156-215.81.20 Practice Test 4 — 25 Questions

Question 1

A security administrator at a company using Check Point R81 Management Server needs to verify that a newly created administrator account named 'jsmith' has been assigned the correct permission profile before the account is used. The administrator opens SmartConsole and navigates to the Manage & Settings view. Which action should the administrator take to view the permission profile assigned to 'jsmith'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In SmartConsole, go to Manage & Settings > Administrators, select the 'jsmith' account, and view the 'Permission Profile' field in the account properties.. Administrator accounts and their assigned permission profiles are managed in SmartConsole under Manage & Settings > Administrators. Selecting an administrator reveals its properties, including the permission profile. The other paths either lead to unrelated settings, such as User Awareness or Gaia OS users, or to logs that do not directly show the current profile assignment.

Answer

In SmartConsole, go to Logs & Monitor > Audit Logs, filter by administrator 'jsmith', and inspect the 'Assigned Profile' column.

Answer

In SmartConsole, go to Manage & Settings > Blades > User Awareness, select 'jsmith', and view the 'Permission Profile' attribute.

Answer

In the Gaia portal, navigate to User Management > Administrators, select 'jsmith', and review the 'Permission Profile' setting.

Question 2

An administrator manages multiple Security Gateways using a single Security Management Server. The administrator needs to restrict a new junior administrator so that they can only view and modify the Access Control policy for a specific gateway, but cannot install policies or modify other gateways. Which SmartConsole feature should the administrator use to meet this requirement?

Accepted Answer

Use the 'Permission Profiles' feature to create a profile with access to only the specific gateway and assign it to the junior administrator.. Permission Profiles in SmartConsole are designed to provide granular access control for administrators. By creating a profile that includes only the specific gateway and grants read/write access to Access Control policies while excluding installation permissions, the administrator can precisely meet the requirement. This avoids granting excessive privileges and uses the built-in RBAC feature.

Answer

Set up a separate Management Server for the specific gateway and create a new administrator account there.

Answer

Create a new administrator account with the 'Read/Write' permission for all gateways and then use a policy rule to restrict access.

Answer

Configure the junior administrator's account with 'Super User' permissions and rely on trust to prevent changes to other gateways.

Question 3

A security administrator is troubleshooting a Security Gateway that shows SIC status 'Unknown' in SmartConsole. The administrator suspects the gateway's SIC certificate has expired. Which command on the gateway can be used to check the SIC certificate's expiration date and validity?

Accepted Answer

cpca_client lscert -kind SIC. The cpca_client lscert -kind SIC command on the gateway enumerates SIC certificates from the local store and displays their validity period. When a gateway's SIC certificate has expired, SIC communication fails and SmartConsole may show 'Unknown' or 'Not Communicating'. Checking the certificate with this command confirms expiration, after which the administrator can reset SIC to obtain a new certificate.

Answer

cpinfo -y all

Answer

cpstat os -f sic

Answer

fw stat

Question 4

An administrator notices that the Security Management Server's disk space is being consumed rapidly by log files. The administrator wants to automatically delete logs older than 90 days to free up space. Which Check Point feature should be configured to achieve this?

Accepted Answer

Log Retention Policy. Log Retention Policy is the correct feature because it allows the administrator to set a retention period for logs, after which they are automatically deleted. This directly solves the problem of disk space being consumed by old logs. Other features like Log Exporter, SmartEvent Policy, and Database Revision Control do not provide automatic log deletion based on age.

Answer

SmartEvent Policy

Answer

Database Revision Control

Answer

Log Exporter

Question 5

A Security Gateway stops sending logs to the Management Server, and users report that SmartView Logs shows no new entries. The administrator confirms the gateway is passing traffic. Which action should be taken first to diagnose the log transmission problem?

Accepted Answer

Verify SIC trust status between the Security Gateway and the Management Server.. Secure Internal Communication, or SIC, is the trust foundation for all traffic between a Security Gateway and its Management Server, including log delivery. When logs stop arriving but traffic still flows, verifying SIC status quickly identifies whether the management channel itself is broken. Other actions either treat display symptoms or alter configuration without evidence.

Answer

Increase the log storage quota on the Security Gateway.

