156-215.81.20 Practice Questions 2 — 50 Questions

Question 1

Which of the following is a recommended best practice when using Identity Awareness for internal network security?

Accepted Answer

Create rules based on user groups rather than IP addresses.. The most effective way to secure an internal network using Identity Awareness is to implement a 'least privilege' approach combined with granular user-group rules. By defining policies that only allow specific users access to the resources they need to perform their job functions, administrators significantly reduce the internal attack surface. This prevents lateral movement by attackers who might compromise a single machine, as their access remains limited to the authorized user's permissions.

Answer

Enable all Identity Awareness sources on all gateways.

Answer

Only use Captive Portal for all users.

Answer

Disable logging to improve gateway performance.

Question 2

An administrator successfully logs into SmartConsole and modifies several Access Control rules. Another administrator attempts to open SmartConsole to review the threat prevention settings, but receives a warning message indicating that the database is currently locked by the first administrator. What is the standard behavior of SmartConsole regarding concurrent policy editing?

Accepted Answer

The second administrator can choose to open the session in Read-Only mode to view configurations without making changes.. SmartConsole enforces strict object locking mechanisms to prevent database corruption caused by concurrent writes. Only one administrator can hold an active write lock on a specific domain database at a time, while others can open the session in Read-Only mode to inspect configurations safely without risking race conditions during policy saves.

Answer

SmartConsole allows multiple administrators to write to the exact same policy rulebase simultaneously using automated merge algorithms.

Answer

The management server automatically terminates the first administrator session to prioritize the incoming login request.

Answer

The second administrator is completely blocked from authenticating until the first administrator completely exits SmartConsole.

Question 3

Refer to the exhibit. Why are users on non-domain machines labeled as 'unknown'?

Accepted Answer

AD Query cannot identify non-domain machines.. The current configuration only enables AD Query, which specifically relies on Windows domain login events. Non-domain machines do not participate in the domain login process, so the domain controller never generates the security logs required for AD Query to function. Because Captive Portal and Identity Agents are disabled, there is no secondary or fallback method available to identify these non-domain users, resulting in an 'unknown' identity status for their traffic.

Answer

The firewall policy is too restrictive.

Answer

The Identity Awareness blade is malfunctioning.

Answer

The network is using NAT.

Question 4

Which command is used to clear the user sessions in the Identity Awareness database on a Security Gateway?

Accepted Answer

pdp session revoke all. The 'pdp' (Policy Decision Point) command is the primary CLI utility for managing Identity Awareness. Specifically, 'pdp session revoke' allows administrators to manually terminate individual user sessions or clear the entire database. This is a vital task when testing identity policies or when a user's session appears stuck, preventing them from accessing resources correctly due to an outdated identity mapping in the gateway's active cache.

Answer

fw tab -t user_auth -x

Answer

cpstop && cpstart

Answer

identity_clear

Question 5

What is the purpose of the 'SmartConsole Check Point User Center' integration?

Accepted Answer

To synchronize contract and license status information.. The integration with the User Center allows for automated updates of contracts and product information. This ensures the management server has the most current license and support information, which is critical for accessing software updates and technical support. Keeping this information synchronized is a vital administrative task for maintaining a healthy and supported security infrastructure.

Answer

To manage administrative passwords centrally.

Answer

To allow remote access for Check Point support engineers.

Answer

To enable multi-factor authentication for admins.

Question 6

An administrator notices that Application Control is not identifying a popular cloud-based application even though it is listed in the Application Control database. The gateway is running R81.10 and the database is up to date. What could be the cause?

Accepted Answer

The application uses HTTPS and the gateway is not configured for HTTPS inspection.. The most likely cause is that the application uses HTTPS and the gateway lacks HTTPS inspection. Without decrypting the traffic, Application Control cannot identify the application based on its signature. Enabling HTTPS inspection would allow the gateway to inspect the traffic and correctly identify the application.

Answer

The application signature is not included in the current database version.

