156-215.81.20 Practice Test 12 — 15 Questions

Question 1

An administrator has configured a rule to block the 'File Storage and Sharing' category. Users report that they can still access 'Dropbox' via the web interface, but the log shows the connection as allowed. The administrator verifies that the rule is correctly placed and the Application Control blade is enabled. Which action should the administrator take to ensure 'Dropbox' is blocked?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'HTTPS Inspection' on the Security Gateway.. The correct action is to enable HTTPS Inspection because Dropbox uses HTTPS, and without decryption the gateway cannot identify the application or category to enforce the blocking rule. This allows the gateway to inspect the encrypted traffic and apply the configured policy, ensuring that access to Dropbox is denied as intended.

Answer

Update the Application Control and URL Filtering database.

Answer

Add a new rule to block the 'Dropbox' application specifically.

Answer

Configure a URL Filtering category override for 'Dropbox'.

Question 2

A security administrator manages a Check Point R81.20 environment with Identity Awareness using Active Directory Query. Users on domain-joined machines are identified correctly, but users who connect through a NAT device are consistently shown as unknown. What is the most likely cause?

Accepted Answer

The AD Query method cannot resolve identities when the source IP is translated by NAT.. Active Directory Query relies on matching the source IP of traffic to the IP recorded in AD security events. NAT rewrites the source IP, so the gateway sees a different address than the one in the AD logs, and the identity lookup fails. To support NATed users, the administrator must use a method that carries identity in the traffic itself, such as Identity Collector or RADIUS Accounting.

Answer

The gateway is missing a license for Identity Awareness.

Answer

The AD Query account password has expired.

Answer

The Security Gateway is not configured to read the correct AD security log.

Question 3

A security administrator wants to configure the Check Point Management Server to authenticate administrators using an external LDAP directory. The LDAP server is already defined as an object in SmartConsole. Which of the following is the correct next step to enable LDAP authentication for administrators?

Accepted Answer

In the administrator's account properties, set the Authentication Method to the LDAP server object.. Administrator authentication on the Check Point Management Server is configured per administrator account. To use an external LDAP directory, you must edit the administrator's properties and set the authentication method to the LDAP server object. Global Properties and server objects do not control this setting. Permission profiles only handle authorization, not authentication.

Answer

Create a new LDAP user group and assign it to the administrator's permission profile.

Answer

Modify the Management Server's host object to use LDAP as the authentication server.

Answer

Enable LDAP authentication in Global Properties > Authentication.

Question 4

A security analyst is investigating a suspected intrusion and needs to view all logs related to a specific source IP address across multiple Security Gateways. The logs are stored on a central Management Server. Which SmartConsole feature should the analyst use to efficiently search and filter these logs?

Accepted Answer

SmartLog. SmartLog is the correct feature because it is specifically designed for fast, indexed searching of logs across multiple gateways. It allows the analyst to filter by source IP and view results from all gateways in a single interface. SmartView Tracker is less efficient, SmartEvent is for events, and Log Consolidation is not a search tool. Thus, SmartLog is the most efficient choice.

Answer

SmartEvent

Answer

SmartView Tracker

Answer

Log Consolidation

Question 5

An administrator is configuring a Remote Access VPN with Endpoint Security VPN clients connecting to a Check Point R81 gateway. The administrator wants to ensure that the VPN clients can access internal resources and that the gateway can apply security policies to the clients based on their user identity. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

Office Mode. Office Mode and User Authentication are the two components needed. Office Mode provides a virtual IP address so the client can access internal resources and the gateway can apply policies based on that IP. User Authentication identifies the user, allowing the gateway to enforce identity-based policies. Other options like Visitor Mode, NAT Traversal, and SecureXL do not directly fulfill these requirements.

Answer

SecureXL

Answer

Visitor Mode

Answer

NAT Traversal

Question 6

An administrator is configuring Identity Awareness on a Check Point R81.20 Security Gateway. The company uses a single Active Directory domain and wants to identify users without installing any software on client machines. Which Identity Awareness method should the administrator choose?

Accepted Answer

AD Query. AD Query is the only method that automatically identifies users in an Active Directory domain without installing any software on client machines. It leverages the existing domain infrastructure and the Security Gateway's ability to query domain controllers, making it the correct choice for this scenario. Other methods either require client software or manual authentication.

Answer

Identity Agent

Answer

Browser-Based Authentication

Answer

Terminal Server Agent

Question 7

An administrator is configuring NAT for a new web server on the internal network. The server must be accessible from the Internet using a public IP address, and connections must be initiated from the Internet to the server. The internal IP is 10.1.1.10, and the public IP is 203.0.113.10. Which NAT method should be used?

Accepted Answer

Static NAT. Static NAT provides a permanent one-to-one mapping between an internal IP and a public IP, enabling inbound connections from the Internet to reach the internal server. Hide NAT and dynamic NAT are suited for outbound traffic and do not allow external hosts to initiate connections to internal servers. Therefore, Static NAT is required.

Answer

Hide NAT

Answer

Port Address Translation (PAT) with a single IP

Answer

Dynamic NAT with a pool of public IPs

Question 8

An administrator is configuring a Security Gateway to send logs to an external SIEM via syslog. They want to ensure that the logs include the action taken and the rule number for each connection. Which TWO of the following log fields must be included in the exported syslog messages to meet this requirement? (Choose two.)

Accepted Answer

action. To meet the requirement of including the action taken and the rule number in exported syslog messages, the administrator must ensure that the 'action' and 'rule' fields are included. These fields provide the necessary information to identify what the gateway did and which policy rule was matched, enabling effective SIEM analysis.

