Updated 156-215.81 Questions For Check Point Certified Security Administrator R81 Certification

NEW QUESTION 1
Fill in the blanks: Default port numbers for an LDAP server is ________ for standard connections and _______ SSL connections.

• A. 675, 389
• B. 389, 636
• C. 636, 290
• D. 290, 675

Answer: B

Explanation:
A client starts an LDAP session by connecting to an LDAP server, called a Directory System Agent (DSA), by default on TCP and UDP port 389, or on port 636 for LDAPS. Global Catalog is available by default on ports 3268, and 3269 for LDAPS.

NEW QUESTION 2
Which tool is used to enable cluster membership on a Gateway?

• A. SmartUpdate
• B. cpconfig
• C. SmartConsole
• D. sysconfig

Answer: B

Explanation:
References:

NEW QUESTION 3
When a Security Gateway sends its logs to an IP address other than its own, which deployment option is installed?

• A. Distributed
• B. Standalone
• C. Bridge Mode
• D. Targeted

Answer: A

NEW QUESTION 4
Which SmartConsole application shows correlated logs and aggregated data to provide an overview of potential threats and attack patterns?

• A. SmartEvent
• B. SmartView Tracker
• C. SmartLog
• D. SmartView Monitor

Answer: A

Explanation:
https://www.checkpoint.com/downloads/products/smartevent-datasheet.pdf

NEW QUESTION 5
What is the BEST method to deploy Identity Awareness for roaming users?

• A. Use Office Mode
• B. Use identity agents
• C. Share user identities between gateways
• D. Use captive portal

Answer: B

Explanation:
Using Endpoint Identity Agents give you:

NEW QUESTION 6
Session unique identifiers are passed to the web api using which http header option?

• A. X-chkp-sid
• B. Accept-Charset
• C. Proxy-Authorization
• D. Application

Answer: C

NEW QUESTION 7
When connected to the Check Point R80 Management Server using the SmartConsole the first administrator to connect has a lock on:

• A. Only the objects being modified in the Management Database and other administrators can connect to make changes using a special session as long as they all connect from the same LAN network.
• B. The entire Management Database and other administrators can connect to make changes only if the first administrator switches to Read-only.
• C. The entire Management Database and all sessions and other administrators can connect only as Read-only.
• D. Only the objects being modified in his session of the Management Database and other administrators can connect to make changes using different sessions.

Answer: D

NEW QUESTION 8
What is the purpose of Captive Portal?

• A. It manages user permission in SmartConsole
• B. It provides remote access to SmartConsole
• C. It authenticates users, allowing them access to the Internet and corporate resources
• D. It authenticates users, allowing them access to the Gaia OS

Answer: C

Explanation:
Captive Portal is a simple method that authenticates users with a web interface. When users try to access a protected web resource, they enter authentication information in a form that shows in their web browser. https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_IdentityAwareness_AdminG

NEW QUESTION 9
What is the best sync method in the ClusterXL deployment?

• A. Use 1 cluster + 1st sync
• B. Use 1 dedicated sync interface
• C. Use 3 clusters + 1st sync + 2nd sync + 3rd sync
• D. Use 2 clusters + 1st sync + 2nd sync

Answer: B

NEW QUESTION 10
You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don’t have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

• A. fw ctl multik dynamic_dispatching on
• B. fw ctl multik dynamic_dispatching set_mode 9
• C. fw ctl multik set_mode 9
• D. fw ctl miltik pq enable

Answer: C

NEW QUESTION 11
A network administrator has informed you that they have identified a malicious host on the network, and instructed you to block it. Corporate policy dictates that firewall policy changes cannot be made at this time. What tool can you use to block this traffic?

• A. Anti-Bot protection
• B. Anti-Malware protection
• C. Policy-based routing
• D. Suspicious Activity Monitoring (SAM) rules

Answer: D

Explanation:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGu

NEW QUESTION 12
To quickly review when Threat Prevention signatures were last updated, which Threat Tool would an administrator use?

• A. Protections
• B. IPS Protections
• C. Profiles
• D. ThreatWiki

Answer: B

NEW QUESTION 13
A stateful inspection firewall works by registering connection data and compiling this information. Where is the information stored?

• A. In the system SMEM memory pool.
• B. In State tables.
• C. In the Sessions table.
• D. In a CSV file on the firewall hard drive located in $FWDIR/conf/.

Answer: B

Explanation:
The information stored in the state tables provides cumulative data that can be used to evaluate future connections......
https://www.checkpoint.com/cyber-hub/network-security/what-is-firewall/what-is-a-stateful-firewall/

NEW QUESTION 14
When changes are made to a Rule base, it is important to _______ to enforce changes.

• A. Publish database
• B. Activate policy
• C. Install policy
• D. Save changes

Answer: C

NEW QUESTION 15
Which is a suitable command to check whether Drop Templates are activated or not?

• A. fw ctl get int activate_drop_templates
• B. fwaccel stat
• C. fwaccel stats
• D. fw ctl templates –d

Answer: B

NEW QUESTION 16
What Identity Agent allows packet tagging and computer authentication?

• A. Endpoint Security Client
• B. Full Agent
• C. Light Agent
• D. System Agent

Answer: B

Explanation:
Identity Agent Description Full
Default Identity AgentClosed that includes packet tagging and computer authentication. It applies to all users on the computer on which it is installed.
Administrator permissions are required to use the Full Identity Agent type. For the Full Identity Agent, you can enforce IP spoofing protection. In addition, you can leverage computer authentication if you specify computers in Access Roles.
Light
Default Identity Agent that does not include packet tagging and computer authentication. You can install this Identity Agent individually for each user on the target computer. Light Identity Agent type does not require Administrator permissions.
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_IdentityAwareness_AdminGuide/T

NEW QUESTION 17
......