156-315.81.20 Practice Test 14 — 15 Questions

Question 1

An administrator is deploying a new R81.20 Security Gateway using the Gaia First Time Configuration Wizard. During the wizard, the administrator is prompted to select the 'Security Gateway' role. Which additional configuration is required to complete the deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The administrator must specify the Security Management Server's IP address and the gateway's SIC (Secure Internal Communication) activation key.. During the Gaia First Time Configuration Wizard, selecting the Security Gateway role prompts for the Security Management Server's IP address and a SIC activation key. These are essential to establish trusted communication between the gateway and the management server, enabling the gateway to be managed and to receive security policies. Without this information, the gateway cannot be added to the management server or function as a managed Security Gateway.

Answer

The administrator must configure the gateway as a standalone management server and then convert it to a managed gateway.

Answer

The administrator must enable the 'Management Server' role and install a policy locally.

Answer

The administrator must configure the gateway to use DHCP and obtain its IP address automatically.

Question 2

An administrator is implementing Identity Awareness using AD Query on a Security Gateway. Before identities can be learned from Active Directory, which two actions must be performed? (Choose two.)

Accepted Answer

Configure the AD Query settings with the domain controller address and credentials. AD Query requires the gateway to connect to the domain controllers with valid credentials and to know which networks to monitor for logon events. Configuring the DC address and credentials enables the query, while listing the user subnets ensures events from those subnets are actually processed. Both are mandatory for identities to appear.

Answer

Enable the Captive Portal on the gateway's internal interface

Answer

Install an Identity Agent on each workstation

Answer

Configure a RADIUS server object for accounting

Question 3

A security administrator is deploying a new ClusterXL High Availability cluster with two members. The administrator wants to ensure that if the standby member takes over as Active, it will automatically return to Standby once the original active member recovers. Which ClusterXL feature must be enabled?

Accepted Answer

Preemption. Preemption enables a recovering member to take back the Active role based on its configured priority. In a High Availability cluster, the member with the highest priority becomes Active when it is available. If preemption is enabled, the standby member that assumed Active will step down once the original member recovers and rejoins the cluster, restoring the intended active/standby arrangement.

Answer

Load Sharing

Answer

Delayed Failover

Answer

State Synchronization

Question 4

You are preparing an R81.20 Security Gateway for an in-place upgrade using CPUSE. Corporate policy requires that you can roll back to the previous version if the upgrade fails. Which two actions must you take before starting the upgrade? (Choose two.)

Accepted Answer

Verify that the repository contains the current version package for rollback.. Rollback readiness for a CPUSE in-place upgrade depends on having a Gaia system backup and confirming that the current version package remains in the repository. The backup can restore the full previous state, while the repository package allows CPUSE to revert the installed version quickly. Together they satisfy the corporate mandate to recover from a failed R81.20 upgrade.

Answer

Export the Security Management Server database to the gateway.

Answer

Run cpstop on the gateway and leave all services stopped during the upgrade.

Answer

Disable SecureXL and CoreXL permanently before upgrading.

Question 5

Before performing an R81.20 upgrade on a gateway, what is the best practice to verify that the current configuration is compatible?

Accepted Answer

Run the Pre-Upgrade Verifier tool.. Running the 'pre-upgrade verifier' is a critical prerequisite for any major Check Point upgrade. It scans the existing database and configuration for potential issues that could prevent a successful transition to the target version. This step is vital because it identifies incompatible settings, deprecated features, or hardware limitations *before* the installation begins, saving administrators from hours of troubleshooting during a maintenance window and ensuring that the final upgrade is clean and successful.

Answer

Check the CPU utilization during peak traffic hours.

Answer

Review the logs in the /var/log/messages file.

Answer

Consult the release notes and manually verify every setting.

Question 6

What is the primary function of the 'ThreatCloud' service in the context of SandBlast Threat Prevention?

Accepted Answer

To provide real-time updates of malicious signatures and reputation intelligence.. ThreatCloud provides a dynamic, global repository of threat intelligence that is updated in real-time. It correlates data from millions of Check Point gateways, identifying new attack patterns and malicious entities. This intelligence is delivered to gateways to ensure they have the latest signatures and reputation data to block threats, including zero-day exploits, before they can cause damage, making it a cornerstone of the SandBlast architecture's effectiveness and reliability.

Answer

To store backup copies of decrypted HTTPS traffic for compliance auditing.

Answer

To perform physical hardware replacement for failed appliances in the field.

Answer

To manage the deployment of security policy updates to the Management Server.

Question 7

Refer to the exhibit. An administrator is analyzing SecureXL performance and sees a high number of F2F (Firewall-to-Fastpath) packets. What is the most likely reason for this performance pattern?

Accepted Answer

The traffic contains unsupported features that prevent template acceleration. F2F packets indicate traffic is being processed by the Firewall kernel because it cannot be fully accelerated by the SecureXL template. When traffic hits the firewall repeatedly without matching a template, overhead increases significantly. This is critical because it implies that the SecureXL acceleration path is failing to offload certain traffic patterns, causing the CPU to work harder than necessary for connections that should be offloaded for high-speed performance.

Answer

SecureXL is disabled globally

Answer

CoreXL is disabled

Answer

The NIC drivers are incompatible

Question 8

What is the primary difference between ClusterXL High Availability (HA) mode and Load Sharing (LS) mode?

