do a backup on the Blue Security Gateway.
Which command would accomplish this in the Gaia CLI?

• A. Blue > add backup local
• B. Expert&Blue#add local backing
• C. Blue > add local backup
• D. Blue > set backup local

Answer: A

NEW QUESTION # 134
When connected to the Check Point R80 Management Server using the SmartConsole the first administrator to connect has a lock on:

• A. Only the objects being modified in the Management Database and other administrators can connect to make changes using a special session as long as they all connect from the same LAN network.
• B. Only the objects being modified in his session of the Management Database and other administrators can connect to make changes using different sessions.
• C. The entire Management Database and other administrators can connect to make changes only if the first administrator switches to Read-only.
• D. The entire Management Database and all sessions and other administrators can connect only as Read-only.

Answer: B

NEW QUESTION # 135
URL Filtering cannot be used to:

• A. Control Bandwidth issues
• B. Control Data Security
• C. Improve organizational security
• D. Decrease legal liability

Answer: A

Explanation:
Explanation
URL Filtering is a blade that enables administrators to control access to millions of websites by category, users, groups, and machines. URL Filtering can be used to improve organizational security, decrease legal liability, and control data security by preventing users from accessing malicious or inappropriate websites. However, URL Filtering cannot be used to control bandwidth issues, such as limiting the amount of traffic or prioritizing certain applications over others3. For that purpose, other blades such as QoS (Quality of Service) or SecureXL are more suitable. References: Check Point R81 URL Filtering Administration Guide

NEW QUESTION # 136
Which statement describes what Identity Sharing is in Identity Awareness?

• A. Security Gateways can acquire and share identities with other Security Gateways
• B. Administrators can share identifies with other administrators
• C. Management servers can acquire and share identities with Security Gateways
• D. Users can share identities with other users

Answer: A

Explanation:
Identity Sharing
Best Practice - In environments that use many Security Gateways and AD Query, we recommend that you set only one Security Gateway to acquire identities from a given Active Directory domain controller for each physical site. If more than one Security Gateway gets identities from the same AD server, the AD server can become overloaded with WMI queries.
Set these options on the Identity Awareness > Identity Sharing page of the Security Gateway object:

NEW QUESTION # 137
When using Automatic Hide NAT, what is enabled by default?

• A. Static Route
• B. HTTPS Inspection
• C. Static NAT
• D. Source Port Address Translation (PAT)

Answer: D

Explanation:
Explanation
When using Automatic Hide NAT, Source Port Address Translation (PAT) is enabled by default1. This means that the source IP address and port number are translated to a different IP address and port number. This allows multiple hosts to share a single IP address for outbound connections. References: Check Point R81 Firewall Administration Guide

NEW QUESTION # 138
After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?

• A. Security Gateway IP-address cannot be changed without re-establishing the trust
• B. The Security Gateway name cannot be changed in command line without re-establishing trust
• C. The Security Management Server IP-address cannot be changed without re-establishing the trust
• D. The Security Management Server name cannot be changed in SmartConsole without re-establishing trust

Answer: A

NEW QUESTION # 139
Examine the sample Rule Base.

What will be the result of a verification of the policy from SmartConsole?

• A. Verification Error. Rule 7 (Clean-Up Rule) hides Implicit Clean-up Rule
• B. No errors or Warnings
• C. Verification Error. Rule 4 (Web Inbound) hides Rule 6 (Webmaster access)
• D. Verification Error. Empty Source-List in Rule 5 (Mail Inbound)

Answer: C

Explanation:
Explanation
Verification Error. Rule 4 (Web Inbound) hides Rule 6 (Webmaster access) is the correct answer. This is because Rule 4 has a broader source and destination than Rule 6, and both rules have the same service (HTTP). Therefore, Rule 6 will never be matched, and the Webmaster access will be denied. References:
Check Point R80.10 - Part 3 - Rule Base Order

NEW QUESTION # 140
With URL Filtering, what portion of the traffic is sent to the Check Point Online Web Service for analysis?

• A. The IP address of the source machine.
• B. The end user credentials.
• C. The host portion of the URL.
• D. The complete communication is sent for inspection.

