156-215.81.20 Practice Test 2 — 30 Questions

Question 1

Refer to the exhibit. An administrator is troubleshooting a site-to-site VPN connection. Based on the debug log provided, what is the most likely cause of the issue?

Accepted Answer

Pre-shared key mismatch. The log explicitly points to a 'Pre-shared key mismatch'. This error occurs when the PSK configured on the local gateway does not match the PSK configured on the remote peer. Because the authentication phase (Phase 1) fails immediately, no tunnel is established. The administrator must verify the character-by-character accuracy of the secret on both peer devices to resolve this authentication failure and allow the tunnel to initialize properly.

Answer

Encryption domain mismatch

Answer

Expired certificate

Answer

IKE version mismatch

Question 2

What is the consequence of setting the 'Log Severity' threshold too high on a Security Gateway?

Accepted Answer

Important security events may not be logged.. Setting a high severity threshold limits the volume of logs generated, which improves performance but risks missing lower-priority security events. Administrators must balance log detail with system performance. Finding the right balance is essential for maintaining a clean log environment that facilitates effective threat detection without overloading the storage systems or creating a bottleneck in the log indexing process on the Management Server.

Answer

The gateway stops processing traffic.

Answer

The management server becomes overloaded.

Answer

The CPU usage on the gateway increases significantly.

Question 3

Refer to the exhibit. An administrator sees this error in the logs. What is the most effective way to resolve this for better visibility?

Accepted Answer

Enable HTTPS Inspection and define appropriate bypass policies.. Without HTTPS inspection, the gateway cannot read the contents of encrypted traffic, limiting its ability to identify applications hidden within HTTPS tunnels. Enabling HTTPS inspection allows the gateway to act as an SSL proxy, decrypting and re-encrypting traffic to perform full inspection. This is critical for modern security, as the vast majority of web traffic is now encrypted, rendering standard packet inspection largely ineffective for application-layer controls.

Answer

Disable Application Control and rely on URL Filtering.

Answer

Increase the timeout settings on the gateway for encrypted traffic.

Answer

Configure the client browsers to trust the Management Server certificate.

Question 4

Refer to the exhibit. An administrator receives this message when trying to publish changes. How can the administrator resolve this conflict?

Accepted Answer

Contact 'admin_alpha' to publish or discard their session. The error indicates a concurrent session conflict where another admin (admin_alpha) holds a write lock on the database. In a multi-admin environment, only one session can hold the write lock at a time. The current administrator must wait for the other session to publish or discard their changes, or contact the other administrator to coordinate the release of the lock.

Answer

Run 'fwm lock_clear' from the CLI

Answer

Restart the Management Server services

Answer

Create a temporary administrative domain

Question 5

An administrator needs to review all logs generated by a specific Security Gateway over the past week. The administrator wants to see the logs in a tabular format and apply filters based on source IP. Which SmartConsole tool should the administrator use?

Accepted Answer

SmartLog. SmartLog is the primary tool in SmartConsole for querying and viewing logs. It provides a tabular format and allows filtering by various fields, including gateway and source IP. SmartView Tracker is deprecated, SmartEvent is for event correlation, and SmartView Monitor is for real-time monitoring. Thus, SmartLog is the correct choice.

Answer

SmartEvent

Answer

SmartView Monitor

Answer

SmartView Tracker

Question 6

An administrator wants to ensure that specific logs are always sent to a remote Log Server, even if the primary Log Server becomes unreachable. Which feature should they configure?

Accepted Answer

Log Redundancy. Log redundancy ensures high availability for log storage. By defining multiple Log Servers in the gateway object properties, Check Point gateways can automatically failover or load-balance log traffic. This is crucial for maintaining compliance in environments where continuous logging is a strict requirement, ensuring that no security events are lost during a single-point-of-failure event on the primary logging server.

Answer

Log Aggregation

Answer

Log Compression

Answer

Log Indexing

Question 7

Refer to the exhibit. An administrator is experiencing intermittent connectivity issues for users behind Hide NAT. What might this setting indicate regarding the root cause?

Accepted Answer

The NAT table limit is too low for the current traffic load.. The parameter 'fw_nat_hide_nat_map_table_size' determines the maximum number of simultaneous translations the gateway can track for Hide NAT. A value of 5000 might be insufficient for a high-traffic environment with many concurrent users. When this limit is reached, new Hide NAT sessions cannot be created, leading to connectivity drops for internal hosts until existing sessions expire and free up table entries.

Answer

The gateway is running out of memory for connection states.

Answer

The gateway is misconfigured and needs to be set to 0.

Answer

The system is ignoring all NAT rule changes.

Question 8

An administrator is creating a new user account in SmartConsole. The administrator wants the user to be able to authenticate to the Check Point Mobile Access portal using a username and password stored locally on the Management Server. Which authentication method should be selected for this user?

