156-215.81.20 Practice Test 6 — 10 Questions

Question 1

Which of the following is a recommended best practice when using Identity Awareness for internal network security?

Accepted Answer

Create rules based on user groups rather than IP addresses.. The most effective way to secure an internal network using Identity Awareness is to implement a 'least privilege' approach combined with granular user-group rules. By defining policies that only allow specific users access to the resources they need to perform their job functions, administrators significantly reduce the internal attack surface. This prevents lateral movement by attackers who might compromise a single machine, as their access remains limited to the authorized user's permissions.

Answer

Enable all Identity Awareness sources on all gateways.

Answer

Only use Captive Portal for all users.

Answer

Disable logging to improve gateway performance.

Question 2

An administrator successfully logs into SmartConsole and modifies several Access Control rules. Another administrator attempts to open SmartConsole to review the threat prevention settings, but receives a warning message indicating that the database is currently locked by the first administrator. What is the standard behavior of SmartConsole regarding concurrent policy editing?

Accepted Answer

The second administrator can choose to open the session in Read-Only mode to view configurations without making changes.. SmartConsole enforces strict object locking mechanisms to prevent database corruption caused by concurrent writes. Only one administrator can hold an active write lock on a specific domain database at a time, while others can open the session in Read-Only mode to inspect configurations safely without risking race conditions during policy saves.

Answer

SmartConsole allows multiple administrators to write to the exact same policy rulebase simultaneously using automated merge algorithms.

Answer

The management server automatically terminates the first administrator session to prioritize the incoming login request.

Answer

The second administrator is completely blocked from authenticating until the first administrator completely exits SmartConsole.

Question 3

Refer to the exhibit. Why are users on non-domain machines labeled as 'unknown'?

Accepted Answer

AD Query cannot identify non-domain machines.. The current configuration only enables AD Query, which specifically relies on Windows domain login events. Non-domain machines do not participate in the domain login process, so the domain controller never generates the security logs required for AD Query to function. Because Captive Portal and Identity Agents are disabled, there is no secondary or fallback method available to identify these non-domain users, resulting in an 'unknown' identity status for their traffic.

Answer

The firewall policy is too restrictive.

Answer

The Identity Awareness blade is malfunctioning.

Answer

The network is using NAT.

Question 4

Which command is used to clear the user sessions in the Identity Awareness database on a Security Gateway?

Accepted Answer

pdp session revoke all. The 'pdp' (Policy Decision Point) command is the primary CLI utility for managing Identity Awareness. Specifically, 'pdp session revoke' allows administrators to manually terminate individual user sessions or clear the entire database. This is a vital task when testing identity policies or when a user's session appears stuck, preventing them from accessing resources correctly due to an outdated identity mapping in the gateway's active cache.

Answer

fw tab -t user_auth -x

Answer

cpstop && cpstart

Answer

identity_clear

Question 5

What is the purpose of the 'SmartConsole Check Point User Center' integration?

Accepted Answer

To synchronize contract and license status information.. The integration with the User Center allows for automated updates of contracts and product information. This ensures the management server has the most current license and support information, which is critical for accessing software updates and technical support. Keeping this information synchronized is a vital administrative task for maintaining a healthy and supported security infrastructure.

Answer

To manage administrative passwords centrally.

Answer

To allow remote access for Check Point support engineers.

Answer

To enable multi-factor authentication for admins.

Question 6

An administrator notices that Application Control is not identifying a popular cloud-based application even though it is listed in the Application Control database. The gateway is running R81.10 and the database is up to date. What could be the cause?

Accepted Answer

The application uses HTTPS and the gateway is not configured for HTTPS inspection.. The most likely cause is that the application uses HTTPS and the gateway lacks HTTPS inspection. Without decrypting the traffic, Application Control cannot identify the application based on its signature. Enabling HTTPS inspection would allow the gateway to inspect the traffic and correctly identify the application.

Answer

The application signature is not included in the current database version.

