Free Practice Questions for Checkpoint 156-215.81 Exam

Address translation rules are used to map an IP address space into another by modifying network address information in the IP header of packets. Address translation rules have two elements: original packet and translated packet6. The original packet is the packet before it undergoes address translation, and the translated packet is the packet after it undergoes address translation. The original packet and the translated packet may have different source and destination IP addresses, depending on the type and direction of address translation. 

A Distinguished Name (DN) is a unique identifier for an entry in an LDAP directory. A DN consists of a sequence of relative distinguished names (RDNs) separated by commas. Each RDN is composed of an attribute type and an attribute value, such as cn=John Smith or ou=Sales. A DN can have different components depending on the structure and schema of the LDAP directory, but some common components are: Common Name (cn), Country ©, Organizational Unit (ou), Organization (o), State or Province (st), and Locality (l). User container is not a component of a DN3. References: Check Point R81 Identity Awareness Administration Guide

Check Point provides an Automatic Licensing and Verification tool that ensures licenses are properly validated. This tool:

Automatically checks current licenses against Check Point's online license repository.

Activates newly added licenses.

Ensures compliance with active contracts.

Option B (incorrect): "Verification licensing" is not an official Check Point feature.

Option C (incorrect): "Verification tool" is too generic and does not refer to Check Point’s licensing system.

Option D (incorrect): "Automatic licensing" does not fully describe the verification and activation process.

Thus, the correct answer is A. Automatic Licensing and Verification tool.

The Security Management Server and the Security Gateway are the components that can store logs in the Check Point Security Management Architecture. The Security Management Server stores logs in a database and can also forward them to external log servers. The Security Gateway can store logs locally in a buffer or a local log file, and can also send them to the Security Management Server or a log server.

References: Check Point Security Management Administration Guide R81, p. 11-12

This answer is correct because the vpn tu command is used for VPN tunnel management and shows detailed information about VPN tunnels, such as the tunnel ID, peer IP, encryption domain, and status1. This command will bring up a menu for you to choose from, such as list all IPsec SAs, delete all IPsec SAs, or delete IPsec SA for given peer1.

The other answers are not correct because they either show different information or do not exist as commands. The cat $FWDlR/conf/vpn.conf command shows the VPN configuration file, which contains the VPN domains, communities, and encryption settings2. The vpn tu tlist command does not exist, but it might be confused with the vpn tunnelutil tlist command, which shows the tunnel utilization statistics3. The cpview command shows the Check Point real-time performance monitoring tool, which displays various system and network parameters, such as CPU, memory, disk, interfaces, and VPN4.

How to use the “vpn tu” command for VPN tunnel management

New VPN daemons in R81.10 / R81.20 - Check Point CheckMates

Remote Access VPN R81.20 Administration Guide - Check Point Software

Remote Access VPN R81 Administration Guide - Check Point Software

The GAiA Portal is the WebUI for Check Point security appliances. By default, it uses the HTTPS protocol for secure communication. The default port for HTTPS-based web access is port 443.

Port 4434 (A) is not the default port for GAiA Portal.

Port 80 (B) is the default for standard HTTP, but GAiA Portal requires HTTPS.

Port 8080 (C) is sometimes used for alternative web services, but not for GAiA Portal.

Port 443 (D) is the correct default port for GAiA Portal access.

Thus, the correct answer is D. 443.

In Check Point’s Security Management Architecture, logs can be stored on the Security Management Server and Security Gateway.

Security Management Server stores logs when configured to do so.

Security Gateways can store logs locally, but they are often forwarded to a Security Management Server or a dedicated Log Server.

Option B (Incorrect): SmartConsole is only a management interface and does not store logs.

Option C (Incorrect): SmartConsole does not store logs.

Option D (Incorrect): Logs are not exclusively stored on the Security Management Server—they can also be stored on the Security Gateway.

Thus, the correct answer is A. Security Management Server and Security Gateway.

 The answer is A because changing the Security Gateway IP-address requires re-establishing the trust with the Security Management Server by initializing the Secure Internal Communication (SIC). Changing the Security Gateway name in command line or changing the Security Management Server name or IP-address in SmartConsole does not require re-establishing the trust, but it may require updating the topology and pushing the policy.References: [Check Point R81 Security Management Administration Guide], [Check Point R81 Security Gateway Administration Guide]

The type of Endpoint Identity Agent that includes packet tagging and computer authentication is Full. The Full Identity Agent is a client-side software that provides full identity awareness features, such as user authentication, computer authentication, packet tagging, identity caching, and identity sharing. The other types of Endpoint Identity Agents are Custom, Complete, and Light, which have different features and capabilities. 

Central licensing is the preferred licensing model because it ties the package license to the IP-address of the Security Management Server and has no dependency on the gateway. This allows for easier management and distribution of licenses across multiple gateways1.

References: 1: Check Point R81 Security Management Administration Guide, page 14.