156-215.81.20 Application Control and URL Filtering Practice Test 2 — 15 Questions

Question 1

A security administrator wants to allow access to a specific website that is currently blocked by a URL Filtering category. The website is categorized as 'Gambling' but is used for legitimate business research. What is the simplest way to allow access to this site while keeping the category blocked for all other sites?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a URL Filtering exception rule above the blocking rule for the specific URL.. The simplest and most granular method is to create a URL Filtering exception rule for the specific URL above the blocking rule. This allows only that site while keeping the category blocked for all others. Other options either are not supported, too broad, or do not provide the required control.

Answer

Disable URL Filtering for the entire organization and rely on Application Control.

Answer

Modify the category definition to remove the site from the 'Gambling' category.

Answer

Add the website to the 'Allowed URLs' list in the URL Filtering blade settings.

Question 2

An administrator wants to allow users to access a business-critical web application that is categorized as 'Social Networking' by Check Point's URL Filtering, but only for a specific group of users. The administrator does not want to change the global category definition. What is the most appropriate solution?

Accepted Answer

Create a URL Filtering rule above the block rule that allows the specific URL for the user group.. URL Filtering rules can match specific URLs and be applied to user groups. By placing an allow rule for the specific URL above the general block rule, the administrator grants access only to the intended group without changing the global category. This is the most precise and least invasive method.

Answer

Create a Category Override for the specific URL and apply it to the user group.

Answer

Add the URL to the 'Allow' list in the ThreatCloud exceptions.

Answer

Create an Application Control rule that allows the Social Networking category for the specific user group.

Question 3

A security administrator notices that the Application Control policy allows the 'Facebook' application, but users report they can still post to Facebook through a third-party social media management tool that uses its own client. The administrator wants to block posting actions regardless of the client used. Which Application Control configuration should the administrator apply?

Accepted Answer

Use the 'Application/Site' rule with the Facebook application and set the action to 'Block' for the 'Post' action, and ensure the rule applies to all users and all clients.. Application Control in Check Point is designed to identify applications and their specific actions, not just the application as a whole. Blocking the 'Post' action within the Facebook application ensures that posting is prevented even when a third-party social media management client is used, because the gateway inspects the traffic and recognizes the action. This granular approach is more reliable than category blocking or per-client rules.

Answer

Enable 'Application Control' with the 'Block' action on the Facebook application and add a separate rule for the third-party client.

Answer

Create a new Application/Site rule that blocks the 'Social Networking' category for all users.

Answer

Configure a URL Filtering rule to block the Facebook posting URL and enable 'HTTPS Inspection' for all traffic.

Question 4

An administrator is configuring Application Control and URL Filtering on a new gateway. Which two actions are required to ensure that the gateway can enforce policies based on application and URL categories? (Choose two.)

Accepted Answer

Enable the Application Control and URL Filtering blades on the gateway.. The two required actions are enabling the Application Control and URL Filtering blades on the gateway and installing a policy that uses them. The blades provide the inspection capability, and the policy defines the rules for enforcement. Other options are either optional or not applicable to Check Point gateways.

Answer

Configure the gateway to use a proxy for all outbound HTTP traffic.

Answer

Update the Application Control and URL Filtering database to the latest version.

Answer

Enable HTTPS inspection for all traffic to identify applications.

Question 5

An administrator is configuring a URL Filtering policy and wants to allow access to a specific news website that is currently categorized as 'News' but also contains a section with user-generated content that is categorized as 'Social Networking'. The administrator wants to allow the news content but block the social networking section. Which URL Filtering configuration should the administrator use?

Accepted Answer

Configure a URL Filtering rule that allows the 'News' category and blocks the 'Social Networking' category, and add a custom application/site rule for the specific social networking URL path with a block action.. The most precise way to allow news content while blocking a social networking section within the same domain is to use category-based rules for the broad categories and then add a specific rule for the social networking URL path. This ensures that the news category is allowed and the social networking content is blocked, even if the category detection for the specific path is inconsistent. It leverages both category and URL/application granularity.

Answer

Enable 'HTTPS Inspection' and create a rule that allows the news website by URL and blocks all other URLs on the same domain.

Answer

Create a custom category that includes the news website and set the action to 'Allow', then block the 'Social Networking' category.

Answer

Use the 'Category Override' feature to reclassify the specific URL path of the social networking section as 'News' and allow it.

Question 6

An administrator needs to configure Application Control to block the use of remote administration tools such as TeamViewer and LogMeIn, but must allow Microsoft Remote Desktop for IT staff. Which configuration achieves this with the least granularity?

Accepted Answer

Block the 'Remote Administration' category in an Application Control rule, then create an exception rule above it allowing Microsoft Remote Desktop for the IT group.. Application Control categories group similar applications. Blocking the Remote Administration category blocks all tools in it, including TeamViewer and LogMeIn. An exception rule above it, scoped to the IT group, allows Microsoft Remote Desktop only for those users. This approach is efficient and scalable.

Answer

Block all applications in the 'Remote Administration' category and allow Microsoft Remote Desktop globally.

Answer

Use a URL Filtering rule to block TeamViewer and LogMeIn URLs, and allow Microsoft Remote Desktop.

Answer

Create individual block rules for TeamViewer and LogMeIn, and an allow rule for Microsoft Remote Desktop.

Question 7

An administrator is configuring Application Control and URL Filtering on a Check Point gateway. Which two statements are true regarding the update mechanism for these features? (Choose two.)

Accepted Answer

Application Control and URL Filtering signatures are updated automatically from the Check Point Update Service.. Application Control and URL Filtering signatures are updated automatically from the Check Point Update Service. The gateway can be configured to use the Check Point cloud or a designated internal update server. These two statements accurately describe the update mechanism, while the other options contain incorrect claims about manual updates, independent updates, or separate licensing.

