156-215.81.20 Practice Test 17 — 15 Questions

Question 1

Which TWO settings are required when configuring the 'Active Directory Query' method in the Identity Awareness blade?

Accepted Answer

The IP address of the Domain Controller.. To configure AD Query, the administrator must provide the gateway with the necessary credentials to read security logs and identify the target domain controller. These two components—the specific Domain Controller and the service account with adequate permissions—are fundamental. Without them, the gateway lacks the administrative authorization required to query the remote logs, and it would be unable to map IP addresses to user accounts.

Answer

A list of all users in the Active Directory.

Answer

The public DNS server IP address.

Answer

An installed Identity Agent on the Domain Controller.

Question 2

Which IKE Phase 2 proposal setting specifically ensures that session keys are not derived from the original long-term keys, protecting past sessions if a key is compromised?

Accepted Answer

Perfect Forward Secrecy (PFS). Perfect Forward Secrecy (PFS) is a property of key-agreement protocols that ensures a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future. By forcing a new Diffie-Hellman exchange during Phase 2, the gateway ensures each session has unique, independent keying material, which is a best practice for high-security environments.

Answer

Main Mode

Answer

Aggressive Mode

Answer

Anti-Replay Protection

Question 3

What happens when the URL Filtering database is unreachable by the gateway?

Accepted Answer

The gateway uses the last cached version of the database.. When the gateway cannot reach the URL Filtering cloud service, it defaults to the 'fail-open' or 'fail-closed' behavior based on the configured policy. By default, most gateways continue to use the locally cached database. This ensures that legitimate traffic is not unnecessarily blocked due to a temporary network disruption between the gateway and the Check Point cloud update services.

Answer

All web traffic is immediately blocked.

Answer

The gateway disables URL filtering entirely.

Answer

The gateway enters 'Learning Mode'.

Question 4

An administrator needs to restrict a junior admin's access to only managing security policies within a specific Management Server domain. Which feature should be configured to implement this granular control?

Accepted Answer

Custom Permission Profile. Permission Profiles define the specific tasks and scope an administrator can perform within SmartConsole. By creating a custom profile and assigning it to the administrator, you ensure compliance with the principle of least privilege. This is critical in large-scale deployments where duties must be segregated to prevent unauthorized configuration changes or accidental policy deletions across different administrative domains.

Answer

Multi-Domain Server (MDS) licensing configuration

Answer

Global Policy assignment in the MDS container

Answer

Identity Awareness user groups

Question 5

A senior administrator needs to restrict a junior security operator so they can view and edit access control policies, but they must be strictly prohibited from installing policies onto production Security Gateways. Which SmartConsole mechanism should be utilized to enforce this operational boundary?

Accepted Answer

Assign a custom Permission Profile to the administrator account that allows rulebase editing but explicitly denies policy installation.. Check Point utilizes fine-grained Role-Based Administration to manage administrative capabilities down to specific task levels. By creating custom permission profiles that grant management write access to Access Control while excluding installation privileges, administrators enforce strict operational governance. This ensures junior staff cannot push untested modifications into production traffic paths.

Answer

Configure global multi-domain system domains to completely segregate the junior operator account environment.

Answer

Enable Read-Only mode globally for the entire SmartConsole application whenever the junior operator logs into the management server.

Answer

Revoke write permissions from the underlying Linux operating system account on the Security Management Server.

Question 6

Why is it recommended to use a separate administrative account for policy management versus day-to-day monitoring?

Accepted Answer

To implement the principle of least privilege.. Separating administrative duties is a best practice to reduce the impact of account compromise. By using different accounts for different levels of access, an attacker who compromises a monitoring account will not necessarily have the permissions to modify security policies. This enhances the overall security posture and ensures that critical policy changes are performed by accounts with higher levels of scrutiny.

Answer

To increase the number of licenses for the management server.

Answer

To bypass the concurrent session limits.

Answer

To speed up the policy installation process.

Question 7

When configuring a NAT rule that involves a VPN community, why is 'Hide NAT' often problematic?

Accepted Answer

The modified source IP breaks the VPN interesting traffic policy.. Hide NAT changes the source IP of a packet to the gateway's IP. In a VPN tunnel, the gateway expects the original source IP to match the VPN's interesting traffic policy (the encryption domain). When Hide NAT modifies the source IP, the packet no longer matches the VPN policy, causing the gateway to drop the packet or fail to encrypt it because the source identity is now masked.

Answer

Hide NAT uses too much bandwidth for VPN tunnels.

Answer

VPN traffic is automatically excluded from NAT rules.

Answer

Hide NAT causes infinite loop errors in the VPN tunnel.

Question 8

When a Management Server is in a high-availability configuration, how does SIC handle communication if the primary management server fails?