Answer

src

Answer

proto

Answer

dst

Question 9

A security administrator is configuring NAT for a new internal server (10.0.0.5) that needs to be accessible from the Internet on port 443 using the public IP 203.0.113.20. The administrator creates a host object for the server and configures a Static NAT rule. Which additional configuration is required to allow inbound HTTPS traffic to reach the server?

Accepted Answer

A firewall rule allowing HTTPS traffic from the Internet to the public IP 203.0.113.20.. NAT and firewall rules work together. NAT translates the destination IP from public to private, but the firewall must still allow the traffic. A rule permitting HTTPS from the Internet to the public IP (or the internal server object, depending on NAT rule configuration) is essential. Without it, the gateway drops the packets.

Answer

A route on the Security Gateway pointing the public IP 203.0.113.20 to the internal server.

Answer

A NAT rule that translates the destination port from 443 to 443 for the server.

Answer

A NAT rule that translates the source IP of the server to the public IP for outbound traffic.

Question 10

An administrator has configured Identity Awareness with Terminal Server Agent on a Terminal Server. Users report that after disconnecting from a Remote Desktop session and reconnecting, they are sometimes identified as the previous user. What is the most likely cause of this issue?

Accepted Answer

The Terminal Server Agent maps users to session IDs, and when a session ID is reused without a proper logoff event, the previous user's identity can persist.. The correct answer is that the Terminal Server Agent maps users to session IDs, and if a session ID is reused without a proper logoff event, the previous user's identity can persist. This can happen when users disconnect instead of logging off, leaving the session in a disconnected state. When the session ID is later assigned to a new user, the agent may not have processed a logoff for the old user, causing misidentification.

Answer

The Terminal Server Agent is not configured to monitor session state changes.

Answer

The Security Gateway is not receiving updates from the Terminal Server Agent due to a network issue.

Answer

The Identity Awareness blade is not enabled on the Security Gateway.

Question 11

A Check Point administrator needs to configure authentication for a group of external users who will access the network via a VPN. The users are stored in an Active Directory domain. The administrator wants to use the AD credentials for authentication and also wants to assign different permissions based on AD group membership. Which two actions must the administrator take to achieve this? (Choose two.)

Accepted Answer

Create an LDAP account unit that points to the Active Directory domain.. To authenticate external users against Active Directory and assign permissions based on AD groups, the administrator must first create an LDAP account unit that defines the AD connection. Then, an LDAP group object must be created to map the AD group and assign the necessary permissions. These two steps enable both authentication and group-based authorization.

Answer

Define a new user group object and manually add each AD user to it.

Answer

Configure a RADIUS server for authentication and use its group attributes.

Answer

Enable User Directory authentication in Global Properties and select Active Directory.

Question 12

A Check Point administrator is configuring user authentication for a remote access VPN community. The organization uses an external LDAP directory server for user credentials. The administrator wants to avoid creating local user accounts on the Security Management Server. Which Check Point object should be used to represent the external LDAP users for authentication?

Accepted Answer

LDAP Account Unit. The LDAP Account Unit is the dedicated object in Check Point that defines connectivity to an external LDAP directory. It enables the Security Management Server to authenticate users against that directory without creating local user objects. The other options either require local accounts or do not provide the necessary authentication mechanism. Thus, the LDAP Account Unit is the correct choice for integrating external LDAP users for VPN authentication.

Answer

External User Profile with LDAP server

Answer

Generic User with LDAP authentication

Answer

User Group with LDAP as the authentication method

Question 13

An administrator wants to receive immediate notification when a critical security event, such as a malware infection, is detected by a Security Gateway. Which Check Point feature should the administrator configure to send an alert?

Accepted Answer

Alert definitions in SmartConsole. Alert definitions in SmartConsole are the correct feature for configuring immediate notifications on specific security events. The administrator can define an alert that triggers when a malware log is generated, and set actions such as email or SNMP traps. This provides real-time awareness of critical incidents without relying on external systems.

Answer

Log Exporter

Answer

SmartView Monitor threshold alerts

Answer

SmartEvent correlation policy

Question 14

An administrator is configuring Identity Awareness on a Check Point R81.20 Security Gateway using the Identity Collector. The administrator wants to ensure that the Identity Collector can retrieve user identity information from Active Directory. Which two components are required for the Identity Collector to function? (Choose two.)

Accepted Answer

A dedicated server or virtual machine to run the Identity Collector. The two required components are a user account with read permissions to Active Directory and a dedicated server or virtual machine to run the Identity Collector. The Identity Collector uses the account to authenticate and retrieve identity events from domain controllers, and it must run on a separate server that has network connectivity to both Active Directory and the Security Gateway.

Answer

The Terminal Server Agent installed on all domain controllers

Answer

The Security Gateway must be a member of the Active Directory domain

Answer

A RADIUS server configured for accounting

Question 15

An administrator is troubleshooting a Site-to-Site VPN between two Check Point R81 gateways. The VPN tunnel is up, but traffic is not passing through it. The administrator suspects that the encryption domains are misconfigured. Which SmartConsole tool should the administrator use to verify the encryption domains of the gateways?

Accepted Answer

SmartConsole Gateway Properties. The encryption domains, known as VPN Domains in Check Point, are configured within the Gateway Properties in SmartConsole. To verify them, the administrator must open the gateway object and inspect the VPN Domain settings. This directly shows which networks are included in the encryption domain. Other tools like SmartView Monitor, SmartLog, and SmartEvent are for monitoring, logging, and event management, respectively, and do not display the configuration. Thus, SmartConsole Gateway Properties is the correct choice.

Answer

SmartEvent

Answer

SmartLog

Answer

SmartView Monitor