156-215.81.20 Practice Test 10 — 10 Questions

Question 1

A security administrator at a financial firm needs to block all peer-to-peer file-sharing applications for the entire company, but must allow legitimate business use of instant messaging. The administrator wants the least administrative effort and automatic updates of new application signatures. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Application Control rule that blocks the Peer-to-Peer category and install the policy.. Application Control uses signatures to identify applications regardless of port or protocol. Blocking the Peer-to-Peer category in an Application Control rule immediately blocks all current and future P2P applications, while instant messaging remains allowed. Because signatures are updated automatically, no manual intervention is needed when new P2P apps appear.

Answer

Create a Service object for each known P2P protocol and add them to a drop rule in the firewall policy.

Answer

Create a URL Filtering rule that blocks the Peer-to-Peer category and install the policy.

Answer

Enable HTTPS Inspection and create a rule that blocks all applications except instant messaging.

Question 2

An administrator notices that a user is able to access a website categorized as 'Social Networking' even though the URL Filtering policy blocks that category. The administrator confirms the policy is installed and the user's traffic is inspected. What is the most likely cause?

Accepted Answer

The user is accessing the website via HTTPS, and HTTPS inspection is not enabled.. HTTPS inspection is required for URL Filtering to categorize and enforce policy on encrypted traffic. Without it, the gateway cannot see the full URL or category, so the block rule for 'Social Networking' may not apply. Enabling HTTPS inspection resolves this.

Answer

The user's IP address is excluded from the URL Filtering policy via a bypass rule.

Answer

The 'Social Networking' category is set to 'Ask' instead of 'Block' in the policy.

Answer

The website is also categorized under a custom category that is allowed.

Question 3

A company wants users on managed Windows endpoints to be identified by Identity Awareness without requiring them to open a browser or wait for an AD event log poll. The endpoints are domain-joined and already managed by the organization. Which acquisition method meets this requirement most directly?

Accepted Answer

Identity Agent installed on each managed endpoint. An endpoint-resident Identity Agent authenticates the logged-in user to the gateway automatically, providing immediate identification with no browser prompt and no dependency on AD event polling. For centrally managed, domain-joined Windows endpoints, this is the most direct way to achieve seamless, prompt-free identity acquisition.

Answer

Captive Portal with single sign-on enabled

Answer

AD Query configured against the domain controllers

Answer

RADIUS Accounting configured on the gateway

Question 4

A security administrator is configuring a new Security Gateway in SmartConsole. The gateway is behind a NAT device and its internal IP address is 10.1.1.1, but it communicates with the Management Server over the internet using a public IP address of 203.0.113.5. The administrator needs to ensure that SIC and policy installation work correctly. What should be configured on the gateway object in SmartConsole?

Accepted Answer

Set the gateway's IP address to 10.1.1.1 and enable 'IP Address is NATed' with the public IP 203.0.113.5.. When a gateway is behind NAT, the gateway object in SmartConsole must reflect the internal IP and have the NATed public IP configured. This allows the Management Server to use the correct address for SIC and policy installation. The 'IP Address is NATed' option ensures that the Management Server communicates with the gateway using the public IP while the gateway's internal configuration remains unchanged.

Answer

Set the gateway's IP address to 203.0.113.5 and disable NAT on the gateway.

Answer

Set the gateway's IP address to 203.0.113.5 and configure NAT on the gateway.

Answer

Set the gateway's IP address to 10.1.1.1 and configure a static route on the Management Server to reach 203.0.113.5.

Question 5

A security administrator needs to allow access to a specific website that is categorized as 'Social Networking' while blocking all other social networking sites. The administrator wants to ensure that only that particular URL is allowed. What is the most efficient way to achieve this in the URL Filtering policy?

Accepted Answer

Create a rule with the action 'Allow' for the specific URL and place it above the rule that blocks the 'Social Networking' category.. To allow a specific URL while blocking its category, the administrator can create an allow rule for that URL and position it above the category block rule. Check Point evaluates rules top-down, so the specific allow rule will match first, granting access to that URL. Other social networking sites will not match the allow rule and will be blocked by the category rule.

Answer

Modify the 'Social Networking' category to exclude the specific URL.

Answer

Use the 'Category Override' feature to allow the URL for all users.

Answer

Create a new rule with the action 'Block' for the specific URL and place it above the block rule for 'Social Networking'.