Answer

Restart the SmartConsole client to refresh the log view.

Answer

Change the log forwarding port in Global Properties.

Question 6

An administrator is troubleshooting an Identity Awareness deployment where some users are intermittently shown as unidentified on the Security Gateway. The environment uses AD Query. Which TWO conditions would cause AD Query to fail to identify a logged-in user? (Choose two.)

Accepted Answer

The Security Gateway cannot reach the domain controller on the required ports for event log retrieval.. AD Query relies on reaching domain controllers to read security event logs, and it only sees logons generated after monitoring is enabled for those controllers. Blocked connectivity or logons predating configuration both leave users unidentified. Endpoint agent state, portal certificates, and session timeout length do not govern whether AD Query can read domain login events.

Answer

The Captive Portal certificate has expired on the gateway.

Answer

The gateway's identity session timeout is shorter than the users' typical work session.

Answer

The endpoint has the Identity Agent installed but the service is set to manual start.

Question 7

An administrator needs to ensure that employees cannot access known malicious websites. The company uses Check Point URL Filtering with ThreatCloud. Which action should the administrator take to block access to these sites?

Accepted Answer

Enable the 'Malicious Sites' category in a URL Filtering rule with a 'Block' action.. Using the 'Malicious Sites' category in URL Filtering is the most efficient way to block access to known malicious websites. This category is maintained by Check Point's ThreatCloud, which continuously updates its database with new threats. Other methods either do not target URLs or are too broad, making them unsuitable for this requirement.

Answer

Add the malicious sites to a custom group and apply a 'Block' action in the URL Filtering policy.

Answer

Configure a Threat Prevention profile with a 'Block' action for malicious sites.

Answer

Create an Application Control rule to block the 'Web Browsing' application.

Question 8

An administrator is configuring a new user group in SmartConsole. The group will be used in a rule to allow access to a specific server. The administrator wants to ensure that only users who are members of this group can access the server, and that membership is managed dynamically based on the user's department in the LDAP directory. Which type of user group should the administrator create?

Accepted Answer

An LDAP user group that maps to an LDAP group. To achieve dynamic membership based on the LDAP directory, an LDAP user group object must be created. This object references an LDAP group, and membership is automatically synchronized. Local user groups, generic groups, and RADIUS-based groups do not provide the required dynamic LDAP integration.

Answer

An external user group defined by a RADIUS server

Answer

A generic user group with a wildcard

Answer

A local user group with manually added users

Question 9

A remote access user connects to a Check Point Security Gateway using the Mobile Access blade. The user needs to access internal resources, but the connection fails. The administrator checks the gateway and sees that the user authenticated successfully, but no IP address was assigned. Which component is responsible for assigning IP addresses to remote access users in this scenario?

Accepted Answer

The Office Mode pool configured on the gateway.. The correct answer is the Office Mode pool configured on the gateway. Office Mode is the Check Point feature that assigns virtual IP addresses to remote access clients. When a user authenticates but receives no IP address, the most likely cause is that the Office Mode pool is not configured, is exhausted, or is incorrectly defined. This component is directly responsible for IP assignment in Remote Access VPN.

Answer

The RADIUS server used for authentication.

Answer

The DHCP server on the internal network.

Answer

The DNS server configured in the VPN community.

Question 10

An administrator is setting up a Remote Access VPN using Check Point Mobile Access. The administrator wants to ensure that remote users can access internal resources using the same IP address throughout their session, even if they disconnect and reconnect. Which Check Point feature should be enabled to achieve this?

Accepted Answer

IP Address Persistence. IP Address Persistence is the feature that ensures a remote user receives the same virtual IP address each time they connect, provided the address is still available. This is particularly useful for applications that require a consistent IP address for the user. Office Mode must be enabled to assign IP addresses, but IP Address Persistence is the specific setting that maintains the same address across sessions. Together, they provide a stable and consistent remote access experience.

Answer

Visitor Mode

Answer

Office Mode

Answer

Secure Domain Logon

Question 11

A Check Point administrator is configuring a new SmartConsole administrator account for a security analyst. The analyst must be able to view all objects and rules but must not be able to modify any security policy or object. The administrator assigns the 'Read-Only All' Permission Profile. However, the analyst reports that they can still edit their own personal settings, such as changing their password. Is this expected behavior?

