156-315.81.20 Practice Test 13 — 15 Questions

Question 1

An administrator is configuring Identity Awareness on a Check Point Security Gateway. The organization wants to identify users based on their login to the Windows domain without installing any software on user computers. Which Identity Awareness method should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AD Query. AD Query is a transparent identification method that reads Windows Security Event Logs on domain controllers to track user logons. It requires no software on user computers and integrates with Active Directory. This makes it the ideal choice for identifying users based on domain login without endpoint agents. The other methods either require software installation, user interaction, or additional infrastructure.

Answer

Identity Agent

Answer

RADIUS Accounting

Answer

Captive Portal

Question 2

A security administrator notices that Threat Emulation is bypassing all files from a specific internal server. They want to ensure that files from this server are emulated. What is the most likely reason for the bypass, and how can it be resolved?

Accepted Answer

The server is listed in the Threat Emulation bypass list; remove it from the bypass list.. The Threat Emulation bypass list allows administrators to exclude specific sources from emulation. If an internal server is in this list, its files will bypass emulation. Removing the server from the list will ensure its files are emulated. Other options involve broader exceptions or limitations that would not be server-specific.

Answer

The server's IP address is in the Threat Prevention exception list; remove it from the exception list.

Answer

The server is using an unsupported protocol; enable emulation for that protocol.

Answer

The files are too large for emulation; increase the maximum file size for emulation.

Question 3

An administrator is validating performance tuning on an R81.20 Security Gateway and wants to confirm that the CoreXL firewall instance count matches the planned design of one instance per firewall core. Which command provides the current number of CoreXL firewall instances and the cores assigned to them?

Accepted Answer

fw ctl multik stat. CoreXL instance configuration is exposed through the multik tooling. The stat view reports the number of firewall instances and their core assignments, which is precisely what is needed to confirm the design of one instance per firewall core. SecureXL statistics, OS CPU statistics, and interface listings do not provide instance configuration details.

Answer

cpstat os -f multi_cpu

Answer

fwaccel stats -s

Answer

fw ctl iflist

Question 4

A company wants to enforce identity-based rules for remote users who connect through a VPN. The administrator needs the Security Gateway to learn the user identity during the VPN authentication process without deploying additional agents. Which Identity Awareness feature should the administrator use?

Accepted Answer

VPN Authentication. Identity Awareness can consume the username from Remote Access VPN authentication and bind it to the VPN-assigned IP address. This gives the gateway identity for remote users as soon as the tunnel is established, with no endpoint agent and no browser prompt. Other acquisition methods either depend on domain logon events, require interactive web authentication, or need endpoint software, none of which fit the stated requirement.

Answer

AD Query

Answer

Captive Portal

Answer

Identity Agents

Question 5

You are upgrading a Security Gateway from R80.40 to R81.20 using the CPUSE Web UI. After selecting the upgrade package, you are prompted to choose between 'Upgrade' and 'Clean Install'. You want to preserve the existing configuration and installed hotfixes. Which option should you select?

Accepted Answer

Upgrade. When using CPUSE to upgrade, the 'Upgrade' option performs an in-place upgrade that retains the existing configuration and compatible hotfixes. 'Clean Install' erases everything, while 'Export and Import' and 'Snapshot and Restore' are not upgrade methods. For preserving settings, 'Upgrade' is the correct selection.

Answer

Clean Install

Answer

Snapshot and Restore

Answer

Export and Import

Question 6

An administrator has configured Identity Awareness with AD Query. Users are identified correctly during the day, but every morning many users appear unidentified until they generate new domain logon events. The administrator wants to reduce this morning gap without switching acquisition methods. Which configuration should the administrator adjust?

Accepted Answer

Configure the AD Query to read events from all relevant domain controllers and verify event log retention.. The morning gap indicates that AD Query is not capturing overnight or early-morning logon events. Common causes are querying an incomplete set of domain controllers or security logs rolling over before the gateway reads them. Verifying that all relevant controllers are queried and that event log retention covers the gap allows AD Query to learn the identities. Adjusting timeouts or adding Captive Portal does not address the missing events.

