156-215.81.20 Practice Test 3 — 30 Questions

Question 1

A security administrator at a financial firm wants to allow access to the corporate banking portal at 'secure.bank.com' but block all other online banking sites for a specific user group. The policy already includes a rule that blocks the 'Financial Services' category. How should the administrator configure the policy to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a URL Filtering rule above the blocking rule with an 'Allow' action for the destination 'secure.bank.com'.. The correct approach is to create an Allow rule for the specific URL above the general block rule. URL Filtering rules are evaluated sequentially, so the first matching rule determines the action. This allows precise exceptions without affecting the broader category block. Using Application Control would not provide the URL granularity needed.

Answer

Modify the existing blocking rule to exclude the 'Financial Services' category and create a new rule to block that category.

Answer

Use an Application Control rule to allow the 'Banking' application and block all others.

Answer

Add 'secure.bank.com' to the 'Allowed URLs' list in the Threat Prevention policy.

Question 2

A security administrator is using SmartConsole to manage a Security Gateway. The administrator needs to verify that Secure Internal Communication (SIC) is properly established between the Management Server and the gateway. Which SmartConsole status indicates that SIC is successfully established?

Accepted Answer

The SIC status in the gateway's properties shows 'Trust established'.. The SIC status is explicitly shown in the gateway's properties under Secure Internal Communication. When trust is established, it displays 'Trust established'. Other statuses like 'Active' or 'Installed' refer to different aspects of gateway health and policy, not SIC. Therefore, checking the SIC status field is the correct way to verify SIC.

Answer

The gateway's policy installation status shows 'Installed'.

Answer

The Management Server's log viewer shows SIC connection logs.

Answer

The gateway's status is 'Active' in the Gateways & Servers view.

Question 3

A security administrator is configuring a rule in the Application Control policy to block all peer-to-peer file sharing applications. After enabling the rule, users report that they can still use uTorrent to download files. The administrator checks the logs and sees that the uTorrent traffic is being matched by a different rule that allows all allowed applications. What is the most likely cause of this issue?

Accepted Answer

The rule allowing all allowed applications is positioned above the block rule, so it takes precedence.. Check Point security policies are evaluated sequentially from top to bottom. When a rule that allows all allowed applications is placed above a rule that blocks peer-to-peer file sharing, the permissive rule matches first, allowing uTorrent traffic. To enforce the block, the administrator must move the block rule above the allow rule or adjust the allow rule to exclude peer-to-peer applications.

Answer

The uTorrent application is classified as a different category (e.g., 'File Sharing') that is not blocked by the rule.

Answer

The uTorrent application is not recognized because the Application Control signature database is outdated.

Answer

Application Control requires a separate license, and without it, the block rule is ignored.

Question 4

An administrator is troubleshooting an issue where logs from a Security Gateway are not appearing in SmartLog. The administrator verifies that the gateway is sending logs to the Management Server, but the logs are not indexed. Which service should the administrator check on the Management Server to ensure proper log indexing?

Accepted Answer

solr. The solr service is responsible for indexing logs on the Management Server. When logs are received, solr processes them to enable fast searching in SmartLog. If solr is not running or has errors, logs will not be indexed and will be missing from SmartLog. The administrator should check the status of the solr service and review its logs for any issues.

Answer

fwd

Answer

CPView

Answer

cpd

Question 5

An administrator needs to allow internal users to access the Internet using Hide NAT. The internal network is 192.168.1.0/24, and the gateway's external interface IP is 203.0.113.5. Which NAT rule should be configured?

Accepted Answer

Source: 192.168.1.0/24, Destination: Any, Service: Any, Translated Source: 203.0.113.5, Translated Destination: Original. To hide internal users behind the gateway's external IP for outbound Internet access, the NAT rule must specify the internal network as the source and the public IP as the translated source. The destination should remain original because Hide NAT only translates the source address for outbound traffic. This allows multiple internal users to share the single public IP.

