156-315.81.20 Practice Test 3 — 30 Questions

Question 1

An enterprise environment utilizes Identity Awareness with both AD Query and Browser-Based Authentication. Security administrators notice that contractor devices, which are not joined to the Active Directory domain, fail to acquire identity roles and are blocked by internal firewall rules. Which TWO methods can be implemented to correctly identify and authenticate these non-domain-joined contractor machines? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure identity collection using Browser-Based Authentication (Captive Portal) to prompt unauthenticated users for credentials when accessing web resources.. Non-domain-joined machines lack Active Directory credentials and cannot participate in Kerberos authentication or AD Query log scraping. Captive portal authentication intercepts HTTP traffic to present a login prompt, while Identity Agent provides transparent identification once deployed. Both mechanisms bridge the identification gap for external or unmanaged assets effectively.

Answer

Increase the AD Query polling frequency to target the local workgroups of the contractor laptops directly via WMI queries.

Answer

Configure Identity Awareness to map user identities statically based on the physical switch port numbers of the access layer switches.

Answer

Implement RADIUS Accounting synchronization with the corporate DHCP server to capture dynamic IP leases of contractor endpoints.

Question 2

What is the primary benefit of using CoreXL on a multi-core Security Gateway?

Accepted Answer

It enables the gateway to inspect traffic in parallel.. CoreXL enables the Security Gateway to process multiple firewall instances in parallel by distributing traffic across multiple CPU cores. By utilizing more cores, the gateway can handle significantly higher concurrent traffic volumes and throughput. This is the cornerstone of modern Check Point performance tuning, as it effectively multiplies the processing capacity of the gateway, ensuring that security inspection does not become the limiting factor for network performance.

Answer

It reduces the total number of security rules required.

Answer

It automatically creates VPN tunnels for traffic.

Answer

It improves the accuracy of the intrusion detection system.

Question 3

What is the primary advantage of deploying Threat Emulation on a Security Gateway rather than just using endpoint-based protection?

Accepted Answer

Gateway emulation allows for proactive protection against unknown threats for all hosts.. Deploying Threat Emulation at the gateway provides a centralized, perimeter-based defense that inspects files before they enter the internal network. This approach prevents malicious files from reaching endpoints entirely, reducing the risk of lateral movement and infection. It provides visibility into files downloaded via various protocols and protects unmanaged devices or legacy systems that may not have full-featured endpoint security agents installed.

Answer

Gateway emulation eliminates the need for any endpoint security agents.

Answer

Gateway emulation can detect threats without needing to decrypt traffic.

Answer

Gateway emulation is faster than endpoint-based sandboxing.

Question 4

How can an administrator monitor the effectiveness of the Threat Prevention blades over time?

Accepted Answer

By using the Threat Prevention dashboard and generating scheduled reports in SmartConsole.. The Check Point SmartConsole provides built-in tools such as the Threat Prevention dashboard and extensive logging and reporting features. These tools allow administrators to visualize trends, review blocked threats, and analyze the impact of security policies. By regularly reviewing these reports, administrators can identify recurring threats, adjust staging settings to prevent, and ensure that the threat prevention posture remains robust against evolving risks, proving the value of the investment in Check Point security.

Answer

By manually reviewing every packet in the packet capture file.

Answer

By checking the CPU load on the security gateway every hour.

Answer

By testing the gateway's security with public, unverified third-party penetration tools.

Question 5

A security engineer is asked to verify whether SecureXL is currently enabled on a Check Point R81 Security Gateway. Which command should the engineer use?

Accepted Answer

fwaccel stat. The 'fwaccel stat' command is the correct tool to check SecureXL status. It explicitly shows whether SecureXL is enabled or disabled, along with other useful information. Other commands either provide CoreXL statistics, are invalid, or give detailed performance counters without status.

Answer

fwaccel stats

Answer

fw ctl multik stat

Answer

cpstat -f securexl

Question 6

A security administrator is configuring Threat Prevention profiles on a Check Point R81.20 Security Gateway. The administrator wants to ensure that the organization benefits from Check Point's recommended settings for Threat Emulation and Threat Extraction. Which two of the following are characteristics of the 'Recommended' Threat Prevention profile? (Choose two.)

