156-315.81.20 Practice Test 9 — 10 Questions

Question 1

A Check Point Security Gateway is experiencing high CPU utilization on a single core, while other cores are underutilized. CoreXL is enabled, and the administrator suspects that the traffic is not being distributed evenly across the CoreXL firewall instances. Which command should the administrator use to verify the distribution of connections across CoreXL instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

fw ctl multik stat. To verify the distribution of connections across CoreXL instances, the administrator should use 'fw ctl multik stat'. This command provides per-instance statistics, including the number of connections and packets, allowing the administrator to see if the load is balanced. If one instance is handling more traffic, it may indicate a configuration issue or a traffic pattern that is not being hashed evenly. The other commands provide different information, such as SecureXL statistics or thread-level CPU usage, which are not specific to CoreXL instance distribution.

Answer

fw ctl multik print_instances

Answer

top -H

Answer

fwaccel stats -s

Question 2

A security administrator is deploying a new ClusterXL High Availability cluster with two members. The administrator needs to ensure that the cluster can properly synchronize state and perform failover. Which two actions are required to configure the synchronization network? (Choose two.)

Accepted Answer

Assign a dedicated interface on each member for synchronization and configure it with a unique IP address on each member.. To configure the synchronization network in a ClusterXL High Availability cluster, each member needs a dedicated interface with a unique IP address, and this network should be separate from the data network to avoid interference. Using the same IP address, enabling VRRP, or configuring a virtual IP on the sync interface are incorrect and can cause communication failures or unnecessary complexity.

Answer

Configure the synchronization interface as a cluster interface with a virtual IP address.

Answer

Enable VRRP on the synchronization interface to provide redundancy.

Answer

Configure the synchronization interface to use the same IP address on both members.

Question 3

A Security Administrator is configuring a new ClusterXL High Availability cluster with two members. The administrator wants to ensure that if the active member fails, the standby member takes over within the shortest possible time. Which ClusterXL mechanism is responsible for detecting a failure of the active member and triggering the failover?

Accepted Answer

Cluster Control Protocol (CCP) heartbeats exchanged over the synchronization network and cluster interfaces.. ClusterXL High Availability uses Cluster Control Protocol (CCP) heartbeats to monitor member health. These heartbeats are exchanged over the synchronization network and cluster interfaces, allowing the standby member to detect when the active member fails and to take over. Other protocols like VRRP, SNMP, or ICMP are not the internal failure detection mechanism for ClusterXL.

Answer

Simple Network Management Protocol (SNMP) traps generated by the active member.

Answer

Virtual Router Redundancy Protocol (VRRP) advertisements sent by the active member.

Answer

Internet Control Message Protocol (ICMP) pings sent between cluster members.

Question 4

An administrator is troubleshooting an Identity Awareness deployment where users authenticated through a Captive Portal are shown as unidentified on a different Security Gateway in the same distributed environment. The portal gateway correctly identifies the users, but the second gateway does not. Which action should the administrator take to allow the identity information to reach the second gateway?

Accepted Answer

Configure Identity Sharing on the portal gateway to share identities with the second gateway. Identity Sharing is the feature that lets one gateway publish the identities it has learned so that peer gateways can use them for policy enforcement. When users are identified at the portal gateway but unknown at another gateway, enabling and correctly scoping Identity Sharing from the acquiring gateway to the peer is the direct fix.

Answer

Enable AD Query on the second gateway and point it at the same domain controllers

Answer

Add the second gateway's internal interface to the Captive Portal configuration

Answer

Configure the second gateway as a Secondary Security Management Server

Question 5

An administrator is deploying a new R81.20 Security Gateway using the Gaia First Time Configuration Wizard. The organization requires the gateway to obtain its IP address dynamically from the corporate DHCP server, but the administrator also needs to ensure the gateway can be reached at a predictable address for management. Which configuration should the administrator select during the wizard?

Accepted Answer

Use DHCP and configure a DHCP reservation on the DHCP server for the gateway's MAC address.. The requirement is twofold: obtain an IP dynamically via DHCP and ensure the gateway remains reachable at a predictable address. A DHCP reservation on the server side achieves both by binding a specific IP to the gateway's MAC address, so the gateway still uses DHCP but always receives the same address. This is the standard method for combining dynamic configuration with stable management access.

