156-215.81.20 Application Control and URL Filtering Practice Test 3 — 15 Questions

Question 1

What happens when the URL Filtering database is unreachable by the gateway?

Accepted Answer

The gateway uses the last cached version of the database.. When the gateway cannot reach the URL Filtering cloud service, it defaults to the 'fail-open' or 'fail-closed' behavior based on the configured policy. By default, most gateways continue to use the locally cached database. This ensures that legitimate traffic is not unnecessarily blocked due to a temporary network disruption between the gateway and the Check Point cloud update services.

Answer

All web traffic is immediately blocked.

Answer

The gateway disables URL filtering entirely.

Answer

The gateway enters 'Learning Mode'.

Question 2

Which blade must be active to perform HTTPS Inspection on traffic?

Accepted Answer

HTTPS Inspection. HTTPS Inspection is a prerequisite for several other blades, including Application Control, URL Filtering, and Threat Prevention. It is managed via a dedicated policy area in the SmartConsole. The inspection engine decrypts SSL/TLS traffic, inspects the plaintext, and then re-encrypts it, allowing the security blades to see the content that would otherwise be hidden from the gateway, which is essential for modern security.

Answer

Threat Emulation

Answer

Application Control

Answer

Identity Awareness

Question 3

When would an administrator use a 'Custom Application' instead of a standard application in the Application Control blade?

Accepted Answer

When the application is not present in the Check Point database.. Custom Applications are used when the gateway cannot identify a proprietary, internal, or very niche web application using the standard signature database. By defining a custom application based on URL patterns, domains, or specific header content, administrators can extend the reach of the Application Control blade to include internal corporate apps that are not covered by Check Point's public database.

Answer

When the application is blocked by the URL Filtering blade.

Answer

When the application requires HTTPS Inspection.

Answer

When the administrator wants to bypass the security policy.

Question 4

Refer to the exhibit. An administrator is troubleshooting Application Control traffic. What does the CLI output verify regarding the traffic flow?

Accepted Answer

It validates that the Application Control engine has successfully identified the traffic.. The 'app_id_flag' is a specific indicator in Check Point traffic inspection that confirms the Application Control engine has identified the application. By filtering for this flag, the administrator validates that the packet is being processed by the application identification engine rather than bypassing it or failing classification. This is a critical debugging step to ensure the security gateway is successfully inspecting traffic before applying policy enforcement actions.

Answer

It verifies that HTTPS inspection is successfully decrypting the payload.

Answer

It confirms that the packet was permitted by the Security Policy.

Answer

It forces the gateway to bypass all future inspection for this host.

Question 5

Refer to the exhibit. An administrator sees this error in the logs. What is the most effective way to resolve this for better visibility?

Accepted Answer

Enable HTTPS Inspection and define appropriate bypass policies.. Without HTTPS inspection, the gateway cannot read the contents of encrypted traffic, limiting its ability to identify applications hidden within HTTPS tunnels. Enabling HTTPS inspection allows the gateway to act as an SSL proxy, decrypting and re-encrypting traffic to perform full inspection. This is critical for modern security, as the vast majority of web traffic is now encrypted, rendering standard packet inspection largely ineffective for application-layer controls.

Answer

Disable Application Control and rely on URL Filtering.

Answer

Increase the timeout settings on the gateway for encrypted traffic.

Answer

Configure the client browsers to trust the Management Server certificate.

Question 6

Which object type should an administrator use to block access to a wide range of websites deemed inappropriate, such as adult content?

Accepted Answer

A URL Filtering category.. URL Filtering categories are the most efficient way to block vast numbers of sites based on their content type. Instead of manually inputting thousands of individual URLs, administrators use these pre-defined categories provided by Check Point. This approach is highly scalable and ensures that new sites added to these categories are automatically blocked as the cloud-based database updates, keeping the policy effective without constant manual intervention by the security team.

Answer

An Application object.

Answer

A Service object.

Answer

A Host object.

Question 7

What is the primary benefit of the 'ThreatCloud' service for URL Filtering?

Accepted Answer

It provides real-time updates and global intelligence on URLs.. ThreatCloud provides real-time, global threat intelligence and URL categorization. By querying this cloud service, the gateway receives immediate updates on newly registered malicious domains or updated site categories. This is vital because the landscape of malicious websites changes daily; local database snapshots are insufficient, and cloud-based intelligence ensures the gateway stays ahead of emerging threats by leveraging data collected from millions of sensors worldwide in a collaborative security model.

Answer

It replaces the need for local gateway policy rules.

Answer

It forces all traffic to be sent to a Check Point data center for processing.

Answer

It automatically decrypts all HTTPS traffic for the gateway.

Question 8

Refer to the exhibit. The log shows a drop. What does this indicate about the rule base?

Accepted Answer

A rule exists that blocks the P2P application category.. The log entry explicitly states the action was a drop due to the Application Control blade identifying P2P traffic. This implies that there is an active security rule in the policy configured to block the P2P application category. The gateway is functioning correctly by identifying the traffic type and enforcing the defined security policy, demonstrating that the blade is successfully integrated and operational within the existing security policy infrastructure.

Answer

The gateway is failing to identify the application correctly.

