156-215.81.20 Practice Test 11 — 15 Questions

Question 1

A security administrator needs to block access to a specific unknown application that uses HTTP but does not match any signature in the current Application Control database. The administrator wants to ensure the application is blocked immediately without waiting for a database update. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom application signature using the 'Custom Application' feature in SmartConsole.. The Custom Application feature in Check Point allows administrators to define signatures for applications not yet recognized by the Application Control database. This provides immediate enforcement without relying on external updates, ensuring the unknown application is blocked promptly.

Answer

Configure a firewall rule to block all traffic on the application's default port.

Answer

Use a URL Filtering category override to block the application's known URLs.

Answer

Enable 'Application Control' in 'Detect' mode and rely on ThreatCloud to update the signature.

Question 2

An administrator is setting up a Remote Access VPN using Check Point Mobile Access Blade. The company wants to ensure that remote users can access internal resources using the same IP address throughout their session, and that the IP address is from a specific internal subnet. Which feature should be enabled in the gateway's Remote Access configuration?

Accepted Answer

Office Mode. Office Mode is designed to assign a virtual IP address to remote access clients from a predefined pool, often an internal subnet. This ensures the client has a consistent IP address for the session and can access internal resources as if it were on the local network. Other features like NAT Traversal, Visitor Mode, and SecureXL do not provide IP address assignment, so they do not meet the requirement.

Answer

Visitor Mode

Answer

NAT Traversal

Answer

SecureXL

Question 3

A security policy requires that users are presented with a warning page before accessing sites categorized as 'High Risk'. After the warning, they can choose to proceed. Which URL Filtering action should be configured in the rule?

Accepted Answer

Ask. The Ask action is designed to present a warning page and allow the user to proceed after acknowledgment. This aligns with the requirement to warn users before accessing high-risk sites while giving them the option to continue. Other actions either block completely or allow without warning.

Answer

Allow

Answer

Block

Answer

Inform

Question 4

A security administrator has configured a URL Filtering rule to block the 'Gambling' category. Users report that they can still access some gambling sites. The administrator checks the logs and sees that the traffic is being allowed by a rule that allows 'Any' application and 'Any' URL. The administrator verifies that the block rule is above the allow rule. What is the most likely reason for the issue?

Accepted Answer

The gambling sites are using HTTPS, and HTTPS Inspection is not enabled, so the gateway cannot see the full URL and thus cannot categorize it.. When HTTPS traffic is not inspected, the gateway can only see the server name indication (SNI) or the IP address, not the full URL. Many gambling sites use HTTPS, and if the domain alone is not categorized as Gambling, the block rule will not match. Enabling HTTPS Inspection allows the gateway to decrypt the traffic and inspect the full URL, ensuring proper categorization and blocking.

Answer

The allow rule is using a different action that overrides the block rule.

Answer

The gateway is not licensed for URL Filtering, so it ignores the block rule.

Answer

The 'Gambling' category is not included in the URL Filtering database by default.

Question 5

A security administrator is configuring NAT for a Check Point R81 Security Gateway that protects a web server farm. The administrator needs to ensure that external users can access the web servers using a single public IP, and that the web servers can initiate outbound connections to the Internet. The administrator decides to use manual NAT rules. Which two statements are correct regarding the configuration of manual NAT rules in this scenario? (Choose two.)

Accepted Answer

Manual NAT rules can be configured to translate both source and destination in a single rule.. Manual NAT rules are processed before automatic NAT rules, allowing administrators to override automatic translations. They also support translation of both source and destination in a single rule, which is useful for complex scenarios involving web servers that need bidirectional translation.

Answer

Manual NAT rules are evaluated after the security policy.

Answer

Manual NAT rules require the gateway to be in a NAT-enabled mode.

Answer

Manual NAT rules are only applied to inbound traffic.

Question 6

A security administrator is deploying Identity Awareness using the Identity Collector in an environment with multiple domain controllers. The administrator wants to ensure that user identity information is collected from all domain controllers and that the load is distributed. Which configuration should be implemented?