Accepted Answer

Yes, it is expected; the 'Read-Only All' profile permits users to modify their own personal settings, including password, while restricting changes to security policies and objects.. The 'Read-Only All' Permission Profile is intended to provide view-only access to all security objects and rules. It does not prevent an administrator from managing their own account, such as changing a password or adjusting personal preferences. Therefore, the analyst's ability to edit personal settings is expected and does not violate the read-only restriction on policy and objects.

Answer

No, the 'Read-Only All' profile should block all write operations, but a known bug in R81 allows password changes; the administrator should open a support ticket.

Answer

No, the 'Read-Only All' profile should prevent any changes, including personal settings; the administrator must apply an additional restriction.

Answer

Yes, but only if the administrator also has the 'Super User' profile; otherwise, personal settings are locked.

Question 12

An administrator configures a Site-to-Site VPN between two Check Point R81 gateways using a Star community. IKE Phase 1 completes successfully, but IKE Phase 2 fails with the error 'No proposal chosen'. The administrator has verified that the encryption and hash algorithms match on both gateways. Which action should the administrator take to resolve this issue?

Accepted Answer

Verify that the Diffie-Hellman group configured for IKE Phase 2 (Perfect Forward Secrecy) matches on both gateways.. IKE Phase 2 negotiates the IPsec SA and includes its own set of security parameters, including the Perfect Forward Secrecy (PFS) Diffie-Hellman group. Even if Phase 1 succeeds, a mismatch in the PFS group will cause Phase 2 to fail with 'No proposal chosen'. Aligning the PFS group on both gateways resolves the issue.

Answer

Ensure that the VPN community is configured to use 'One VPN tunnel per subnet pair'.

Answer

Confirm that the pre-shared secret is identical on both gateways.

Answer

Check that the gateway's VPN domain includes the correct encryption domain.

Question 13

An administrator notices that the Security Management Server disk is filling rapidly because log files are retained indefinitely. The retention policy must keep logs for 90 days and then remove older records automatically. Where should this be configured?

Accepted Answer

In the Management Server object's Logging settings, by defining a log retention period.. Log retention is governed on the Management Server object, where an administrator defines how many days logs are kept. Setting 90 days ensures older records are purged automatically, controlling disk consumption while satisfying the retention policy. Gateway-side settings and manual file deletion do not provide supported, age-based log lifecycle management.

Answer

By scheduling a cron job that deletes files from the log directory nightly.

Answer

By adjusting the log size limit per gateway in Global Properties.

Answer

In the Security Gateway object's Logging and Time settings.

Question 14

A security administrator is preparing to establish Secure Internal Communication (SIC) between a Security Management Server and a new Security Gateway. Which two actions are required to successfully initialize SIC? (Choose two.)

Accepted Answer

On the gateway, run cpconfig and enter the same one-time password in the Secure Internal Communication section.. SIC initialization requires a shared secret. The administrator sets a one-time password in the gateway object in SmartConsole, then enters the identical password on the gateway using cpconfig's Secure Internal Communication section. This exchange authenticates the gateway to the management server's internal CA, which issues the SIC certificate. Both actions are mandatory for successful initialization.

Answer

On the management server, run fw putkey to push the SIC certificate to the gateway.

Answer

On the gateway, run sic_reset to clear any existing trust before initialization.

Answer

On the management server, run cpca_client create_cert to generate a new SIC certificate for the gateway.

Question 15

A Check Point administrator is configuring user authentication for a Remote Access VPN. The administrator wants to use certificates for authentication but also requires a second factor. The administrator decides to use SecurID tokens as the second factor. Which authentication method should be configured in the user object to achieve this?

Accepted Answer

Certificate + SecurID. To use certificates and SecurID tokens together, the user object must be configured with the 'Certificate + SecurID' authentication method. This method enforces both factors: the user must present a valid certificate and a correct SecurID token code. Other methods either use only one factor or substitute the certificate with a password.

Answer

User Name and Password + SecurID

Answer

SecurID

Answer

Certificate

Question 16

A security administrator at a financial firm needs to block all peer-to-peer file-sharing applications for the entire company, but must allow legitimate business use of instant messaging. The administrator wants the least administrative effort and automatic updates of new application signatures. What should the administrator do?

