CheckPoint 156-315.81 Practice Exam Questions & Answers

Explanation

You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines anInspectorBypassaction for the file types.The Inspect action means that the file will be sent to the Threat Emulation engine for analysis, and the Bypass action means that the file will not be sent and will be allowed or blocked based on other Threat Prevention blades1. The other options are not valid actions for file types in Threat Prevention profiles. Reference:Check Point R81 Threat Prevention Administration Guide

Explanation

The correct upgrade method for upgrading from R80.40 to R81.20 without any downtime is the Multi-Version Cluster Upgrade (MVC). MVC is a new feature in R80.40 that replaces the deprecated Connectivity Upgrade (CU). MVC allows you to upgrade cluster members to a newer version without losing connectivity and test the new version on some of the cluster members before you decide to upgrade the rest of the cluster members. MVC synchronizes connections between cluster members that run different versions and ensures that the cluster remains operational during the upgrade process. MVC is intended only to test the current configuration in the newer version and not to change the security policy and install it on cluster members with different software versions. MVC is disabled by default and can be enabled on each cluster member individually. MVC has some limitations, such as not supporting VSX clusters, IPS blade, or SecureXL acceleration.

Multi-Version Cluster (MVC) replaces Connectivity Upgrade (CU) in R80.40

Multi-Version Cluster (MVC) Upgrade

Configuring the Multi-Version Cluster Mechanism

Explanation

Captive Portal is one of the authentication methods used for Identity Awareness, which is a feature of Check Point that enables you to identify users and apply security policy rules based on their identity. Captive Portal redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity.

The references are:

Machine Authentication & Identity Awareness - Check Point CheckMates

Check Point Certified Security Expert R81.20, slide 13

Check Point R81 Identity Awareness Administration Guide, page 9

Explanation

SandBlast appliances can be deployed in the following modes:

C) Inline/prevent or detect

SandBlast appliances can be deployed in an inline mode where they actively inspect and prevent or detect malicious traffic. In this mode, the appliance sits in the network traffic path and can take actions to block or detect threats in real-time.

Explanation

In R81, more than one administrator can login to the Security Management Server with write permission at the same time. This feature is enabled by default and allows concurrent administration of the security policy. Every administrator works in a session that is independent of the other administrators. Changes made by one administrator are not visible to others until they are published. Administrators can also lock objects to prevent others from editing them until they are unlocked. Reference:R81 Security Management Administration Guide, page 43.

Explanation

Dynamic Balancing is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load. It dynamically changes the split between CoreXL SNDs and CoreXL Firewalls and does not require a reboot or cause an outage. It monitors the system and makes changes as needed to optimize the performance of the Security Gateway. It is supported on Check Point Appliances with R80.40 and higher versions. Reference:Dynamic Balancing for CoreXL - Check Point Software,Dynamic Balancing available on R80.40 - Check Point CheckMates,CLI R81.20 Reference Guide - Check Point Software,Performance Tuning R81.20 Administration Guide - Check Point Software

Explanation In Clish and Web GUI, you acquire a write lock to make configuration changes using specific commands. The correct answer identifies which command is NOT valid for acquiring the lock. The command 'set rbac rw = 1' is not a recognized lock acquisition method in Check Point systems. Valid lock commands include 'lock database override' and 'lock database' in Clish. Understanding proper lock acquisition is essential for administrators managing gateway configurations and preventing conflicts when multiple users access the system simultaneously.