Accepted Answer

It balances security and performance by using pre-tuned settings.. The Recommended profile is pre-tuned by Check Point to provide a balance of security and performance, and it is continuously updated through ThreatCloud with new protections. It does not enable all blades blindly or require manual configuration, and it does not disable Threat Extraction. These characteristics make it a convenient and effective starting point for many organizations.

Answer

It disables Threat Extraction by default to avoid user disruption.

Answer

It automatically enables all Threat Prevention blades with default settings.

Answer

It requires manual configuration of each blade's advanced settings.

Question 7

A security administrator is deploying Identity Awareness on a Check Point R81 Security Gateway. The environment uses a Windows Server 2019 domain controller, and the administrator wants the gateway to learn user identities by querying Windows Security Event Logs on the domain controller. The administrator has already configured the Identity Awareness blade and enabled AD Query in SmartConsole. Which additional configuration is required on the domain controller for AD Query to function?

Accepted Answer

Enable the 'Audit Logon Events' and 'Audit Account Logon Events' policies in the Default Domain Controllers Policy.. AD Query collects user identity by reading Windows Security Event Logs from domain controllers. For the domain controller to generate the necessary logon events, audit policies for logon events must be enabled. Without these audit policies, the gateway cannot receive the events and map users to IP addresses, causing identity awareness to fail.

Answer

Enable the 'Identity Awareness' Windows Firewall exception on the domain controller.

Answer

Configure a RADIUS server on the domain controller and point the gateway to it.

Answer

Install the Check Point Identity Awareness agent on each domain controller.

Question 8

An administrator has deployed Identity Awareness on a Security Gateway in AD Query mode. Users authenticate to the domain and their identities are learned successfully. However, a security policy rule that should permit access to an internal web server for the group 'Sales' is not matching. The administrator verifies that user 'jsmith' is a member of 'Sales' in Active Directory. The gateway's PDP shows the user identity, but the group is missing. What is the most likely cause?

Accepted Answer

The AD Query account does not have permissions to read group membership attributes.. AD Query relies on a service account to read user and group objects from Active Directory. If the account cannot read the memberOf attribute or group membership, the gateway will not have the group list, causing group-based rules to fail. The other options are either unrelated to the symptom or would cause broader failures.

Answer

The user's identity was learned via a different method (e.g., Captive Portal) and is not associated with AD Query.

Answer

The Security Gateway's Identity Awareness blade is not licensed for group-based policies.

Answer

The gateway is not configured to use LDAP over SSL (LDAPS) for group retrieval.

Question 9

An administrator is configuring a VPN between a Check Point R81 Security Gateway and a third-party vendor's gateway. The third-party gateway uses a single IP address for both IKE and IPsec traffic, but the Check Point gateway is behind a NAT device that translates its public IP. The administrator wants to ensure the VPN tunnel establishes successfully. Which Check Point feature should be enabled on the Check Point gateway?

Accepted Answer

NAT Traversal (NAT-T). NAT Traversal (NAT-T) is required when a VPN gateway is behind a NAT device. It encapsulates IPsec ESP packets in UDP, allowing them to pass through NAT. The other options are unrelated to NAT traversal: DPD monitors peer availability, PFS enhances key security, and Tunnel Sharing optimizes tunnel usage. Only NAT-T addresses the address translation issue that prevents the tunnel from establishing.

Answer

IPsec Dead Peer Detection (DPD)

Answer

Perfect Forward Secrecy (PFS)

Answer

VPN Tunnel Sharing

Question 10

A Check Point administrator wants to ensure that files downloaded from the internet are inspected by Threat Emulation before reaching the user. Which blade must be enabled in the Threat Prevention policy to achieve this?

Accepted Answer

Threat Emulation. Threat Emulation is the blade that sends files to a sandbox for behavioral analysis. It detects malicious files by executing them in a safe environment. Enabling it in the Threat Prevention policy ensures files are inspected before reaching users.

