156-215.81.20 sample questions

Question 1

A security administrator is configuring a new Check Point R81.20 Security Gateway. They have enabled the Identity Awareness blade and need to integrate it with the company's Active Directory for transparent user identification. Which feature should be configured to allow the gateway to associate IP addresses with user identities by reading security event logs from the Domain Controllers?

Accepted Answer

AD Query

Answer

Captive Portal

Answer

Identity Agent

Answer

RADIUS Accounting

Question 2

A junior administrator at a financial firm is tasked with creating a backup of the Security Management Server. They are unsure of the difference between creating a 'snapshot' and a 'backup' via the Gaia WebUI. Which statement accurately describes the primary distinction between these two options?

Accepted Answer

A snapshot is a full system image including OS and hotfixes, while a backup only contains the Check Point configuration.

Answer

A backup can only be performed via the CLI, while a snapshot can only be created from the WebUI.

Answer

A snapshot is stored externally on a TFTP/SCP server, whereas a backup is stored locally on the management server's disk.

Answer

A backup includes firewall logs, while a snapshot excludes them to save space.

Question 3

During a security audit, you are reviewing the NAT policy on an R81.20 Security Gateway. You find the following two manual NAT rules:

Rule 1: Original Source: `Internal_Users`, Original Destination: `Any`, Original Service: `HTTPS` -> Translated Source: `GW_External_IP` (Hide)
Rule 2: Original Source: `Web_Server_Internal`, Original Destination: `Any`, Original Service: `Any` -> Translated Source: `Web_Server_Public` (Static)

If a user from the `Internal_Users` group attempts to access an external website via HTTPS, which NAT rule will be applied and why?

Accepted Answer

Rule 1 will be applied because it is more specific based on the service (HTTPS).

Answer

Rule 2 will be applied because Static NAT has a higher priority than Hide NAT.

Answer

Neither rule will be applied; Automatic NAT will be used instead.

Answer

The connection will be dropped because the rules are conflicting.

Question 4

A new Inline Layer named 'Critical_Apps_Layer' has been added to the main security policy. This layer contains rules specific to financial applications. If a packet matches a rule in the main policy layer that is positioned before the inline layer, the packet will bypass the rules within 'Critical_Apps_Layer'.

Accepted Answer

False

Answer

True

Question 5

A systems administrator is troubleshooting a Secure Internal Communication (SIC) issue between a newly deployed Security Gateway and the Security Management Server (SMS). The `cpconfig` menu on the gateway shows that SIC is 'Initialized, but Trust is not established'. The administrator has confirmed network connectivity and correct routing between the two components on port 18191. What are the MOST likely next steps to resolve this issue? (Select TWO)

Accepted Answer

On the gateway, run `sic_reset` and re-enter the activation key.

Accepted Answer

In SmartConsole, reset the communication for the gateway object and establish a new activation key.

Answer

Reboot the Security Management Server.

Answer

Run `fw unloadlocal` on the Security Gateway.

Answer

Verify that NTP is synchronized between the gateway and SMS.

Question 6

The command `fw ctl zdebug drop` is used on a Security Gateway to view real-time packet drops. An administrator runs this command and sees drops related to 'rule 0'. What does 'rule 0' signify in the context of the Check Point firewall policy?

Accepted Answer

The default implicit drop rule (Cleanup Rule).

Answer

The first user-defined rule in the policy.

Answer

A rule that has been disabled by an administrator.

Answer

An anti-spoofing violation.

Question 7

A network security engineer is configuring HTTPS Inspection to decrypt and inspect SSL/TLS traffic. After enabling the feature, users report receiving certificate warnings in their browsers when accessing HTTPS sites. Which of the following is the most critical step the engineer missed during the configuration?

Accepted Answer

Distributing the Security Gateway's CA certificate to client browsers.

Answer

Enabling the Application Control blade.

Answer

Creating a rule in the Threat Prevention policy.

Answer

Configuring a static NAT rule for the web traffic.

Question 8

To upgrade a Security Gateway using the Check Point Upgrade Service Engine (CPUSE) from the Gaia command line, which command should be used to view available packages, including the recommended Jumbo Hotfix Accumulator?

Accepted Answer

show installer available-packages

Answer

show installer packages

Answer

installer view

Answer

cpuse -l

Question 9

A security architect is designing a policy for a large enterprise using R81.20's new Policy Layer capabilities. The goal is to have a baseline security policy for the entire organization, with specific, stricter policies for the PCI and Development environments that can be managed by different teams. The PCI policy must take precedence over the baseline. Which policy structure best achieves this?
```mermaid
graph TD
subgraph "Policy Package"
A["Baseline Layer"]
B["PCI Ordered Layer"]
C["Dev Ordered Layer"]
D["Final Cleanup Rule"]
end
B --> A
C --> A
A --> D
```

Accepted Answer

Use Ordered Layers for PCI and Development, placed above a main layer containing the baseline policy.

Answer

Create a single flat policy with sections for PCI and Development.

Answer

Use Inline Layers for PCI and Development inside the main policy layer.

Answer

Create two separate Policy Packages, one for PCI and one for the rest of the organization.

Question 10

**Case Study:**

A retail company, 'StyleStream', is deploying a new e-commerce platform. The architecture consists of web servers in a DMZ and database servers in a secure internal zone. The Security Management Server (SMS) and Security Gateway are both running R81.20.

The lead security administrator has defined the following requirements:
1. All administrative changes to the security policy must be reviewed and approved by a senior manager before they can be published and installed. This is a strict compliance requirement.
2. The web servers in the DMZ must be accessible from the internet on port 443 (HTTPS). These servers must initiate connections to the database servers on port 1433 (MSSQL).
3. No other traffic should be allowed from the DMZ to the internal database zone.
4. Administrators should authenticate to SmartConsole using their corporate Active Directory credentials via SAML 2.0.

To meet these requirements, the administrator needs to configure several key features. Which Check Point feature directly addresses the first requirement for mandatory change review and approval?

Accepted Answer

SmartWorkflow with Session Approval

Answer

Administrator Roles and Permissions

Answer

Policy Installation History and Auditing

Answer

SAML 2.0 Integration

Top vendors

Top exams

Free 156-215.81.20 sample questions

A junior administrator at a financial firm is tasked with creating a backup of the Security Management Server. They are unsure of the difference between creating a 'snapshot' and a 'backup' via the Gaia WebUI. Which statement accurately describes the primary distinction between these two options?

The command `fw ctl zdebug drop` is used on a Security Gateway to view real-time packet drops. An administrator runs this command and sees drops related to 'rule 0'. What does 'rule 0' signify in the context of the Check Point firewall policy?

To upgrade a Security Gateway using the Check Point Upgrade Service Engine (CPUSE) from the Gaia command line, which command should be used to view available packages, including the recommended Jumbo Hotfix Accumulator?

10 more free samples are waiting