Answer

The Application Control blade is not enabled on the gateway.

Answer

The gateway is configured to bypass Application Control for traffic on port 443.

Question 7

An administrator wants to enforce a policy that blocks access to websites categorized as 'Hacking' but allows access to 'Computer Security' sites. The administrator creates a URL Filtering rule with the action 'Block' for the 'Hacking' category and places it above a rule that allows 'Computer Security'. However, users report that they can still access some hacking-related sites. Upon investigation, the administrator finds that these sites are categorized as 'Computer Security' by the Check Point URL Filtering database. What should the administrator do to ensure these sites are blocked?

Accepted Answer

Create a custom category that includes these specific URLs and block that category.. When Check Point's URL Filtering database categorizes sites incorrectly, administrators can create custom categories to explicitly define which URLs should be blocked or allowed. Custom categories take precedence over the default database, allowing precise control. This approach ensures that specific hacking-related sites are blocked even if they are misclassified as 'Computer Security'.

Answer

Update the URL Filtering database and wait for the next scheduled update.

Answer

Enable 'HTTPS Inspection' to decrypt the traffic and then block based on content.

Answer

Modify the rule to block all sites that are not explicitly allowed.

Question 8

Refer to the exhibit. An administrator reviews the Identity Awareness status of a user workstation using CLI commands on the Security Gateway. What does the 'Identity Source: Identity Agent' field specifically indicate about how this user's identity was acquired?

Accepted Answer

A client application installed on the user workstation actively authenticated to the Security Gateway.. The Identity Agent source indicates that a lightweight client is installed on the endpoint device, actively communicating user credentials and state directly to the Security Gateway. This method offers high reliability and supports advanced features like post-connection accounting and explicit sign-out.

Answer

The gateway queried the Active Directory Domain Controller security event logs using WMI.

Answer

The user successfully completed a web-based Captive Portal challenge in their browser.

Answer

The gateway intercepted a Kerberos ticket exchange via passive network sniffing.

Question 9

A network administrator is configuring a VPN community that includes a Check Point R81 Security Gateway and a third-party IPsec gateway. The administrator needs to ensure that the VPN tunnel uses specific encryption and hashing algorithms that are supported by both devices. Where should the administrator configure these settings in SmartConsole?

Accepted Answer

In the VPN community's 'Encryption' properties.. The VPN community's 'Encryption' properties allow administrators to define the encryption and hashing algorithms for that specific community. This is crucial when interoperating with third-party gateways that may not support the default algorithms. Other locations like Global Properties or gateway IPsec settings do not provide per-community algorithm configuration.

Answer

In the Global Properties under 'VPN > Advanced'.

Answer

In the Security Gateway object's 'IPsec' section.

Answer

In the 'VPN Clients' section of the gateway object.

Question 10

A Check Point administrator is configuring NAT for a new subnet that will be used for a guest wireless network. The guest subnet is 172.16.50.0/24, and the administrator wants to hide all guest traffic behind the external interface IP 203.0.113.5. The administrator creates a network object for the guest subnet and configures Hide NAT using the external interface. After testing, guests can access the Internet, but the administrator notices that the translation is not being applied to traffic originating from the guest subnet when it is destined to a server on the internal network (192.168.1.0/24). What is the most likely reason for this behavior?

Accepted Answer

The NAT rule is only applied to traffic that traverses the gateway; internal-to-internal traffic does not match the rule.. NAT rules in Check Point are applied only to traffic that passes through the Security Gateway. Guest-to-internal traffic may be routed internally without going through the gateway, or the gateway may not apply NAT to that traffic. Therefore, the Hide NAT rule is not triggered, and the source IP remains unchanged.

Answer

The Hide NAT rule must be placed below the internal cleanup rule to take effect.

Answer

The guest subnet object must be configured with a Static NAT rule for internal traffic.

Answer

The external interface IP 203.0.113.5 is not reachable from the internal network, so NAT fails.