156-315.81 Online Practice Questions and Answers

Correct Answer: D

Full synchronization between cluster members is handled by Firewall Kernel using TCP port 256 by default. Full synchronization occurs when a cluster member joins or rejoins the cluster and needs to receive the entire state table from

another member. References:

[ClusterXL Administration Guide]

Correct Answer: A

The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via the cpm process. The cpm process is the main management process that handles database operations, policy installation, and communication with GUI clients via TCP port 190093. The other options are either incorrect or irrelevant to the log flow. References: Certified Security Expert (CCSE) R81.20 Course Overview, Check Point Ports Used for Communication by Various Check Point Modules

Correct Answer: C

The formats in which Threat Emulation forensics reports can be viewed in are PDF, HTML, and XML. Threat Emulation is a feature that detects and prevents zero-day attacks by emulating files in a sandbox environment and analyzing their behavior. Threat Emulation generates forensics reports that provide detailed information about the emulated files, such as verdict, severity, activity summary, screenshots, network activity, registry activity, file activity, and process activity. These reports can be viewed in PDF, HTML, or XML formats from SmartConsole or SmartView.

Correct Answer: A

SandBlast agent extends zero-day prevention to web browsers and user devices. Zero-day prevention is a capability that protects devices from unknown and emerging threats that exploit vulnerabilities that have not been patched or disclosed. SandBlast Agent provides zero-day prevention by using various technologies such as threat emulation, threat extraction, anti-exploitation, anti-ransomware, and behavioral analysis. SandBlast Agent protects web browsers and user devices from malicious downloads, phishing links, drive-by downloads, browser exploits, malicious scripts, and more.

Correct Answer: D

The kind of information that you would expect to see using the sim affinity command is network interfaces and core distribution used for CoreXL. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. CoreXL is a technology that improves the performance of the Security Gateway by using multiple cores to handle concurrent connections. The sim affinity command can show which network interfaces and SecureXL instances are bound to which CPU cores, and allow administrators to change the affinity settings.

Correct Answer: C

According to the Check Point website, you can use the pre_upgrade_verifier tool to verify if your management server is ready to upgrade to R81.20. This tool checks the compatibility of your current configuration and database with the target version, and provides a detailed report of any issues or warnings. The other tools are either used for exporting or importing databases, or not valid tools. References: Upgrade Verification Service

Correct Answer: C

The Check Point installation history feature provides the following:

Policy Installation Date: The date and time when the policy was installed on the Security Gateway.

View install changes: The ability to view the differences between two policy versions that were installed on the Security Gateway. Install specific version: The ability to install a specific policy version from the installation history on the Security

Gateway3. References: Check Point R81 SmartConsole Guide

Correct Answer: B

Endpoint Security VPN is a lightweight remote access client that supports Windows and macOS computers. It provides secure connectivity to corporate resources using L2TP/IPSec, SSL, or Check Point's proprietary VPN protocol. Endpoint Security VPN also integrates with other Endpoint Security products such as SandBlast Agent, Full Disk Encryption, Media Encryption, and Firewall. References: Check Point R81 Endpoint Security VPN Administration Guide, page 5

Correct Answer: B

The FWD process provides logging services, such as forwarding logs from Gateway to Log Server, providing Log Export API (LEA) and Event Logging API (EL-A) services. The FWD process is responsible for sending logs from the Security

Gateway to the Security Management Server or Log Server, and for fetching logs from the Security Management Server or Log Server to SmartConsole. The FWD process also handles the communication with external logging applications

that use the LEA or EL-A protocols.

References:

FWD process does not work after reboot - Check Point CheckMates, section "FWD process does not work after reboot"

Check Point R81, section "Logging and Monitoring"

CoreXL Dynamic Dispatcher - Check Point Software, section "Example of output"

Correct Answer: D

You can establish a VPN before the user login to the Endpoint Client by enabling Machine Authentication in the Gateway object of the Smart Console1. Machine Authentication is a feature that allows you to authenticate with a machine

certificate and establish a VPN tunnel before the Windows Logon2. This feature provides the following benefits2:

It enhances the security of the VPN connection by verifying the identity of the machine before allowing access to the network. It simplifies the user experience by eliminating the need to enter credentials twice (once for the VPN and once for

the Windows Logon). It enables seamless connectivity to the network resources and domain services, such as Group Policy, login scripts, and mapped drives. Machine Authentication is supported on Check Point Endpoint Security Client for

Windows with E80.71 and higher versions2. It requires a hotfix on top of R77.30 jumbo 286 on the Security Gateway2. To configure Machine Authentication, you need to do the following steps2:

Generate and distribute machine certificates to the Endpoint machines using a trusted Certificate Authority (CA).

Enable Machine Authentication in the Gateway object of the Smart Console and select the CA that issued the machine certificates. Install policy on the Security Gateway and reboot it. Enable Machine Authentication in the Endpoint Security

Client and select the machine certificate to use.