Free Practice Questions for Checkpoint 156-315.81 Exam

If an administrator wants to add manual NAT for addresses not owned by the Check Point firewall, they also need to add the proxy ARP configurations in a file called $FWDIR/conf/local.arp. This file contains the mappings between the IP addresses and the MAC addresses of the NATed hosts. The proxy ARP feature allows the firewall to answer ARP requests on behalf of the NATed hosts and forward the traffic to them. The local.arp file needs to be edited manually and reloaded with the command arp -f $FWDIR/conf/local.arp. References: R81 Security Management Administration Guide, page 1014.

You can disable the SecureXL mechanism temporarily for further diagnostic by running fwaccel off on the Security Gateway1. This command disables SecureXL, which is an acceleration solution that maximizes the performance of the Firewall by offloading CPU-intensive operations to the SecureXL device2. Disabling SecureXL can help you troubleshoot connectivity or policy issues, as it forces all traffic to go through the Firewall kernel and bypass the SecureXL device1. To run this command, you need to access the Security Gateway in expert mode and run fwaccel off1. To enable SecureXL again, you can run fwaccel on1. Note that disabling SecureXL may affect the performance of the Security Gateway, so use it with caution and only when necessary1.

References: How to enable/disable Check Point SecureXL via CLI - Check Point Software, SecureXL - Check Point Software

 The CLISH command to change the default Gaia WebUI Portal port number is set web ssl-port . This command will change the port that the WebUI listens on for HTTPS connections. After changing the port, you need to save the configuration with save config and verify that the change was applied with show web ssl-port. You also need to update the Main URL in the Platform Portal section of the gateway object in SmartConsole and install the policy. 

The Hit Count feature allows tracking the number of connections that each rule matches, regardless of the Track option set for the rule. When you enable Hit Count, the Security Management Server collects the data from supported Security Gateways and displays it in SmartConsole. You can use the Hit Count feature to optimize your rule base by identifying unused or rarely used rules, or rules that match too many connections. 

The correct answer is C. CPM (19009), CPMI (18190) https (443).

SmartConsole is a client application that connects to the Security Management Server to manage and configure the security policy and objects. SmartConsole uses three ports to communicate with the Security Management Server1:

CPM (19009): This port is used for the communication between the SmartConsole client and the Check Point Management (CPM) process on the Security Management Server. The CPM process handles the database operations and the policy installation.

CPMI (18190): This port is used for the communication between the SmartConsole client and the Check Point Management Interface (CPMI) process on the Security Management Server. The CPMI process handles the authentication and encryption of the SmartConsole sessions.

https (443): This port is used for the communication between the SmartConsole client and the web server on the Security Management Server. The web server provides the SmartConsole GUI and the SmartConsole extensions.

The other options are incorrect because they either include ports that are not used by SmartConsole or omit ports that are used by SmartConsole.

References:

SmartConsole R81.20 - Check Point Software1

 SmartEvent uses its event policy to identify events. The event policy can be customized by matching logs against event rules. Event rules define the conditions and actions for generating events. You can create, edit, delete, enable, or disable event rules in the SmartEvent Policy tab of the SmartConsole. References: [SmartEvent Administration Guide]

 The default port for the Gaia WebUI Portal is HTTPS 443. This is the standard port for secure web communication over SSL/TLS. Changing the port may cause inconsistency with the settings on the SmartConsole and is not recommended unless necessary. To change the port, you can use the CLISH command set web ssl-port  and save the configuration. References: 13

The process that pulls the application monitoring status from gateways is cpd1. The cpd process is responsible for the communication between the Security Management Server and the Security Gateway2. It handles tasks such as policy installation, status reporting, logging, and synchronization2. The cpd process also monitors the application status of the Security Gateway, such as CPU, memory, disk space, and processes3. The cpd process sends this information to the Security Management Server, which displays it in SmartConsole and SmartView Monitor3.

References: How to troubleshoot issues with Check Point Application Control and URL Filtering blades - Check Point Software, Processes and Daemons in Gaia OS - Check Point Software, Monitoring Device Status - Check Point Software

 The option that allows traffic to VPN gateways in specific VPN communities is Specific VPN Communities. This option lets you specify which VPN communities are allowed or denied by the rule. A VPN community is a group of VPN gateways or hosts that share the same VPN policy and keys. You can create different types of VPN communities, such as star, meshed, or remote access, depending on your network topology and security requirements. You can also use tags to group VPN gateways or hosts into logical categories. 

 Aaron should check API Server status with “api status” from Expert mode. If services are stopped, he should start them with “api start”. This is the correct way to verify and start the API Server on a Security Management Server running Gaia R81.X. The other commands are either invalid or not related to the API Server. The api command is a wrapper script that simplifies the management of the API Server. It can be used to start, stop, restart, status, enable, or disable the API Server. References: [API Server]

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_PerformanceTuning_AdminGuide/Content/Topics-PTG/CoreXL-Configuring-IPv4-and-IPv6-CoreXL-FW-instances.htm?Highlight=Configuring%20the%20Number%20of%20IPv4%20CoreXL%20Firewall%20Instances R81 https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_PerformanceTuning_AdminGuide/Topics-PTG/CoreXL-Configuring-IPv4-and-IPv6-CoreXL-FW-instances.htm cpconfig - > Enter the number of the Check Point CoreXL option. ( Enter 1 to select Change the number of firewall instances. OR Enter 2 for the option Change the number of IPv6 firewall instances.) -> Enter the total number of IPv4 (IPv6) CoreXL Firewall instances you wish the Security Gateway to run. Follow the instructions on the screen. -> Exit from the cpconfig menu. - Reboot the Security Gateway.

 The correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI is mgmt_cli add host name "emailserver1" ip-address 10.50.23.90. The name and ip-address parameters are required and must be enclosed in double quotes. The other options are missing the double quotes or have incorrect parameter names1. References: 1: Check Point Software, Getting Started, Adding a Host.

The minimum open server hardware requirements for a Security Management Server/Standalone in R81 are:

CPU: Intel Core i5-4590 or equivalent (4 cores)

Memory: 8 GB RAM

Disk space: 500 GB

The other options do not match the minimum requirements. Option A has insufficient CPU cores, memory and disk space. Option B has excessive CPU cores and disk space. Option D has excessive CPU cores, memory and disk space.

References: Check Point R81 Release Notes, page 6

Which firewall daemon is responsible for the FW CLI commands? The firewall daemon that is responsible for the FW CLI commands is fwd. This daemon handles the communication between the firewall kernel and the user space processes, such as SmartConsole, SmartView Tracker, etc. The FW CLI commands are used to control and monitor various aspects of the firewall, such as connections, policy installation, logs, NAT, etc. The FW CLI commands are executed with the prefix fw, such as fw stat, fw tab, fw monitor, etc. References: R81 Command Line Interface Reference Guide, page 13.