Question 6

A Check Point administrator is deploying a Mesh VPN community with three gateways: GW-A, GW-B, and GW-C. The administrator wants to ensure that traffic between any two gateways is encrypted and that the community automatically creates the necessary tunnels. After configuration, the administrator notices that traffic between GW-A and GW-C is not encrypted, while traffic between GW-A and GW-B is encrypted. What is the most likely reason for this issue?

Accepted Answer

GW-C is not included in the VPN community's 'Participating Gateways' list.. The correct answer is that GW-C is not included in the VPN community's 'Participating Gateways' list. In a Mesh community, all gateways that need to communicate securely must be explicitly added to the community. If GW-C is missing, no tunnel will be established between GW-A and GW-C, resulting in unencrypted traffic. The working tunnel between GW-A and GW-B confirms that the community and other settings are functional.

Answer

The 'Shared Secret' for GW-C is different from the one used by GW-A and GW-B.

Answer

The 'VPN Domain' of GW-C does not include the networks behind GW-A.

Answer

The 'Encryption Domain' of GW-A does not include the networks behind GW-C.

Question 7

A security administrator is troubleshooting a Site-to-Site VPN between two Check Point R81 gateways. The VPN tunnel is up, but traffic from a specific subnet behind Gateway A is not reaching the corresponding subnet behind Gateway B. The administrator has verified that the encryption domains include the correct subnets and that the VPN community is properly configured. Which action should the administrator take next to resolve the issue?

Accepted Answer

Verify that the Security Policy on both gateways allows the traffic between the subnets.. When a VPN tunnel is established but traffic fails to pass, the most common cause is a missing or misconfigured Security Policy rule on one or both gateways. The policy must explicitly allow the traffic between the subnets. Other settings like NAT, tunnel granularity, or permanent tunnels do not control whether traffic is permitted through the tunnel.

Answer

Increase the 'Tunnel Granularity' in the VPN community to 'Per Subnet Pair'.

Answer

Check the 'Disable NAT inside the VPN Community' setting in the VPN community.

Answer

Enable 'Permanent Tunnels' in the VPN community to keep the tunnel active.

Question 8

An administrator needs to block a specific web application that is not recognized by the default Application Control signature database. The application uses a custom protocol on TCP port 8443. What is the most appropriate method to achieve this?

Accepted Answer

Create a new Application Control signature using the Application Control Signature Tool.. To block a custom application not in the signature database, the administrator must create a custom Application Control signature using the Application Control Signature Tool. This tool allows defining the application based on port, protocol, and other characteristics. Port-based blocking or URL categorization would not accurately target the application and could cause collateral damage.

Answer

Enable the 'Application Control' blade and rely on its heuristic engine to detect the application.

Answer

Use a URL Filtering category override to block all traffic to the server hosting the application.

Answer

Configure a firewall rule that blocks all traffic on TCP port 8443.

Question 9

A Check Point administrator is configuring a Remote Access VPN with Endpoint Security VPN clients. The administrator wants to ensure that all traffic from the remote clients, including Internet-bound traffic, is routed through the Security Gateway for inspection. Which configuration should be enabled in the Remote Access VPN community?

Accepted Answer

Enable 'Route all traffic through this gateway' in the Remote Access VPN community.. To ensure all traffic from remote clients is inspected, the administrator must enable 'Route all traffic through this gateway' in the Remote Access VPN community. This setting overrides the client's default routing and directs all packets to the gateway, where they can be inspected and filtered according to policy.

Answer

Configure 'Office Mode' and assign IP addresses to clients.

Answer

Enable 'Hub Mode' in the Remote Access VPN community.

Answer

Configure 'Visitor Mode' to allow clients to connect from behind NAT devices.

Question 10

A security administrator needs to send only Security Gateway log records to an external SIEM over syslog, while keeping the Management Server's own audit logs local. Which Check Point configuration should be performed?

Accepted Answer

Configure Log Forwarding on the Security Gateway object with the external syslog server as the target and select the Security log type.. Log Forwarding is the supported Check Point feature for exporting logs from a Security Gateway to an external destination such as a syslog server. Because it is configured on the gateway object and lets you select log types, it can send security logs to the SIEM while leaving management-side audit logs in place. Other mechanisms either loop logs back internally or target the wrong log category.

Answer

Enable Log Forwarding in the Security Gateway object and set the Management Server as the target.

Answer

Run cp_log_export on the Management Server with the --audit flag and a remote destination.

Answer

Modify the fwd.elg file on the Security Gateway to redirect log output to the SIEM.