Accepted Answer

Check Point Password. For a user to authenticate with a username and password stored locally on the Management Server, the Check Point Password authentication method must be selected. LDAP, RADIUS, and SecurID all rely on external servers for credential verification, which contradicts the requirement for local storage. Check Point Password is the built-in method for local authentication.

Answer

LDAP

Answer

RADIUS

Answer

SecurID

Question 9

A Check Point administrator is configuring a new administrator account in SmartConsole. The administrator wants to grant this account permissions to manage only the Security Policies and objects within a specific Domain, while restricting access to other Domains in a Multi-Domain Management environment. The administrator plans to use a Permission Profile that is scoped to that Domain. Which two statements are true regarding this configuration? (Choose two.)

Accepted Answer

The administrator must assign a Permission Profile that is defined in the same Domain as the administrator account.. In a Multi-Domain Management environment, to restrict an administrator to a specific Domain, the administrator account must be created in that Domain, and a Permission Profile defined in that same Domain must be assigned. This ensures that the account's permissions are scoped only to that Domain, preventing access to other Domains.

Answer

The administrator can use a Domain-level Permission Profile to grant access to multiple Domains simultaneously.

Answer

The administrator can assign a global Permission Profile that applies to all Domains, but it will grant access to all Domains.

Answer

The administrator must assign the 'Super User' Permission Profile to allow management of Security Policies in the Domain.

Question 10

A security administrator needs to create a rule that matches HTTP traffic based on the specific web application 'LinkedIn' rather than the entire 'Social Networking' category. The administrator has already enabled Application Control and URL Filtering on the Security Gateway. In SmartConsole, which object type should be used in the Source or Destination column of the security rule to match the application directly?

Accepted Answer

Application/Site. Application/Site objects are the correct choice because they are purpose-built for Application Control and URL Filtering, enabling the administrator to match specific applications like 'LinkedIn' instead of broad categories. This allows precise enforcement of policies that differentiate between individual applications and their parent categories, which is essential for granular control.

Answer

Network object

Answer

Service object

Answer

User object

Question 11

A security administrator notices that users are accessing a gambling website that is not being blocked, even though the 'Gambling' category is set to Block in the URL Filtering policy. The administrator verifies that the policy is installed and the site is indeed categorized as 'Gambling'. What is the most likely reason for this issue?

Accepted Answer

The users are accessing the site via HTTPS and HTTPS inspection is not enabled.. The most likely cause is that the gambling site is accessed over HTTPS and HTTPS inspection is not enabled. Without inspection, the gateway cannot see the full URL path or the encrypted content, so it cannot accurately categorize the traffic. Enabling HTTPS inspection allows the gateway to decrypt and inspect the traffic, ensuring that URL Filtering policies are enforced.

Answer

The 'Gambling' category is not included in the ThreatCloud database.

Answer

The user's browser is using DNS over HTTPS (DoH), bypassing the gateway's DNS filtering.

Answer

The URL Filtering policy is applied only to HTTP traffic by default.

Question 12

A security administrator is investigating a suspicious connection to an external IP. The administrator needs to see the raw packet-level details captured by the Security Gateway's IPS blade to determine the exact payload that triggered the protection. Which SmartConsole tool should the administrator use to view this information?

Accepted Answer

Forensics. The Forensics view in SmartConsole is designed to provide packet-level details for IPS events, capturing the raw payload that triggered a protection. While SmartLog and SmartView Tracker show log entries, they do not include the actual packet data. SmartView Monitor is for real-time status, not forensic analysis. Therefore, Forensics is the correct tool for examining the exact payload of the suspicious connection.

Answer

SmartView Tracker

Answer

SmartLog

Answer

SmartView Monitor

Question 13

A security administrator must let contractors on personally owned, non-domain laptops access internal resources. The contractors cannot install endpoint software, and the organization wants them to authenticate through a web page before access is granted. Which Identity Awareness acquisition method fits these constraints?

Accepted Answer

Captive Portal configured on the Security Gateway. Captive Portal is designed for users who cannot run endpoint agents and are not in the domain. It presents a browser-based login before granting access, satisfying both the no-install and web-authentication requirements. The gateway then maps the authenticated user to the source address for identity-based enforcement.

Answer

AD Query against the corporate domain controllers

Answer

Identity Agent installed by each contractor

Answer

RADIUS Accounting from a third-party network access server

Question 14

An administrator configures Identity Awareness to use AD Query and creates an Access Control rule allowing the 'Sales' identity group to reach a CRM server. Users in Sales are identified, yet some still get blocked. Reviewing logs shows their sessions exist but the group membership is missing. Which configuration should the administrator verify first?

Accepted Answer

The AD Query refresh and group synchronization settings that determine how often group membership is updated from Active Directory.. When an identity session exists but group membership is absent, the issue is usually in how group data is resolved and refreshed from Active Directory. AD Query relies on periodic synchronization to map users to their groups, so stale or misconfigured group synchronization settings explain why identified Sales users lack the group needed to match the rule.

