Updated 156-215.81 Dumps - Best Way To Pass Check Point Certified Security Administrator R81 Exam

Updated 156-215.81 Dumps – Best Way To Pass Check Point Certified Security Administrator R81 Exam

Eleanor2022-11-07T07:35:09+00:00

By Eleanor CCSA, Check Point 156-215.81, 156-215.81 exam dumps, 156-215.81 free dumps, Check Point Certified Security Administrator R81 0 Comments

It is not easy to pass the 156-215.81 Check Point Certified Security Administrator R81 certification exam, so we have the most updated Check Point 156-215.81 dumps as your learning materials. No need to wait, just download the Check Point CCSA R81 156-215.81 dumps questions in pdf format to start learning all these questions and answers. Using the updated Check Point 156-215.81 dumps of ITPrepare to study will help you answer the CheckPoint 156-215.81 questions correctly.

Before Getting 156-215.81 Dumps PDF, Check 156-215.81 Free Demo Dumps Online

Page 1 of 10

1. Of all the Check Point components in your network, which one changes most often and should be backed up most frequently?

SmartManager

SmartConsole

Security Gateway

Security Management Server

2. After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?

Security Gateway IP-address cannot be changed without re-establishing the trust

The Security Gateway name cannot be changed in command line without re-establishing trust

The Security Management Server name cannot be changed in SmartConsole without re-establishing trust

The Security Management Server IP-address cannot be changed without re-establishing the trust

3. What is the purpose of the Stealth Rule?

To prevent users from directly connecting to a Security Gateway.

To reduce the number of rules in the database.

To reduce the amount of logs for performance issues.

To hide the gateway from the Internet.

4. Log query results can be exported to what file format?

Word Document (docx)

Comma Separated Value (csv)

Portable Document Format (pdf)

Text (txt)

5. You have enabled "Extended Log" as a tracking option to a security rule. However, you are still not seeing any data type information.

What is the MOST likely reason?

Identity Awareness is not enabled.

Log Trimming is enabled.

Logging has disk space issues

Content Awareness is not enabled.

6. An administrator wishes to enable Identity Awareness on the Check Point firewalls. However they allow users to use company issued or personal laptops.

Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

AD Query

Browser-Based Authentication

Identity Agents

Terminal Servers Agent

7. Fill in the blank: SmartConsole, SmartEvent GUI client, and ___________ allow viewing of billions of consolidated logs and shows them as prioritized security events.

SmartView Web Application

SmartTracker

SmartMonitor

SmartReporter

8. John is using Management HA.

Which Smartcenter should be connected to for making changes?

secondary Smartcenter

active Smartcenter

connect virtual IP of Smartcenter HA

primary Smartcenter

9. Under which file is the proxy arp configuration stored?

$FWDIR/state/proxy_arp.conf on the management server

$FWDIR/conf/local.arp on the management server

$FWDIR/state/_tmp/proxy.arp on the security gateway

$FWDIR/conf/local.arp on the gateway

10. Fill in the blank: An identity server uses a ___________ for user authentication.

Shared secret

Certificate

One-time password

Token

Page 2 of 10

11. Fill in the blanks: Default port numbers for an LDAP server is ______ for standard connections and _______ SSL connections.

675, 389

389, 636

636, 290

290, 675

12. URL Filtering employs a technology, which educates users on web usage policy in real time.

What is the name of that technology?

WebCheck

UserCheck

Harmony Endpoint

URL categorization

13. Fill in the blank: With the User Directory Software Blade, you can create user definitions on a(n) ___________ Server.

SecurID

LDAP

NT domain

SMTP

14. Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.

After installation, is the administrator required to perform any additional tasks?

Go to clash-Run cpstop | Run cpstart

Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway

Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores

Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway | Install Security Policy

15. Which option would allow you to make a backup copy of the OS and Check Point configuration, without stopping Check Point processes?

All options stop Check Point processes

backup

migrate export

snapshot

16. John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole.

To make John’s changes available to other administrators, and to save the database before installing a policy, what must John do?

Logout of the session

File > Save

Install database

Publish the session

17. Using ClusterXL, what statement is true about the Sticky Decision Function?

Can only be changed for Load Sharing implementations

All connections are processed and synchronized by the pivot

Is configured using cpconfig

Is only relevant when using SecureXL

18. What is the Transport layer of the TCP/IP model responsible for?

It transports packets as datagrams along different routes to reach their destination.