Answer

The Application Control blade is not enabled on the gateway.

Answer

The gateway is configured to bypass Application Control for traffic on port 443.

Question 7

An administrator wants to enforce a policy that blocks access to websites categorized as 'Hacking' but allows access to 'Computer Security' sites. The administrator creates a URL Filtering rule with the action 'Block' for the 'Hacking' category and places it above a rule that allows 'Computer Security'. However, users report that they can still access some hacking-related sites. Upon investigation, the administrator finds that these sites are categorized as 'Computer Security' by the Check Point URL Filtering database. What should the administrator do to ensure these sites are blocked?

Accepted Answer

Create a custom category that includes these specific URLs and block that category.. When Check Point's URL Filtering database categorizes sites incorrectly, administrators can create custom categories to explicitly define which URLs should be blocked or allowed. Custom categories take precedence over the default database, allowing precise control. This approach ensures that specific hacking-related sites are blocked even if they are misclassified as 'Computer Security'.

Answer

Update the URL Filtering database and wait for the next scheduled update.

Answer

Enable 'HTTPS Inspection' to decrypt the traffic and then block based on content.

Answer

Modify the rule to block all sites that are not explicitly allowed.

Question 8

Refer to the exhibit. An administrator reviews the Identity Awareness status of a user workstation using CLI commands on the Security Gateway. What does the 'Identity Source: Identity Agent' field specifically indicate about how this user's identity was acquired?

Accepted Answer

A client application installed on the user workstation actively authenticated to the Security Gateway.. The Identity Agent source indicates that a lightweight client is installed on the endpoint device, actively communicating user credentials and state directly to the Security Gateway. This method offers high reliability and supports advanced features like post-connection accounting and explicit sign-out.

Answer

The gateway queried the Active Directory Domain Controller security event logs using WMI.

Answer

The user successfully completed a web-based Captive Portal challenge in their browser.

Answer

The gateway intercepted a Kerberos ticket exchange via passive network sniffing.

Question 9

A network administrator is configuring a VPN community that includes a Check Point R81 Security Gateway and a third-party IPsec gateway. The administrator needs to ensure that the VPN tunnel uses specific encryption and hashing algorithms that are supported by both devices. Where should the administrator configure these settings in SmartConsole?

Accepted Answer

In the VPN community's 'Encryption' properties.. The VPN community's 'Encryption' properties allow administrators to define the encryption and hashing algorithms for that specific community. This is crucial when interoperating with third-party gateways that may not support the default algorithms. Other locations like Global Properties or gateway IPsec settings do not provide per-community algorithm configuration.

Answer

In the Global Properties under 'VPN > Advanced'.

Answer

In the Security Gateway object's 'IPsec' section.

Answer

In the 'VPN Clients' section of the gateway object.

Question 10

A Check Point administrator is configuring NAT for a new subnet that will be used for a guest wireless network. The guest subnet is 172.16.50.0/24, and the administrator wants to hide all guest traffic behind the external interface IP 203.0.113.5. The administrator creates a network object for the guest subnet and configures Hide NAT using the external interface. After testing, guests can access the Internet, but the administrator notices that the translation is not being applied to traffic originating from the guest subnet when it is destined to a server on the internal network (192.168.1.0/24). What is the most likely reason for this behavior?

Accepted Answer

The NAT rule is only applied to traffic that traverses the gateway; internal-to-internal traffic does not match the rule.. NAT rules in Check Point are applied only to traffic that passes through the Security Gateway. Guest-to-internal traffic may be routed internally without going through the gateway, or the gateway may not apply NAT to that traffic. Therefore, the Hide NAT rule is not triggered, and the source IP remains unchanged.

Answer

The Hide NAT rule must be placed below the internal cleanup rule to take effect.

Answer

The guest subnet object must be configured with a Static NAT rule for internal traffic.

Answer

The external interface IP 203.0.113.5 is not reachable from the internal network, so NAT fails.

