156-215.81.20 Practice Test 5 — 10 Questions

Question 1

A security administrator notices that users are accessing a gambling website that is not being blocked, even though the 'Gambling' category is set to Block in the URL Filtering policy. The administrator verifies that the policy is installed and the site is indeed categorized as 'Gambling'. What is the most likely reason for this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The users are accessing the site via HTTPS and HTTPS inspection is not enabled.. The most likely cause is that the gambling site is accessed over HTTPS and HTTPS inspection is not enabled. Without inspection, the gateway cannot see the full URL path or the encrypted content, so it cannot accurately categorize the traffic. Enabling HTTPS inspection allows the gateway to decrypt and inspect the traffic, ensuring that URL Filtering policies are enforced.

Answer

The 'Gambling' category is not included in the ThreatCloud database.

Answer

The user's browser is using DNS over HTTPS (DoH), bypassing the gateway's DNS filtering.

Answer

The URL Filtering policy is applied only to HTTP traffic by default.

Question 2

A security administrator is investigating a suspicious connection to an external IP. The administrator needs to see the raw packet-level details captured by the Security Gateway's IPS blade to determine the exact payload that triggered the protection. Which SmartConsole tool should the administrator use to view this information?

Accepted Answer

Forensics. The Forensics view in SmartConsole is designed to provide packet-level details for IPS events, capturing the raw payload that triggered a protection. While SmartLog and SmartView Tracker show log entries, they do not include the actual packet data. SmartView Monitor is for real-time status, not forensic analysis. Therefore, Forensics is the correct tool for examining the exact payload of the suspicious connection.

Answer

SmartView Tracker

Answer

SmartLog

Answer

SmartView Monitor

Question 3

A security administrator must let contractors on personally owned, non-domain laptops access internal resources. The contractors cannot install endpoint software, and the organization wants them to authenticate through a web page before access is granted. Which Identity Awareness acquisition method fits these constraints?

Accepted Answer

Captive Portal configured on the Security Gateway. Captive Portal is designed for users who cannot run endpoint agents and are not in the domain. It presents a browser-based login before granting access, satisfying both the no-install and web-authentication requirements. The gateway then maps the authenticated user to the source address for identity-based enforcement.

Answer

AD Query against the corporate domain controllers

Answer

Identity Agent installed by each contractor

Answer

RADIUS Accounting from a third-party network access server

Question 4

An administrator configures Identity Awareness to use AD Query and creates an Access Control rule allowing the 'Sales' identity group to reach a CRM server. Users in Sales are identified, yet some still get blocked. Reviewing logs shows their sessions exist but the group membership is missing. Which configuration should the administrator verify first?

Accepted Answer

The AD Query refresh and group synchronization settings that determine how often group membership is updated from Active Directory.. When an identity session exists but group membership is absent, the issue is usually in how group data is resolved and refreshed from Active Directory. AD Query relies on periodic synchronization to map users to their groups, so stale or misconfigured group synchronization settings explain why identified Sales users lack the group needed to match the rule.

Answer

The Identity Agent installation package version deployed to Sales laptops.

Answer

The Captive Portal login page branding and timeout values.

Answer

The Security Gateway's routing table entries toward the CRM server subnet.

Question 5

A security administrator has deployed Identity Awareness with Terminal Server Agent on a Check Point R81.20 gateway. Users report that their identities are correctly identified when they log in, but after disconnecting and reconnecting to a different session on the same terminal server, they are still associated with the old session. What is the most likely cause?

Accepted Answer

The Terminal Server Agent is not configured to monitor session changes.. The Terminal Server Agent must be configured to monitor all session events, including logoff and reconnection, to keep the identity database current. If it only tracks initial logons, the gateway will not update the mapping when a user switches sessions, resulting in stale associations. Ensuring that session change monitoring is enabled resolves the issue.

Answer

The gateway's identity database is full and cannot accept new entries.

Answer

The gateway is not licensed for Identity Awareness with Terminal Server Agent.

