156-315.81.20 Practice Test 8 — 10 Questions

Question 1

An administrator is configuring Identity Awareness on a Check Point Security Gateway using the Terminal Server Agent. The environment has multiple users logging into a Citrix terminal server. The administrator wants to ensure that each user's identity is correctly associated with their individual session, not just the terminal server's IP address. Which statement describes how the Terminal Server Agent accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It monitors Windows Security Event Logs on the terminal server to detect user logon and logoff events.. The Terminal Server Agent is installed on the terminal server and reads Windows Security Event Logs to detect user logon and logoff events. It then sends this information to the Security Gateway, which maps each user to the terminal server's IP address. This enables per-user identity awareness even when multiple users share the same IP.

Answer

It uses RADIUS accounting to track user sessions on the terminal server.

Answer

It requires each user to authenticate through a Captive Portal when accessing the terminal server.

Answer

It assigns a unique IP address to each user session on the terminal server.

Question 2

A security administrator is configuring a ClusterXL High Availability cluster and wants to verify that the cluster is in the correct mode. Which command should the administrator use to display the current ClusterXL mode and status?

Accepted Answer

cphaprob stat. The cphaprob stat command is the standard tool to view ClusterXL status, including the mode and the state of each member. It provides a clear summary that helps administrators verify that the cluster is in High Availability mode and that members are active or standby as expected. Other commands like cpstat ha, fw stat, and cpconfig serve different purposes and do not directly show cluster mode.

Answer

cpconfig

Answer

cpstat ha

Answer

fw stat

Question 3

A network engineer is reviewing the performance of a Check Point Security Gateway. The engineer runs the command 'fwaccel stats' and sees the following output: Accelerated: 100000, F2F: 5000, Total: 105000. The engineer wants to understand what the 'F2F' counter represents. Which of the following best describes the meaning of 'F2F' in this context?

Accepted Answer

Packets that were forwarded to the Firewall path for processing because they could not be accelerated.. The F2F counter in 'fwaccel stats' indicates packets that were forwarded to the Firewall path because SecureXL could not accelerate them. This happens when traffic requires features not supported by SecureXL, such as VPN or deep inspection. A high F2F count relative to accelerated packets suggests that a significant portion of traffic is being processed by the firewall kernel, potentially impacting performance.

Answer

Packets that were accelerated by SecureXL and then forwarded to the destination.

Answer

Packets that were forwarded to a different interface due to routing decisions.

Answer

Packets that were dropped by the firewall due to security policy.

Question 4

A security administrator manages a two-member ClusterXL High Availability cluster. The administrator wants to run a failover test during a maintenance window without unplugging any cables or stopping the cluster. Which action will cause the currently active member to relinquish its Active state and force the standby member to take over?

Accepted Answer

Run `clusterXL_admin down` on the active member.. Administratively taking the active member down with `clusterXL_admin down` is the supported way to simulate a failure and verify that the standby member assumes the Active role. The command cleanly transitions the local member to Down, prompting the peer to promote itself. Other options are diagnostic or affect the wrong member, so they do not produce the desired controlled failover.

Answer

Run `cphaprob -a if` on the active member.

Answer

Run `fw ctl debug -m cluster on` on the active member.

Answer

Run `cpstop` on the standby member.

Question 5

An administrator is troubleshooting a Check Point Security Gateway that is experiencing performance degradation. The administrator runs 'fwaccel stats -s' and notices a high number of 'Non-accelerated conns' with the reason 'P' (Policy). Which of the following is the most likely cause for this?

Accepted Answer

The connections are subject to a rule with 'X11' or other deep inspection.. The 'P' reason code in 'fwaccel stats -s' indicates that connections are not accelerated because of policy settings, such as rules that require deep packet inspection or logging. This is common when rules include application control, content inspection, or other features that SecureXL cannot offload. The administrator should examine the security policy to find rules that enforce such inspections and consider whether they are necessary. Other reason codes like 'C' for crypto or 'S' for services point to different causes, so the 'P' flag specifically directs attention to policy.

Answer

The connections are matching a rule with a 'Drop' action.

Answer

The connections are using IPsec VPN.

Answer

The connections are being decrypted for HTTPS inspection.