It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.

It defines the protocols that are used to exchange data between networks and how host programs interact with the Application layer.

It deals with all aspects of the physical components of network connectivity and connects with different network types.

19. What is the purpose of the CPCA process?

Monitoring the status of processes

Sending and receiving logs

Communication between GUI clients and the SmartCenter server

Generating and modifying certificates

20. Fill in the blank: Back up and restores can be accomplished through_________.

SmartConsole, WebUI, or CLI

WebUI, CLI, or SmartUpdate

CLI, SmartUpdate, or SmartBackup

SmartUpdate, SmartBackup, or SmartConsole

Page 3 of 10

21. When configuring Anti-Spoofing, which tracking options can an Administrator select?

Log, Alert, None

Log, Allow Packets, Email

Drop Packet, Alert, None

Log, Send SNMP Trap, Email

22. Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

Application Control

Threat Emulation

Anti-Virus

Advanced Networking Blade

23. In ____________ NAT, the ____________ is translated.

Hide; source

Static; source

Simple; source

Hide; destination

24. Name the authentication method that requires token authenticator.

SecureID

Radius

DynamicID

TACACS

25. What are the two types of NAT supported by the Security Gateway?

Destination and Hide

Hide and Static

Static and Source

Source and Destination

26. Which Identity Source(s) should be selected in Identity Awareness for when there is a requirement for a higher level of security for sensitive servers?

AD Query

Terminal Servers Endpoint Identity Agent

Endpoint Identity Agent and Browser-Based Authentication

RADIUS and Account Logon

27. Which of the following are types of VPN communities?

Pentagon, star, and combination

Star, octagon, and combination

Combined and star

Meshed, star, and combination

28. Which GUI tool can be used to view and apply Check Point licenses?

cpconfig

Management Command Line

SmartConsole

SmartUpdate

29. What type of NAT is a one-to-one relationship where each host is translated to a unique address?

Source

Static

Hide

Destination

30. How would you determine the software version from the CLI?

fw ver

fw stat

fw monitor

cpinfo

Page 4 of 10

31. In order for changes made to policy to be enforced by a Security Gateway, what action must an administrator perform?

Publish changes

Save changes

Install policy

Install database

32. Which Threat Prevention profile uses sanitization technology?

Cloud/data Center

perimeter

Sandbox

Guest Network

33. What is the purpose of Captive Portal?

It manages user permission in SmartConsole

It provides remote access to SmartConsole

It authenticates users, allowing them access to the Internet and corporate resources

It authenticates users, allowing them access to the Gaia OS

34. The Gateway Status view in SmartConsole shows the overall status of Security Gateways and Software Blades.

What does the Status Attention mean?

Cannot reach the Security Gateway.

The gateway and all its Software Blades are working properly.

At least one Software Blade has a minor issue, but the gateway works.

Cannot make SIC between the Security Management Server and the Security Gateway

35. An administrator can use section titles to more easily navigate between large rule bases.

Which of these statements is FALSE?

Section titles are not sent to the gateway side.

These sections are simple visual divisions of the Rule Base and do not hinder the order of rule enforcement.

A Sectional Title can be used to disable multiple rules by disabling only the sectional title.

Sectional Titles do not need to be created in the SmartConsole.

36. 1.URL Filtering cannot be used to:

Control Bandwidth issues

Control Data Security

Improve organizational security

Decrease legal liability

37. What is the purpose of a Clean-up Rule?

Clean-up Rules do not server any purpose.

Provide a metric for determining unnecessary rules.

To drop any traffic that is not explicitly allowed.

Used to better optimize a policy.

38. True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway

True, CLI is the prefer method for Licensing

False, Central License are handled via Security Management Server

False, Central License are installed via Gaia on Security Gateways

True, Central License can be installed with CPLIC command on a Security Gateway

39. Which type of attack can a firewall NOT prevent?

Network Bandwidth Saturation

Buffer Overflow

SYN Flood

SQL Injection

40. View the rule below.

What does the pen-symbol in the left column mean?

Those rules have been published in the current session.

Rules have been edited by the logged in administrator, but the policy has not been published yet.