Accepted Answer

Create an Application Control rule that blocks the Peer-to-Peer category and install the policy.. Application Control uses signatures to identify applications regardless of port or protocol. Blocking the Peer-to-Peer category in an Application Control rule immediately blocks all current and future P2P applications, while instant messaging remains allowed. Because signatures are updated automatically, no manual intervention is needed when new P2P apps appear.

Answer

Create a Service object for each known P2P protocol and add them to a drop rule in the firewall policy.

Answer

Create a URL Filtering rule that blocks the Peer-to-Peer category and install the policy.

Answer

Enable HTTPS Inspection and create a rule that blocks all applications except instant messaging.

Question 17

An administrator notices that a user is able to access a website categorized as 'Social Networking' even though the URL Filtering policy blocks that category. The administrator confirms the policy is installed and the user's traffic is inspected. What is the most likely cause?

Accepted Answer

The user is accessing the website via HTTPS, and HTTPS inspection is not enabled.. HTTPS inspection is required for URL Filtering to categorize and enforce policy on encrypted traffic. Without it, the gateway cannot see the full URL or category, so the block rule for 'Social Networking' may not apply. Enabling HTTPS inspection resolves this.

Answer

The user's IP address is excluded from the URL Filtering policy via a bypass rule.

Answer

The 'Social Networking' category is set to 'Ask' instead of 'Block' in the policy.

Answer

The website is also categorized under a custom category that is allowed.

Question 18

A company wants users on managed Windows endpoints to be identified by Identity Awareness without requiring them to open a browser or wait for an AD event log poll. The endpoints are domain-joined and already managed by the organization. Which acquisition method meets this requirement most directly?

Accepted Answer

Identity Agent installed on each managed endpoint. An endpoint-resident Identity Agent authenticates the logged-in user to the gateway automatically, providing immediate identification with no browser prompt and no dependency on AD event polling. For centrally managed, domain-joined Windows endpoints, this is the most direct way to achieve seamless, prompt-free identity acquisition.

Answer

Captive Portal with single sign-on enabled

Answer

AD Query configured against the domain controllers

Answer

RADIUS Accounting configured on the gateway

Question 19

A security administrator is configuring a new Security Gateway in SmartConsole. The gateway is behind a NAT device and its internal IP address is 10.1.1.1, but it communicates with the Management Server over the internet using a public IP address of 203.0.113.5. The administrator needs to ensure that SIC and policy installation work correctly. What should be configured on the gateway object in SmartConsole?

Accepted Answer

Set the gateway's IP address to 10.1.1.1 and enable 'IP Address is NATed' with the public IP 203.0.113.5.. When a gateway is behind NAT, the gateway object in SmartConsole must reflect the internal IP and have the NATed public IP configured. This allows the Management Server to use the correct address for SIC and policy installation. The 'IP Address is NATed' option ensures that the Management Server communicates with the gateway using the public IP while the gateway's internal configuration remains unchanged.

Answer

Set the gateway's IP address to 203.0.113.5 and disable NAT on the gateway.

Answer

Set the gateway's IP address to 203.0.113.5 and configure NAT on the gateway.

Answer

Set the gateway's IP address to 10.1.1.1 and configure a static route on the Management Server to reach 203.0.113.5.

Question 20

A security administrator needs to allow access to a specific website that is categorized as 'Social Networking' while blocking all other social networking sites. The administrator wants to ensure that only that particular URL is allowed. What is the most efficient way to achieve this in the URL Filtering policy?

Accepted Answer

Create a rule with the action 'Allow' for the specific URL and place it above the rule that blocks the 'Social Networking' category.. To allow a specific URL while blocking its category, the administrator can create an allow rule for that URL and position it above the category block rule. Check Point evaluates rules top-down, so the specific allow rule will match first, granting access to that URL. Other social networking sites will not match the allow rule and will be blocked by the category rule.

Answer

Modify the 'Social Networking' category to exclude the specific URL.

Answer

Use the 'Category Override' feature to allow the URL for all users.

Answer

Create a new rule with the action 'Block' for the specific URL and place it above the block rule for 'Social Networking'.