Answer: A

Explanation:
"A local cache that gives answers to 99% of URL categorization requests. When the cache does not have an answer, only the host name is sent to the Check Point Online Web Service for categorization. " https://downloads.checkpoint.com/fileserver/SOURCE/direct/ID/24853/FILE/CP_R77_ApplicationControlURLFiltering_AdminGuide.pdf

NEW QUESTION # 141
Which of the following is TRUE regarding Gaia command line?

• A. Configuration changes should be done in expert-mode and CLISH is used for monitoring
• B. Configuration changes should be done in mgmt_cli and use expert-mode for OS-level tasks.
• C. Configuration changes should be done in mgmt_di and use CLISH for monitoring. Expert mode is used only for OS level tasks
• D. All configuration changes should be made in CLISH and expert-mode should be used for OS-level tasks.

Answer: D

Explanation:
Explanation
The statement that is true regarding Gaia command line is that all configuration changes should be made in CLISH and expert-mode should be used for OS-level tasks. CLISH is the default shell of Gaia CLI that provides a limited set of commands for basic configuration and troubleshooting. Expert mode is an advanced shell that allows running Linux commands and accessing the file system. Configuration changes should not be done in expert-mode, as they may cause inconsistencies or errors in the system. The other statements are false regarding Gaia command line.

NEW QUESTION # 142
What is the purpose of Captive Portal?

• A. It authenticates users, allowing them access to the Internet and corporate resources
• B. It provides remote access to SmartConsole
• C. It manages user permission in SmartConsole
• D. It authenticates users, allowing them access to the Gaia OS

Answer: A

Explanation:
Explanation
Captive Portal is a feature of Identity Awareness that allows you to authenticate users through a web browser before they access the Internet or corporate resources. Captive Portal can be used for various authentication methods, such as user name and password, one-time password (OTP), or certificate3. Captive Portal does not manage user permission in SmartConsole, provide remote access to SmartConsole, or authenticate users to the Gaia OS. Those are different functions that are not related to Captive Portal. References: Check Point R81 Identity Awareness Administration Guide

NEW QUESTION # 143
Which authentication scheme requires a user to possess a token?

• A. Check Point password
• B. TACACS
• C. RADIUS
• D. SecurID

Answer: D

Explanation:
SecurID
SecurID requires users to both possess a token authenticator and to supply a PIN or password

NEW QUESTION # 144
Fill in the blanks: There are ________ types of software containers ________.

• A. Three; security management, Security Gateway, and endpoint security
• B. Two; security management and endpoint security
• C. Three; Security gateway, endpoint security, and gateway management
• D. Two; endpoint security and Security Gateway

Answer: A

Explanation:
There are three types of Software Containers: Security Management, Security Gateway, and Endpoint Security.

NEW QUESTION # 145
With URL Filtering, what portion of the traffic is sent to the Check Point Online Web Service for analysis?

• A. The host portion of the URL.
• B. The end user credentials.
• C. The complete communication is sent for inspection.
• D. The IP address of the source machine.

Answer: A

NEW QUESTION # 146
Of all the Check Point components in your network, which one changes most often and should be backed up most frequently?

• A. Security Gateway
• B. SmartConsole
• C. Security Management Server
• D. SmartManager

Answer: C

Explanation:
Explanation
The Security Management Server is the component that changes most often and should be backed up most frequently, because it stores all the security policies and configurations for the Check Point components in your network. The other components are either clients or gateways that do not change as frequently.
References: Check Point Security Management Administration Guide R81, p. 9

NEW QUESTION # 147
What does it mean if Deyra sees the gateway status:

Choose the BEST answer.

• A. SmartCenter Server cannot reach this Security Gateway
• B. VPN software blade is reporting a malfunction
• C. Security Gateway's MGNT NIC card is disconnected.
• D. There is a blade reporting a problem

Answer: D

Explanation:

NEW QUESTION # 148
What type of NAT is a one-to-one relationship where each host is translated to a unique address?

• A. Static
• B. Destination
• C. Source
• D. Hide

Answer: A

Explanation:
Explanation
The type of NAT that is a one-to-one relationship where each host is translated to a unique address is Static NAT. Static NAT maps an unregistered IP address to a registered IP address on a one-to-one basis3. This means that for each internal host, there is a corresponding external address that represents it3. Therefore, the correct answer is B

NEW QUESTION # 149
Where can administrator edit a list of trusted SmartConsole clients in R81?