Accepted Answer

HA mode uses one active member, while Load Sharing mode allows all members to process traffic simultaneously.. ClusterXL HA focuses on redundancy, where one member is active and others are passive. In contrast, Load Sharing distributes traffic across multiple active members to increase throughput. Choosing between these modes depends on the organization's requirements for capacity versus simplicity. HA is easier to manage, while LS provides better scalability, requiring careful consideration of the physical network topology to ensure traffic is correctly distributed between the cluster members.

Answer

HA mode requires specialized hardware, while Load Sharing works on standard virtual machines.

Answer

Load Sharing mode does not require synchronization between members, whereas HA mode does.

Answer

HA mode supports more than two cluster members, while Load Sharing is strictly limited to two.

Question 9

An administrator wants to ensure that a specific cluster member always takes priority during a failover. Which setting should be adjusted?

Accepted Answer

Increase the 'priority' value of the preferred cluster member.. Priority in ClusterXL is determined by the cluster member configuration. By assigning a higher priority value to the preferred node, the administrator ensures that it will attempt to occupy the 'Active' role whenever it is healthy. This is crucial in environments where one gateway may have more physical resources or is connected to a more stable uplink, providing a deterministic failover behavior that aligns with the business requirements.

Answer

Enable 'failover' on the preferred member's interface.

Answer

Reduce the 'heartbeat' timeout on the secondary member.

Answer

Assign a lower MAC address to the preferred member.

Question 10

When configuring a VPN Star Community, what is the primary role of the Center Gateway?

Accepted Answer

To serve as the traffic hub for all spoke-to-spoke communication.. In a Star Community, the Center Gateway acts as the hub that manages all encrypted traffic flows for the spokes. It is responsible for routing traffic between spokes (if configured) and inspecting all incoming traffic from them. This centralized architecture simplifies policy management by allowing the administrator to define rules on the hub, which then governs the entire communication flow within the VPN network.

Answer

To act as a certificate authority for all spoke gateways.

Answer

To perform local traffic inspection for spokes only.

Answer

To disable encryption for faster communication between spokes.

Question 11

A security administrator needs to ensure that the primary firewall node always regains the master role after a failover once it recovers. Which setting must be enabled?

Accepted Answer

Enable the Preemption feature.. Preemption allows the higher-priority node to reclaim the master role automatically once it returns to a healthy state after a failure. Without preemption enabled, a cluster will remain on the secondary node even if the primary node has recovered, which might not align with corporate uptime or performance policies. Mastering this setting is vital for maintaining predictable cluster behavior in production.

Answer

Enable VRRP Master-Only mode.

Answer

Set the preempt-delay to zero.

Answer

Set the cluster-mode to High Availability.

Question 12

Why should an administrator use a 'VPN Community' instead of manual IKE settings for site-to-site tunnels?

Accepted Answer

They provide centralized management and simplified policy enforcement.. VPN Communities provide a centralized, object-oriented approach to VPN management. They allow administrators to define common security parameters, such as encryption suites and routing settings, and apply them to multiple gateways at once. This significantly reduces manual configuration, lowers the risk of human error, and makes it easier to enforce a consistent security posture across the entire enterprise VPN deployment.

Answer

Communities are required for manual IPsec key exchange.

Answer

Communities are faster to negotiate than manual tunnels.

Answer

They allow for the use of non-standard IKE ports.

Question 13

Which TWO of the following are primary components of the Check Point SandBlast Threat Extraction solution?

Accepted Answer

Conversion of files to a safe static format. Threat Extraction is a proactive security measure that ensures files are clean by removing active content. It achieves this by sanitizing files in real-time. By converting active content to static forms, the organization reduces the attack surface of common document formats. These two components represent the core workflow: immediate conversion of content to ensure safe delivery and the maintenance of a security-hardened environment by stripping potentially dangerous active code from incoming files.

Answer

Deep behavioral analysis of executables

Answer

Automatic quarantine of suspicious email accounts

Answer

Hardware-level instruction tracing

Question 14

Which mechanism does Check Point use to allow VPN users to access resources using a single virtual IP address while hidden behind a gateway?

Accepted Answer

Office Mode.. Office Mode allows the security gateway to assign an internal virtual IP address to the remote access client. By doing this, the client appears as if it is physically on the internal network. This simplifies policy creation, as the administrator can write firewall rules using the user's specific virtual IP address rather than the client's actual public IP, ensuring consistent security and access control.

Answer

Dynamic NAT mapping on the remote client.

Answer

Transparent Mode VPN.

Answer

Client-side proxy forwarding.

Question 15

An administrator needs to allow VPN traffic to pass through a NAT device. Which feature must be enabled in the VPN community settings?

Accepted Answer

NAT-Traversal (NAT-T).. NAT-Traversal (NAT-T) is required when the VPN traffic passes through a device performing address translation, as the original IP headers are modified. NAT-T encapsulates the ESP packets within UDP port 4500, allowing the traffic to traverse the NAT device successfully without breaking the integrity of the IPsec connection. This is a standard requirement for remote access and site-to-site VPNs in environments where global IPs are limited.

Answer

VPN Domain NAT.

Answer

IKEv1 Aggressive Mode.

Answer

Hide NAT on the VPN Gateway.