Answer

The packet was blocked by a standard Firewall rule, not Application Control.

Answer

The P2P application is allowed, but the traffic was dropped by HTTPS inspection.

Question 9

What is the primary function of the 'Application Wiki' (AppWiki) in Check Point?

Accepted Answer

It provides a database of application signatures and behavioral patterns.. AppWiki is the centralized, comprehensive database of application signatures used by the gateway to identify traffic. It contains detailed information about thousands of web applications, their protocols, and behavior. By leveraging this database, the gateway can accurately differentiate between legitimate business traffic and unauthorized or risky applications, enabling administrators to write effective, granular rules that control access based on application identity rather than mere IP addresses or ports.

Answer

It stores user identity information.

Answer

It provides a list of all IP addresses associated with web applications.

Answer

It manages the SSL inspection certificates for the gateway.

Question 10

An administrator wants to ensure that users are warned before accessing a potentially high-risk website. Which feature should be used?

Accepted Answer

The 'Ask' action.. The 'Ask' action in UserCheck is the standard way to implement a warning mechanism. Instead of outright blocking, it prompts the user to acknowledge the risk before proceeding. This is an effective balance for productivity, allowing access to useful but potentially risky sites while ensuring users are aware of the risks, thereby meeting compliance requirements while minimizing business disruption for necessary web-based tasks.

Answer

The 'Drop' action.

Answer

The 'Reject' action.

Answer

The 'Accept' action.

Question 11

An administrator needs to block a specific web application that is not recognized by the default Application Control signature database. The application uses a custom protocol on TCP port 8443. What is the most appropriate method to achieve this?

Accepted Answer

Create a new Application Control signature using the Application Control Signature Tool.. To block a custom application not in the signature database, the administrator must create a custom Application Control signature using the Application Control Signature Tool. This tool allows defining the application based on port, protocol, and other characteristics. Port-based blocking or URL categorization would not accurately target the application and could cause collateral damage.

Answer

Enable the 'Application Control' blade and rely on its heuristic engine to detect the application.

Answer

Use a URL Filtering category override to block all traffic to the server hosting the application.

Answer

Configure a firewall rule that blocks all traffic on TCP port 8443.

Question 12

A security administrator at a financial firm needs to block all peer-to-peer file-sharing applications for the entire company, but must allow legitimate business use of instant messaging. The administrator wants the least administrative effort and automatic updates of new application signatures. What should the administrator do?

Accepted Answer

Create an Application Control rule that blocks the Peer-to-Peer category and install the policy.. Application Control uses signatures to identify applications regardless of port or protocol. Blocking the Peer-to-Peer category in an Application Control rule immediately blocks all current and future P2P applications, while instant messaging remains allowed. Because signatures are updated automatically, no manual intervention is needed when new P2P apps appear.

Answer

Create a Service object for each known P2P protocol and add them to a drop rule in the firewall policy.

Answer

Create a URL Filtering rule that blocks the Peer-to-Peer category and install the policy.

Answer

Enable HTTPS Inspection and create a rule that blocks all applications except instant messaging.

Question 13

An administrator notices that Application Control is not identifying a popular cloud-based application even though it is listed in the Application Control database. The gateway is running R81.10 and the database is up to date. What could be the cause?

Accepted Answer

The application uses HTTPS and the gateway is not configured for HTTPS inspection.. The most likely cause is that the application uses HTTPS and the gateway lacks HTTPS inspection. Without decrypting the traffic, Application Control cannot identify the application based on its signature. Enabling HTTPS inspection would allow the gateway to inspect the traffic and correctly identify the application.

Answer

The application signature is not included in the current database version.

Answer

The Application Control blade is not enabled on the gateway.

Answer

The gateway is configured to bypass Application Control for traffic on port 443.

Question 14

A security administrator notices that users are accessing a newly registered domain that is not yet categorized by Check Point. The administrator wants to block access to uncategorized sites until they are reviewed. Which URL Filtering action should be configured?

Accepted Answer

Block the 'Uncategorized' category in the URL Filtering policy.. URL Filtering includes an Uncategorized category for sites not yet classified. Setting the action to Block for this category prevents access to unknown or newly registered domains, reducing exposure to phishing and malware. This is a straightforward configuration within the URL Filtering policy.

Answer

Configure a Threat Prevention rule to block uncategorized domains.

Answer

Set the action for the 'Uncategorized' category to 'Allow' but enable logging.

Answer

Enable 'Blocked Categories' and add the specific domain to the block list.

Question 15

A security administrator needs to block access to a specific unknown application that uses HTTP but does not match any signature in the current Application Control database. The administrator wants to ensure the application is blocked immediately without waiting for a database update. What is the most efficient way to achieve this?

Accepted Answer

Create a custom application signature using the 'Custom Application' feature in SmartConsole.. The Custom Application feature in Check Point allows administrators to define signatures for applications not yet recognized by the Application Control database. This provides immediate enforcement without relying on external updates, ensuring the unknown application is blocked promptly.

Answer

Configure a firewall rule to block all traffic on the application's default port.

Answer

Use a URL Filtering category override to block the application's known URLs.

Answer

Enable 'Application Control' in 'Detect' mode and rely on ThreatCloud to update the signature.