Another user has currently locked the rules for editing.

The configuration lock is present. Click the pen symbol in order to gain the lock.

Page 5 of 10

41. Security Zones do no work with what type of defined rule?

Application Control rule

Manual NAT rule

IPS bypass rule

Firewall rule

42. From the Gaia web interface, which of the following operations CANNOT be performed on a Security Management Server?

Verify a Security Policy

Open a terminal shell

Add a static route

View Security Management GUI Clients

43. Which of the following commands is used to verify license installation?

Cplic verify license

Cplic print

Cplic show

Cplic license

44. Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Detects and blocks malware by correlating multiple detection engines before users are affected.

Configure rules to limit the available network bandwidth for specified users or groups.

Use UserCheck to help users understand that certain websites are against the company’s security policy.

Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.

45. Fill in the blank: ____________ is the Gaia command that turns the server off.

sysdown

exit

halt

shut-down

46. Fill in the blanks: The _______ collects logs and sends them to the _______.

Log server; Security Gateway

Log server; security management server

Security management server; Security Gateway

Security Gateways; log server

47. Full synchronization between cluster members is handled by Firewall Kernel.

Which port is used for this?

UDP port 265

TCP port 265

UDP port 256

TCP port 256

48. Can you use the same layer in multiple policies or rulebases?

Yes - a layer can be shared with multiple policies and rules.

No - each layer must be unique.

No - layers cannot be shared or reused, but an identical one can be created.

Yes - but it must be copied and pasted with a different name.

49. You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don’t have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher.

How can you enable them?

fw ctl multik dynamic_dispatching on

fw ctl multik dynamic_dispatching set_mode 9

fw ctl multik set_mode 9

fw ctl miltik pq enable

50. Both major kinds of NAT support Hide and Static NAT. However, one offers more flexibility.

Which statement is true?

Manual NAT can offer more flexibility than Automatic NA

Dynamic Network Address Translation (NAT) Overloading can offer more flexibility than Port Address Translation.

Dynamic NAT with Port Address Translation can offer more flexibility than Network Address Translation (NAT) Overloading.

Automatic NAT can offer more flexibility than Manual NA

Page 6 of 10

51. Which message indicates IKE Phase 2 has completed successfully?

Quick Mode Complete

Aggressive Mode Complete

Main Mode Complete

IKE Mode Complete

52. How are the backups stored in Check Point appliances?

Saved as*.tar under /var/log/CPbackup/backups

Saved as*tgz under /var/CPbackup

Saved as*tar under /var/CPbackup

Saved as*tgz under /var/log/CPbackup/backups

53. Fill in the blanks: A ____ license requires an administrator to designate a gateway for attachment whereas a _____ license is automatically attached to a Security Gateway.

Formal; corporate

Local; formal

Local; central

Central; local

54. Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the ____________ algorithm.

SHA-256

SHA-200

MD5

SHA-128

55. Which tool is used to enable ClusterXL?

SmartUpdate

cpconfig

SmartConsole

sysconfig

56. Fill in the blank: The _____ feature allows administrators to share a policy with other policy packages.

Concurrent policy packages

Concurrent policies

Global Policies

Shared policies

57. Which of the following is NOT a valid deployment option for R80?

All-in-one (stand-alone)

CloudGuard

Distributed

Bridge Mode

58. A network administrator has informed you that they have identified a malicious host on the network, and instructed you to block it. Corporate policy dictates that firewall policy changes cannot be made at this time.

What tool can you use to block this traffic?

Anti-Bot protection

Anti-Malware protection

Policy-based routing

Suspicious Activity Monitoring (SAM) rules

59. What kind of NAT enables Source Port Address Translation by default?

Automatic Static NAT

Manual Hide NAT

Automatic Hide NAT

Manual Static NAT

60. What is the purpose of the Clean-up Rule?

To log all traffic that is not explicitly allowed or denied in the Rule Base

To clean up policies found inconsistent with the compliance blade reports

To remove all rules that could have a conflict with other rules in the database

To eliminate duplicate log entries in the Security Gateway

Page 7 of 10

61. Which part of SmartConsole allows administrators to add, edit delete, and clone objects?

Object Browser

Object Editor

Object Navigator

Object Explorer

62. Most Check Point deployments use Gaia but which product deployment utilizes special Check Point code (with unification in R81.10)?