Answer

Configure a static IP address manually on the management interface.

Answer

Configure a secondary IP address on the management interface using an alias.

Answer

Use DHCP and rely on DNS dynamic updates to resolve the gateway's hostname.

Question 6

An administrator is upgrading a Security Gateway using CPUSE. The pre-upgrade verification fails with the error 'Unsupported configuration: IPv6 is enabled on interface eth0'. What is the most appropriate action to resolve this?

Accepted Answer

Disable IPv6 on eth0 using the Gaia Portal or CLI before re-running the upgrade.. The pre-upgrade verification fails because IPv6 is enabled on eth0, which is unsupported for the upgrade. The correct resolution is to disable IPv6 on that interface using Gaia tools. This ensures the configuration meets the upgrade requirements and allows the process to proceed without errors.

Answer

Ignore the warning and proceed with the upgrade, as IPv6 is not used in the environment.

Answer

Upgrade the gateway to an intermediate version that supports IPv6 before upgrading to R81.20.

Answer

Remove the IPv6 address from eth0 but leave IPv6 enabled globally.

Question 7

A security administrator manages a two-member ClusterXL High Availability cluster running R81.10. The primary member fails and the secondary takes over. After the primary is repaired and rejoins, the administrator wants to verify which member is currently active and which is standby, and confirm that the failover completed cleanly. Which command should be run on either member to display the current cluster state and member roles?

Accepted Answer

cphaprob stat. To confirm the current ClusterXL role of each member after a failover, the administrator needs a command that reports live cluster state. cphaprob stat outputs the local member's state (Active/Standby), the cluster mode, and the identity of the active member, providing exactly the post-failover confirmation required.

Answer

cpstat ha

Answer

fw ctl pstat

Answer

cpconfig

Question 8

A security administrator is configuring Threat Prevention on a R81.20 Security Gateway. They enable Threat Emulation for incoming files and want to reduce the gateway's CPU load by having emulation performed by a dedicated appliance rather than the gateway itself. Which Check Point component should they deploy and configure to achieve this?

Accepted Answer

Threat Emulation appliance (SandBlast TE2500). The dedicated Threat Emulation appliance is designed to offload emulation from Security Gateways, reducing their CPU load. The other options either are cloud-based, do not perform emulation, or are endpoint-focused, and thus do not meet the requirement of a dedicated appliance for gateway offload.

Answer

Check Point SandBlast Agent

Answer

ThreatCloud Emulation service

Answer

Security Management Server

Question 9

A security administrator is setting up a VPN community between two Check Point Security Gateways using IKEv2. The administrator wants to ensure that the gateways authenticate each other using certificates. What must be configured on both gateways to enable certificate-based authentication?

Accepted Answer

A valid certificate from a trusted Certificate Authority. To enable certificate-based authentication in an IKEv2 VPN community, each gateway must have a valid certificate issued by a trusted Certificate Authority. The gateways exchange these certificates during IKE negotiation and verify them against the trusted CA, providing mutual authentication without relying on pre-shared secrets.

Answer

A VPN tunnel interface

Answer

A shared secret key

Answer

Pre-shared secret

Question 10

An administrator is troubleshooting a performance degradation on a Check Point Security Gateway. The administrator suspects that SecureXL is not accelerating traffic as expected. Which two actions should the administrator take to verify and potentially resolve the issue? (Choose two.)

Accepted Answer

Run 'fwaccel conns' to identify non-accelerated connections.. To verify and resolve SecureXL acceleration issues, the administrator should first confirm that SecureXL is enabled using 'fwaccel stat'. Then, using 'fwaccel conns', the administrator can identify which connections are not accelerated and why. These two actions provide the necessary information to diagnose the problem and take corrective measures, such as enabling SecureXL or adjusting policy to allow acceleration.

Answer

Disable CoreXL to force all traffic through SecureXL.

Answer

Increase the number of CoreXL instances to improve SecureXL acceleration.

Answer

Check the SecureXL templates status with 'fwaccel templates'.