156-315.81.20 Multiple Select — 20 Questions

Question 1

Which THREE factors can cause a ClusterXL member to transition to a 'Down' state?

Accepted Answer

The Security Gateway process (fwd) is not responding on the local member.. A member enters the 'Down' state when critical processes stop responding or connectivity is lost. Monitoring these factors is essential for HA stability. Failures in critical processes like fwd or cphad, or persistent loss of connectivity on heart-beat interfaces, directly trigger state transitions. Administrators must monitor these components carefully, as a 'Down' state triggers an automatic failover to the secondary gateway, affecting production traffic patterns during the transition period.

Answer

A temporary spike in CPU utilization exceeding 90% for two seconds.

Answer

An administrator manually initiates a policy install on a peer member.

Question 2

Which TWO of the following are benefits of using the Threat Prevention 'Recommended' profile over a custom profile?

Accepted Answer

It automatically includes the latest security best practices from Check Point.. The 'Recommended' profile is a pre-configured best-practice policy designed by Check Point security researchers. It automatically incorporates the most effective settings, balance of blades, and confidence levels. Using this profile ensures that the security posture is aligned with industry-standard best practices, reducing administrative overhead and preventing gaps in protection that often occur due to misconfigurations or the omission of critical protections during custom policy creation.

Answer

It disables all non-essential features to maximize network throughput.

Answer

It guarantees zero false positives in every network environment.

Answer

It forces all traffic to be inspected by every blade regardless of protocol.

Question 3

Which THREE parameters must be correctly configured when setting up an Active Directory Query identity source in SmartConsole? (Choose THREE)

Accepted Answer

Domain Controller IP addresses or hostnames. Configuring AD Query requires specifying the Active Directory domain name, identifying the specific Domain Controllers to poll, and assigning an account with sufficient privileges to read the Windows security event logs. These settings allow the Security Gateway to establish secure RPC connections and query logon events accurately.

Answer

LDAP Account Unit integration with write permissions

Answer

Client SSL certificate for mutual TLS authentication

Question 4

Which TWO authentication methods are natively supported by Check Point Identity Awareness for acquiring user identities without requiring a client-side agent installation? (Choose TWO)

Accepted Answer

Active Directory Query (AD Query). Active Directory Query and Captive Portal allow the Security Gateway to identify users transparently or interactively without deploying software to endpoints. AD Query reads domain controller events, while Captive Portal prompts users via a browser redirect, making both methods ideal for unmanaged devices or environments where endpoint agent deployment is restricted.

Answer

Check Point Endpoint Identity Agent

Answer

Terminal Server Identity Agent

Answer

Browser-Based Identity Agent

Question 5

Which TWO of the following are primary functions of the Threat Extraction blade in Check Point SandBlast? (Choose two)

Accepted Answer

Delivering a clean, flattened PDF version of an original document to the user immediately.. Threat Extraction provides immediate protection by proactively removing potentially malicious content from files, rather than waiting for sandbox analysis to complete. By delivering a sanitized version of the document to the user, it maintains workflow productivity. This function is vital for organizations that cannot afford the latency associated with full emulation, ensuring that business-critical documents remain accessible even if they contain active, suspicious content.

Answer

Updating the local ThreatCloud database with new malware signatures detected.

Answer

Performing full behavioral analysis on executable files to determine malicious intent.

Answer

Blocking encrypted archives that cannot be scanned for malware.

Question 6

Which TWO requirements must be met before a Security Gateway can be successfully provisioned using the Zero Touch Provisioning (ZTP) service?

Accepted Answer

The appliance must have internet access to reach the Check Point Cloud.. Zero Touch Provisioning relies on the appliance being able to reach the Check Point Cloud to fetch its configuration. This requires the device to have a serial number registered in the Zero Touch portal and a valid path to the internet, usually via DHCP on the designated management or first interface.

Answer

The administrator must manually run the 'cpconfig' command on the CLI first.

Answer

A console cable must be connected to the appliance during the boot sequence.