Accepted Answer

Deploy multiple Identity Collector instances, each connecting to a different domain controller, and configure them to share data with the Security Gateway.. To collect identities from multiple domain controllers and distribute load, deploy multiple Identity Collector instances, each assigned to a different domain controller. They all forward data to the Security Gateway, providing redundancy. This is the recommended approach for large environments with multiple domain controllers.

Answer

Enable the Identity Awareness blade on each domain controller to push identities directly to the gateway.

Answer

Use a single Identity Collector and configure it to query all domain controllers simultaneously via LDAP.

Answer

Configure the Identity Collector to connect to each domain controller individually and enable load balancing.

Question 7

An administrator is configuring Application Control and URL Filtering on a new Security Gateway. The administrator wants to ensure that the gateway can identify applications and enforce policy correctly. Which two actions are required to enable Application Control and URL Filtering? (Choose two.)

Accepted Answer

Install the Application Control and URL Filtering policy on the Security Gateway.. To enable Application Control and URL Filtering, the administrator must first enable the blade on the Security Gateway object, which activates the inspection capabilities. Then, after configuring the desired rules, the policy must be installed on the gateway to enforce those rules. Both steps are essential for the features to function.

Answer

Enable HTTPS Inspection on all rules.

Answer

Configure a DNS server for reverse lookups.

Answer

Create a new administrator account with read-only permissions.

Question 8

An administrator is configuring Identity Awareness on a Security Gateway and wants to enable users to authenticate via a web portal before accessing network resources. The administrator wants to minimize user disruption and avoid installing additional software. Which Identity Awareness method should be used?

Accepted Answer

Browser-Based Authentication. Browser-Based Authentication provides a web portal for user login, requiring only a browser. It avoids software installation and domain integration. This method is suitable when users need to authenticate before accessing resources, and it minimizes disruption by leveraging familiar browser interfaces.

Answer

AD Query

Answer

Terminal Server Agent

Answer

Identity Collector

Question 9

An administrator has just initialized Secure Internal Communication (SIC) on a new Security Gateway using the one-time password 'CpWk987'. In SmartConsole, the administrator opens the gateway object, goes to the General Properties > Secure Internal Communication section, and enters the same one-time password. After clicking Initialize, the SIC status changes to 'Trust established'. However, the administrator notices that the gateway's SIC status later reverts to 'Unknown' after a few minutes. What is the most likely cause?

Accepted Answer

The gateway's SIC trust was established, but the gateway is unable to communicate with the Management Server due to a network or routing issue.. SIC trust is not a one-time event; it requires ongoing communication between the gateway and the Management Server. After the initial trust is established, the Management Server periodically checks the gateway's status. If the gateway becomes unreachable due to network problems, the status will revert to Unknown. The other options either describe issues that would prevent initial trust establishment or are not relevant to the SIC status after trust is established.

Answer

The one-time password was not complex enough and was rejected by the gateway's internal policy.

Answer

The gateway's SIC status reverts to Unknown because the gateway was rebooted before the SIC initialization was fully completed.

Answer

The gateway's SIC certificate was not yet issued by the Internal Certificate Authority (ICA) on the Management Server.

Question 10

A security administrator needs to allow a group of external consultants to access the corporate network via the Remote Access VPN. These consultants are not defined in the internal Active Directory. The administrator wants to minimize administrative overhead and ensure that the consultants can authenticate using their own existing credentials from their home company's LDAP server. Which Check Point object should be used to represent these external consultants?

Accepted Answer

An LDAP Group. The requirement is to authenticate external users against their own LDAP server without creating local accounts. The LDAP Group object is the correct Check Point object for this purpose, as it allows mapping to an external LDAP group and enables authentication using those external credentials. Other user objects are either local or not designed for external directory integration.

Answer

A LocalUser Group

Answer

A Generic User Account

Answer

A User Template

Question 11

A security administrator is troubleshooting a NAT configuration on a Check Point Security Gateway. Internal users cannot reach an external web server through a manual Hide NAT rule, although the Security Policy allows the traffic. The administrator suspects that the NAT rule is not being applied. Which two actions should the administrator take to verify that NAT translation is occurring as expected? (Choose two.)

