156-215.81.20 Application Control and URL Filtering — 25 Questions

Question 1

Which TWO of the following statements are true regarding the Application Control and URL Filtering update process in Check Point?

Accepted Answer

The database update is incremental to reduce bandwidth usage.. Security gateways rely on the Application Control and URL Filtering database to identify traffic. Updates are managed by the Security Management Server or via the gateway's automatic update mechanism. Understanding this process is vital for ensuring that the policy engine uses the latest signatures to identify new and evolving web applications and malicious domains, keeping the network protected against current threats.

Answer

Updates are performed only by the Security Management Server.

Answer

Updates require a full gateway reboot to take effect.

Answer

Updates only include new application signatures, not URL categories.

Question 2

Which THREE of the following are prerequisites for effective Application Control and URL Filtering?

Accepted Answer

HTTPS Inspection enabled for encrypted traffic.. For Application Control and URL Filtering to function correctly, the gateway needs to see the traffic, identify the traffic, and have the latest intelligence on the traffic. These prerequisites ensure that the security policy is applied accurately and that the gateway can distinguish between legitimate traffic and potential threats, which is foundational to the security architecture of Check Point's Next Generation Threat Prevention.

Answer

A valid Threat Prevention subscription.

Answer

The policy must be installed on the management server.

Question 3

What is the primary difference between a 'Block' and 'Ask' action in Application Control?

Accepted Answer

Ask prompts the user to acknowledge the policy before allowing access.. The 'Ask' action in Check Point's Application Control serves as a notification mechanism that informs users about the corporate policy, requiring them to confirm they understand the rules before proceeding. This is often used for non-critical but discouraged sites. In contrast, 'Block' is an absolute denial, which is used for security-critical or policy-violating applications where no user interaction can allow access to the forbidden resource.

Answer

Block provides a notification while Ask performs an automatic redirect.

Answer

Block allows the connection after a timeout, while Ask never allows it.

Answer

They are functionally identical for all application categories.

Question 4

Refer to the exhibit. If a user tries to access 'linkedin.com', what happens?

Accepted Answer

Access is allowed due to the URL Filtering exception.. Check Point policy evaluation follows a specific order: explicit rules, then implicit rules. Exceptions created within the URL Filtering blade take precedence over general category blocks. By defining an exception for 'linkedin.com', the administrator overrides the 'Social Networking' block, ensuring the user can access the site. This is standard behavior to prevent category-based policies from being too restrictive in a business environment.

Answer

Access is blocked because it is categorized as Social Networking.

Answer

Access is blocked because category blocks take precedence.

Answer

Access is allowed only if the user is in the Business group.

Question 5

Which object type should an administrator use to create a custom URL category for a list of internal websites?

Accepted Answer

Network Object. To manage a custom group of URLs that are not part of the standard Check Point classification, administrators use 'Custom Categories' within the URL Filtering blade. This allows the grouping of multiple domains into a single object, which can then be referenced in security rules, providing a centralized and manageable way to control access to internal or specialized web resources.

Answer

Application Group

Answer

Service Object

Answer

Address Range

Question 6

Which log field in the SmartConsole shows the 'Application' and 'Category' detected by the gateway?

Accepted Answer

Application/Site. The 'Application/Site' field in the SmartConsole logs provides the specific name of the application or the domain name identified by the security blade. The 'Category' field shows the classification associated with that site. Together, these fields are crucial for administrators to understand exactly what traffic is being permitted or blocked and why, which is fundamental for effective troubleshooting and auditing.

Answer

Product Name

Answer

Rule Name

Answer

Service

Question 7

How can an administrator monitor the performance impact of enabling Application Control and URL Filtering?

Accepted Answer

By using the 'cpview' utility on the gateway.. The 'Gateway Status' or 'Security Gateway View' in SmartConsole provides performance metrics. Additionally, using CLI commands like 'cpview' allows administrators to see real-time CPU and memory utilization, specifically related to the inspect engine's load. Monitoring these metrics is vital to ensure that the security blades do not degrade the overall gateway throughput or cause latency for end-users, which is essential for maintaining service level agreements.

Answer

By checking the 'Policy Installation' logs.

Answer

By reviewing the 'Threat Prevention' reports.

Answer

By checking the 'SmartEvent' correlation logs.

Question 8

An administrator needs to restrict access to Facebook while allowing users to utilize the Facebook Chat feature. Which Application Control configuration provides this granularity?

