Free Practice Questions for Checkpoint 156-315.81 Exam

Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.

The component of SandBlast protection that her company is using on a Gateway is SandBlast Threat Extraction. SandBlast Threat Extraction is a software blade that provides protection against malicious files by removing potentially risky elements, such as macros, embedded objects, scripts, etc. The sanitized files are delivered to the users with a notification about the removed elements. SandBlast Threat Extraction can also reconstruct the original files after they are scanned by SandBlast Threat Emulation, which is another software blade that provides protection against malicious files by emulating them in a virtual sandbox and analyzing their behavior. References: R81 Threat Prevention Administration Guide, page 37.

The correct way to check if the web service is enabled, running and which port is used is to use option C. In dish, run show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode, run netstat -anp | grep httpd2 to see if the httpd2 is up1. The httpd2 service is responsible for the Gaia Web Management Interface2. If the web daemon is disabled, you can enable it by running set web daemon-enable on in dish3. If the httpd2 service is down, you can start it by running service httpd2 start in expert mode4. References: Gaia WebUI and CLI - Check Point CheckMates, Gaia R81.20 Administration Guide - Check Point Software, Gaia R81 Administration Guide - Check Point Software, How to restart Gaia Portal (WebUI) process - Check Point Software

 To optimize Rule Base efficiency, the most hit rules should be towards the top of the Rule Base. This is because the Rule Base is processed from top to bottom, and the first rule that matches the traffic is applied. Therefore, placing the most hit rules at the top reduces the number of rules that need to be checked and improves the performance of the firewall. References: R81 Security Management Administration Guide, page 97.

 To grant GAiAAPI permissions for a newly created user, you need to assign the user a permission profile in SmartConsole. A permission profile defines the access level and scope of actions that a user can perform using the GAiAAPI. You can choose from predefined permission profiles or create your own custom profiles. You cannot grant GAiAAPI permissions using dish or bash commands. References: [Check Point Security Expert R81 API Reference Guide], page 9.

The lowest gateway version supported by R81.20 management server is R77.30. According to the Check Point Release Map1, you can upgrade to R81.20 from R77.30, R80, R80.10, R80.20.M1, R80.20, R80.20SP, R80.20.M2, R80.20 3.10, R80.30, R80.30 3.10, R80.30SP, R80.40, R81 and R81.20. However, to upgrade from R77.30, R80 and R80.10, you first need to upgrade to R80.40. For more information, you can refer to the Check Point R81.20 (Titan) Release Home page2 or the Certified Security Expert (CCSE) R81.20 Course Overview3.

 In order for changes made to policy to be enforced by a Security Gateway, an administrator must perform the action of installing policy. Installing policy is the process of transferring the policy package from the Security Management Server to the Security Gateway. Publishing changes is the process of saving changes to the database and making them available to other administrators. Saving changes is the process of saving changes to a session without publishing them2. References: Check Point R81 Security Management Guide

 The action that is not supported in UserCheck objects is Reject. UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users and display messages or requests on their browsers. The supported actions in UserCheck objects are Ask, Inform, Block, and Continue. The Ask action prompts the user to confirm or cancel an action. The Inform action notifies the user about an event or a policy. The Block action prevents the user from accessing a resource or performing an action. The Continue action allows the user to access a resource or perform an action after displaying a message. References: [UserCheck]

A minimal effort upgrade is a process of upgrading the Security Gateway software without changing the configuration or policy. It is done by using the CPUSE (Check Point Update Service Engine) tool, which is available in the Gaia Portal or CLI. The CPUSE tool performs a pre-upgrade verification to check the compatibility and readiness of the system for the upgrade. If the verification passes, the CPUSE tool installs the new software package and reboots the system. During the reboot, there is a short network downtime, but it does not affect the existing connections. All connections that were initiated before the upgrade will be handled normally by the upgraded gateway. The minimal effort upgrade preserves the existing configuration and policy, so there is no need to reinstall the policy or reconfigure the gateway after the upgrade.

References:

Check Point Upgrade Path and Management Servers and Security Gateways Compatibility Maps, section “Minimal Effort Upgrade”

INSTALLATION AND UPGRADE GUIDE R81, page 21-22

https://community.checkpoint.com/t5/General-Topics/Check-Point-Inspection-points-iIoO/td-p/34938

The default order of the "fw monitor" inspection points is:

i (input): this is the first inspection point, where packets enter the firewall.

l (local): this is the second inspection point, where packets are processed locally by the firewall, before being forwarded to the next hop.

o (output): this is the third inspection point, where packets are sent out to their final destination.

O (offload): this is the fourth inspection point, where packets are offloaded to hardware acceleration for faster processing.

The component that is not required to communicate with the Web Services API is the API key. The Web Services API uses a session ID token for authentication, which is obtained by sending a login request with a valid username and password. The other components are required for sending requests and receiving responses from the Web Services API. The content-type specifies the format of the data being sent or received, such as JSON or XML. The request payload contains the data and parameters for the API call, such as command name, object name, etc. References: [Web Services API Reference Guide]

The best way to make sure that the old logs will be available after updating the Management to version R81.20 using the Advanced Upgrade Method is to use the migrate_server tool with the option ‘-l’ for the logs and ‘-x’ for the index. This option will export both logs and index files from an existing Security Management Server or Multi-Domain Server to a specified directory or file. The exported data can then be imported to a new server using a similar command with ‘-i’ option. References: [Check Point R81 Installation and Upgrade Guide]

VLAN Tag is not an attribute of packet acceleration. Packet acceleration is a feature of SecureXL that allows certain packets to bypass the Firewall kernel and be processed by a more efficient mechanism. Packet acceleration is based on templates that match packets based on four attributes: Source IP address, Destination IP address, Protocol, and Destination port. If a packet matches an existing template, it is accelerated; otherwise, it is sent to the Firewall path for inspection. References: [SecureXL Mechanism]

You will find the config.txt file in the home directory of your user account (e.g. /home/admin/)1. The save configuration config.txt command is a Clish command that saves the current Gaia configuration to a text file2. The file is stored in the home directory of the user who executed the command, and it can be accessed by using the cat or less commands in expert mode1. The file can also be transferred to another machine by using the scp or sftp commands1. The config.txt file contains the Clish commands that are needed to restore the Gaia configuration to the same state as when the file was saved2. The file can be used for backup, migration, or troubleshooting purposes2.

References: How to backup and restore Gaia configuration - Check Point Software, Gaia R81.20 Administration Guide - Check Point Software

 The best sync method in the ClusterXL deployment is to use one dedicated sync interface. This means that one interface on each cluster member is used exclusively for synchronization traffic, which improves performance and security. Using multiple clusters or sync interfaces is not recommended, as it can cause network congestion or synchronization issues. References: : Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 8.