156-215.81.20 Practice Test 13 — 15 Questions

Question 1

An administrator is reviewing the NAT configuration on a Check Point R81 Security Gateway. The gateway has two interfaces: eth1 (internal, 192.168.1.1) and eth2 (external, 203.0.113.1). Internal users need to access the Internet, and the administrator wants to hide their private IP addresses behind the external interface IP. The administrator creates a Hide NAT rule for the internal network object. Which statement correctly describes the outcome of this configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Outbound traffic from internal users will have its source IP translated to 203.0.113.1.. Hide NAT, also known as many-to-one NAT, translates the source IP of outbound traffic to a single public IP, typically the external interface of the gateway. This allows internal users with private addresses to access the Internet while hiding their internal addressing scheme.

Answer

The gateway will perform destination NAT on outbound traffic.

Answer

Internal users will be unable to access each other using their private IPs.

Answer

Inbound traffic from the Internet will be translated to 192.168.1.1.

Question 2

An administrator is configuring a VPN community in SmartConsole for a set of gateways that will use IKEv2. The administrator wants to ensure that the VPN tunnel can be established even if the two gateways are behind NAT devices. Which setting should be enabled in the VPN community?

Accepted Answer

Enable NAT Traversal. NAT Traversal must be enabled to allow IPsec packets to pass through NAT devices by encapsulating them in UDP. Without it, NAT would modify the IP headers and likely cause the VPN tunnel to fail. Other settings like IP Compression, Aggressive Mode, or Permanent Tunnels do not solve NAT-related issues, so they are not correct for this scenario.

Answer

Support IP Compression

Answer

Set Permanent Tunnels

Answer

Use Aggressive Mode

Question 3

An administrator is configuring NAT on a Check Point R81 Security Gateway. A web server with a private IP address of 10.1.1.10 must be reachable from the Internet at the public IP address 203.0.113.10. The administrator creates a host object for the web server and configures a Static NAT rule. Which translation method should be selected in the NAT rule so that the internal IP address is translated to the public IP address?

Accepted Answer

Static. Static NAT is the correct translation method because it creates a permanent one-to-one mapping between the internal web server address and the public address. This enables external clients to initiate connections to the server and ensures that return traffic is correctly translated back to the internal address. Hide NAT is designed for outbound connections and does not provide inbound reachability.

Answer

Hide behind gateway

Answer

Hide

Answer

Hide behind cluster

Question 4

A security administrator has just installed a new R81 Security Gateway. In SmartConsole, the gateway object shows SIC status 'Not Communicating'. The administrator has already initialized SIC on the gateway using 'cpconfig' and entered the activation key. What is the next step required in SmartConsole to complete SIC establishment?

Accepted Answer

In the gateway object's General Properties, enter the same activation key in the 'One-time password' field and click 'Initialize'.. SIC establishment requires a shared secret (activation key) to be configured on both the gateway and the management server. After initializing SIC on the gateway via 'cpconfig', the administrator must enter the same one-time password in the gateway object's General Properties in SmartConsole and click 'Initialize'. This allows the management server to authenticate the gateway and issue the SIC certificate, transitioning the status to 'Communicating'.

Answer

Run 'cpstart' on the Security Management Server to restart the SIC daemon and push the trust configuration to the gateway.

Answer

On the gateway, run 'sic_reset' and then import the management server's SIC certificate manually using 'cpca_client'.

Answer

In the gateway object's General Properties, click 'Test SIC Status' to force the gateway to initiate the SIC handshake.

Question 5

A security administrator is troubleshooting a performance issue on a Check Point R81 Security Gateway. The administrator suspects that a specific process is generating an excessive number of logs, causing high CPU usage. Which SmartConsole tool should the administrator use to view real-time, per-process resource consumption on the gateway?

Accepted Answer

cpview. The correct answer is cpview, as it is the dedicated real-time monitoring tool that runs on a Check Point Security Gateway. It provides detailed, per-process CPU and memory statistics, enabling administrators to quickly identify resource-heavy processes. Other tools like SmartView Monitor offer broader overviews but lack the granularity needed for this specific troubleshooting task.

Answer

SmartView Tracker

Answer

SmartView Monitor

Answer

SmartEvent

Question 6

A security administrator has configured Identity Awareness with AD Query on a Check Point R81.20 Security Gateway. Users report that they can access resources immediately after logging in, but after a password change, some users are still identified with their old group memberships for an extended period. What is the most likely cause of this behavior?

