156-315.81.20 Practice Test 2 — 30 Questions

Question 1

Which TWO requirements must be met before a Security Gateway can be successfully provisioned using the Zero Touch Provisioning (ZTP) service?

Accepted Answer

The appliance must have internet access to reach the Check Point Cloud.. Zero Touch Provisioning relies on the appliance being able to reach the Check Point Cloud to fetch its configuration. This requires the device to have a serial number registered in the Zero Touch portal and a valid path to the internet, usually via DHCP on the designated management or first interface.

Answer

The administrator must manually run the 'cpconfig' command on the CLI first.

Answer

A console cable must be connected to the appliance during the boot sequence.

Answer

The Security Management Server must be in the same Layer 2 network segment.

Question 2

What is the primary function of the 'fwaccel' module in the context of Check Point performance tuning?

Accepted Answer

It offloads packet inspection to the fast path.. The 'fwaccel' module is the heart of SecureXL, responsible for offloading packet processing from the CPU to the hardware acceleration path. By reducing the number of packets that require full inspection, it significantly increases the gateway's throughput. Understanding the role of this module is fundamental for performance tuning, as it allows administrators to recognize the boundary between hardware-accelerated traffic and the traffic that requires full kernel inspection for security validation.

Answer

It manages the routing table entries.

Answer

It handles user authentication for the gateway.

Answer

It enables logging for all traffic.

Question 3

When deploying a new Security Gateway, what is the role of the 'First Time Wizard'?

Accepted Answer

It configures the base network and administrative settings.. The First Time Wizard is a critical tool for initializing a gateway's base configuration, including network interfaces, DNS, NTP, and basic administrative access. It ensures that the gateway is correctly identified and reachable within the network before being connected to the Security Management Server. Properly configuring these parameters through the wizard prevents common connectivity issues during the initial registration of the gateway into the Check Point environment.

Answer

It automatically installs the latest jumbo hotfix.

Answer

It pushes the security policy from the management server.

Answer

It automatically creates the SIC trust with the SMS.

Question 4

Refer to the exhibit. An administrator sees this CPU distribution on a gateway. What is the most appropriate action?

Accepted Answer

Review security policy for non-acceleratable features. This CPU breakdown shows high kernel utilization, suggesting the firewall engine is overburdened, while SecureXL is underutilized. This indicates that traffic is not being successfully offloaded. The administrator should investigate policies or features preventing acceleration, such as complex rules or inspection settings. Addressing this allows the gateway to shift the load from the kernel to the faster SecureXL path, significantly improving throughput and responsiveness.

Answer

Increase the number of CoreXL instances

Answer

Lower the MTU size on the interfaces

Answer

Reinstall the gateway software

Question 5

A security administrator needs to ensure that all encrypted traffic is inspected by the Threat Prevention blades. What is the mandatory requirement for this?

Accepted Answer

Configure the HTTPS Inspection policy and install the CA certificate on all client machines.. HTTPS Inspection is essential because many threats are delivered over encrypted channels to bypass inspection. By performing HTTPS Inspection, the gateway decrypts the traffic, inspects the payload using Threat Prevention blades, and re-encrypts it before sending it to the destination. This provides full visibility into the traffic, ensuring that malicious content hidden within encrypted payloads is effectively detected and blocked before reaching the internal network or the user's endpoint.

Answer

Enable SSL Inspection in the Threat Prevention policy.

Answer

Upgrade to the latest JHF (Jumbo Hotfix) on the Management Server only.

Answer

Enable the 'Deep Packet Inspection' blade globally on all interfaces.

Question 6

When deploying a Security Gateway in a public cloud environment like AWS or Azure, which method is typically used to handle the initial Gaia configuration?

Accepted Answer

Cloud-Init or CloudConfig scripts provided during instance creation.. Cloud deployments often use specialized templates or scripts to automate the initial setup, ensuring that the gateway is correctly integrated with the cloud provider's networking and identity services. This differs from physical appliance deployments where manual console access or ZTP is more common.

Answer

Physical console redirection via a serial-over-LAN connection.

Answer

Using a USB bootable drive with a 'Blink' image pre-installed.

Answer

Connecting to the default IP 192.168.1.1 via a local crossover cable.

Question 7

Refer to the exhibit. Rule 5 allows the group 'Admins'. Why is the user 'admin' being blocked?

Accepted Answer

The rule has additional constraints (e.g., source/destination/time) not met.. The user is correctly associated with the 'Admins' group. If a rule specifically allowing this group is blocking the traffic, it is highly likely that the rule contains additional restrictions, such as time-based limitations, specific service restrictions, or the rule is being shadowed by a higher-priority block rule. Alternatively, the user might be mapped to the group, but the rule requires an additional factor like a specific machine or device.

Answer

The user is not authenticated.

Answer

The PDP table is corrupt.

Answer

The group 'Admins' is not synced to the gateway.

Question 8

When should an administrator consider changing the 'CoreXL instance' count?