Question 6

A security administrator is troubleshooting a performance issue on an R81 Security Gateway. The administrator runs 'fwaccel stats -s' and observes that a large number of connections are being handled by the Firewall path instead of being accelerated. The administrator wants to identify which specific connections are not being accelerated. Which command should be used to view the acceleration status of active connections?

Accepted Answer

fwaccel conns. To identify which specific connections are not being accelerated, the administrator must view the SecureXL connection table. The 'fwaccel conns' command lists active connections and indicates whether each is accelerated or handled by the Firewall path. This granular view is essential for troubleshooting why certain traffic bypasses acceleration, as it provides details like source, destination, and the reason for non-acceleration.

Answer

fwaccel stats

Answer

fw monitor -e 'accel;'

Answer

cpview -t

Question 7

An administrator is preparing to upgrade a Security Gateway from R80.40 to R81.20 using the CPUSE Web UI. Before initiating the upgrade, the administrator wants to ensure that all required packages are available and that the repository is up to date. Which action should the administrator take first?

Accepted Answer

In the CPUSE Web UI, click 'Check for Updates' to refresh the repository and list available packages.. Before upgrading, the administrator must ensure that the CPUSE repository is current. The CPUSE Web UI provides a 'Check for Updates' button that queries Check Point's servers for the latest packages, including the R81.20 upgrade package and required hotfixes. This step ensures that the correct packages are available for the upgrade, avoiding failures due to missing or outdated files. It is a best practice to perform this check before any upgrade.

Answer

Run 'yum update' to update the underlying operating system packages.

Answer

Manually download the R81.20 upgrade package from the Check Point Support Center and upload it via SCP.

Answer

Run 'cpuse fetch' from the command line to download the latest packages.

Question 8

A security administrator is configuring a Remote Access VPN with Endpoint Security VPN clients. The requirement is that all client traffic, including Internet-bound traffic, must be inspected by the gateway's Threat Prevention blades before reaching its destination. Which client configuration setting should the administrator enable?

Accepted Answer

Enable 'Route all traffic to gateway' in the VPN client's advanced settings.. To have the gateway inspect all client traffic, the client must route everything into the tunnel. The 'Route all traffic to gateway' option creates a full-tunnel configuration, ensuring that Internet-bound packets reach the Security Gateway where Threat Prevention and other blades can inspect them before forwarding.

Answer

Configure the client to use 'Hub Mode' with a dedicated gateway cluster.

Answer

Enable 'Allow split tunneling' and define the corporate subnet as the only encrypted route.

Answer

Enable 'Visitor Mode' on the gateway so clients connect over a single port.

Question 9

A Security Gateway is configured with Identity Awareness using AD Query, and users authenticate to the domain normally. An administrator notices that identities for users who log on to workstations on a remote subnet are not appearing in the Identity Awareness database, while local subnet users are identified correctly. The domain controllers are reachable and audit logging is enabled. Which configuration item should the administrator verify first?

Accepted Answer

The remote subnet is included in the AD Query configuration's monitored networks. AD Query filters the domain controller logon events it consumes based on the configured monitored networks. A subnet that is not listed produces no identities for its users, even when domain controllers and auditing are healthy. Verifying that the remote subnet appears in the AD Query network list is the direct and most likely fix for this selective failure.

Answer

The Captive Portal certificate is trusted by the remote workstations

Answer

The gateway's identity sharing setting is set to 'Sharing to all gateways'

Answer

The gateway's DNS resolver is configured to query the domain controllers

Question 10

An administrator is analyzing the performance of a Security Gateway with CoreXL and SecureXL enabled. The administrator notices that certain types of traffic, such as VoIP and streaming media, are not being accelerated by SecureXL. Which of the following is the most likely reason for this behavior?

Accepted Answer

The traffic requires deep packet inspection by the firewall.. Traffic that requires deep packet inspection, such as VoIP and streaming media subject to IPS or application control, cannot be accelerated by SecureXL. These advanced security features require full firewall processing, so SecureXL bypasses them. This is a common reason for selective non-acceleration, as SecureXL is designed to offload only simple, stateless packet handling.

Answer

The SecureXL templates for UDP are disabled by default.

Answer

CoreXL is not configured to handle UDP traffic.

Answer

SecureXL does not accelerate UDP traffic.