Answer

Source: Any, Destination: 192.168.1.0/24, Service: Any, Translated Source: Original, Translated Destination: 203.0.113.5

Answer

Source: 203.0.113.5, Destination: 192.168.1.0/24, Service: Any, Translated Source: Original, Translated Destination: Original

Answer

Source: 192.168.1.0/24, Destination: Any, Service: Any, Translated Source: Original, Translated Destination: 203.0.113.5

Question 6

An administrator is configuring a new Security Gateway to communicate with a Security Management Server using SIC. The administrator must ensure the SIC trust is established securely. Which two actions are required to complete SIC initialization? (Choose two.)

Accepted Answer

Run 'cpconfig' on the gateway and select 'Secure Internal Communication' to enter the one-time password.. SIC initialization requires two key actions: generating a one-time password in SmartConsole for the gateway object, and then entering that password on the gateway via cpconfig under Secure Internal Communication. These steps create the trust relationship. Other actions like DNS configuration or policy installation are either prerequisites or subsequent tasks, not part of SIC initialization.

Answer

Install the Security Policy on the gateway to activate SIC.

Answer

Manually copy the management server's certificate to the gateway using SCP.

Answer

Configure the gateway's DNS settings to resolve the management server's hostname.

Question 7

An administrator is creating a new user account in the SmartConsole. The user needs to authenticate via a username and password that is stored in the Check Point user database. Which user type should the administrator select?

Accepted Answer

Internal User. An Internal User account is created and managed directly in the Check Point database, and its password is stored there. This is the correct choice when the requirement is to authenticate with a username and password that Check Point manages. Other user types rely on external authentication sources.

Answer

External User

Answer

LDAP User

Answer

Generic User

Question 8

A security administrator notices that users are accessing a newly registered domain that is not yet categorized by Check Point. The administrator wants to block access to uncategorized sites until they are reviewed. Which URL Filtering action should be configured?

Accepted Answer

Block the 'Uncategorized' category in the URL Filtering policy.. URL Filtering includes an Uncategorized category for sites not yet classified. Setting the action to Block for this category prevents access to unknown or newly registered domains, reducing exposure to phishing and malware. This is a straightforward configuration within the URL Filtering policy.

Answer

Configure a Threat Prevention rule to block uncategorized domains.

Answer

Set the action for the 'Uncategorized' category to 'Allow' but enable logging.

Answer

Enable 'Blocked Categories' and add the specific domain to the block list.

Question 9

An administrator needs to review logs from a specific Security Gateway that occurred between 2:00 AM and 4:00 AM yesterday. Which SmartConsole application should the administrator use to efficiently filter and analyze these logs?

Accepted Answer

SmartLog. SmartLog is the correct tool for searching and analyzing historical logs. It provides a dedicated interface with time-range filters and query capabilities, allowing the administrator to isolate logs from a specific gateway and time window. Other tools like SmartView Monitor, SmartEvent, and SmartDashboard serve different purposes and are not suited for this task.

Answer

SmartView Monitor

Answer

SmartEvent

Answer

SmartDashboard

Question 10

A security administrator manages a Check Point R81.20 environment with a Security Gateway and a separate Identity Collector. Users authenticate through Microsoft Active Directory, and the administrator wants to minimize the number of AD queries sent from the gateway. Which configuration should the administrator use to achieve this?

Accepted Answer

Deploy Identity Collector to receive identity events from AD and forward them to the Security Gateway.. Identity Collector is specifically designed to reduce load on Active Directory by having a dedicated collector receive security event log data and push identity updates to the Security Gateway. This eliminates the need for the gateway to poll AD, which is the behavior of AD Query. The other methods either still query AD or are intended for different authentication scenarios.

Answer

Configure the Security Gateway to use RADIUS accounting to receive user identity information.

Answer

Configure Identity Awareness with AD Query and enable caching on the Security Gateway.

Answer

Enable Identity Awareness with Terminal Server Agent on all domain controllers.

Question 11

An administrator configures Identity Awareness with Active Directory Query on an R81.20 Security Gateway. Users are authenticated via Kerberos, and the gateway has been joined to the domain. However, after login, some users are not being identified. The administrator notices that the gateway's AD Query service account password has expired. What is the most likely cause of the identification failure?