Accepted Answer

When the CPU usage indicates an imbalance or capacity constraint. The CoreXL instance count should be adjusted when there is a significant change in traffic volume or available CPU cores. If CPU utilization is uneven or consistently high, adding instances can help distribute the load, provided there are sufficient physical cores available. This tuning ensures that the gateway can handle peak traffic without dropping packets, maintaining the integrity and availability of the network inspection services.

Answer

Only when installing a new software version

Answer

Whenever a new security blade is enabled

Answer

When the gateway is in Standby mode in a cluster

Question 9

In ClusterXL High Availability mode, how many cluster members can be active for a specific virtual IP at any given time?

Accepted Answer

Only one member is active at a time.. High Availability mode is designed for redundancy, not load distribution. Consequently, only one member acts as the Active gateway, while the other remains in a Standby state. This ensures a clear ownership of the virtual IP and simplifies troubleshooting, as traffic flow is deterministic. If the active member fails, the standby member promotes itself to active to maintain service availability.

Answer

All members are active simultaneously for redundancy.

Answer

Up to four members can be active concurrently.

Answer

The number of active members is equal to the number of nodes in the cluster.

Question 10

An administrator notices that the Threat Extraction blade is converting incoming Microsoft Word documents into static PDF files, but users complain that embedded dynamic macros are completely missing from the converted documents. What is the cause of this behavior?

Accepted Answer

Threat Extraction permanently strips all active content, including macros, when rebuilding documents into safe formats.. Threat Extraction operates by removing active content such as macros, scripts, and embedded objects instantly to deliver a clean file while the full inspection happens. When converting files, active content elements are stripped out rather than preserved. This proactive approach prevents zero-day exploits safely without delaying initial user access, making it essential to understand for user expectation management.

Answer

The Threat Emulation blade failed to sandbox the Word document, causing the macro engine to crash during conversion.

Answer

The Security Gateway lacks sufficient memory resources to process complex Visual Basic for Applications scripts during extraction.

Answer

Anti-Bot policy rules supersede Threat Prevention settings, causing active document elements to be blocked at the firewall layer.

Question 11

During a Connectivity Upgrade of a cluster, what happens to the traffic when the first member (Member A) is being upgraded and is currently down?

Accepted Answer

Member B takes over all traffic and maintains existing session states.. The goal of a cluster upgrade is to maintain availability. When one member is taken offline for an upgrade, the cluster's failover mechanism ensures that the remaining members take over its traffic. In a Connectivity Upgrade, this is managed carefully to ensure session persistence.

Answer

Traffic is dropped until Member A returns with the new version.

Answer

The Management Server takes over traffic inspection temporarily.

Answer

The cluster enters 'Down' state and requires manual traffic routing.

Question 12

A security engineer configures Threat Emulation to inspect incoming archive files containing nested compressed directories. During testing, an archive containing six nested levels of ZIP files bypasses deep emulation inspection. What is the most likely configuration cause?

Accepted Answer

The maximum archive extraction depth limit in the Threat Emulation advanced settings was reached and traversal stopped.. SandBlast Threat Emulation enforces strict limits on archive extraction depth to protect gateway CPU and memory resources from denial-of-service attacks utilizing zip bombs. Exceeding the maximum archive depth threshold stops recursive extraction, meaning deeply nested files are passed without full emulation analysis. Administrators must balance security depth against gateway performance limits.

Answer

The file type filter profile was configured to exclude compressed archives exceeding four megabytes from sandbox evaluation.

Answer

Threat Extraction was disabled in the active policy layer, causing compressed payloads to bypass all inspection engines automatically.

Answer

The local Threat Emulation private cloud appliance encountered a CPU throttling event during the nested extraction phase.

Question 13

Which cryptographic function is primary in verifying the integrity of IKE packets during the negotiation?

Accepted Answer

SHA-256 hashing.. Integrity is verified using Hashed Message Authentication Codes (HMACs) or similar hashing functions like SHA-256. During IKE negotiation, these algorithms ensure that the packets haven't been tampered with in transit. If an attacker modifies the negotiation parameters, the hash comparison at the receiving end will fail, causing the gateway to drop the packet and prevent a potential man-in-the-middle attack.

Answer

Diffie-Hellman (DH) exchange.

Answer

AES-GCM encryption.

Answer

Public Key Infrastructure (PKI).

Question 14

Which mechanism does ClusterXL use to prevent the 'split-brain' scenario in a High Availability deployment?

Accepted Answer

A dedicated synchronization network interface.. Split-brain occurs when both nodes believe they are the master due to a loss of communication. ClusterXL uses multiple mechanisms, including heartbeat packets over dedicated synchronization links, to ensure nodes remain in contact. If communication fails, logic is applied to prevent both from becoming active. This is crucial for avoiding duplicate IP address conflicts and ensuring consistent policy enforcement across the network infrastructure.

Answer

A shared storage heartbeat file.

Answer

An external load balancer to monitor member health.

Answer

ARP resolution with the default gateway.

Question 15

You are preparing to upgrade a Security Gateway from R80.40 to R81.20 using CPUSE. Before initiating the upgrade, you want to ensure a smooth process. Which TWO actions are recommended best practices? (Choose two.)

