156-215.81.20 Practice Test 2 — 25 Questions

Question 1

When defining an Encryption Domain for a Check Point Security Gateway, which TWO configuration methods are natively supported within SmartConsole? (Choose TWO)

Accepted Answer

Using a manually selected group object containing specific internal network and subnet objects.. Check Point Security Gateways support defining encryption domains through manually specified network objects or automatically via the underlying topology configuration. Selecting the correct method ensures that the gateway correctly identifies traffic destined for the secure tunnel versus traffic requiring standard routing procedures.

Answer

Utilizing a dedicated BGP routing table instance to dynamically inject encryption domain subnets.

Answer

Importing a comma-separated text file of IP ranges directly into the global system parameters.

Answer

Relying on dynamic DHCP scope assignments to automatically update protected VPN subnets.

Question 2

Refer to the exhibit. An administrator sees the following debug output while troubleshooting a blocked connection. What is the most likely cause for this traffic being dropped?

Accepted Answer

The rule base contains a drop rule for 'Unknown' applications.. The debug output indicates that the traffic was dropped because Application Control could not identify the application or categorize the traffic. When the policy is set to 'Block' for non-matching or unknown traffic, the gateway drops packets that do not trigger a specific rule match. This is a common security best practice to prevent unauthorized or potentially malicious protocols from traversing the gateway undetected.

Answer

The connection is being dropped by a malicious URL category.

Answer

The HTTPS inspection certificate is expired.

Answer

The user is not authenticated.

Question 3

An administrator is configuring Static NAT for a server. Which NAT option should be selected in the object properties to ensure that the server is reachable via a dedicated public IP address, allowing both inbound and outbound traffic?

Accepted Answer

Static NAT. Static NAT creates a one-to-one mapping between a private internal IP and a specific public IP. When configured on the server object in Check Point, this ensures that the external identity is fixed, which is required for services like mail servers or public-facing web servers that need a consistent IP address for DNS records and incoming connections from the internet.

Answer

Hide NAT

Answer

Hide NAT with Port Mapping

Answer

No NAT

Question 4

Which security feature is enabled by default in Check Point VPN communities to protect against replay attacks?

Accepted Answer

Anti-Replay Protection. Anti-replay protection is a standard feature of the IPsec suite. It uses a sliding window protocol to track sequence numbers of incoming packets. If a packet arrives with a sequence number that has already been processed or is too old, the gateway drops it. This prevents an attacker from capturing encrypted packets and re-sending them later to cause unauthorized actions or service disruption on the internal network.

Answer

IKE Aggressive Mode

Answer

VPN Compression

Answer

Dynamic Routing over VPN

Question 5

An administrator wants to ensure that mobile devices are correctly identified. Which method is most appropriate for mobile device identity identification in a Wi-Fi environment?

Accepted Answer

Captive Portal. Captive Portal or integration with an MDM (Mobile Device Management) system is most appropriate for mobile devices. Unlike Windows PCs that can join a domain and use AD Query, mobile devices are typically not domain-joined. Using Captive Portal ensures that regardless of the device type or OS, the user must authenticate, allowing the firewall to associate their mobile session with a known identity for consistent security policy application.

Answer

AD Query

Answer

Identity Agent

Answer

Browser-based transparent authentication

Question 6

Refer to the exhibit. An administrator is troubleshooting a site-to-site VPN connection. Based on the debug log provided, what is the most likely cause of the issue?

Accepted Answer

Pre-shared key mismatch. The log explicitly points to a 'Pre-shared key mismatch'. This error occurs when the PSK configured on the local gateway does not match the PSK configured on the remote peer. Because the authentication phase (Phase 1) fails immediately, no tunnel is established. The administrator must verify the character-by-character accuracy of the secret on both peer devices to resolve this authentication failure and allow the tunnel to initialize properly.

Answer

Encryption domain mismatch

Answer

Expired certificate

Answer

IKE version mismatch

Question 7

What is the consequence of setting the 'Log Severity' threshold too high on a Security Gateway?

Accepted Answer

Important security events may not be logged.. Setting a high severity threshold limits the volume of logs generated, which improves performance but risks missing lower-priority security events. Administrators must balance log detail with system performance. Finding the right balance is essential for maintaining a clean log environment that facilitates effective threat detection without overloading the storage systems or creating a bottleneck in the log indexing process on the Management Server.

Answer

The gateway stops processing traffic.

Answer

The management server becomes overloaded.

Answer

The CPU usage on the gateway increases significantly.

Question 8

Refer to the exhibit. An administrator sees this error in the logs. What is the most effective way to resolve this for better visibility?

