156-215.81.20 Practice Test 7 — 10 Questions

Question 1

A security administrator at a financial firm wants to allow access to the corporate banking portal at 'secure.bank.com' but block all other online banking sites for a specific user group. The policy already includes a rule that blocks the 'Financial Services' category. How should the administrator configure the policy to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a URL Filtering rule above the blocking rule with an 'Allow' action for the destination 'secure.bank.com'.. The correct approach is to create an Allow rule for the specific URL above the general block rule. URL Filtering rules are evaluated sequentially, so the first matching rule determines the action. This allows precise exceptions without affecting the broader category block. Using Application Control would not provide the URL granularity needed.

Answer

Modify the existing blocking rule to exclude the 'Financial Services' category and create a new rule to block that category.

Answer

Use an Application Control rule to allow the 'Banking' application and block all others.

Answer

Add 'secure.bank.com' to the 'Allowed URLs' list in the Threat Prevention policy.

Question 2

A security administrator is using SmartConsole to manage a Security Gateway. The administrator needs to verify that Secure Internal Communication (SIC) is properly established between the Management Server and the gateway. Which SmartConsole status indicates that SIC is successfully established?

Accepted Answer

The SIC status in the gateway's properties shows 'Trust established'.. The SIC status is explicitly shown in the gateway's properties under Secure Internal Communication. When trust is established, it displays 'Trust established'. Other statuses like 'Active' or 'Installed' refer to different aspects of gateway health and policy, not SIC. Therefore, checking the SIC status field is the correct way to verify SIC.

Answer

The gateway's policy installation status shows 'Installed'.

Answer

The Management Server's log viewer shows SIC connection logs.

Answer

The gateway's status is 'Active' in the Gateways & Servers view.

Question 3

A security administrator is configuring a rule in the Application Control policy to block all peer-to-peer file sharing applications. After enabling the rule, users report that they can still use uTorrent to download files. The administrator checks the logs and sees that the uTorrent traffic is being matched by a different rule that allows all allowed applications. What is the most likely cause of this issue?

Accepted Answer

The rule allowing all allowed applications is positioned above the block rule, so it takes precedence.. Check Point security policies are evaluated sequentially from top to bottom. When a rule that allows all allowed applications is placed above a rule that blocks peer-to-peer file sharing, the permissive rule matches first, allowing uTorrent traffic. To enforce the block, the administrator must move the block rule above the allow rule or adjust the allow rule to exclude peer-to-peer applications.

Answer

The uTorrent application is classified as a different category (e.g., 'File Sharing') that is not blocked by the rule.

Answer

The uTorrent application is not recognized because the Application Control signature database is outdated.

Answer

Application Control requires a separate license, and without it, the block rule is ignored.

Question 4

An administrator is troubleshooting an issue where logs from a Security Gateway are not appearing in SmartLog. The administrator verifies that the gateway is sending logs to the Management Server, but the logs are not indexed. Which service should the administrator check on the Management Server to ensure proper log indexing?

Accepted Answer

solr. The solr service is responsible for indexing logs on the Management Server. When logs are received, solr processes them to enable fast searching in SmartLog. If solr is not running or has errors, logs will not be indexed and will be missing from SmartLog. The administrator should check the status of the solr service and review its logs for any issues.

Answer

fwd

Answer

CPView

Answer

cpd

Question 5

An administrator needs to allow internal users to access the Internet using Hide NAT. The internal network is 192.168.1.0/24, and the gateway's external interface IP is 203.0.113.5. Which NAT rule should be configured?

Accepted Answer

Source: 192.168.1.0/24, Destination: Any, Service: Any, Translated Source: 203.0.113.5, Translated Destination: Original. To hide internal users behind the gateway's external IP for outbound Internet access, the NAT rule must specify the internal network as the source and the public IP as the translated source. The destination should remain original because Hide NAT only translates the source address for outbound traffic. This allows multiple internal users to share the single public IP.