Answer

Antivirus

Answer

Threat Extraction

Answer

IPS

Question 11

An administrator is configuring Identity Awareness on a Check Point Security Gateway using the Terminal Server Agent. The environment has multiple users logging into a Citrix terminal server. The administrator wants to ensure that each user's identity is correctly associated with their individual session, not just the terminal server's IP address. Which statement describes how the Terminal Server Agent accomplishes this?

Accepted Answer

It monitors Windows Security Event Logs on the terminal server to detect user logon and logoff events.. The Terminal Server Agent is installed on the terminal server and reads Windows Security Event Logs to detect user logon and logoff events. It then sends this information to the Security Gateway, which maps each user to the terminal server's IP address. This enables per-user identity awareness even when multiple users share the same IP.

Answer

It uses RADIUS accounting to track user sessions on the terminal server.

Answer

It requires each user to authenticate through a Captive Portal when accessing the terminal server.

Answer

It assigns a unique IP address to each user session on the terminal server.

Question 12

A security administrator is configuring a ClusterXL High Availability cluster and wants to verify that the cluster is in the correct mode. Which command should the administrator use to display the current ClusterXL mode and status?

Accepted Answer

cphaprob stat. The cphaprob stat command is the standard tool to view ClusterXL status, including the mode and the state of each member. It provides a clear summary that helps administrators verify that the cluster is in High Availability mode and that members are active or standby as expected. Other commands like cpstat ha, fw stat, and cpconfig serve different purposes and do not directly show cluster mode.

Answer

cpconfig

Answer

cpstat ha

Answer

fw stat

Question 13

A network engineer is reviewing the performance of a Check Point Security Gateway. The engineer runs the command 'fwaccel stats' and sees the following output: Accelerated: 100000, F2F: 5000, Total: 105000. The engineer wants to understand what the 'F2F' counter represents. Which of the following best describes the meaning of 'F2F' in this context?

Accepted Answer

Packets that were forwarded to the Firewall path for processing because they could not be accelerated.. The F2F counter in 'fwaccel stats' indicates packets that were forwarded to the Firewall path because SecureXL could not accelerate them. This happens when traffic requires features not supported by SecureXL, such as VPN or deep inspection. A high F2F count relative to accelerated packets suggests that a significant portion of traffic is being processed by the firewall kernel, potentially impacting performance.

Answer

Packets that were accelerated by SecureXL and then forwarded to the destination.

Answer

Packets that were forwarded to a different interface due to routing decisions.

Answer

Packets that were dropped by the firewall due to security policy.

Question 14

A security administrator manages a two-member ClusterXL High Availability cluster. The administrator wants to run a failover test during a maintenance window without unplugging any cables or stopping the cluster. Which action will cause the currently active member to relinquish its Active state and force the standby member to take over?

Accepted Answer

Run `clusterXL_admin down` on the active member.. Administratively taking the active member down with `clusterXL_admin down` is the supported way to simulate a failure and verify that the standby member assumes the Active role. The command cleanly transitions the local member to Down, prompting the peer to promote itself. Other options are diagnostic or affect the wrong member, so they do not produce the desired controlled failover.

Answer

Run `cphaprob -a if` on the active member.

Answer

Run `fw ctl debug -m cluster on` on the active member.

Answer

Run `cpstop` on the standby member.

Question 15

An administrator is troubleshooting a Check Point Security Gateway that is experiencing performance degradation. The administrator runs 'fwaccel stats -s' and notices a high number of 'Non-accelerated conns' with the reason 'P' (Policy). Which of the following is the most likely cause for this?

Accepted Answer

The connections are subject to a rule with 'X11' or other deep inspection.. The 'P' reason code in 'fwaccel stats -s' indicates that connections are not accelerated because of policy settings, such as rules that require deep packet inspection or logging. This is common when rules include application control, content inspection, or other features that SecureXL cannot offload. The administrator should examine the security policy to find rules that enforce such inspections and consider whether they are necessary. Other reason codes like 'C' for crypto or 'S' for services point to different causes, so the 'P' flag specifically directs attention to policy.

Answer

The connections are matching a rule with a 'Drop' action.

Answer

The connections are using IPsec VPN.

Answer

The connections are being decrypted for HTTPS inspection.