Accepted Answer

Enable HTTPS Inspection and define appropriate bypass policies.. Without HTTPS inspection, the gateway cannot read the contents of encrypted traffic, limiting its ability to identify applications hidden within HTTPS tunnels. Enabling HTTPS inspection allows the gateway to act as an SSL proxy, decrypting and re-encrypting traffic to perform full inspection. This is critical for modern security, as the vast majority of web traffic is now encrypted, rendering standard packet inspection largely ineffective for application-layer controls.

Answer

Disable Application Control and rely on URL Filtering.

Answer

Increase the timeout settings on the gateway for encrypted traffic.

Answer

Configure the client browsers to trust the Management Server certificate.

Question 9

Refer to the exhibit. An administrator receives this message when trying to publish changes. How can the administrator resolve this conflict?

Accepted Answer

Contact 'admin_alpha' to publish or discard their session. The error indicates a concurrent session conflict where another admin (admin_alpha) holds a write lock on the database. In a multi-admin environment, only one session can hold the write lock at a time. The current administrator must wait for the other session to publish or discard their changes, or contact the other administrator to coordinate the release of the lock.

Answer

Run 'fwm lock_clear' from the CLI

Answer

Restart the Management Server services

Answer

Create a temporary administrative domain

Question 10

An administrator needs to review all logs generated by a specific Security Gateway over the past week. The administrator wants to see the logs in a tabular format and apply filters based on source IP. Which SmartConsole tool should the administrator use?

Accepted Answer

SmartLog. SmartLog is the primary tool in SmartConsole for querying and viewing logs. It provides a tabular format and allows filtering by various fields, including gateway and source IP. SmartView Tracker is deprecated, SmartEvent is for event correlation, and SmartView Monitor is for real-time monitoring. Thus, SmartLog is the correct choice.

Answer

SmartEvent

Answer

SmartView Monitor

Answer

SmartView Tracker

Question 11

An administrator wants to ensure that specific logs are always sent to a remote Log Server, even if the primary Log Server becomes unreachable. Which feature should they configure?

Accepted Answer

Log Redundancy. Log redundancy ensures high availability for log storage. By defining multiple Log Servers in the gateway object properties, Check Point gateways can automatically failover or load-balance log traffic. This is crucial for maintaining compliance in environments where continuous logging is a strict requirement, ensuring that no security events are lost during a single-point-of-failure event on the primary logging server.

Answer

Log Aggregation

Answer

Log Compression

Answer

Log Indexing

Question 12

Refer to the exhibit. An administrator is experiencing intermittent connectivity issues for users behind Hide NAT. What might this setting indicate regarding the root cause?

Accepted Answer

The NAT table limit is too low for the current traffic load.. The parameter 'fw_nat_hide_nat_map_table_size' determines the maximum number of simultaneous translations the gateway can track for Hide NAT. A value of 5000 might be insufficient for a high-traffic environment with many concurrent users. When this limit is reached, new Hide NAT sessions cannot be created, leading to connectivity drops for internal hosts until existing sessions expire and free up table entries.

Answer

The gateway is running out of memory for connection states.

Answer

The gateway is misconfigured and needs to be set to 0.

Answer

The system is ignoring all NAT rule changes.

Question 13

An administrator is creating a new user account in SmartConsole. The administrator wants the user to be able to authenticate to the Check Point Mobile Access portal using a username and password stored locally on the Management Server. Which authentication method should be selected for this user?

Accepted Answer

Check Point Password. For a user to authenticate with a username and password stored locally on the Management Server, the Check Point Password authentication method must be selected. LDAP, RADIUS, and SecurID all rely on external servers for credential verification, which contradicts the requirement for local storage. Check Point Password is the built-in method for local authentication.

Answer

LDAP

Answer

RADIUS

Answer

SecurID

Question 14

A Check Point administrator is configuring a new administrator account in SmartConsole. The administrator wants to grant this account permissions to manage only the Security Policies and objects within a specific Domain, while restricting access to other Domains in a Multi-Domain Management environment. The administrator plans to use a Permission Profile that is scoped to that Domain. Which two statements are true regarding this configuration? (Choose two.)

Accepted Answer

The administrator must assign a Permission Profile that is defined in the same Domain as the administrator account.. In a Multi-Domain Management environment, to restrict an administrator to a specific Domain, the administrator account must be created in that Domain, and a Permission Profile defined in that same Domain must be assigned. This ensures that the account's permissions are scoped only to that Domain, preventing access to other Domains.

Answer

The administrator can use a Domain-level Permission Profile to grant access to multiple Domains simultaneously.

Answer

The administrator can assign a global Permission Profile that applies to all Domains, but it will grant access to all Domains.

Answer

The administrator must assign the 'Super User' Permission Profile to allow management of Security Policies in the Domain.