Answer

Source: Any, Destination: 192.168.1.0/24, Service: Any, Translated Source: Original, Translated Destination: 203.0.113.5

Answer

Source: 203.0.113.5, Destination: 192.168.1.0/24, Service: Any, Translated Source: Original, Translated Destination: Original

Answer

Source: 192.168.1.0/24, Destination: Any, Service: Any, Translated Source: Original, Translated Destination: 203.0.113.5

Question 6

An administrator is configuring a new Security Gateway to communicate with a Security Management Server using SIC. The administrator must ensure the SIC trust is established securely. Which two actions are required to complete SIC initialization? (Choose two.)

Accepted Answer

Run 'cpconfig' on the gateway and select 'Secure Internal Communication' to enter the one-time password.. SIC initialization requires two key actions: generating a one-time password in SmartConsole for the gateway object, and then entering that password on the gateway via cpconfig under Secure Internal Communication. These steps create the trust relationship. Other actions like DNS configuration or policy installation are either prerequisites or subsequent tasks, not part of SIC initialization.

Answer

Install the Security Policy on the gateway to activate SIC.

Answer

Manually copy the management server's certificate to the gateway using SCP.

Answer

Configure the gateway's DNS settings to resolve the management server's hostname.

Question 7

An administrator is creating a new user account in the SmartConsole. The user needs to authenticate via a username and password that is stored in the Check Point user database. Which user type should the administrator select?

Accepted Answer

Internal User. An Internal User account is created and managed directly in the Check Point database, and its password is stored there. This is the correct choice when the requirement is to authenticate with a username and password that Check Point manages. Other user types rely on external authentication sources.

Answer

External User

Answer

LDAP User

Answer

Generic User

Question 8

A security administrator notices that users are accessing a newly registered domain that is not yet categorized by Check Point. The administrator wants to block access to uncategorized sites until they are reviewed. Which URL Filtering action should be configured?

Accepted Answer

Block the 'Uncategorized' category in the URL Filtering policy.. URL Filtering includes an Uncategorized category for sites not yet classified. Setting the action to Block for this category prevents access to unknown or newly registered domains, reducing exposure to phishing and malware. This is a straightforward configuration within the URL Filtering policy.

Answer

Configure a Threat Prevention rule to block uncategorized domains.

Answer

Set the action for the 'Uncategorized' category to 'Allow' but enable logging.

Answer

Enable 'Blocked Categories' and add the specific domain to the block list.

Question 9

An administrator needs to review logs from a specific Security Gateway that occurred between 2:00 AM and 4:00 AM yesterday. Which SmartConsole application should the administrator use to efficiently filter and analyze these logs?

Accepted Answer

SmartLog. SmartLog is the correct tool for searching and analyzing historical logs. It provides a dedicated interface with time-range filters and query capabilities, allowing the administrator to isolate logs from a specific gateway and time window. Other tools like SmartView Monitor, SmartEvent, and SmartDashboard serve different purposes and are not suited for this task.

Answer

SmartView Monitor

Answer

SmartEvent

Answer

SmartDashboard

Question 10

A security administrator manages a Check Point R81.20 environment with a Security Gateway and a separate Identity Collector. Users authenticate through Microsoft Active Directory, and the administrator wants to minimize the number of AD queries sent from the gateway. Which configuration should the administrator use to achieve this?

Accepted Answer

Deploy Identity Collector to receive identity events from AD and forward them to the Security Gateway.. Identity Collector is specifically designed to reduce load on Active Directory by having a dedicated collector receive security event log data and push identity updates to the Security Gateway. This eliminates the need for the gateway to poll AD, which is the behavior of AD Query. The other methods either still query AD or are intended for different authentication scenarios.

Answer

Configure the Security Gateway to use RADIUS accounting to receive user identity information.

Answer

Configure Identity Awareness with AD Query and enable caching on the Security Gateway.

Answer

Enable Identity Awareness with Terminal Server Agent on all domain controllers.