Accepted Answer

Take a system snapshot before upgrading.. Taking a system snapshot and verifying sufficient disk space are both recommended best practices before a CPUSE upgrade. A snapshot provides a rollback point, and adequate disk space ensures the upgrade package can be downloaded and installed. Disabling policies, uninstalling hotfixes, and upgrading during peak hours are not recommended and can increase risk.

Answer

Uninstall all hotfixes before upgrading.

Answer

Schedule the upgrade during peak business hours to minimize impact.

Answer

Disable all security policies before upgrading.

Question 16

A firewall engineer is troubleshooting a CoreXL-enabled R81.20 gateway where a single firewall instance appears saturated while others are lightly loaded, even though SecureXL is active and the interface is configured for multi-queue. After reviewing fw ctl multik stat output, the engineer suspects that the distribution of connections across instances is uneven. Which factor most directly explains why CoreXL instance distribution can become skewed on this gateway?

Accepted Answer

A small number of very high-volume, long-lived connections whose source and destination pairs consistently hash to the same firewall instance.. CoreXL dispatches connections to firewall instances based on a hash of connection parameters. When a few long-lived, high-volume flows dominate the traffic mix, their hashes can repeatedly select the same instance, producing one saturated instance while others remain idle. Template state and core reservation schemes do not produce this specific skew pattern.

Answer

The gateway using only two cores for the Firewall Kernel while the remaining cores are reserved exclusively for SecureXL processing.

Answer

The firewall instance count exceeding the number of physical cores, causing instances to time-share and one instance to starve others.

Answer

SecureXL templates being disabled, which forces every packet through the Firewall Kernel and removes instance-level distribution.

Question 17

A security administrator is troubleshooting a Security Gateway that shows low throughput despite low CPU utilization. The administrator runs 'fwaccel stats -s' and observes that the 'Accelerated' packet count is extremely low, while 'F2F' (Forward to Firewall) packets are high. The administrator wants to understand why traffic is being sent to the Firewall path instead of being accelerated. Which of the following is the most likely reason for this behavior?

Accepted Answer

The traffic is being processed by the Firewall path due to a feature that is not supported by SecureXL, such as IPsec VPN or NAT with port translation.. SecureXL accelerates only traffic that does not require complex processing. Features like IPsec VPN, NAT with port translation, and deep inspection force packets to the Firewall path, increasing F2F counts. The low accelerated count and high F2F count indicate that a significant portion of traffic is being handled by the Firewall. The administrator should review the rulebase and gateway configuration for such features.

Answer

The SecureXL templates are disabled, causing all packets to be forwarded to the Firewall path.

Answer

The SecureXL device driver is not loaded, so all packets are handled by the Firewall kernel.

Answer

The CoreXL firewall instances are not properly distributing traffic, causing a bottleneck on a single core.

Question 18

An administrator is configuring Threat Extraction on a R81.20 Security Gateway. They want to ensure that files are sanitized and delivered quickly while maintaining security. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure Threat Emulation to run in the background while the sanitized file is delivered.. Threat Extraction delivers a sanitized file immediately while Threat Emulation runs in the background on the original. This combination ensures fast delivery with security. Disabling emulation or delivering the original file first compromises security, and size-based sanitization is not a recommended practice.

Answer

Disable Threat Emulation to reduce latency.

Answer

Configure Threat Extraction to only sanitize files larger than 10 MB.

Answer

Set Threat Extraction to deliver the original file and then sanitize it if malicious.

Question 19

A security administrator is troubleshooting a performance bottleneck on a Check Point Security Gateway. The administrator suspects that SecureXL is not accelerating a large portion of traffic. Which command should the administrator use to identify which traffic is being accelerated and which is not?

Accepted Answer

fwaccel stats -s. The 'fwaccel stats -s' command provides comprehensive statistics on SecureXL acceleration, including the number of packets in the fast path, medium path, and slow path. It helps administrators understand which traffic is being accelerated and which is not, enabling targeted performance tuning. Other commands like 'fw monitor' or 'cpview' are useful for different purposes but do not provide the same level of detail on SecureXL acceleration.

Answer

fw ctl zdebug + drop

Answer

fw monitor -e 'accept;'

Answer

cpview -t

Question 20

An administrator is configuring Threat Emulation on a Check Point R81.20 Security Gateway. The administrator wants to ensure that files downloaded from the internet are inspected in a sandbox environment. Which of the following best describes the function of the Threat Emulation blade?

Accepted Answer

It executes files in a virtual sandbox to detect malicious behavior and block threats.. Threat Emulation is a Check Point blade that sends files to a sandbox for dynamic analysis, executing them in a virtual environment to detect malicious behavior. This allows it to catch unknown threats that signature-based methods might miss. The other options describe different blades: Threat Extraction sanitizes content, Anti-Virus uses signatures, and Anti-Bot monitors traffic, none of which provide sandbox execution.

Answer

It inspects network traffic for command and control communication and blocks it.

Answer

It scans files for known virus signatures and blocks them based on a signature database.

Answer

It extracts malicious macros from documents and replaces them with benign content.