Accepted Answer

Use the fw monitor command to capture packets before and after NAT translation.. To confirm NAT translation, the administrator should use fw monitor to observe packets before and after translation, and verify the NAT rule base order to ensure the correct rule is matched first. These actions directly show whether translation is applied and whether rule precedence is correct.

Answer

Disable the Security Policy temporarily to see if NAT starts working.

Answer

Review the gateway's ARP cache to see if the NAT IP is resolved.

Answer

Enable IP forwarding on the gateway to allow NAT to function.

Question 12

A security administrator is configuring NAT for a network where internal users need to access external web servers. The administrator wants to hide the internal IP addresses behind a single public IP address. However, some internal users report that they cannot access certain websites that require multiple simultaneous connections from the same source IP. What is the most likely cause of this issue?

Accepted Answer

The Hide NAT rule is using a single IP address, and the port pool is exhausted.. Hide NAT using a single public IP relies on port address translation, which has a finite number of ports. When many internal users initiate multiple simultaneous connections, the available ports can be exhausted, leading to failures for new connections. This is a scalability limitation of Hide NAT with a single IP. Using a pool of public IPs or configuring multiple IP addresses can mitigate this issue.

Answer

The external web servers are blocking the public IP address due to too many connections.

Answer

The Hide NAT rule is not applied to the correct interface.

Answer

The internal users are using a proxy server that is not configured for NAT.

Question 13

An administrator is configuring Identity Awareness on a Check Point R81.20 gateway using the Identity Collector. Users are authenticated via multiple Active Directory domains in a forest. The administrator notices that users from one domain are not being identified. What is the most likely cause?

Accepted Answer

The Identity Collector service account does not have sufficient permissions to read the Event Log on domain controllers in that domain.. The Identity Collector relies on reading security event logs from domain controllers. When multiple domains exist, the service account must have read permissions on each domain controller. If permissions are missing for one domain, the collector cannot retrieve login events, leaving users unidentified. Ensuring the account has appropriate rights in every domain is essential for full coverage.

Answer

The Identity Collector does not support multiple domains in a single forest.

Answer

The gateway is not configured with a DNS server that can resolve the domain controllers in that domain.

Answer

The users in that domain are not members of any groups that are used in Identity Awareness rules.

Question 14

An administrator needs to verify that a Security Gateway is sending logs to the Management Server. The administrator wants to see a real-time count of log messages received by the management server from each gateway. Which SmartConsole tool provides this information?

Accepted Answer

SmartView Monitor. SmartView Monitor includes a Logging section that shows real-time statistics, such as the number of logs received from each Security Gateway. This allows administrators to quickly verify that gateways are successfully sending logs to the management server. SmartLog is for querying individual logs, SmartEvent is for correlation, and SmartConsole Logs & Monitor is the container for these tools, not a monitoring tool itself.

Answer

SmartEvent

Answer

SmartConsole Logs & Monitor

Answer

SmartLog

Question 15

A security administrator is configuring a Check Point R81 Management Server to authenticate administrators via RADIUS. The RADIUS server is already configured with the necessary user accounts. After creating a RADIUS server object and enabling RADIUS authentication for administrators, the administrator tests login with a RADIUS user but fails. The administrator confirms the RADIUS server is reachable and the shared secret matches. What is the most likely cause of the failure?

Accepted Answer

The RADIUS user must be added as a Check Point administrator with a matching username and a Permission Profile.. Check Point separates authentication from authorization. Even if RADIUS authenticates the user, the Management Server must have a local administrator object with the same username and an assigned Permission Profile to grant access. Without this object, the login fails because the system cannot determine the user's permissions. This is a common pitfall when integrating external authentication.

Answer

The RADIUS server's shared secret must be configured with a minimum length of 16 characters.

Answer

The administrator must enable 'LDAP' authentication on the Management Server in addition to RADIUS.

Answer

The RADIUS server object must be configured with the 'Use for administrator authentication' option and the user must be added to a RADIUS group.