Answer

The Security Management Server must be in the same Layer 2 network segment.

Question 7

You are preparing to upgrade a Security Gateway from R80.40 to R81.20 using CPUSE. Before initiating the upgrade, you want to ensure a smooth process. Which TWO actions are recommended best practices? (Choose two.)

Accepted Answer

Take a system snapshot before upgrading.. Taking a system snapshot and verifying sufficient disk space are both recommended best practices before a CPUSE upgrade. A snapshot provides a rollback point, and adequate disk space ensures the upgrade package can be downloaded and installed. Disabling policies, uninstalling hotfixes, and upgrading during peak hours are not recommended and can increase risk.

Answer

Uninstall all hotfixes before upgrading.

Answer

Schedule the upgrade during peak business hours to minimize impact.

Answer

Disable all security policies before upgrading.

Question 8

An administrator is configuring Threat Extraction on a R81.20 Security Gateway. They want to ensure that files are sanitized and delivered quickly while maintaining security. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure Threat Emulation to run in the background while the sanitized file is delivered.. Threat Extraction delivers a sanitized file immediately while Threat Emulation runs in the background on the original. This combination ensures fast delivery with security. Disabling emulation or delivering the original file first compromises security, and size-based sanitization is not a recommended practice.

Answer

Disable Threat Emulation to reduce latency.

Answer

Configure Threat Extraction to only sanitize files larger than 10 MB.

Answer

Set Threat Extraction to deliver the original file and then sanitize it if malicious.

Question 9

An enterprise environment utilizes Identity Awareness with both AD Query and Browser-Based Authentication. Security administrators notice that contractor devices, which are not joined to the Active Directory domain, fail to acquire identity roles and are blocked by internal firewall rules. Which TWO methods can be implemented to correctly identify and authenticate these non-domain-joined contractor machines? (Choose TWO)

Accepted Answer

Configure identity collection using Browser-Based Authentication (Captive Portal) to prompt unauthenticated users for credentials when accessing web resources.. Non-domain-joined machines lack Active Directory credentials and cannot participate in Kerberos authentication or AD Query log scraping. Captive portal authentication intercepts HTTP traffic to present a login prompt, while Identity Agent provides transparent identification once deployed. Both mechanisms bridge the identification gap for external or unmanaged assets effectively.

Answer

Increase the AD Query polling frequency to target the local workgroups of the contractor laptops directly via WMI queries.

Answer

Configure Identity Awareness to map user identities statically based on the physical switch port numbers of the access layer switches.

Answer

Implement RADIUS Accounting synchronization with the corporate DHCP server to capture dynamic IP leases of contractor endpoints.

Question 10

A security administrator is configuring Threat Prevention profiles on a Check Point R81.20 Security Gateway. The administrator wants to ensure that the organization benefits from Check Point's recommended settings for Threat Emulation and Threat Extraction. Which two of the following are characteristics of the 'Recommended' Threat Prevention profile? (Choose two.)

Accepted Answer

It balances security and performance by using pre-tuned settings.. The Recommended profile is pre-tuned by Check Point to provide a balance of security and performance, and it is continuously updated through ThreatCloud with new protections. It does not enable all blades blindly or require manual configuration, and it does not disable Threat Extraction. These characteristics make it a convenient and effective starting point for many organizations.

Answer

It disables Threat Extraction by default to avoid user disruption.

Answer

It automatically enables all Threat Prevention blades with default settings.

Answer

It requires manual configuration of each blade's advanced settings.

Question 11

A security administrator is deploying a new ClusterXL High Availability cluster with two members. The administrator needs to ensure that the cluster can properly synchronize state and perform failover. Which two actions are required to configure the synchronization network? (Choose two.)

Accepted Answer

Assign a dedicated interface on each member for synchronization and configure it with a unique IP address on each member.. To configure the synchronization network in a ClusterXL High Availability cluster, each member needs a dedicated interface with a unique IP address, and this network should be separate from the data network to avoid interference. Using the same IP address, enabling VRRP, or configuring a virtual IP on the sync interface are incorrect and can cause communication failures or unnecessary complexity.