Answer

Enable Captive Portal as an additional acquisition method for unidentified users.

Answer

Increase the identity acquisition timeout value for AD Query.

Answer

Reduce the identity acquisition timeout so stale entries are removed faster.

Question 7

A Check Point R81 gateway is configured with Threat Emulation. An administrator notices that a suspicious executable file downloaded via HTTP was not emulated. The log shows the action as 'Bypassed'. Which of the following is the most likely reason for this bypass?

Accepted Answer

The file size exceeded the maximum emulation limit configured on the gateway.. The most likely reason for a bypass is that the file size exceeded the configured emulation limit. Threat Emulation has a maximum file size setting, and files larger than this are not emulated to prevent resource exhaustion. This results in a 'Bypassed' action in the logs, which matches the administrator's observation.

Answer

The Threat Emulation blade was disabled on the gateway.

Answer

The file was downloaded from a trusted internal server.

Answer

The file hash was not found in the ThreatCloud database.

Question 8

A junior administrator is learning how Check Point performance acceleration works on an R81.20 Security Gateway. The administrator wants to understand the role of SecureXL in the packet processing pipeline. Which statement best describes what SecureXL provides?

Accepted Answer

A mechanism that caches connection decisions so that subsequent packets of an accepted connection can be processed quickly without full Firewall Kernel inspection.. SecureXL accelerates the data path by reusing connection decisions, so packets belonging to accepted connections are processed quickly without repeating full Firewall Kernel inspection. Distributing connections across cores is CoreXL's responsibility, deep inspection is what acceleration avoids, and policy installation belongs to the management plane.

Answer

A service that performs full payload inspection for threat prevention blades on every packet of a connection.

Answer

A module that distributes connections across multiple firewall instances, each bound to a dedicated CPU core.

Answer

A tool that enforces security policy installation and version synchronization between the gateway and its management server.

Question 9

A security administrator is troubleshooting an Identity Awareness deployment that uses Identity Agents. Users report that they can access resources based on their identity, but sometimes they are prompted to authenticate again even though they are already logged in. The administrator checks the gateway and sees that the Identity Agent is running on the users' computers. What is a possible cause for the re-authentication prompts?

Accepted Answer

The user's IP address has changed, and the Identity Agent has not updated the PDP with the new IP.. Identity Agents dynamically update the PDP with the user's current IP address. If the IP changes and the agent fails to update the PDP promptly, the gateway may see traffic from an unknown IP and treat it as unauthenticated, triggering re-authentication. This is a common issue in environments with DHCP or multiple network interfaces. Ensuring the agent is running and can communicate with the gateway is essential.

Answer

The Identity Agent is not configured to start automatically, so it stops when the user logs off and on.

Answer

The gateway is configured to use AD Query in addition to Identity Agents, causing conflicting identity information.

Answer

The Identity Agent is configured to use a different port than the gateway's Identity Awareness service.

Question 10

A Check Point security administrator is designing a route-based VPN between two R81.10 Security Gateways. The administrator wants to route dynamic routing protocols (OSPF) and multicast traffic through the VPN tunnel without defining encryption domains for each network. Which VPN community type should be used?

Accepted Answer

Route-Based VPN Community. Route-Based VPN communities in Check Point use a virtual tunnel interface (VTI) to route traffic, which allows dynamic routing protocols such as OSPF and multicast to operate over the tunnel. Unlike traditional domain-based VPNs, they do not require encryption domains. The other community types rely on encryption domains or are not designed for site-to-site routing, so they cannot fulfill the requirement.

Answer

Remote Access VPN Community

Answer

Star VPN Community

Answer

Meshed VPN Community

Question 11

A security administrator is troubleshooting a performance issue on an R81 Security Gateway (156-315.81.20) with SecureXL enabled. The administrator runs 'fwaccel stats' and observes a high number of packets in the 'P' (pass) path but also a significant number in the 'F' (forward) path. Which action should the administrator take to improve performance?

