156-215.81.20 Application Control and URL Filtering — Timed 15 Questions

Question 1

Which TWO of the following statements are true regarding the Application Control and URL Filtering update process in Check Point?

Accepted Answer

The database update is incremental to reduce bandwidth usage.. Security gateways rely on the Application Control and URL Filtering database to identify traffic. Updates are managed by the Security Management Server or via the gateway's automatic update mechanism. Understanding this process is vital for ensuring that the policy engine uses the latest signatures to identify new and evolving web applications and malicious domains, keeping the network protected against current threats.

Answer

Updates are performed only by the Security Management Server.

Answer

Updates require a full gateway reboot to take effect.

Answer

Updates only include new application signatures, not URL categories.

Question 2

Which THREE of the following are prerequisites for effective Application Control and URL Filtering?

Accepted Answer

HTTPS Inspection enabled for encrypted traffic.. For Application Control and URL Filtering to function correctly, the gateway needs to see the traffic, identify the traffic, and have the latest intelligence on the traffic. These prerequisites ensure that the security policy is applied accurately and that the gateway can distinguish between legitimate traffic and potential threats, which is foundational to the security architecture of Check Point's Next Generation Threat Prevention.

Answer

A valid Threat Prevention subscription.

Answer

The policy must be installed on the management server.

Question 3

What is the primary difference between a 'Block' and 'Ask' action in Application Control?

Accepted Answer

Ask prompts the user to acknowledge the policy before allowing access.. The 'Ask' action in Check Point's Application Control serves as a notification mechanism that informs users about the corporate policy, requiring them to confirm they understand the rules before proceeding. This is often used for non-critical but discouraged sites. In contrast, 'Block' is an absolute denial, which is used for security-critical or policy-violating applications where no user interaction can allow access to the forbidden resource.

Answer

Block provides a notification while Ask performs an automatic redirect.

Answer

Block allows the connection after a timeout, while Ask never allows it.

Answer

They are functionally identical for all application categories.

Question 4

Refer to the exhibit. If a user tries to access 'linkedin.com', what happens?

Accepted Answer

Access is allowed due to the URL Filtering exception.. Check Point policy evaluation follows a specific order: explicit rules, then implicit rules. Exceptions created within the URL Filtering blade take precedence over general category blocks. By defining an exception for 'linkedin.com', the administrator overrides the 'Social Networking' block, ensuring the user can access the site. This is standard behavior to prevent category-based policies from being too restrictive in a business environment.

Answer

Access is blocked because it is categorized as Social Networking.

Answer

Access is blocked because category blocks take precedence.

Answer

Access is allowed only if the user is in the Business group.

Question 5

Which object type should an administrator use to create a custom URL category for a list of internal websites?

Accepted Answer

Network Object. To manage a custom group of URLs that are not part of the standard Check Point classification, administrators use 'Custom Categories' within the URL Filtering blade. This allows the grouping of multiple domains into a single object, which can then be referenced in security rules, providing a centralized and manageable way to control access to internal or specialized web resources.

Answer

Application Group

Answer

Service Object

Answer

Address Range

Question 6

Which log field in the SmartConsole shows the 'Application' and 'Category' detected by the gateway?

Accepted Answer

Application/Site. The 'Application/Site' field in the SmartConsole logs provides the specific name of the application or the domain name identified by the security blade. The 'Category' field shows the classification associated with that site. Together, these fields are crucial for administrators to understand exactly what traffic is being permitted or blocked and why, which is fundamental for effective troubleshooting and auditing.

Answer

Product Name

Answer

Rule Name

Answer

Service

Question 7

How can an administrator monitor the performance impact of enabling Application Control and URL Filtering?

Accepted Answer

By using the 'cpview' utility on the gateway.. The 'Gateway Status' or 'Security Gateway View' in SmartConsole provides performance metrics. Additionally, using CLI commands like 'cpview' allows administrators to see real-time CPU and memory utilization, specifically related to the inspect engine's load. Monitoring these metrics is vital to ensure that the security blades do not degrade the overall gateway throughput or cause latency for end-users, which is essential for maintaining service level agreements.

Answer

By checking the 'Policy Installation' logs.

Answer

By reviewing the 'Threat Prevention' reports.

Answer

By checking the 'SmartEvent' correlation logs.

Question 8

An administrator needs to restrict access to Facebook while allowing users to utilize the Facebook Chat feature. Which Application Control configuration provides this granularity?

Accepted Answer

Create a rule blocking 'Facebook' and a separate rule above it allowing 'Facebook Chat'.. Application Control uses AppWiki to identify specific features within a single application. By selecting the 'Facebook' application but excluding specific sub-features, or using the 'Facebook Chat' application object alongside a block rule for the main site, administrators enforce precise security policies. This granularity is essential for balancing productivity requirements with corporate security policies, ensuring that legitimate business communication remains operational while reducing social media distractions across the network.