Answer

Configure the synchronization interface as a cluster interface with a virtual IP address.

Answer

Enable VRRP on the synchronization interface to provide redundancy.

Answer

Configure the synchronization interface to use the same IP address on both members.

Question 12

An administrator is troubleshooting a performance degradation on a Check Point Security Gateway. The administrator suspects that SecureXL is not accelerating traffic as expected. Which two actions should the administrator take to verify and potentially resolve the issue? (Choose two.)

Accepted Answer

Run 'fwaccel conns' to identify non-accelerated connections.. To verify and resolve SecureXL acceleration issues, the administrator should first confirm that SecureXL is enabled using 'fwaccel stat'. Then, using 'fwaccel conns', the administrator can identify which connections are not accelerated and why. These two actions provide the necessary information to diagnose the problem and take corrective measures, such as enabling SecureXL or adjusting policy to allow acceleration.

Answer

Disable CoreXL to force all traffic through SecureXL.

Answer

Increase the number of CoreXL instances to improve SecureXL acceleration.

Answer

Check the SecureXL templates status with 'fwaccel templates'.

Question 13

A security administrator is deploying a ClusterXL High Availability cluster and needs to ensure that the cluster will successfully synchronize kernel tables between members. Which two conditions are required for successful synchronization? (Choose two.)

Accepted Answer

The synchronization interface must be configured and reachable between members.. Successful ClusterXL synchronization requires a dedicated, reachable synchronization interface and identical software versions and hotfix levels on all members. These conditions ensure that kernel table updates can be transmitted and interpreted correctly. Hardware differences and management server placement do not affect synchronization, and not all interfaces need to be on the same broadcast domain.

Answer

The cluster members must have identical hardware specifications.

Answer

The cluster members must be connected to the same broadcast domain on all interfaces.

Answer

The management server must be a member of the cluster.

Question 14

A Check Point administrator is deploying a ClusterXL High Availability cluster with two members. The administrator wants to ensure that the cluster can properly synchronize connection tables and maintain state during failover. Which two conditions must be met for successful synchronization? (Choose two.)

Accepted Answer

Both cluster members must run the same Check Point software version and patch level.. Successful ClusterXL synchronization requires that both members run the same software version and patch level, and that a synchronization network is properly configured and reachable. Version consistency ensures that Full Sync can transfer kernel tables without compatibility issues. A dedicated sync network provides the communication path for state updates. These two conditions are essential for maintaining synchronized connection tables and ensuring seamless failover.

Answer

The cluster members must have the same number of network interfaces.

Answer

The cluster members must be configured with the same cluster ID and cluster name.

Answer

Both cluster members must have identical hardware configurations.

Question 15

An administrator is preparing to upgrade a Security Gateway from R80.40 to R81.20 using CPUSE. Before starting the upgrade, the administrator wants to ensure that the gateway meets all prerequisites. Which two actions should the administrator perform? (Choose two.)

Accepted Answer

Run the Pre-Upgrade Verifier to check for potential issues.. Before upgrading, it is essential to verify sufficient disk space and run the Pre-Upgrade Verifier. These steps help identify and mitigate potential issues, ensuring a successful upgrade. Disabling blades, uninstalling hotfixes, or changing IP addresses are not required and could introduce unnecessary risks or complications.

Answer

Disable all blade protections to prevent interference with the upgrade.

Answer

Manually uninstall all hotfixes to ensure a clean upgrade.

Answer

Change the gateway's IP address to avoid conflicts during the upgrade.

Question 16

An administrator is configuring a VPN community in a Check Point R81 environment to support multiple remote access clients using Office Mode. The administrator needs to ensure that Office Mode IP addresses are assigned correctly. Which two statements about Office Mode are true? (Choose two.)