Accepted Answer

Create a rule blocking 'Facebook' and a separate rule above it allowing 'Facebook Chat'.. Application Control uses AppWiki to identify specific features within a single application. By selecting the 'Facebook' application but excluding specific sub-features, or using the 'Facebook Chat' application object alongside a block rule for the main site, administrators enforce precise security policies. This granularity is essential for balancing productivity requirements with corporate security policies, ensuring that legitimate business communication remains operational while reducing social media distractions across the network.

Answer

Enable 'Facebook' and 'Facebook Chat' in the same rule with an 'Accept' action.

Answer

Configure the URL Filtering blade to block all Facebook URLs via a custom category.

Answer

Disable the Application Control blade and use traditional Access Control rules.

Question 9

Which TWO of the following are prerequisites for proper Application Control and URL Filtering functionality?

Accepted Answer

An active Service Contract and updated application signatures.. To function correctly, Application Control requires active subscriptions and proper security policy configuration. The gateway must be able to reach the User Center to download the latest application signatures, and HTTPS inspection is often necessary to categorize traffic that uses encrypted channels. These components work in tandem to ensure the gateway has current intelligence to identify, categorize, and enforce rules against modern web traffic effectively across the enterprise network.

Answer

The Security Gateway must be running in Bridge mode only.

Answer

HTTPS Inspection must be enabled for all traffic types.

Answer

The gateway must be configured as an Identity Awareness primary server.

Question 10

Where are the application and URL category updates downloaded from?

Accepted Answer

From the Check Point User Center via the Security Management Server.. Check Point gateways receive updates for Application Control and URL Filtering directly from the Check Point User Center. This synchronization ensures that the gateway has the latest signatures for identifying new web services and updated website classifications. Keeping these databases current is crucial for security, as it allows the gateway to defend against newly discovered threats and correctly categorize websites that change their content or infrastructure over time.

Answer

From the local management server's cached database only.

Answer

From the internal DNS server.

Answer

From the SmartConsole client.

Question 11

When a user attempts to access a blocked website, what happens by default if the 'UserCheck' feature is enabled?

Accepted Answer

The session is redirected to the Check Point management portal.. UserCheck provides a customizable interface to inform users why their traffic was blocked. By default, it presents a notification page in the browser explaining the policy violation. This feature is vital for reducing help-desk tickets, as it gives users immediate feedback, allows them to understand corporate policy, and can provide options to bypass the block if the administrator permits it for legitimate work-related tasks, thereby improving overall organizational efficiency.

Answer

The packet is silently dropped without notifying the user.

Answer

The connection is reset via a TCP RST packet only.

Answer

The user is prompted to enter an administrative password to bypass the block.

Question 12

Which THREE criteria can be used to define a custom Application Control application?

Accepted Answer

URL patterns.. Custom applications allow administrators to define traffic patterns that are not covered by the default AppWiki. By specifying URL patterns, domain names, or specific protocol attributes, administrators gain control over proprietary or internal web applications. This is necessary for organizations that use custom-built tools or specific SaaS platforms that require unique handling or security policies distinct from the standard application definitions provided by Check Point.

Answer

Operating system version of the client.

Answer

IP address range of the destination server.

Question 13

What is the primary difference between a 'Categorization' rule and an 'Application' rule in the policy?

Accepted Answer

Categorization rules target website groups, while Application rules target specific software or services.. Categorization rules act on groups of websites sharing a common theme (e.g., 'Gambling'), while Application rules identify specific software or web services (e.g., 'Skype'). Categorization is best for broad policy enforcement, while Application rules offer granular control over specific tools. Understanding this distinction allows administrators to build efficient policies that group similar threats together while maintaining specific exceptions for individual applications required for day-to-day business productivity.

Answer

Application rules apply to internal traffic only.

Answer

Application rules are processed after Categorization rules.

Answer

Categorization rules require HTTPS inspection to function, but Application rules do not.

Question 14

Why would an administrator use 'Category Override' in the URL Filtering policy?

Accepted Answer

To manually change the classification of a specific website.. Category Override is used when a website is incorrectly classified by the cloud database or when a site needs to be treated differently for a specific business unit. For example, a site categorized as 'Gambling' might need to be allowed for a research department. It provides the flexibility to adjust the default classification to fit specific organizational needs while still relying on the dynamic database for the vast majority of other sites.

Answer

To force all traffic to be encrypted.

Answer

To bypass HTTPS inspection for the entire category.

Answer

To hide the category from the logs.

Question 15

How can an administrator ensure that the Application Control database is updated even if the management server has no direct Internet access?

Accepted Answer

Use the 'Offline Update' feature from the SmartConsole.. In isolated environments, administrators can use the 'Offline Update' process. This involves downloading the update package from a machine with internet access and manually uploading it to the management server. This ensures that even high-security, air-gapped networks can maintain current application identification capabilities, which is critical because outdated signatures lead to poor detection rates and increased risk from unmanaged or new web applications that emerge daily.

