156-215.81.20 Practice Test 9 — 10 Questions

Question 1

An administrator is troubleshooting an Identity Awareness deployment where some users are intermittently shown as unidentified on the Security Gateway. The environment uses AD Query. Which TWO conditions would cause AD Query to fail to identify a logged-in user? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Security Gateway cannot reach the domain controller on the required ports for event log retrieval.. AD Query relies on reaching domain controllers to read security event logs, and it only sees logons generated after monitoring is enabled for those controllers. Blocked connectivity or logons predating configuration both leave users unidentified. Endpoint agent state, portal certificates, and session timeout length do not govern whether AD Query can read domain login events.

Answer

The Captive Portal certificate has expired on the gateway.

Answer

The gateway's identity session timeout is shorter than the users' typical work session.

Answer

The endpoint has the Identity Agent installed but the service is set to manual start.

Question 2

An administrator needs to ensure that employees cannot access known malicious websites. The company uses Check Point URL Filtering with ThreatCloud. Which action should the administrator take to block access to these sites?

Accepted Answer

Enable the 'Malicious Sites' category in a URL Filtering rule with a 'Block' action.. Using the 'Malicious Sites' category in URL Filtering is the most efficient way to block access to known malicious websites. This category is maintained by Check Point's ThreatCloud, which continuously updates its database with new threats. Other methods either do not target URLs or are too broad, making them unsuitable for this requirement.

Answer

Add the malicious sites to a custom group and apply a 'Block' action in the URL Filtering policy.

Answer

Configure a Threat Prevention profile with a 'Block' action for malicious sites.

Answer

Create an Application Control rule to block the 'Web Browsing' application.

Question 3

An administrator is configuring a new user group in SmartConsole. The group will be used in a rule to allow access to a specific server. The administrator wants to ensure that only users who are members of this group can access the server, and that membership is managed dynamically based on the user's department in the LDAP directory. Which type of user group should the administrator create?

Accepted Answer

An LDAP user group that maps to an LDAP group. To achieve dynamic membership based on the LDAP directory, an LDAP user group object must be created. This object references an LDAP group, and membership is automatically synchronized. Local user groups, generic groups, and RADIUS-based groups do not provide the required dynamic LDAP integration.

Answer

An external user group defined by a RADIUS server

Answer

A generic user group with a wildcard

Answer

A local user group with manually added users

Question 4

A remote access user connects to a Check Point Security Gateway using the Mobile Access blade. The user needs to access internal resources, but the connection fails. The administrator checks the gateway and sees that the user authenticated successfully, but no IP address was assigned. Which component is responsible for assigning IP addresses to remote access users in this scenario?

Accepted Answer

The Office Mode pool configured on the gateway.. The correct answer is the Office Mode pool configured on the gateway. Office Mode is the Check Point feature that assigns virtual IP addresses to remote access clients. When a user authenticates but receives no IP address, the most likely cause is that the Office Mode pool is not configured, is exhausted, or is incorrectly defined. This component is directly responsible for IP assignment in Remote Access VPN.

Answer

The RADIUS server used for authentication.

Answer

The DHCP server on the internal network.

Answer

The DNS server configured in the VPN community.

Question 5

An administrator is setting up a Remote Access VPN using Check Point Mobile Access. The administrator wants to ensure that remote users can access internal resources using the same IP address throughout their session, even if they disconnect and reconnect. Which Check Point feature should be enabled to achieve this?

Accepted Answer

IP Address Persistence. IP Address Persistence is the feature that ensures a remote user receives the same virtual IP address each time they connect, provided the address is still available. This is particularly useful for applications that require a consistent IP address for the user. Office Mode must be enabled to assign IP addresses, but IP Address Persistence is the specific setting that maintains the same address across sessions. Together, they provide a stable and consistent remote access experience.

Answer

Visitor Mode

Answer

Office Mode

Answer

Secure Domain Logon

Question 6

A Check Point administrator is configuring a new SmartConsole administrator account for a security analyst. The analyst must be able to view all objects and rules but must not be able to modify any security policy or object. The administrator assigns the 'Read-Only All' Permission Profile. However, the analyst reports that they can still edit their own personal settings, such as changing their password. Is this expected behavior?