Enterprise Network Security Appliances

Rugged Appliances

Scalable Platforms

Small Business and Branch Office Appliances

63. Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance?

Application Control

Threat Emulation

Logging and Status

Monitoring

64. To enforce the Security Policy correctly, a Security Gateway requires:

a routing table

awareness of the network topology

a Demilitarized Zone

a Security Policy install

65. Choose what BEST describes users on Gaia Platform.

There are two default users and neither can be deleted.

There are two default users and one cannot be deleted.

There is one default user that can be deleted.

There is one default user that cannot be deleted.

66. What is the main objective when using Application Control?

To filter out specific content.

To assist the firewall blade with handling traffic.

To see what users are doing.

Ensure security and privacy of information.

67. When using Automatic Hide NAT, what is enabled by default?

Source Port Address Translation (PAT)

Static NAT

Static Route

HTTPS Inspection

68. What are the Threat Prevention software components available on the Check Point Security Gateway?

IPS, Threat Emulation and Threat Extraction

IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction

IPS, Anti-Bot, Anti-Virus, Threat Emulation and Threat Extraction

IDS, Forensics, Anti-Virus, Sandboxing

69. The competition between stateful inspection and proxies was based on performance, protocol support, and security.

Considering stateful Inspections and Proxies, which statement is correct?

Stateful Inspection is limited to Layer 3 visibility, with no Layer 4 to Layer 7 visibility capabilities.

When it comes to performance, proxies were significantly faster than stateful inspection firewalls.

Proxies offer far more security because of being able to give visibility of the payload (the data).

When it comes to performance, stateful inspection was significantly faster than proxies.

70. A SAM rule Is implemented to provide what function or benefit?

Allow security audits.

Handle traffic as defined in the policy.

Monitor sequence activity.

Block suspicious activity.

Page 8 of 10

71. In HTTPS Inspection policy, what actions are available in the "Actions" column of a rule?

"Inspect", "Bypass"

"Inspect", "Bypass", "Categorize"

"Inspect", "Bypass", "Block"

"Detect", "Bypass"

72. Stateful Inspection compiles and registers connections where?

Connection Cache

State Cache

State Table

Network Table

73. Which of the following methods can be used to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server?

Save Policy

Install Database

Save session

Install Policy

74. If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsible, which of these steps should NOT be performed:

Rename the hostname of the Standby member to match exactly the hostname of the Active member.

Change the Standby Security Management Server to Active.

Change the Active Security Management Server to Standby.

Manually synchronize the Active and Standby Security Management Servers.

75. What are the three components for Check Point Capsule?

Capsule Docs, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Cloud, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Connect

Capsule Workspace, Capsule Docs, Capsule Cloud

76. In which scenario is it a valid option to transfer a license from one hardware device to another?

From a 4400 Appliance to a 2200 Appliance

From a 4400 Appliance to an HP Open Server

From an IBM Open Server to an HP Open Server

From an IBM Open Server to a 2200 Appliance

77. To view statistics on detected threats, which Threat Tool would an administrator use?

Protections

IPS Protections

Profiles

ThreatWiki

78. Which statement is TRUE of anti-spoofing?

Anti-spoofing is not needed when IPS software blade is enabled

It is more secure to create anti-spoofing groups manually

It is BEST Practice to have anti-spoofing groups in sync with the routing table

With dynamic routing enabled, anti-spoofing groups are updated automatically whenever there is a routing change

79. What are the three main components of Check Point security management architecture?

SmartConsole, Security Management, and Security Gateway

Smart Console, Standalone, and Security Management

SmartConsole, Security policy, and Logs & Monitoring

GUI-Client, Security Management, and Security Gateway

80. To increase security, the administrator has modified the Core protection ‘Host Port Scan’ from ‘Medium’ to ‘High’ Predefined Sensitivity.

Which Policy should the administrator install after Publishing the changes?

The Access Control and Threat Prevention Policies.

The Access Control Policy.

The Access Control & HTTPS Inspection Policy.

The Threat Prevention Policy.

Page 9 of 10

81. True or False: More than one administrator can log into the Security Management Server with SmartConsole with write permission at the same time.

True, every administrator works on a different database that Is independent of the other administrators

False, this feature has to be enabled in the Global Properties.

