156-215.81.20 Practice Test 8 — 10 Questions

Question 1

An administrator configures Identity Awareness with Active Directory Query on an R81.20 Security Gateway. Users are authenticated via Kerberos, and the gateway has been joined to the domain. However, after login, some users are not being identified. The administrator notices that the gateway's AD Query service account password has expired. What is the most likely cause of the identification failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The AD Query service account password must be updated in the Identity Awareness configuration, and the service restarted.. The AD Query method relies on a service account to read login events from Active Directory. If that account's password expires or is changed, the gateway loses access and cannot identify users. The fix is to update the password in the Identity Awareness configuration and restart the service. This ensures continuous identification.

Answer

The Security Gateway must be rebooted to re-establish the Kerberos trust with the domain controller.

Answer

The users must log in again because their Kerberos tickets have expired due to the service account issue.

Answer

The Identity Awareness blade must be reinstalled because the expired password corrupted its database.

Question 2

An administrator is deploying Identity Awareness on a Check Point R81.20 Security Gateway. Users authenticate to a captive portal hosted by the gateway itself, without any external directory service. Which Identity Awareness method is being used?

Accepted Answer

Browser-Based Authentication. Browser-Based Authentication is the only Identity Awareness method that operates entirely on the Security Gateway without any external directory or identity source. It presents a captive portal, validates credentials against the gateway's local user database, and then maps the source IP to the authenticated user for policy enforcement. All other methods depend on external infrastructure, which the scenario explicitly excludes.

Answer

RADIUS Accounting

Answer

Identity Collector

Answer

Active Directory Query

Question 3

A security administrator is configuring NAT for a Check Point R81 Security Gateway that protects a DMZ. The DMZ contains a mail server with IP address 10.10.10.5 and a web server with IP address 10.10.10.6. Both servers must be accessible from the Internet using separate public IP addresses. The administrator wants to minimize the number of NAT rules and ensure that the translation is applied correctly. Which NAT configuration approach is most appropriate?

Accepted Answer

Create two Static NAT rules: one for the mail server and one for the web server, each translating to its respective public IP address.. The most appropriate approach is to create two Static NAT rules, one for each server, mapping each to its own public IP address. This provides deterministic one-to-one translation, enabling inbound access to each server and preserving outbound source IPs. Hide NAT and NAT pools are designed for outbound many-to-one or many-to-many translation and do not support publishing multiple servers on distinct public IPs.

Answer

Configure NAT on the gateway object to automatically translate all DMZ traffic to the gateway's external IP address.

Answer

Create a single Hide NAT rule for the entire DMZ subnet, translating to one public IP address.

Answer

Create a single manual NAT rule that translates both servers using a NAT pool of two public IP addresses.

Question 4

A security administrator needs to configure a Security Gateway to send its logs to a third-party SIEM via syslog. The SIEM is reachable only through an external interface, and the administrator wants to avoid sending logs over the internal network. Which Check Point feature should be used to achieve this requirement?

Accepted Answer

Log Exporter. Log Exporter is the correct feature because it is designed to export logs from Check Point Security Gateways to external syslog servers. It can be configured to use a specific source interface, allowing the administrator to direct traffic through an external interface and avoid the internal network. This provides the required functionality without relying on the Management Server for forwarding.

Answer

Logging and Status Blade

Answer

SmartEvent Correlation Unit

Answer

SmartView Tracker

Question 5

A security administrator needs to allow a group of contractors to access the corporate network via Remote Access VPN. The contractors are already defined in an external LDAP directory. The administrator wants to avoid creating individual user accounts in SmartConsole and wants to apply a specific set of VPN settings to all contractors. Which object should the administrator use to represent the contractors in the VPN community configuration?

Accepted Answer

An LDAP user group object that references the external directory group. To represent external LDAP users as a group without creating individual accounts, an LDAP user group object is used. This object references a group in the LDAP directory, and all members inherit the settings applied to the group. It is the correct way to apply VPN settings to multiple contractors efficiently.