Accepted Answer

The AD Query cache has not expired, and the gateway is using cached group information.. The correct answer is that the AD Query cache has not expired, and the gateway is using cached group information. AD Query periodically queries Active Directory and caches the results to reduce load. When group memberships change, the gateway may not reflect the changes until the cache is refreshed, causing users to retain old group memberships for an extended period.

Answer

The Identity Awareness blade is not configured to synchronize group memberships.

Answer

The user's session on the Security Gateway has not been refreshed, and the old session is still active.

Answer

The Security Gateway is not receiving real-time login events from the domain controllers.

Question 7

A Check Point administrator is configuring a Route-Based VPN between two R81 gateways. The administrator wants to ensure that the VPN tunnel is established only when there is traffic that needs to be encrypted, and that the tunnel is torn down after a period of inactivity to conserve resources. Which Check Point feature should be configured to achieve this?

Accepted Answer

On-Demand Tunnels. On-Demand Tunnels is designed to create the VPN tunnel only when there is traffic that requires encryption, and to tear it down after a configurable idle timeout. This conserves resources on the gateways and is ideal for scenarios where continuous connectivity is not required. Permanent Tunnels and Empty Tunnels keep the tunnel up regardless of traffic, which is not desired here. Tunnel Sharing is about tunnel granularity, not on-demand establishment. Thus, On-Demand Tunnels is the correct feature.

Answer

VPN Tunnel Sharing

Answer

Permanent Tunnels

Answer

Empty Tunnels

Question 8

A security administrator has just initialized a new Security Gateway with the First Time Configuration Wizard. In SmartConsole, the gateway object exists but its SIC status shows 'Not Communicating'. The administrator opens the gateway object and clicks 'Communication' to initialize SIC. Which action must be performed on the gateway itself for the trust to be established?

Accepted Answer

Enter the one-time password on the gateway in the 'Secure Internal Communication' section of cpconfig.. SIC initialization always requires a shared secret: the administrator sets a one-time password in the gateway object in SmartConsole, then enters that same password on the gateway through cpconfig's Secure Internal Communication section. The gateway uses this password to authenticate itself to the management server's internal CA, which then issues the gateway's SIC certificate. Only after this exchange does the status change to Communicating.

Answer

Run 'cpstart' on the gateway to start all Check Point services.

Answer

Reboot the gateway so it can retrieve its SIC certificate from the management server.

Answer

Import the management server's SIC certificate manually using 'cpca_client'.

Question 9

A security administrator has just installed a new R81 Security Gateway and initialized SIC with the Security Management Server. The gateway appears in SmartConsole with SIC status 'Trust established'. However, the administrator notices that the gateway's fingerprint was not verified before initialization. Which action should the administrator take to ensure the gateway's identity is trusted?

Accepted Answer

In SmartConsole, open the gateway object, go to the 'Secure Internal Communication' section, and compare the fingerprint displayed there with the one shown on the gateway via 'cpconfig'.. After SIC initialization, the administrator must verify the gateway's fingerprint to ensure it matches the one presented during initialization. SmartConsole displays the fingerprint in the gateway object's Secure Internal Communication section. Comparing it with the fingerprint shown on the gateway via cpconfig or cpstat confirms authenticity. This step prevents man-in-the-middle attacks and is a best practice even when SIC status shows 'Trust established'.

Answer

Edit the gateway object in SmartConsole and change the 'One-time password' to a new value, then install policy.

Answer

Run 'cpconfig' on the gateway and select 'Secure Internal Communication' to regenerate the SIC certificate.

Answer

Use the 'sic_reset' command on the gateway and then re-initialize SIC from SmartConsole.

Question 10

A security administrator is configuring a NAT rule to hide internal users behind the gateway's external IP when accessing the Internet. The administrator wants to ensure that return traffic is correctly routed back to the internal users. Which configuration setting is essential for this to work?

Accepted Answer

The gateway must maintain a NAT session table to map the translated connections back to the original source IPs.. Hide NAT relies on the gateway maintaining a stateful session table that tracks the translation of source IP and port. When return traffic arrives, the gateway uses this table to reverse the translation and forward packets to the correct internal host. Without this stateful mapping, return traffic would not be delivered, and connections would fail.

Answer

The Hide NAT rule must be configured with the 'Translate destination on client side' option.