Answer

Configure the gateway to use a secondary DNS server.

Answer

Enable a web proxy on the gateway.

Answer

Disable the blade until the server is connected to the Internet.

Question 16

A security administrator wants to allow access to a specific website that is currently blocked by a URL Filtering category. The website is categorized as 'Gambling' but is used for legitimate business research. What is the simplest way to allow access to this site while keeping the category blocked for all other sites?

Accepted Answer

Create a URL Filtering exception rule above the blocking rule for the specific URL.. The simplest and most granular method is to create a URL Filtering exception rule for the specific URL above the blocking rule. This allows only that site while keeping the category blocked for all others. Other options either are not supported, too broad, or do not provide the required control.

Answer

Disable URL Filtering for the entire organization and rely on Application Control.

Answer

Modify the category definition to remove the site from the 'Gambling' category.

Answer

Add the website to the 'Allowed URLs' list in the URL Filtering blade settings.

Question 17

An administrator wants to allow users to access a business-critical web application that is categorized as 'Social Networking' by Check Point's URL Filtering, but only for a specific group of users. The administrator does not want to change the global category definition. What is the most appropriate solution?

Accepted Answer

Create a URL Filtering rule above the block rule that allows the specific URL for the user group.. URL Filtering rules can match specific URLs and be applied to user groups. By placing an allow rule for the specific URL above the general block rule, the administrator grants access only to the intended group without changing the global category. This is the most precise and least invasive method.

Answer

Create a Category Override for the specific URL and apply it to the user group.

Answer

Add the URL to the 'Allow' list in the ThreatCloud exceptions.

Answer

Create an Application Control rule that allows the Social Networking category for the specific user group.

Question 18

A security administrator notices that the Application Control policy allows the 'Facebook' application, but users report they can still post to Facebook through a third-party social media management tool that uses its own client. The administrator wants to block posting actions regardless of the client used. Which Application Control configuration should the administrator apply?

Accepted Answer

Use the 'Application/Site' rule with the Facebook application and set the action to 'Block' for the 'Post' action, and ensure the rule applies to all users and all clients.. Application Control in Check Point is designed to identify applications and their specific actions, not just the application as a whole. Blocking the 'Post' action within the Facebook application ensures that posting is prevented even when a third-party social media management client is used, because the gateway inspects the traffic and recognizes the action. This granular approach is more reliable than category blocking or per-client rules.

Answer

Enable 'Application Control' with the 'Block' action on the Facebook application and add a separate rule for the third-party client.

Answer

Create a new Application/Site rule that blocks the 'Social Networking' category for all users.

Answer

Configure a URL Filtering rule to block the Facebook posting URL and enable 'HTTPS Inspection' for all traffic.

Question 19

An administrator is configuring Application Control and URL Filtering on a new gateway. Which two actions are required to ensure that the gateway can enforce policies based on application and URL categories? (Choose two.)

Accepted Answer

Enable the Application Control and URL Filtering blades on the gateway.. The two required actions are enabling the Application Control and URL Filtering blades on the gateway and installing a policy that uses them. The blades provide the inspection capability, and the policy defines the rules for enforcement. Other options are either optional or not applicable to Check Point gateways.

Answer

Configure the gateway to use a proxy for all outbound HTTP traffic.

Answer

Update the Application Control and URL Filtering database to the latest version.

Answer

Enable HTTPS inspection for all traffic to identify applications.

Question 20

An administrator is configuring a URL Filtering policy and wants to allow access to a specific news website that is currently categorized as 'News' but also contains a section with user-generated content that is categorized as 'Social Networking'. The administrator wants to allow the news content but block the social networking section. Which URL Filtering configuration should the administrator use?

Accepted Answer

Configure a URL Filtering rule that allows the 'News' category and blocks the 'Social Networking' category, and add a custom application/site rule for the specific social networking URL path with a block action.. The most precise way to allow news content while blocking a social networking section within the same domain is to use category-based rules for the broad categories and then add a specific rule for the social networking URL path. This ensures that the news category is allowed and the social networking content is blocked, even if the category detection for the specific path is inconsistent. It leverages both category and URL/application granularity.

Answer

Enable 'HTTPS Inspection' and create a rule that allows the news website by URL and blocks all other URLs on the same domain.

Answer

Create a custom category that includes the news website and set the action to 'Allow', then block the 'Social Networking' category.

Answer

Use the 'Category Override' feature to reclassify the specific URL path of the social networking section as 'News' and allow it.