Accepted Answer

Office Mode assigns an IP address to the remote client from a predefined pool, allowing the client to access internal resources as if it were on the local network.. Office Mode assigns a virtual IP from a pool, DHCP, or manual configuration, allowing remote clients to access internal resources. It does not require a public IP, is not for Site-to-Site VPNs, and does not automatically encrypt all traffic. The two correct statements are that it assigns an IP from a predefined pool and that allocation can be from DHCP, manual pool, or gateway-defined pool.

Answer

Office Mode is only supported for Site-to-Site VPNs and not for Remote Access VPNs.

Answer

Office Mode automatically encrypts all traffic from the client, including traffic destined for the Internet, without any configuration.

Answer

Office Mode requires the remote client to have a publicly routable IP address to establish the VPN tunnel.

Question 17

An administrator is configuring Identity Awareness on a Check Point Security Gateway using the Captive Portal method. The organization wants to ensure that users who authenticate via the portal are correctly identified and that their identities are used in security policies. Which two actions are necessary to enable this? (Choose two.)

Accepted Answer

Configure the Captive Portal to use Local Authentication or an external authentication server such as RADIUS.. Captive Portal requires an authentication method (local or external) and network access to the portal interface. These two actions enable users to authenticate and be identified. Installing endpoint agents or using AD Query/Identity Collector are not necessary for the Captive Portal method, as it is designed to work without endpoint software and uses its own authentication flow.

Answer

Configure the gateway to use the Identity Collector for real-time identity updates.

Answer

Enable AD Query to synchronize user groups from Active Directory.

Answer

Install a Check Point Identity Agent on each user workstation.

Question 18

A security administrator is configuring a Check Point R81 gateway running Threat Emulation and Threat Extraction blades. They want to ensure that files downloaded by users are inspected and, when necessary, sanitized before delivery. Which two of the following statements correctly describe the behavior of Threat Extraction? (Choose two.)

Accepted Answer

Threat Extraction removes potentially malicious content from supported file types and delivers a sanitized version to the user.. Threat Extraction sanitizes supported files by removing active content and delivers a safe version to the user. It can also reconstruct the original file if needed and if the file is clean. These two behaviors are fundamental to the blade's operation and align with the administrator's goal of inspecting and sanitizing downloads.

Answer

Threat Extraction requires a separate license and is not included with the Threat Prevention blades.

Answer

Threat Extraction only works on files transferred over HTTP and does not support SMTP or FTP.

Answer

Threat Extraction sends the original file to ThreatCloud for analysis and blocks it if malicious.

Question 19

An administrator is implementing Identity Awareness using AD Query on a Security Gateway. Before identities can be learned from Active Directory, which two actions must be performed? (Choose two.)

Accepted Answer

Configure the AD Query settings with the domain controller address and credentials. AD Query requires the gateway to connect to the domain controllers with valid credentials and to know which networks to monitor for logon events. Configuring the DC address and credentials enables the query, while listing the user subnets ensures events from those subnets are actually processed. Both are mandatory for identities to appear.

Answer

Enable the Captive Portal on the gateway's internal interface

Answer

Install an Identity Agent on each workstation

Answer

Configure a RADIUS server object for accounting

Question 20

You are preparing an R81.20 Security Gateway for an in-place upgrade using CPUSE. Corporate policy requires that you can roll back to the previous version if the upgrade fails. Which two actions must you take before starting the upgrade? (Choose two.)

Accepted Answer

Verify that the repository contains the current version package for rollback.. Rollback readiness for a CPUSE in-place upgrade depends on having a Gaia system backup and confirming that the current version package remains in the repository. The backup can restore the full previous state, while the repository package allows CPUSE to revert the installed version quickly. Together they satisfy the corporate mandate to recover from a failed R81.20 upgrade.

Answer

Export the Security Management Server database to the gateway.

Answer

Run cpstop on the gateway and leave all services stopped during the upgrade.

Answer

Disable SecureXL and CoreXL permanently before upgrading.