Answer

The gateway must have a default route pointing to the Internet.

Answer

The internal users must have a route to the gateway's external IP.

Question 11

A company uses Hide NAT to allow internal users to access the Internet through a single public IP address on the gateway. The security administrator notices that external servers cannot initiate connections to internal hosts, but internal users can reach external services. Which statement explains why external servers cannot initiate connections to internal hosts in this scenario?

Accepted Answer

Hide NAT uses a one-to-many mapping, so external hosts have no unique internal address to connect to.. Hide NAT maps many internal addresses to one public address, so external systems cannot determine which internal host to reach. Without a unique one-to-one mapping such as Static NAT, inbound connections initiated from the Internet cannot be delivered to a specific internal machine.

Answer

The gateway drops all inbound traffic by default unless a corresponding NAT rule exists.

Answer

Hide NAT is only applied to outbound traffic, so inbound connections are never translated.

Answer

Hide NAT requires a separate public IP address for each internal host, which is not configured.

Question 12

An administrator is setting up a Remote Access VPN for employees using Check Point Mobile Access. The administrator wants to ensure that remote users can access internal web applications securely without installing a full VPN client. Which Check Point feature should be configured?

Accepted Answer

Mobile Access Blade with application-based VPN.. The Mobile Access Blade enables clientless remote access to internal web applications through a web browser, using application-based VPN technology. It provides secure access without the need for a full VPN client, which aligns with the administrator's requirement. Other options involve full VPN clients or Site-to-Site configurations that do not meet the clientless access need.

Answer

Endpoint Security VPN client with Office Mode.

Answer

IPsec VPN with pre-shared key authentication.

Answer

Site-to-Site VPN community with a satellite gateway.

Question 13

During an investigation, an administrator must find all connections that were dropped by the Security Gateway in the last 24 hours for a specific source IP. Which SmartConsole tool provides the most efficient way to search and filter these logs?

Accepted Answer

SmartView Logs with a filter on the source IP and Action equal to Drop.. SmartView Logs provides field-based filtering in SmartConsole, allowing an administrator to combine conditions such as source IP and action to narrow millions of records down to the relevant dropped connections. It queries indexed logs efficiently and displays results immediately. Other tools focus on correlation, real-time performance, or administrative auditing and cannot perform this targeted historical search.

Answer

SmartConsole Audit Logs filtered by administrator name.

Answer

SmartEvent with a predefined report on network activity.

Answer

cpview on the Security Gateway with the connections view.

Question 14

An administrator is using SmartConsole to manage a Security Gateway. The gateway's SIC status shows 'Communicating', but the administrator cannot install policy; the installation fails with an error about the gateway not being trusted. Which action should the administrator take to resolve this?

Accepted Answer

Verify that the gateway's SIC certificate has not expired and re-initialize SIC if necessary.. A gateway can show SIC status 'Communicating' even if its SIC certificate has expired, because the status may reflect the last known state or a cached connection. However, policy installation requires a valid trust relationship. An expired certificate prevents the management server from authenticating the gateway, resulting in a trust error. The administrator must check the certificate expiration and re-initialize SIC to issue a new certificate, restoring trust and enabling policy installation.

Answer

Run 'fw putkey' on the gateway to manually update the SIC key and then push policy again.

Answer

Restart the Check Point services on the management server using 'cpstop' and 'cpstart' to refresh the SIC daemon.

Answer

Check the firewall rulebase to ensure that TCP port 18191 is allowed between the management server and gateway.

Question 15

An administrator is configuring a Site-to-Site VPN between two Check Point R81 Security Gateways using a Star community. The administrator wants to ensure that the VPN tunnel is established and that traffic is encrypted and decrypted correctly. Which two actions must be performed on both gateways to allow the VPN to function properly? (Choose two.)

Accepted Answer

Define a pre-shared secret or certificate for authentication in the VPN community.. For a Site-to-Site VPN to establish and pass traffic, both gateways must have a correctly defined VPN domain that includes the networks to be encrypted, and they must share matching authentication credentials (pre-shared secret or certificates). These are fundamental requirements for IKE Phase 1 and Phase 2 to succeed.

Answer

Enable 'Accept all encrypted traffic' in the Global Properties.

Answer

Set the VPN community to 'Meshed' instead of 'Star'.

Answer

Configure NAT rules to hide the internal networks behind the gateway's external IP address.