True, every administrator works in a session that is independent of the other administrators

False, only one administrator can login with write permission

82. Fill in the blank: To create policy for traffic to or from a particular location, use the _____________.

DLP shared policy

Geo policy shared policy

Mobile Access software blade

HTTPS inspection

83. Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?

AES-GCM-256

AES-CBC-256

AES-GCM-128

84. With URL Filtering, what portion of the traffic is sent to the Check Point Online Web Service for analysis?

The complete communication is sent for inspection.

The IP address of the source machine.

The end user credentials.

The host portion of the UR

85. What is the default shell of Gaia CLI?

clish

Monitor

Read-only

Bash

86. Check Point licenses come in two forms.

What are those forms?

Central and Local.

Access Control and Threat Prevention.

On-premise and Public Cloud.

Security Gateway and Security Management.

87. Administrator Dave logs into R80 Management Server to review and makes some rule changes. He notices that there is a padlock sign next to the DNS rule in the Rule Base.

What is the possible explanation for this?

DNS Rule is using one of the new feature of R80 where an administrator can mark a rule with the padlock icon to let other administrators know it is important.

Another administrator is logged into the Management and currently editing the DNS Rule.

DNS Rule is a placeholder rule for a rule that existed in the past but was deleted.

This is normal behavior in R80 when there are duplicate rules in the Rule Base.

88. Choose what BEST describes the reason why querying logs now is very fast.

New Smart-1 appliances double the physical memory install

Indexing Engine indexes logs for faster search results

SmartConsole now queries results directly from the Security Gateway

The amount of logs been store is less than the usual in older versions

89. Where can administrator edit a list of trusted SmartConsole clients?

cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server.

In cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients.

WebUI client logged to Security Management Server, SmartDashboard: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients, via cpconfig on a Security Gateway.

Only using SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients.

90. What Check Point technologies deny or permit network traffic?

Application Control, DLP

Packet Filtering, Stateful Inspection, Application Layer Firewall.

ACL, SandBlast, MPT

IPS, Mobile Threat Protection

Page 10 of 10

91. DLP and Geo Policy are examples of what type of Policy?

Inspection Policies

Shared Policies

Unified Policies

Standard Policies

92. When an encrypted packet is decrypted, where does this happen?

Security policy

Inbound chain

Outbound chain

Decryption is not supported

93. Which of the following is NOT an authentication scheme used for accounts created through SmartConsole?

RADIUS

Check Point password

Security questions

SecurID

94. In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

SND is a feature to accelerate multiple SSL VPN connections

SND is an alternative to IPSec Main Mode, using only 3 packets

SND is used to distribute packets among Firewall instances

SND is a feature of fw monitor to capture accelerated packets

95. Which of the following situations would not require a new license to be generated and installed?

The Security Gateway is upgraded.

The existing license expires.

The license is upgraded.

The IP address of the Security Management or Security Gateway has changed.

96. From SecureXL perspective, what are the tree paths of traffic flow:

Initial Path; Medium Path; Accelerated Path

Layer Path; Blade Path; Rule Path

Firewall Path; Accept Path; Drop Path

Firewall Path; Accelerated Path; Medium Path

97. Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.

On all satellite gateway to satellite gateway tunnels

On specific tunnels for specific gateways

On specific tunnels in the community

On specific satellite gateway to central gateway tunnels

98. How do logs change when the "Accounting" tracking option is enabled on a traffic rule?

Involved traffic logs will be forwarded to a log server.

Provides log details view email to the Administrator.

Involved traffic logs are updated every 10 minutes to show how much data has passed on the connection.

Provides additional information to the connected user.

99. You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have received a call by one of the management users stating that they are unable to browse the Internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway.

How do you review the logs to see what the problem may be?

Open SmartLog and connect remotely to the IP of the wireless controller

Open SmartView Tracker and filter the logs for the IP address of the tablet

Open SmartView Tracker and check all the IP logs for the tablet

Open SmartLog and query for the IP address of the Manager’s tablet

100. Which tool is used to enable cluster membership on a Gateway?

SmartUpdate

cpconfig

SmartConsole

sysconfig

Updated 156-215.81 Dumps – Best Way To Pass Check Point Certified Security Administrator R81 Exam