156-215.81.20 Practice Test 4 — 10 Questions

Question 1

Refer to the exhibit. An administrator is troubleshooting a site-to-site VPN connection. Based on the debug log provided, what is the most likely cause of the issue?

Accepted Answer

Pre-shared key mismatch. The log explicitly points to a 'Pre-shared key mismatch'. This error occurs when the PSK configured on the local gateway does not match the PSK configured on the remote peer. Because the authentication phase (Phase 1) fails immediately, no tunnel is established. The administrator must verify the character-by-character accuracy of the secret on both peer devices to resolve this authentication failure and allow the tunnel to initialize properly.

Answer

Encryption domain mismatch

Answer

Expired certificate

Answer

IKE version mismatch

Question 2

What is the consequence of setting the 'Log Severity' threshold too high on a Security Gateway?

Accepted Answer

Important security events may not be logged.. Setting a high severity threshold limits the volume of logs generated, which improves performance but risks missing lower-priority security events. Administrators must balance log detail with system performance. Finding the right balance is essential for maintaining a clean log environment that facilitates effective threat detection without overloading the storage systems or creating a bottleneck in the log indexing process on the Management Server.

Answer

The gateway stops processing traffic.

Answer

The management server becomes overloaded.

Answer

The CPU usage on the gateway increases significantly.

Question 3

Refer to the exhibit. An administrator sees this error in the logs. What is the most effective way to resolve this for better visibility?

Accepted Answer

Enable HTTPS Inspection and define appropriate bypass policies.. Without HTTPS inspection, the gateway cannot read the contents of encrypted traffic, limiting its ability to identify applications hidden within HTTPS tunnels. Enabling HTTPS inspection allows the gateway to act as an SSL proxy, decrypting and re-encrypting traffic to perform full inspection. This is critical for modern security, as the vast majority of web traffic is now encrypted, rendering standard packet inspection largely ineffective for application-layer controls.

Answer

Disable Application Control and rely on URL Filtering.

Answer

Increase the timeout settings on the gateway for encrypted traffic.

Answer

Configure the client browsers to trust the Management Server certificate.

Question 4

Refer to the exhibit. An administrator receives this message when trying to publish changes. How can the administrator resolve this conflict?

Accepted Answer

Contact 'admin_alpha' to publish or discard their session. The error indicates a concurrent session conflict where another admin (admin_alpha) holds a write lock on the database. In a multi-admin environment, only one session can hold the write lock at a time. The current administrator must wait for the other session to publish or discard their changes, or contact the other administrator to coordinate the release of the lock.

Answer

Run 'fwm lock_clear' from the CLI

Answer

Restart the Management Server services

Answer

Create a temporary administrative domain

Question 5

An administrator needs to review all logs generated by a specific Security Gateway over the past week. The administrator wants to see the logs in a tabular format and apply filters based on source IP. Which SmartConsole tool should the administrator use?

Accepted Answer

SmartLog. SmartLog is the primary tool in SmartConsole for querying and viewing logs. It provides a tabular format and allows filtering by various fields, including gateway and source IP. SmartView Tracker is deprecated, SmartEvent is for event correlation, and SmartView Monitor is for real-time monitoring. Thus, SmartLog is the correct choice.

Answer

SmartEvent

Answer

SmartView Monitor

Answer

SmartView Tracker

Question 6

An administrator wants to ensure that specific logs are always sent to a remote Log Server, even if the primary Log Server becomes unreachable. Which feature should they configure?

Accepted Answer

Log Redundancy. Log redundancy ensures high availability for log storage. By defining multiple Log Servers in the gateway object properties, Check Point gateways can automatically failover or load-balance log traffic. This is crucial for maintaining compliance in environments where continuous logging is a strict requirement, ensuring that no security events are lost during a single-point-of-failure event on the primary logging server.

Answer

Log Aggregation

Answer

Log Compression

Answer

Log Indexing

Question 7

Refer to the exhibit. An administrator is experiencing intermittent connectivity issues for users behind Hide NAT. What might this setting indicate regarding the root cause?

Accepted Answer

The NAT table limit is too low for the current traffic load.. The parameter 'fw_nat_hide_nat_map_table_size' determines the maximum number of simultaneous translations the gateway can track for Hide NAT. A value of 5000 might be insufficient for a high-traffic environment with many concurrent users. When this limit is reached, new Hide NAT sessions cannot be created, leading to connectivity drops for internal hosts until existing sessions expire and free up table entries.

Answer

The gateway is running out of memory for connection states.

Answer

The gateway is misconfigured and needs to be set to 0.

Answer

The system is ignoring all NAT rule changes.

Question 8

An administrator is creating a new user account in SmartConsole. The administrator wants the user to be able to authenticate to the Check Point Mobile Access portal using a username and password stored locally on the Management Server. Which authentication method should be selected for this user?

Accepted Answer

Check Point Password. For a user to authenticate with a username and password stored locally on the Management Server, the Check Point Password authentication method must be selected. LDAP, RADIUS, and SecurID all rely on external servers for credential verification, which contradicts the requirement for local storage. Check Point Password is the built-in method for local authentication.

Answer

LDAP

Answer

RADIUS

Answer

SecurID

Question 9

A Check Point administrator is configuring a new administrator account in SmartConsole. The administrator wants to grant this account permissions to manage only the Security Policies and objects within a specific Domain, while restricting access to other Domains in a Multi-Domain Management environment. The administrator plans to use a Permission Profile that is scoped to that Domain. Which two statements are true regarding this configuration? (Choose two.)

Accepted Answer

The administrator must assign a Permission Profile that is defined in the same Domain as the administrator account.. In a Multi-Domain Management environment, to restrict an administrator to a specific Domain, the administrator account must be created in that Domain, and a Permission Profile defined in that same Domain must be assigned. This ensures that the account's permissions are scoped only to that Domain, preventing access to other Domains.

Answer

The administrator can use a Domain-level Permission Profile to grant access to multiple Domains simultaneously.

Answer

The administrator can assign a global Permission Profile that applies to all Domains, but it will grant access to all Domains.

Answer

The administrator must assign the 'Super User' Permission Profile to allow management of Security Policies in the Domain.

Question 10

A security administrator needs to create a rule that matches HTTP traffic based on the specific web application 'LinkedIn' rather than the entire 'Social Networking' category. The administrator has already enabled Application Control and URL Filtering on the Security Gateway. In SmartConsole, which object type should be used in the Source or Destination column of the security rule to match the application directly?

Accepted Answer

Application/Site. Application/Site objects are the correct choice because they are purpose-built for Application Control and URL Filtering, enabling the administrator to match specific applications like 'LinkedIn' instead of broad categories. This allows precise enforcement of policies that differentiate between individual applications and their parent categories, which is essential for granular control.

Answer

Network object

Answer

Service object

Answer

User object