Question 15

A security administrator needs to create a rule that matches HTTP traffic based on the specific web application 'LinkedIn' rather than the entire 'Social Networking' category. The administrator has already enabled Application Control and URL Filtering on the Security Gateway. In SmartConsole, which object type should be used in the Source or Destination column of the security rule to match the application directly?

Accepted Answer

Application/Site. Application/Site objects are the correct choice because they are purpose-built for Application Control and URL Filtering, enabling the administrator to match specific applications like 'LinkedIn' instead of broad categories. This allows precise enforcement of policies that differentiate between individual applications and their parent categories, which is essential for granular control.

Answer

Network object

Answer

Service object

Answer

User object

Question 16

A security administrator notices that users are accessing a gambling website that is not being blocked, even though the 'Gambling' category is set to Block in the URL Filtering policy. The administrator verifies that the policy is installed and the site is indeed categorized as 'Gambling'. What is the most likely reason for this issue?

Accepted Answer

The users are accessing the site via HTTPS and HTTPS inspection is not enabled.. The most likely cause is that the gambling site is accessed over HTTPS and HTTPS inspection is not enabled. Without inspection, the gateway cannot see the full URL path or the encrypted content, so it cannot accurately categorize the traffic. Enabling HTTPS inspection allows the gateway to decrypt and inspect the traffic, ensuring that URL Filtering policies are enforced.

Answer

The 'Gambling' category is not included in the ThreatCloud database.

Answer

The user's browser is using DNS over HTTPS (DoH), bypassing the gateway's DNS filtering.

Answer

The URL Filtering policy is applied only to HTTP traffic by default.

Question 17

A security administrator is investigating a suspicious connection to an external IP. The administrator needs to see the raw packet-level details captured by the Security Gateway's IPS blade to determine the exact payload that triggered the protection. Which SmartConsole tool should the administrator use to view this information?

Accepted Answer

Forensics. The Forensics view in SmartConsole is designed to provide packet-level details for IPS events, capturing the raw payload that triggered a protection. While SmartLog and SmartView Tracker show log entries, they do not include the actual packet data. SmartView Monitor is for real-time status, not forensic analysis. Therefore, Forensics is the correct tool for examining the exact payload of the suspicious connection.

Answer

SmartView Tracker

Answer

SmartLog

Answer

SmartView Monitor

Question 18

A security administrator must let contractors on personally owned, non-domain laptops access internal resources. The contractors cannot install endpoint software, and the organization wants them to authenticate through a web page before access is granted. Which Identity Awareness acquisition method fits these constraints?

Accepted Answer

Captive Portal configured on the Security Gateway. Captive Portal is designed for users who cannot run endpoint agents and are not in the domain. It presents a browser-based login before granting access, satisfying both the no-install and web-authentication requirements. The gateway then maps the authenticated user to the source address for identity-based enforcement.

Answer

AD Query against the corporate domain controllers

Answer

Identity Agent installed by each contractor

Answer

RADIUS Accounting from a third-party network access server

Question 19

An administrator configures Identity Awareness to use AD Query and creates an Access Control rule allowing the 'Sales' identity group to reach a CRM server. Users in Sales are identified, yet some still get blocked. Reviewing logs shows their sessions exist but the group membership is missing. Which configuration should the administrator verify first?

Accepted Answer

The AD Query refresh and group synchronization settings that determine how often group membership is updated from Active Directory.. When an identity session exists but group membership is absent, the issue is usually in how group data is resolved and refreshed from Active Directory. AD Query relies on periodic synchronization to map users to their groups, so stale or misconfigured group synchronization settings explain why identified Sales users lack the group needed to match the rule.

Answer

The Identity Agent installation package version deployed to Sales laptops.

Answer

The Captive Portal login page branding and timeout values.

Answer

The Security Gateway's routing table entries toward the CRM server subnet.

Question 20

A security administrator has deployed Identity Awareness with Terminal Server Agent on a Check Point R81.20 gateway. Users report that their identities are correctly identified when they log in, but after disconnecting and reconnecting to a different session on the same terminal server, they are still associated with the old session. What is the most likely cause?

Accepted Answer

The Terminal Server Agent is not configured to monitor session changes.. The Terminal Server Agent must be configured to monitor all session events, including logoff and reconnection, to keep the identity database current. If it only tracks initial logons, the gateway will not update the mapping when a user switches sessions, resulting in stale associations. Ensuring that session change monitoring is enabled resolves the issue.

Answer

The gateway's identity database is full and cannot accept new entries.

Answer

The gateway is not licensed for Identity Awareness with Terminal Server Agent.

Answer

The Terminal Server Agent service is not running on the terminal server.