Accepted Answer

The gateways automatically connect to the secondary management server.. In a High Availability environment, the secondary management server is configured with the same ICA and identity as the primary. When a failover occurs, the gateways continue to trust the certificates issued by the same ICA. As long as the secondary server is active, it assumes the management role seamlessly, and the gateways maintain their SIC connections without requiring any manual reconfiguration or key reset.

Answer

All gateways must be manually re-initialized with the new management IP.

Answer

The administrator must run 'sic_reset' on all gateways after failover.

Answer

SIC is disabled until a manual policy push is performed.

Question 9

An administrator configures Identity Awareness using Active Directory Query to authenticate domain users. After deployment, users report intermittent authentication failures, and logs show that the Security Gateway fails to query the Domain Controllers due to insufficient privileges. Which account permission must be granted to resolve this issue without granting Domain Administrator rights?

Accepted Answer

Read permissions on user objects and membership in the Event Log Readers security group.. Identity Awareness Active Directory Query requires specific read permissions on the Active Directory container objects and membership in the Event Log Readers group to parse security event logs successfully. Granting full domain admin privileges violates security best practices, making targeted permission delegation essential for enterprise compliance and least-privilege enforcement.

Answer

Membership in the Domain Admins group and full control over the root domain partition.

Answer

Membership in the Enterprise Admins group and Schema Admins group.

Answer

Full administrative control over the Built-in Administrators local group on the gateway.

Question 10

What is the function of the 'Internal Certificate Authority' (ICA) in a Check Point environment?

Accepted Answer

To issue and manage certificates for SIC communications.. The ICA acts as the root of trust for the entire management domain. Every gateway and management server within the domain receives a certificate signed by the ICA. This centralized model allows gateways to trust one another and the management server without needing external public key infrastructure, simplifying secure communications and ensuring that only authorized devices can participate in policy management.

Answer

To license the Check Point gateways for traffic inspection.

Answer

To authenticate administrators during SmartConsole login.

Answer

To generate policy packages for installation.

Question 11

Which action must be performed after updating a Permission Profile to ensure the changes take effect for active sessions?

Accepted Answer

The administrator must log out and log back in. When a permission profile is modified, active sessions do not automatically inherit these changes to prevent inconsistencies mid-task. The administrator must log out and log back in to refresh their session and apply the new permission set, ensuring that their actions in the new session are governed by the updated security policy constraints defined in their profile.

Answer

Restart the FWM service

Answer

Publish the session changes

Answer

Install the security policy

Question 12

When configuring a VPN Community with 'Office Mode' enabled, what is the primary benefit for remote access clients?

Accepted Answer

It provides a virtual IP address from the internal network. Office Mode allows remote access clients to receive an internal IP address from the gateway. This is vital because it makes the remote client appear as if it is physically on the internal network, simplifying routing and allowing the client to access resources that might otherwise be blocked by restrictive security policies that rely on internal subnet recognition for access control.

Answer

It enables split-tunneling by default

Answer

It automatically authenticates the user via Kerberos

Answer

It forces the client to use the corporate DNS server

Question 13

When configuring an administrator with 'Read/Write' access in a specific domain, what does 'Scope' define?

Accepted Answer

The specific network objects and gateways the admin can manage. Scope determines the boundaries within which an administrator can exercise their permissions. By defining the scope, organizations can enforce strict segregation of duties, ensuring that administrators only have visibility and control over the network objects, gateways, and policies relevant to their specific region or department, thereby reducing the risk of unauthorized lateral movement within the management plane.

Answer

The time of day the administrator can log in

Answer

The authentication methods allowed for that user

Answer

The number of concurrent sessions permitted

Question 14

What is the primary benefit of using 'Identity Sharing' between multiple Check Point Security Gateways?

Accepted Answer

To allow users to roam between gateways without re-authenticating.. Identity Sharing allows gateways to exchange user-to-IP mapping information, effectively creating a unified identity awareness environment. This is critical in large networks where a user might roam between different gateway segments. By sharing this data, the security policy remains consistent for the user regardless of which gateway they connect through, preventing the need for redundant authentication processes and improving the overall security posture and user experience.

Answer

To reduce the load on the Security Management Server.

Answer

To enforce user access restrictions at the Management Server level.

Answer

To replace the need for AD Query on all gateways.

Question 15

What is the primary function of the Encryption Domain in a Check Point VPN environment?

Accepted Answer

To specify which networks are protected by the VPN. The encryption domain defines the set of IP addresses that are permitted to communicate through the VPN tunnel. It essentially creates the 'interesting traffic' criteria. If a packet's source or destination IP does not fall within the defined encryption domain of the gateway, it will not be encapsulated and encrypted, potentially leading to cleartext transmission or dropped traffic depending on the security policy enforced on the gateway.

Answer

To encrypt all traffic leaving the gateway

Answer

To hide the internal topology from the internet

Answer

To authenticate remote VPN users