Answer

Enable 'Facebook' and 'Facebook Chat' in the same rule with an 'Accept' action.

Answer

Configure the URL Filtering blade to block all Facebook URLs via a custom category.

Answer

Disable the Application Control blade and use traditional Access Control rules.

Question 9

Which TWO of the following are prerequisites for proper Application Control and URL Filtering functionality?

Accepted Answer

An active Service Contract and updated application signatures.. To function correctly, Application Control requires active subscriptions and proper security policy configuration. The gateway must be able to reach the User Center to download the latest application signatures, and HTTPS inspection is often necessary to categorize traffic that uses encrypted channels. These components work in tandem to ensure the gateway has current intelligence to identify, categorize, and enforce rules against modern web traffic effectively across the enterprise network.

Answer

The Security Gateway must be running in Bridge mode only.

Answer

HTTPS Inspection must be enabled for all traffic types.

Answer

The gateway must be configured as an Identity Awareness primary server.

Question 10

Where are the application and URL category updates downloaded from?

Accepted Answer

From the Check Point User Center via the Security Management Server.. Check Point gateways receive updates for Application Control and URL Filtering directly from the Check Point User Center. This synchronization ensures that the gateway has the latest signatures for identifying new web services and updated website classifications. Keeping these databases current is crucial for security, as it allows the gateway to defend against newly discovered threats and correctly categorize websites that change their content or infrastructure over time.

Answer

From the local management server's cached database only.

Answer

From the internal DNS server.

Answer

From the SmartConsole client.

Question 11

When a user attempts to access a blocked website, what happens by default if the 'UserCheck' feature is enabled?

Accepted Answer

The session is redirected to the Check Point management portal.. UserCheck provides a customizable interface to inform users why their traffic was blocked. By default, it presents a notification page in the browser explaining the policy violation. This feature is vital for reducing help-desk tickets, as it gives users immediate feedback, allows them to understand corporate policy, and can provide options to bypass the block if the administrator permits it for legitimate work-related tasks, thereby improving overall organizational efficiency.

Answer

The packet is silently dropped without notifying the user.

Answer

The connection is reset via a TCP RST packet only.

Answer

The user is prompted to enter an administrative password to bypass the block.

Question 12

Which THREE criteria can be used to define a custom Application Control application?

Accepted Answer

URL patterns.. Custom applications allow administrators to define traffic patterns that are not covered by the default AppWiki. By specifying URL patterns, domain names, or specific protocol attributes, administrators gain control over proprietary or internal web applications. This is necessary for organizations that use custom-built tools or specific SaaS platforms that require unique handling or security policies distinct from the standard application definitions provided by Check Point.

Answer

Operating system version of the client.

Answer

IP address range of the destination server.

Question 13

What is the primary difference between a 'Categorization' rule and an 'Application' rule in the policy?

Accepted Answer

Categorization rules target website groups, while Application rules target specific software or services.. Categorization rules act on groups of websites sharing a common theme (e.g., 'Gambling'), while Application rules identify specific software or web services (e.g., 'Skype'). Categorization is best for broad policy enforcement, while Application rules offer granular control over specific tools. Understanding this distinction allows administrators to build efficient policies that group similar threats together while maintaining specific exceptions for individual applications required for day-to-day business productivity.

Answer

Application rules apply to internal traffic only.

Answer

Application rules are processed after Categorization rules.

Answer

Categorization rules require HTTPS inspection to function, but Application rules do not.

Question 14

Why would an administrator use 'Category Override' in the URL Filtering policy?

Accepted Answer

To manually change the classification of a specific website.. Category Override is used when a website is incorrectly classified by the cloud database or when a site needs to be treated differently for a specific business unit. For example, a site categorized as 'Gambling' might need to be allowed for a research department. It provides the flexibility to adjust the default classification to fit specific organizational needs while still relying on the dynamic database for the vast majority of other sites.

Answer

To force all traffic to be encrypted.

Answer

To bypass HTTPS inspection for the entire category.

Answer

To hide the category from the logs.

Question 15

How can an administrator ensure that the Application Control database is updated even if the management server has no direct Internet access?

Accepted Answer

Use the 'Offline Update' feature from the SmartConsole.. In isolated environments, administrators can use the 'Offline Update' process. This involves downloading the update package from a machine with internet access and manually uploading it to the management server. This ensures that even high-security, air-gapped networks can maintain current application identification capabilities, which is critical because outdated signatures lead to poor detection rates and increased risk from unmanaged or new web applications that emerge daily.

Answer

Configure the gateway to use a secondary DNS server.

Answer

Enable a web proxy on the gateway.

Answer

Disable the blade until the server is connected to the Internet.