Answer

URL Filtering categories are updated independently of Application Control signatures.

Answer

Administrators must manually download and install signature updates for Application Control and URL Filtering.

Answer

The update service requires a separate license for URL Filtering and Application Control updates.

Question 8

An administrator is configuring Application Control and URL Filtering on a Check Point gateway. The administrator wants to ensure that the gateway can identify applications and categories even when traffic is encrypted. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure the gateway to use ThreatCloud for application and category updates.. To identify applications and categories in encrypted traffic, HTTPS Inspection is required to decrypt the traffic, and ThreatCloud must be enabled to provide up-to-date signatures and categories. These two actions together enable accurate identification and enforcement.

Answer

Install a server certificate on the gateway for HTTPS Inspection.

Answer

Enable 'Application Control' and 'URL Filtering' blades on the gateway.

Answer

Set the Application Control policy to 'Detect' mode.

Question 9

A security administrator wants to generate a report that shows which users are accessing the most bandwidth-intensive applications, such as video streaming, over the last week. Which SmartConsole feature should the administrator use to obtain this information?

Accepted Answer

SmartEvent. SmartEvent is the correct tool because it specializes in aggregating and analyzing logs to produce reports on application usage and bandwidth consumption over time. It enables administrators to track which applications and users consume the most bandwidth, providing the necessary insights for the weekly report.

Answer

SmartConsole Logs & Monitor tab

Answer

SmartLog

Answer

SmartView Monitor

Question 10

An administrator is configuring Application Control and URL Filtering on a Check Point gateway. The administrator wants to allow access to Facebook but block the use of Facebook apps and games. Which TWO actions should the administrator take to achieve this? (Choose two.)

Accepted Answer

Create an Application Control rule to block the 'Facebook Apps' and 'Facebook Games' applications.. To allow Facebook but block its apps and games, the administrator should use Application Control to allow the Facebook application and then block the specific sub-applications. This approach leverages the granularity of Application Control, which can distinguish between the main site and its embedded applications. URL Filtering categories are too broad for this requirement.

Answer

Enable 'Application Control' and 'URL Filtering' blades on the gateway.

Answer

Create a URL Filtering rule to allow the 'Facebook' category.

Answer

Create a URL Filtering rule to block the 'Social Networking' category.

Question 11

An administrator needs to allow access to a specific website that is categorized as 'Phishing' by the URL Filtering database, because it is actually a legitimate internal site. The administrator wants to ensure that users can access it without changing the global categorization for all users. What should the administrator do?

Accepted Answer

Create a URL Filtering category override for the specific URL.. The administrator should create a URL Filtering category override for the specific URL. This changes the category of that URL to a legitimate one, allowing users to access it without altering the global categorization for all users. It is the most targeted and appropriate solution for a miscategorized internal site.

Answer

Disable URL Filtering for the entire network.

Answer

Modify the global URL Filtering database to reclassify the site.

Answer

Add the website to the 'Allow' list in the Application Control policy.

Question 12

An administrator needs to restrict access to social media applications while allowing access to specific professional features. Which feature in the Application Control blade provides this granularity?

Accepted Answer

Application Features. Application Control includes granular controls for many major web applications, known as 'Application Widgets' or 'Features.' By selecting an application, administrators can choose to block or allow specific sub-functions like 'Chat' or 'Post' instead of the entire site. This allows organizations to maintain productivity while still permitting necessary business communication, which is a critical balance for modern enterprise network security policies.

Answer

HTTPS Inspection

Answer

URL Filtering Category

Answer

Identity Awareness

Question 13

Refer to the exhibit. An administrator sees the following debug output while troubleshooting a blocked connection. What is the most likely cause for this traffic being dropped?

Accepted Answer

The rule base contains a drop rule for 'Unknown' applications.. The debug output indicates that the traffic was dropped because Application Control could not identify the application or categorize the traffic. When the policy is set to 'Block' for non-matching or unknown traffic, the gateway drops packets that do not trigger a specific rule match. This is a common security best practice to prevent unauthorized or potentially malicious protocols from traversing the gateway undetected.

Answer

The connection is being dropped by a malicious URL category.

Answer

The HTTPS inspection certificate is expired.

Answer

The user is not authenticated.

Question 14

A company wants to prevent employees from uploading files to cloud storage sites. Which action should the administrator take in the Application Control rule?

Accepted Answer

Select the application and disable the 'Upload' feature.. To restrict uploads, the administrator should locate the specific cloud storage application in the Application Control rule and use the 'Features' column to disable the 'Upload' capability. This is more effective than blocking the entire domain, as it preserves access to cloud storage for viewing and downloading files while strictly enforcing the corporate policy against data exfiltration through these commonly used tools.

Answer

Enable HTTPS Inspection and block the site entirely.

Answer

Enable the 'Upload' feature in the application signature.

Answer

Create a URL Filtering exception for the domain.

Question 15

An administrator wants to ensure that all URLs are categorized correctly. Which tool is used to verify the category of a specific URL?

Accepted Answer

Check Point URL Filtering Online Categorization tool. The 'Check Point URL Filtering Online Categorization' tool is a web-based service where administrators can input a URL to see its current classification in the Check Point database. This is a critical step in troubleshooting, as it helps determine if a site is being blocked due to a misclassification or if the policy is working as intended based on the current database definitions.

Answer

SmartConsole Logs and Monitor

Answer

The gateway CLI command 'fw url_check'

Answer

SmartDashboard Policy Editor