• A. In cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole: Manage and Settings>Permissions and Administrators>Advanced>Trusted Clients.
• B. cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server.
• C. Only using SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients.
• D. WebUI client logged to Security Management Server, SmartDashboard: Manage and Settings>Permissions and Administrators>Advanced>Trusted Clients, via cpconfig on a Security Gateway.

Answer: A

NEW QUESTION # 150
Fill in the blank: When tunnel test packets no longer invoke a response, SmartView Monitor displays _____________ for the given VPN tunnel.

• A. Down
• B. Failed
• C. No Response
• D. Inactive

Answer: A

NEW QUESTION # 151
The Online Activation method is available for Check Point manufactured appliances. How does the administrator use the Online Activation method?

• A. Using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts.
• B. The SmartLicensing GUI tool must be launched from the SmartConsole for the Online Activation tool to start automatically.
• C. The cpinfo command must be run on the firewall with the switch -online-license-activation.
• D. No action is required if the firewall has internet access and a DNS server to resolve domain names.

Answer: A

Explanation:
Explanation
The Online Activation method is available for Check Point manufactured appliances. The administrator uses the Online Activation method by using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts. This method requires internet access and a valid User Center account. References: [Check Point Licensing and Contract Operations User Guide], [Check Point R81 Gaia Installation and Upgrade Guide]

NEW QUESTION # 152
After a new Log Server is added to the environment and the SIC trust has been established with the SMS what will the gateways do?

• A. Gateways will send new firewall logs to the new Log Server as soon as the SIC trust is set up between the SMS and the new Log Server.
• B. The firewalls will detect the new Log Server after the next policy install and redirect the new logs to the new Log Server.
• C. The gateways can only send logs to an SMS and cannot send logs to a Log Server. Log Servers are proprietary log archive servers.
• D. Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.

Answer: D

Explanation:
https://sc1.checkpoint.com/documents/SMB_R80.20/AdminGuides/Locally_Managed/EN/Content/Topics/Configuring-External-Log-Servers.htm?TocPath=Appliance%20Configuration%7CLogs%20and%20Monitoring%7C_____3
https://sc1.checkpoint.com/documents/SMB_R80.20/AdminGuides/Locally_Managed/EN/Content/Topics/Configuring-External-Log-Servers.htm?TocPath=Appliance%20Configuration%7CLogs%20and%20Monitoring%7C_____3

NEW QUESTION # 153
Look at the following screenshot and select the BEST answer.

• A. Clients external to the Security Gateway can download archive files from FTP_Ext server using FTP.
• B. Clients external to the Security Gateway can upload any files to the FTP_Ext-server using FTP.
• C. Internal clients can upload and download archive-files to FTP_Ext server using FTP.
• D. Internal clients can upload and download any-files to FTP_Ext-server using FTP.

Answer: A

NEW QUESTION # 154
Using ClusterXL, what statement is true about the Sticky Decision Function?

• A. Is only relevant when using SecureXL
• B. Is configured using cpconfig
• C. Can only be changed for Load Sharing implementations
• D. All connections are processed and synchronized by the pivot

Answer: C

NEW QUESTION # 155
When configuring LDAP User Directory integration, Changes applied to a User Directory template are:

• A. Not reflected for any users unless the local user template is changed.
• B. Reflected immediately for all users who are using template.
• C. Not reflected for any users who are using that template.
• D. Reflected for all users who are using that template and if the local user template is changed as well.

Answer: B

NEW QUESTION # 156
......

CheckPoint 156-215.81 exam is a comprehensive test, covering a wide range of topics related to network security. 156-215.81 exam consists of 90 multiple-choice questions, and candidates have 120 minutes to complete it. 156-215.81 exam is computer-based and is administered at Pearson VUE testing centers worldwide. To pass the exam, candidates must achieve a minimum score of 70%.

 

Free 156-215.81 Test Questions Real Practice Test Questions: https://www.testsimulate.com/156-215.81-study-materials.html