156-215.81.20 Practice Test 2 — 10 Questions

Question 1

An administrator wants to audit all changes made to the security policy by other administrators. Which tool should they use?

Accepted Answer

The Audit Log in SmartConsole. The Audit Log within SmartConsole is the primary tool for tracking all administrative activity, including who made a change, when it was made, and what the change involved. This is essential for compliance, troubleshooting, and forensics, allowing administrators to maintain a clear history of modifications and ensuring that any unauthorized or accidental changes can be quickly identified and reversed.

Answer

SmartView Monitor

Answer

SmartEvent

Answer

The 'fw log' CLI command

Question 2

Refer to the exhibit. An administrator is configuring RADIUS authentication for Identity Awareness. What is the cause of this error log?

Accepted Answer

The RADIUS server and gateway have mismatched encryption keys.. The 'shared secret mismatch' error explicitly indicates that the RADIUS client (the Security Gateway) and the RADIUS server are using different keys to encrypt their communications. This is a common configuration error in AAA setups. Both the gateway and the server must have an identical, correctly typed shared secret string, or the authentication handshake will be rejected by the server for security reasons.

Answer

The RADIUS server is down.

Answer

The firewall policy is blocking RADIUS traffic.

Answer

The user password is incorrect.

Question 3

What is the primary function of the 'Application Wiki' (AppWiki) in Check Point?

Accepted Answer

It provides a database of application signatures and behavioral patterns.. AppWiki is the centralized, comprehensive database of application signatures used by the gateway to identify traffic. It contains detailed information about thousands of web applications, their protocols, and behavior. By leveraging this database, the gateway can accurately differentiate between legitimate business traffic and unauthorized or risky applications, enabling administrators to write effective, granular rules that control access based on application identity rather than mere IP addresses or ports.

Answer

It stores user identity information.

Answer

It provides a list of all IP addresses associated with web applications.

Answer

It manages the SSL inspection certificates for the gateway.

Question 4

When would an administrator use a 'Custom Application' instead of a standard application in the Application Control blade?

Accepted Answer

When the application is not present in the Check Point database.. Custom Applications are used when the gateway cannot identify a proprietary, internal, or very niche web application using the standard signature database. By defining a custom application based on URL patterns, domains, or specific header content, administrators can extend the reach of the Application Control blade to include internal corporate apps that are not covered by Check Point's public database.

Answer

When the application is blocked by the URL Filtering blade.

Answer

When the application requires HTTPS Inspection.

Answer

When the administrator wants to bypass the security policy.

Question 5

An administrator needs to ensure that traffic from the internal network (10.10.10.0/24) accessing the Internet is translated to the gateway's external interface IP. Which NAT configuration method is required to achieve this while ensuring that the internal IP addresses are never exposed to the Internet?

Accepted Answer

Hide NAT using the gateway's external interface IP.. Hide NAT, also known as Port Address Translation (PAT), is the optimal method for mapping multiple internal source IP addresses to a single public IP address. By utilizing the gateway's external interface, the administrator effectively masks internal addressing. This is critical for security posture, as it limits reconnaissance opportunities and conserves scarce public IPv4 address space while enabling necessary outbound connectivity for private internal hosts.

Answer

Static NAT mapping for each internal host.

Answer

Dynamic NAT without hide enabled.

Answer

Disable NAT and use proxy ARP on the gateway.

Question 6

An administrator needs to restrict access to social media applications while allowing access to specific professional features. Which feature in the Application Control blade provides this granularity?

Accepted Answer

Application Features. Application Control includes granular controls for many major web applications, known as 'Application Widgets' or 'Features.' By selecting an application, administrators can choose to block or allow specific sub-functions like 'Chat' or 'Post' instead of the entire site. This allows organizations to maintain productivity while still permitting necessary business communication, which is a critical balance for modern enterprise network security policies.

Answer

HTTPS Inspection

Answer

URL Filtering Category

Answer

Identity Awareness

Question 7

Which component in a Check Point VPN community defines the specific subnets that are permitted to send and receive traffic through the VPN tunnel?

Accepted Answer

Encryption Domain. The Encryption Domain defines the scope of traffic that must be encrypted by the VPN tunnel. By specifying the IP addresses and subnets that belong to the VPN community, the Check Point gateway can distinguish between traffic that needs protection and traffic that should be sent in the clear. This is a critical configuration step to ensure that only authorized data is encapsulated within the IPsec tunnel.

Answer

VPN Gateway object

Answer

IKE Phase 2 Proposal

Answer

VPN Community Object

Question 8

A remote branch office requires a persistent VPN connection to the corporate headquarters. Which feature should be configured to ensure the tunnel remains active even when no user traffic is flowing?

Accepted Answer

VPN Tunnel Test. VPN Tunnel Test (Permanent Tunnels) is the standard method in Check Point to ensure a gateway keeps the tunnel alive. By sending periodic probe packets, the gateway prevents the connection from timing out due to inactivity. This is essential for monitoring the health of the connection and ensuring immediate connectivity for time-sensitive applications or branch office operations that require constant reachability to the central data center.

Answer

Dead Peer Detection (DPD)

Answer

IKE Keepalives

Answer

Aggressive Mode

Question 9

Which protocol is primarily used by Check Point gateways to encapsulate IPsec traffic when NAT traversal is required for a VPN tunnel?

Accepted Answer

UDP 4500. When a VPN tunnel traverses a NAT device, the standard IPsec ESP protocol often fails because it lacks port information and NAT devices cannot translate the internal IP headers. UDP encapsulation, typically on port 4500, wraps the ESP packet, allowing NAT devices to handle it like standard UDP traffic, thereby maintaining tunnel integrity and ensuring data flows through intermediate network translation points.

Answer

TCP 443

Answer

ICMP

Answer

ESP port 50

Question 10

An administrator configures Identity Awareness in a Check Point environment using Active Directory Query. Users report that access policies based on user groups fail intermittently for workstations after users lock their screens. Which underlying mechanism causes this authentication loss?

Accepted Answer

AD Query relies on periodic polling of domain controller security logs and may miss rapid logon state transitions or idle timeouts.. Active Directory Query relies on polling Windows security event logs to track user logon sessions through Kerberos and NTLM ticket activity. When a workstation locks or goes idle, specific session events might not immediately refresh the gateway cache, causing temporary identity loss. Understanding this limitation helps administrators combine AD Query with browser-based Captive Portal or terminal servers to ensure robust identity persistence across all network segments.

Answer

The Identity Awareness daemon purges user entries immediately when the workstation screensaver activates.

Answer

Kerberos ticket-granting service renewal failures occur during idle periods, forcing the Security Gateway to drop user mappings.

Answer

The Security Management Server revokes the user's identity certificate when network traffic ceases for more than sixty seconds.