Accepted Answer

Review and optimize the firewall rulebase and objects to reduce the number of rules that cause packets to be handled by the slow path.. The 'F' path indicates packets that are processed by the firewall kernel instead of being accelerated by SecureXL. To improve performance, the administrator should identify why these packets are not accelerated, which is often due to rulebase complexity, NAT, or features not supported by SecureXL. Optimizing the rulebase and simplifying configurations can increase the proportion of accelerated traffic, reducing CPU load and improving throughput. Disabling SecureXL or using the pass list are not appropriate for legitimate traffic.

Answer

Add the affected traffic to the SecureXL 'pass' list using 'fwaccel add -d <destination> -p'.

Answer

Disable SecureXL to force all traffic through the firewall kernel.

Answer

Increase the number of CoreXL firewall instances to distribute the load.

Question 12

A security administrator is troubleshooting a ClusterXL High Availability cluster where the standby member repeatedly fails to synchronize its kernel tables. The administrator suspects that the synchronization network is being blocked. Which interface type must be allowed to pass ClusterXL synchronization traffic for the cluster to function correctly?

Accepted Answer

The dedicated synchronization interface configured in the cluster topology.. ClusterXL synchronization traffic must flow over the dedicated synchronization interface that is configured in the cluster topology. This interface is used exclusively for state updates between members. If a rule or routing issue blocks this interface, the standby member cannot stay synchronized. The other interfaces serve different purposes and do not carry sync traffic, so they are not the required path.

Answer

The external interface facing the Internet.

Answer

The loopback interface of each cluster member.

Answer

The management interface used for SmartConsole connections.

Question 13

An administrator is deploying a new R81.20 Security Gateway and wants to reduce the attack surface by ensuring only required services are reachable on the management interface. After completing the First Time Configuration Wizard, which Gaia action best accomplishes this?

Accepted Answer

Configure the management interface access policy to allow only specific administrative hosts and protocols.. Gaia interface access policies let you define which source networks and protocols may reach an interface for management purposes. Applying a restrictive policy to the management interface ensures only authorized administrative hosts can use SSH, WebUI, or other services, while unrelated traffic is dropped. This is the correct way to minimize exposure on a newly deployed R81.20 gateway.

Answer

Change the management interface to a non-standard port for all services.

Answer

Enable the default drop rule in the security policy for the management interface.

Answer

Disable all blades except Firewall on the gateway object in SmartConsole.

Question 14

A Check Point administrator is configuring a Remote Access VPN using Endpoint Security VPN clients. The administrator wants to ensure that all client traffic, including Internet-bound traffic, is routed through the Security Gateway for inspection. Which option must be enabled in the VPN community or client configuration?

Accepted Answer

Route all traffic through gateway (Full Tunnel). To route all client traffic, including Internet-bound, through the Security Gateway, the administrator must enable Full Tunnel mode, often configured via 'Route all traffic through gateway' in the client or community settings. Split Tunnel would only route corporate traffic, and Visitor Mode or Hub Mode do not affect traffic routing.

Answer

Split Tunnel

Answer

Visitor Mode

Answer

Hub Mode

Question 15

A security administrator is configuring a Check Point R81 gateway running Threat Emulation and Threat Extraction blades. They want to ensure that files downloaded by users are inspected and, when necessary, sanitized before delivery. Which two of the following statements correctly describe the behavior of Threat Extraction? (Choose two.)

Accepted Answer

Threat Extraction removes potentially malicious content from supported file types and delivers a sanitized version to the user.. Threat Extraction sanitizes supported files by removing active content and delivers a safe version to the user. It can also reconstruct the original file if needed and if the file is clean. These two behaviors are fundamental to the blade's operation and align with the administrator's goal of inspecting and sanitizing downloads.

Answer

Threat Extraction requires a separate license and is not included with the Threat Prevention blades.

Answer

Threat Extraction only works on files transferred over HTTP and does not support SMTP or FTP.

Answer

Threat Extraction sends the original file to ThreatCloud for analysis and blocks it if malicious.