Question 11

A security administrator at a financial firm wants to allow access to the corporate banking portal at 'secure.bank.com' but block all other online banking sites for a specific user group. The policy already includes a rule that blocks the 'Financial Services' category. How should the administrator configure the policy to meet this requirement?

Accepted Answer

Create a URL Filtering rule above the blocking rule with an 'Allow' action for the destination 'secure.bank.com'.. The correct approach is to create an Allow rule for the specific URL above the general block rule. URL Filtering rules are evaluated sequentially, so the first matching rule determines the action. This allows precise exceptions without affecting the broader category block. Using Application Control would not provide the URL granularity needed.

Answer

Modify the existing blocking rule to exclude the 'Financial Services' category and create a new rule to block that category.

Answer

Use an Application Control rule to allow the 'Banking' application and block all others.

Answer

Add 'secure.bank.com' to the 'Allowed URLs' list in the Threat Prevention policy.

Question 12

A security administrator is using SmartConsole to manage a Security Gateway. The administrator needs to verify that Secure Internal Communication (SIC) is properly established between the Management Server and the gateway. Which SmartConsole status indicates that SIC is successfully established?

Accepted Answer

The SIC status in the gateway's properties shows 'Trust established'.. The SIC status is explicitly shown in the gateway's properties under Secure Internal Communication. When trust is established, it displays 'Trust established'. Other statuses like 'Active' or 'Installed' refer to different aspects of gateway health and policy, not SIC. Therefore, checking the SIC status field is the correct way to verify SIC.

Answer

The gateway's policy installation status shows 'Installed'.

Answer

The Management Server's log viewer shows SIC connection logs.

Answer

The gateway's status is 'Active' in the Gateways & Servers view.

Question 13

A security administrator is configuring a rule in the Application Control policy to block all peer-to-peer file sharing applications. After enabling the rule, users report that they can still use uTorrent to download files. The administrator checks the logs and sees that the uTorrent traffic is being matched by a different rule that allows all allowed applications. What is the most likely cause of this issue?

Accepted Answer

The rule allowing all allowed applications is positioned above the block rule, so it takes precedence.. Check Point security policies are evaluated sequentially from top to bottom. When a rule that allows all allowed applications is placed above a rule that blocks peer-to-peer file sharing, the permissive rule matches first, allowing uTorrent traffic. To enforce the block, the administrator must move the block rule above the allow rule or adjust the allow rule to exclude peer-to-peer applications.

Answer

The uTorrent application is classified as a different category (e.g., 'File Sharing') that is not blocked by the rule.

Answer

The uTorrent application is not recognized because the Application Control signature database is outdated.

Answer

Application Control requires a separate license, and without it, the block rule is ignored.

Question 14

An administrator is troubleshooting an issue where logs from a Security Gateway are not appearing in SmartLog. The administrator verifies that the gateway is sending logs to the Management Server, but the logs are not indexed. Which service should the administrator check on the Management Server to ensure proper log indexing?

Accepted Answer

solr. The solr service is responsible for indexing logs on the Management Server. When logs are received, solr processes them to enable fast searching in SmartLog. If solr is not running or has errors, logs will not be indexed and will be missing from SmartLog. The administrator should check the status of the solr service and review its logs for any issues.

Answer

fwd

Answer

CPView

Answer

cpd

Question 15

An administrator needs to allow internal users to access the Internet using Hide NAT. The internal network is 192.168.1.0/24, and the gateway's external interface IP is 203.0.113.5. Which NAT rule should be configured?

Accepted Answer

Source: 192.168.1.0/24, Destination: Any, Service: Any, Translated Source: 203.0.113.5, Translated Destination: Original. To hide internal users behind the gateway's external IP for outbound Internet access, the NAT rule must specify the internal network as the source and the public IP as the translated source. The destination should remain original because Hide NAT only translates the source address for outbound traffic. This allows multiple internal users to share the single public IP.