Question 16

A security administrator is troubleshooting a performance issue on an R81 Security Gateway. The administrator runs 'fwaccel stats -s' and observes that a large number of connections are being handled by the Firewall path instead of being accelerated. The administrator wants to identify which specific connections are not being accelerated. Which command should be used to view the acceleration status of active connections?

Accepted Answer

fwaccel conns. To identify which specific connections are not being accelerated, the administrator must view the SecureXL connection table. The 'fwaccel conns' command lists active connections and indicates whether each is accelerated or handled by the Firewall path. This granular view is essential for troubleshooting why certain traffic bypasses acceleration, as it provides details like source, destination, and the reason for non-acceleration.

Answer

fwaccel stats

Answer

fw monitor -e 'accel;'

Answer

cpview -t

Question 17

An administrator is preparing to upgrade a Security Gateway from R80.40 to R81.20 using the CPUSE Web UI. Before initiating the upgrade, the administrator wants to ensure that all required packages are available and that the repository is up to date. Which action should the administrator take first?

Accepted Answer

In the CPUSE Web UI, click 'Check for Updates' to refresh the repository and list available packages.. Before upgrading, the administrator must ensure that the CPUSE repository is current. The CPUSE Web UI provides a 'Check for Updates' button that queries Check Point's servers for the latest packages, including the R81.20 upgrade package and required hotfixes. This step ensures that the correct packages are available for the upgrade, avoiding failures due to missing or outdated files. It is a best practice to perform this check before any upgrade.

Answer

Run 'yum update' to update the underlying operating system packages.

Answer

Manually download the R81.20 upgrade package from the Check Point Support Center and upload it via SCP.

Answer

Run 'cpuse fetch' from the command line to download the latest packages.

Question 18

A security administrator is configuring a Remote Access VPN with Endpoint Security VPN clients. The requirement is that all client traffic, including Internet-bound traffic, must be inspected by the gateway's Threat Prevention blades before reaching its destination. Which client configuration setting should the administrator enable?

Accepted Answer

Enable 'Route all traffic to gateway' in the VPN client's advanced settings.. To have the gateway inspect all client traffic, the client must route everything into the tunnel. The 'Route all traffic to gateway' option creates a full-tunnel configuration, ensuring that Internet-bound packets reach the Security Gateway where Threat Prevention and other blades can inspect them before forwarding.

Answer

Configure the client to use 'Hub Mode' with a dedicated gateway cluster.

Answer

Enable 'Allow split tunneling' and define the corporate subnet as the only encrypted route.

Answer

Enable 'Visitor Mode' on the gateway so clients connect over a single port.

Question 19

A Security Gateway is configured with Identity Awareness using AD Query, and users authenticate to the domain normally. An administrator notices that identities for users who log on to workstations on a remote subnet are not appearing in the Identity Awareness database, while local subnet users are identified correctly. The domain controllers are reachable and audit logging is enabled. Which configuration item should the administrator verify first?

Accepted Answer

The remote subnet is included in the AD Query configuration's monitored networks. AD Query filters the domain controller logon events it consumes based on the configured monitored networks. A subnet that is not listed produces no identities for its users, even when domain controllers and auditing are healthy. Verifying that the remote subnet appears in the AD Query network list is the direct and most likely fix for this selective failure.

Answer

The Captive Portal certificate is trusted by the remote workstations

Answer

The gateway's identity sharing setting is set to 'Sharing to all gateways'

Answer

The gateway's DNS resolver is configured to query the domain controllers

Question 20

An administrator is analyzing the performance of a Security Gateway with CoreXL and SecureXL enabled. The administrator notices that certain types of traffic, such as VoIP and streaming media, are not being accelerated by SecureXL. Which of the following is the most likely reason for this behavior?

Accepted Answer

The traffic requires deep packet inspection by the firewall.. Traffic that requires deep packet inspection, such as VoIP and streaming media subject to IPS or application control, cannot be accelerated by SecureXL. These advanced security features require full firewall processing, so SecureXL bypasses them. This is a common reason for selective non-acceleration, as SecureXL is designed to offload only simple, stateless packet handling.

Answer

The SecureXL templates for UDP are disabled by default.

Answer

CoreXL is not configured to handle UDP traffic.

Answer

SecureXL does not accelerate UDP traffic.