Answer

The Terminal Server Agent service is not running on the terminal server.

Question 6

An administrator has successfully established SIC between a Security Management Server and a Security Gateway. The administrator now needs to verify that SIC is working properly. Which SmartConsole status indicates that SIC is fully established and the gateway is trusted?

Accepted Answer

Trust Established. The 'Trust Established' status in SmartConsole is the indicator that SIC is fully established. It means the gateway has successfully completed the SIC handshake, the management server has approved the trust, and the gateway is ready for policy installation and management. This status confirms that all SIC-related steps are complete and the gateway is trusted.

Answer

Waiting for Activation

Answer

Unknown

Answer

Not Responding

Question 7

A Security Management Server (SMS) is configured in a High Availability (HA) cluster with a primary and secondary server. The primary server fails, and the secondary takes over. An administrator notices that SIC communication with remote gateways continues without interruption. What is the reason for this seamless SIC continuity?

Accepted Answer

The secondary management server shares the same internal CA and SIC certificates as the primary, allowing it to authenticate gateways without re-establishing trust.. In a High Availability management server deployment, the secondary server is kept in sync with the primary, including the internal Certificate Authority (CA) and all SIC certificates. When the primary fails, the secondary can immediately take over because it shares the same trust anchors. Gateways already trust the CA, so they accept the secondary's management connection without requiring a new SIC initialization. This ensures uninterrupted management and policy enforcement.

Answer

SIC uses a stateless protocol that does not rely on a persistent connection, so the secondary server can immediately resume communication using the gateway's public key.

Answer

Each gateway maintains a direct SIC tunnel to both the primary and secondary management servers, and automatically switches to the secondary upon primary failure.

Answer

The gateways are configured with a backup management server IP, and upon primary failure, they automatically run 'sic_reset' and re-establish SIC with the secondary.

Question 8

Refer to the exhibit. A site-to-site VPN tunnel fails to initialize. What is the most likely cause of this error?

Accepted Answer

The encryption domain settings do not match. A Proxy ID mismatch in Phase 2 indicates that the two gateways have different ideas of what traffic should be protected by the tunnel. Proxy IDs are the traffic selectors that define the source and destination networks. If the gateways do not agree on these parameters, they will be unable to generate the matching security associations required to tunnel the traffic, leading to a negotiation failure.

Answer

The pre-shared key is incorrect

Answer

The IKE version is mismatched

Answer

The gateway is not authorized to peer

Question 9

Which THREE of the following are valid methods or configurations associated with NAT in Check Point?

Accepted Answer

Automatic NAT defined in the Network Object.. Check Point provides flexible NAT options including Automatic NAT (defined on objects), Manual NAT (defined in policy rules), and the ability to selectively disable NAT for specific traffic flows. Understanding these variations is essential for designing complex connectivity, such as site-to-site VPNs where NAT might need to be bypassed for internal communication but enabled for external Internet-bound traffic.

Answer

Dynamic NAT using only internal IP addresses.

Answer

Automatic NAT via external script injection.

Question 10

During an emergency maintenance window, an administrator accidentally publishes a severely corrupted Access Control policy from SmartConsole, causing widespread connectivity outages. The administrator needs to immediately revert the management database to the exact state it was in before this faulty session was published. Which built-in mechanism provides the fastest resolution?

Accepted Answer

Access Database Revisions from SmartConsole management settings and revert to the specific session revision prior to the faulty publish.. Check Point Database Revisions track every single published session automatically, creating snapshot points of the management database. Administrators can leverage Database Revisions directly inside SmartConsole to revert the entire configuration back to a stable historical checkpoint prior to the problematic session, restoring operational integrity rapidly without manual configuration rollbacks.

Answer

Use the database_purge utility via expert mode CLI to clear out corrupted policy tables and restart the fwd daemon.

Answer

Run database_export to pull an offline XML backup copy and manually edit the XML file to remove the bad rule.

Answer

Restore a Gaia OS snapshot file created prior to the change using the standard command line interface restoration wizard.