Accepted Answer

The AD Query service account password must be updated in the Identity Awareness configuration, and the service restarted.. The AD Query method relies on a service account to read login events from Active Directory. If that account's password expires or is changed, the gateway loses access and cannot identify users. The fix is to update the password in the Identity Awareness configuration and restart the service. This ensures continuous identification.

Answer

The Security Gateway must be rebooted to re-establish the Kerberos trust with the domain controller.

Answer

The users must log in again because their Kerberos tickets have expired due to the service account issue.

Answer

The Identity Awareness blade must be reinstalled because the expired password corrupted its database.

Question 12

An administrator is deploying Identity Awareness on a Check Point R81.20 Security Gateway. Users authenticate to a captive portal hosted by the gateway itself, without any external directory service. Which Identity Awareness method is being used?

Accepted Answer

Browser-Based Authentication. Browser-Based Authentication is the only Identity Awareness method that operates entirely on the Security Gateway without any external directory or identity source. It presents a captive portal, validates credentials against the gateway's local user database, and then maps the source IP to the authenticated user for policy enforcement. All other methods depend on external infrastructure, which the scenario explicitly excludes.

Answer

RADIUS Accounting

Answer

Identity Collector

Answer

Active Directory Query

Question 13

A security administrator is configuring NAT for a Check Point R81 Security Gateway that protects a DMZ. The DMZ contains a mail server with IP address 10.10.10.5 and a web server with IP address 10.10.10.6. Both servers must be accessible from the Internet using separate public IP addresses. The administrator wants to minimize the number of NAT rules and ensure that the translation is applied correctly. Which NAT configuration approach is most appropriate?

Accepted Answer

Create two Static NAT rules: one for the mail server and one for the web server, each translating to its respective public IP address.. The most appropriate approach is to create two Static NAT rules, one for each server, mapping each to its own public IP address. This provides deterministic one-to-one translation, enabling inbound access to each server and preserving outbound source IPs. Hide NAT and NAT pools are designed for outbound many-to-one or many-to-many translation and do not support publishing multiple servers on distinct public IPs.

Answer

Configure NAT on the gateway object to automatically translate all DMZ traffic to the gateway's external IP address.

Answer

Create a single Hide NAT rule for the entire DMZ subnet, translating to one public IP address.

Answer

Create a single manual NAT rule that translates both servers using a NAT pool of two public IP addresses.

Question 14

A security administrator needs to configure a Security Gateway to send its logs to a third-party SIEM via syslog. The SIEM is reachable only through an external interface, and the administrator wants to avoid sending logs over the internal network. Which Check Point feature should be used to achieve this requirement?

Accepted Answer

Log Exporter. Log Exporter is the correct feature because it is designed to export logs from Check Point Security Gateways to external syslog servers. It can be configured to use a specific source interface, allowing the administrator to direct traffic through an external interface and avoid the internal network. This provides the required functionality without relying on the Management Server for forwarding.

Answer

Logging and Status Blade

Answer

SmartEvent Correlation Unit

Answer

SmartView Tracker

Question 15

A security administrator needs to allow a group of contractors to access the corporate network via Remote Access VPN. The contractors are already defined in an external LDAP directory. The administrator wants to avoid creating individual user accounts in SmartConsole and wants to apply a specific set of VPN settings to all contractors. Which object should the administrator use to represent the contractors in the VPN community configuration?

Accepted Answer

An LDAP user group object that references the external directory group. To represent external LDAP users as a group without creating individual accounts, an LDAP user group object is used. This object references a group in the LDAP directory, and all members inherit the settings applied to the group. It is the correct way to apply VPN settings to multiple contractors efficiently.

Answer

A temporary user account for each contractor

Answer

A generic user account with a wildcard

Answer

An Interoperable device object representing the LDAP server

Question 16

A security administrator at a company using Check Point R81 Management Server needs to verify that a newly created administrator account named 'jsmith' has been assigned the correct permission profile before the account is used. The administrator opens SmartConsole and navigates to the Manage & Settings view. Which action should the administrator take to view the permission profile assigned to 'jsmith'?