Accepted Answer

Yes, it is expected; the 'Read-Only All' profile permits users to modify their own personal settings, including password, while restricting changes to security policies and objects.. The 'Read-Only All' Permission Profile is intended to provide view-only access to all security objects and rules. It does not prevent an administrator from managing their own account, such as changing a password or adjusting personal preferences. Therefore, the analyst's ability to edit personal settings is expected and does not violate the read-only restriction on policy and objects.

Answer

No, the 'Read-Only All' profile should block all write operations, but a known bug in R81 allows password changes; the administrator should open a support ticket.

Answer

No, the 'Read-Only All' profile should prevent any changes, including personal settings; the administrator must apply an additional restriction.

Answer

Yes, but only if the administrator also has the 'Super User' profile; otherwise, personal settings are locked.

Question 7

An administrator configures a Site-to-Site VPN between two Check Point R81 gateways using a Star community. IKE Phase 1 completes successfully, but IKE Phase 2 fails with the error 'No proposal chosen'. The administrator has verified that the encryption and hash algorithms match on both gateways. Which action should the administrator take to resolve this issue?

Accepted Answer

Verify that the Diffie-Hellman group configured for IKE Phase 2 (Perfect Forward Secrecy) matches on both gateways.. IKE Phase 2 negotiates the IPsec SA and includes its own set of security parameters, including the Perfect Forward Secrecy (PFS) Diffie-Hellman group. Even if Phase 1 succeeds, a mismatch in the PFS group will cause Phase 2 to fail with 'No proposal chosen'. Aligning the PFS group on both gateways resolves the issue.

Answer

Ensure that the VPN community is configured to use 'One VPN tunnel per subnet pair'.

Answer

Confirm that the pre-shared secret is identical on both gateways.

Answer

Check that the gateway's VPN domain includes the correct encryption domain.

Question 8

An administrator notices that the Security Management Server disk is filling rapidly because log files are retained indefinitely. The retention policy must keep logs for 90 days and then remove older records automatically. Where should this be configured?

Accepted Answer

In the Management Server object's Logging settings, by defining a log retention period.. Log retention is governed on the Management Server object, where an administrator defines how many days logs are kept. Setting 90 days ensures older records are purged automatically, controlling disk consumption while satisfying the retention policy. Gateway-side settings and manual file deletion do not provide supported, age-based log lifecycle management.

Answer

By scheduling a cron job that deletes files from the log directory nightly.

Answer

By adjusting the log size limit per gateway in Global Properties.

Answer

In the Security Gateway object's Logging and Time settings.

Question 9

A security administrator is preparing to establish Secure Internal Communication (SIC) between a Security Management Server and a new Security Gateway. Which two actions are required to successfully initialize SIC? (Choose two.)

Accepted Answer

On the gateway, run cpconfig and enter the same one-time password in the Secure Internal Communication section.. SIC initialization requires a shared secret. The administrator sets a one-time password in the gateway object in SmartConsole, then enters the identical password on the gateway using cpconfig's Secure Internal Communication section. This exchange authenticates the gateway to the management server's internal CA, which issues the SIC certificate. Both actions are mandatory for successful initialization.

Answer

On the management server, run fw putkey to push the SIC certificate to the gateway.

Answer

On the gateway, run sic_reset to clear any existing trust before initialization.

Answer

On the management server, run cpca_client create_cert to generate a new SIC certificate for the gateway.

Question 10

A Check Point administrator is configuring user authentication for a Remote Access VPN. The administrator wants to use certificates for authentication but also requires a second factor. The administrator decides to use SecurID tokens as the second factor. Which authentication method should be configured in the user object to achieve this?

Accepted Answer

Certificate + SecurID. To use certificates and SecurID tokens together, the user object must be configured with the 'Certificate + SecurID' authentication method. This method enforces both factors: the user must present a valid certificate and a correct SecurID token code. Other methods either use only one factor or substitute the certificate with a password.

Answer

User Name and Password + SecurID

Answer

SecurID

Answer

Certificate