Answer

Source: Any, Destination: 192.168.1.0/24, Service: Any, Translated Source: Original, Translated Destination: 203.0.113.5

Answer

Source: 203.0.113.5, Destination: 192.168.1.0/24, Service: Any, Translated Source: Original, Translated Destination: Original

Answer

Source: 192.168.1.0/24, Destination: Any, Service: Any, Translated Source: Original, Translated Destination: 203.0.113.5

Question 16

An administrator is configuring a new Security Gateway to communicate with a Security Management Server using SIC. The administrator must ensure the SIC trust is established securely. Which two actions are required to complete SIC initialization? (Choose two.)

Accepted Answer

Run 'cpconfig' on the gateway and select 'Secure Internal Communication' to enter the one-time password.. SIC initialization requires two key actions: generating a one-time password in SmartConsole for the gateway object, and then entering that password on the gateway via cpconfig under Secure Internal Communication. These steps create the trust relationship. Other actions like DNS configuration or policy installation are either prerequisites or subsequent tasks, not part of SIC initialization.

Answer

Install the Security Policy on the gateway to activate SIC.

Answer

Manually copy the management server's certificate to the gateway using SCP.

Answer

Configure the gateway's DNS settings to resolve the management server's hostname.

Question 17

An administrator is creating a new user account in the SmartConsole. The user needs to authenticate via a username and password that is stored in the Check Point user database. Which user type should the administrator select?

Accepted Answer

Internal User. An Internal User account is created and managed directly in the Check Point database, and its password is stored there. This is the correct choice when the requirement is to authenticate with a username and password that Check Point manages. Other user types rely on external authentication sources.

Answer

External User

Answer

LDAP User

Answer

Generic User

Question 18

A security administrator notices that users are accessing a newly registered domain that is not yet categorized by Check Point. The administrator wants to block access to uncategorized sites until they are reviewed. Which URL Filtering action should be configured?

Accepted Answer

Block the 'Uncategorized' category in the URL Filtering policy.. URL Filtering includes an Uncategorized category for sites not yet classified. Setting the action to Block for this category prevents access to unknown or newly registered domains, reducing exposure to phishing and malware. This is a straightforward configuration within the URL Filtering policy.

Answer

Configure a Threat Prevention rule to block uncategorized domains.

Answer

Set the action for the 'Uncategorized' category to 'Allow' but enable logging.

Answer

Enable 'Blocked Categories' and add the specific domain to the block list.

Question 19

An administrator needs to review logs from a specific Security Gateway that occurred between 2:00 AM and 4:00 AM yesterday. Which SmartConsole application should the administrator use to efficiently filter and analyze these logs?

Accepted Answer

SmartLog. SmartLog is the correct tool for searching and analyzing historical logs. It provides a dedicated interface with time-range filters and query capabilities, allowing the administrator to isolate logs from a specific gateway and time window. Other tools like SmartView Monitor, SmartEvent, and SmartDashboard serve different purposes and are not suited for this task.

Answer

SmartView Monitor

Answer

SmartEvent

Answer

SmartDashboard

Question 20

A security administrator manages a Check Point R81.20 environment with a Security Gateway and a separate Identity Collector. Users authenticate through Microsoft Active Directory, and the administrator wants to minimize the number of AD queries sent from the gateway. Which configuration should the administrator use to achieve this?

Accepted Answer

Deploy Identity Collector to receive identity events from AD and forward them to the Security Gateway.. Identity Collector is specifically designed to reduce load on Active Directory by having a dedicated collector receive security event log data and push identity updates to the Security Gateway. This eliminates the need for the gateway to poll AD, which is the behavior of AD Query. The other methods either still query AD or are intended for different authentication scenarios.

Answer

Configure the Security Gateway to use RADIUS accounting to receive user identity information.

Answer

Configure Identity Awareness with AD Query and enable caching on the Security Gateway.

Answer

Enable Identity Awareness with Terminal Server Agent on all domain controllers.