Answer

A temporary user account for each contractor

Answer

A generic user account with a wildcard

Answer

An Interoperable device object representing the LDAP server

Question 6

A security administrator at a company using Check Point R81 Management Server needs to verify that a newly created administrator account named 'jsmith' has been assigned the correct permission profile before the account is used. The administrator opens SmartConsole and navigates to the Manage & Settings view. Which action should the administrator take to view the permission profile assigned to 'jsmith'?

Accepted Answer

In SmartConsole, go to Manage & Settings > Administrators, select the 'jsmith' account, and view the 'Permission Profile' field in the account properties.. Administrator accounts and their assigned permission profiles are managed in SmartConsole under Manage & Settings > Administrators. Selecting an administrator reveals its properties, including the permission profile. The other paths either lead to unrelated settings, such as User Awareness or Gaia OS users, or to logs that do not directly show the current profile assignment.

Answer

In SmartConsole, go to Logs & Monitor > Audit Logs, filter by administrator 'jsmith', and inspect the 'Assigned Profile' column.

Answer

In SmartConsole, go to Manage & Settings > Blades > User Awareness, select 'jsmith', and view the 'Permission Profile' attribute.

Answer

In the Gaia portal, navigate to User Management > Administrators, select 'jsmith', and review the 'Permission Profile' setting.

Question 7

An administrator manages multiple Security Gateways using a single Security Management Server. The administrator needs to restrict a new junior administrator so that they can only view and modify the Access Control policy for a specific gateway, but cannot install policies or modify other gateways. Which SmartConsole feature should the administrator use to meet this requirement?

Accepted Answer

Use the 'Permission Profiles' feature to create a profile with access to only the specific gateway and assign it to the junior administrator.. Permission Profiles in SmartConsole are designed to provide granular access control for administrators. By creating a profile that includes only the specific gateway and grants read/write access to Access Control policies while excluding installation permissions, the administrator can precisely meet the requirement. This avoids granting excessive privileges and uses the built-in RBAC feature.

Answer

Set up a separate Management Server for the specific gateway and create a new administrator account there.

Answer

Create a new administrator account with the 'Read/Write' permission for all gateways and then use a policy rule to restrict access.

Answer

Configure the junior administrator's account with 'Super User' permissions and rely on trust to prevent changes to other gateways.

Question 8

A security administrator is troubleshooting a Security Gateway that shows SIC status 'Unknown' in SmartConsole. The administrator suspects the gateway's SIC certificate has expired. Which command on the gateway can be used to check the SIC certificate's expiration date and validity?

Accepted Answer

cpca_client lscert -kind SIC. The cpca_client lscert -kind SIC command on the gateway enumerates SIC certificates from the local store and displays their validity period. When a gateway's SIC certificate has expired, SIC communication fails and SmartConsole may show 'Unknown' or 'Not Communicating'. Checking the certificate with this command confirms expiration, after which the administrator can reset SIC to obtain a new certificate.

Answer

cpinfo -y all

Answer

cpstat os -f sic

Answer

fw stat

Question 9

An administrator notices that the Security Management Server's disk space is being consumed rapidly by log files. The administrator wants to automatically delete logs older than 90 days to free up space. Which Check Point feature should be configured to achieve this?

Accepted Answer

Log Retention Policy. Log Retention Policy is the correct feature because it allows the administrator to set a retention period for logs, after which they are automatically deleted. This directly solves the problem of disk space being consumed by old logs. Other features like Log Exporter, SmartEvent Policy, and Database Revision Control do not provide automatic log deletion based on age.

Answer

SmartEvent Policy

Answer

Database Revision Control

Answer

Log Exporter

Question 10

A Security Gateway stops sending logs to the Management Server, and users report that SmartView Logs shows no new entries. The administrator confirms the gateway is passing traffic. Which action should be taken first to diagnose the log transmission problem?

Accepted Answer

Verify SIC trust status between the Security Gateway and the Management Server.. Secure Internal Communication, or SIC, is the trust foundation for all traffic between a Security Gateway and its Management Server, including log delivery. When logs stop arriving but traffic still flows, verifying SIC status quickly identifies whether the management channel itself is broken. Other actions either treat display symptoms or alter configuration without evidence.

Answer

Increase the log storage quota on the Security Gateway.

Answer

Restart the SmartConsole client to refresh the log view.

Answer

Change the log forwarding port in Global Properties.