Answer

The Identity Agent installation package version deployed to Sales laptops.

Answer

The Captive Portal login page branding and timeout values.

Answer

The Security Gateway's routing table entries toward the CRM server subnet.

Question 15

A security administrator has deployed Identity Awareness with Terminal Server Agent on a Check Point R81.20 gateway. Users report that their identities are correctly identified when they log in, but after disconnecting and reconnecting to a different session on the same terminal server, they are still associated with the old session. What is the most likely cause?

Accepted Answer

The Terminal Server Agent is not configured to monitor session changes.. The Terminal Server Agent must be configured to monitor all session events, including logoff and reconnection, to keep the identity database current. If it only tracks initial logons, the gateway will not update the mapping when a user switches sessions, resulting in stale associations. Ensuring that session change monitoring is enabled resolves the issue.

Answer

The gateway's identity database is full and cannot accept new entries.

Answer

The gateway is not licensed for Identity Awareness with Terminal Server Agent.

Answer

The Terminal Server Agent service is not running on the terminal server.

Question 16

An administrator has successfully established SIC between a Security Management Server and a Security Gateway. The administrator now needs to verify that SIC is working properly. Which SmartConsole status indicates that SIC is fully established and the gateway is trusted?

Accepted Answer

Trust Established. The 'Trust Established' status in SmartConsole is the indicator that SIC is fully established. It means the gateway has successfully completed the SIC handshake, the management server has approved the trust, and the gateway is ready for policy installation and management. This status confirms that all SIC-related steps are complete and the gateway is trusted.

Answer

Waiting for Activation

Answer

Unknown

Answer

Not Responding

Question 17

A Security Management Server (SMS) is configured in a High Availability (HA) cluster with a primary and secondary server. The primary server fails, and the secondary takes over. An administrator notices that SIC communication with remote gateways continues without interruption. What is the reason for this seamless SIC continuity?

Accepted Answer

The secondary management server shares the same internal CA and SIC certificates as the primary, allowing it to authenticate gateways without re-establishing trust.. In a High Availability management server deployment, the secondary server is kept in sync with the primary, including the internal Certificate Authority (CA) and all SIC certificates. When the primary fails, the secondary can immediately take over because it shares the same trust anchors. Gateways already trust the CA, so they accept the secondary's management connection without requiring a new SIC initialization. This ensures uninterrupted management and policy enforcement.

Answer

SIC uses a stateless protocol that does not rely on a persistent connection, so the secondary server can immediately resume communication using the gateway's public key.

Answer

Each gateway maintains a direct SIC tunnel to both the primary and secondary management servers, and automatically switches to the secondary upon primary failure.

Answer

The gateways are configured with a backup management server IP, and upon primary failure, they automatically run 'sic_reset' and re-establish SIC with the secondary.

Question 18

Refer to the exhibit. A site-to-site VPN tunnel fails to initialize. What is the most likely cause of this error?

Accepted Answer

The encryption domain settings do not match. A Proxy ID mismatch in Phase 2 indicates that the two gateways have different ideas of what traffic should be protected by the tunnel. Proxy IDs are the traffic selectors that define the source and destination networks. If the gateways do not agree on these parameters, they will be unable to generate the matching security associations required to tunnel the traffic, leading to a negotiation failure.

Answer

The pre-shared key is incorrect

Answer

The IKE version is mismatched

Answer

The gateway is not authorized to peer

Question 19

Which THREE of the following are valid methods or configurations associated with NAT in Check Point?

Accepted Answer

Automatic NAT defined in the Network Object.. Check Point provides flexible NAT options including Automatic NAT (defined on objects), Manual NAT (defined in policy rules), and the ability to selectively disable NAT for specific traffic flows. Understanding these variations is essential for designing complex connectivity, such as site-to-site VPNs where NAT might need to be bypassed for internal communication but enabled for external Internet-bound traffic.

Answer

Dynamic NAT using only internal IP addresses.

Answer

Automatic NAT via external script injection.

Question 20

During an emergency maintenance window, an administrator accidentally publishes a severely corrupted Access Control policy from SmartConsole, causing widespread connectivity outages. The administrator needs to immediately revert the management database to the exact state it was in before this faulty session was published. Which built-in mechanism provides the fastest resolution?

Accepted Answer

Access Database Revisions from SmartConsole management settings and revert to the specific session revision prior to the faulty publish.. Check Point Database Revisions track every single published session automatically, creating snapshot points of the management database. Administrators can leverage Database Revisions directly inside SmartConsole to revert the entire configuration back to a stable historical checkpoint prior to the problematic session, restoring operational integrity rapidly without manual configuration rollbacks.

Answer

Use the database_purge utility via expert mode CLI to clear out corrupted policy tables and restart the fwd daemon.

Answer

Run database_export to pull an offline XML backup copy and manually edit the XML file to remove the bad rule.

Answer

Restore a Gaia OS snapshot file created prior to the change using the standard command line interface restoration wizard.