Accepted Answer

In SmartConsole, go to Manage & Settings > Administrators, select the 'jsmith' account, and view the 'Permission Profile' field in the account properties.. Administrator accounts and their assigned permission profiles are managed in SmartConsole under Manage & Settings > Administrators. Selecting an administrator reveals its properties, including the permission profile. The other paths either lead to unrelated settings, such as User Awareness or Gaia OS users, or to logs that do not directly show the current profile assignment.

Answer

In SmartConsole, go to Logs & Monitor > Audit Logs, filter by administrator 'jsmith', and inspect the 'Assigned Profile' column.

Answer

In SmartConsole, go to Manage & Settings > Blades > User Awareness, select 'jsmith', and view the 'Permission Profile' attribute.

Answer

In the Gaia portal, navigate to User Management > Administrators, select 'jsmith', and review the 'Permission Profile' setting.

Question 17

An administrator manages multiple Security Gateways using a single Security Management Server. The administrator needs to restrict a new junior administrator so that they can only view and modify the Access Control policy for a specific gateway, but cannot install policies or modify other gateways. Which SmartConsole feature should the administrator use to meet this requirement?

Accepted Answer

Use the 'Permission Profiles' feature to create a profile with access to only the specific gateway and assign it to the junior administrator.. Permission Profiles in SmartConsole are designed to provide granular access control for administrators. By creating a profile that includes only the specific gateway and grants read/write access to Access Control policies while excluding installation permissions, the administrator can precisely meet the requirement. This avoids granting excessive privileges and uses the built-in RBAC feature.

Answer

Set up a separate Management Server for the specific gateway and create a new administrator account there.

Answer

Create a new administrator account with the 'Read/Write' permission for all gateways and then use a policy rule to restrict access.

Answer

Configure the junior administrator's account with 'Super User' permissions and rely on trust to prevent changes to other gateways.

Question 18

A security administrator is troubleshooting a Security Gateway that shows SIC status 'Unknown' in SmartConsole. The administrator suspects the gateway's SIC certificate has expired. Which command on the gateway can be used to check the SIC certificate's expiration date and validity?

Accepted Answer

cpca_client lscert -kind SIC. The cpca_client lscert -kind SIC command on the gateway enumerates SIC certificates from the local store and displays their validity period. When a gateway's SIC certificate has expired, SIC communication fails and SmartConsole may show 'Unknown' or 'Not Communicating'. Checking the certificate with this command confirms expiration, after which the administrator can reset SIC to obtain a new certificate.

Answer

cpinfo -y all

Answer

cpstat os -f sic

Answer

fw stat

Question 19

An administrator notices that the Security Management Server's disk space is being consumed rapidly by log files. The administrator wants to automatically delete logs older than 90 days to free up space. Which Check Point feature should be configured to achieve this?

Accepted Answer

Log Retention Policy. Log Retention Policy is the correct feature because it allows the administrator to set a retention period for logs, after which they are automatically deleted. This directly solves the problem of disk space being consumed by old logs. Other features like Log Exporter, SmartEvent Policy, and Database Revision Control do not provide automatic log deletion based on age.

Answer

SmartEvent Policy

Answer

Database Revision Control

Answer

Log Exporter

Question 20

A Security Gateway stops sending logs to the Management Server, and users report that SmartView Logs shows no new entries. The administrator confirms the gateway is passing traffic. Which action should be taken first to diagnose the log transmission problem?

Accepted Answer

Verify SIC trust status between the Security Gateway and the Management Server.. Secure Internal Communication, or SIC, is the trust foundation for all traffic between a Security Gateway and its Management Server, including log delivery. When logs stop arriving but traffic still flows, verifying SIC status quickly identifies whether the management channel itself is broken. Other actions either treat display symptoms or alter configuration without evidence.

Answer

Increase the log storage quota on the Security Gateway.

Answer

Restart the SmartConsole client to refresh the log view.

Answer

Change the log forwarding port in Global Properties.