Free 156-561 sample questions

Correct answer: Protecting operating systems, applications, and data traffic from advanced zero-day threats.

Under the cloud shared responsibility model, the cloud provider (AWS) is responsible for the 'security OF the cloud' (hardware, virtualization layer, physical data centers). The customer is responsible for 'security IN the cloud', which includes protecting their operating systems, applications, and network traffic. Check Point CloudGuard Network Security fulfills this customer responsibility by providing advanced threat prevention, IPS, and zero-day protection for the workloads.

Correct answer: Performing deep packet inspection and intrusion prevention on traffic entering a VPC.

CloudGuard Network Security (IaaS gateways) acts as a virtual firewall, actively intercepting and inspecting network traffic for threats using Deep Packet Inspection, IPS, and Application Control. Conversely, CloudGuard Posture Management (CSPM) evaluates cloud control plane configurations (like IAM roles, S3 bucket permissions, and compliance frameworks) via API, but does not sit in the data path to inspect live network packets. quadrantChart title CloudGuard Portfolio Focus x-axis API-Driven --> Data Path y-axis Configuration --> Threat Prevention quadrant-1 Network Security quadrant-2 Web App & API Protection quadrant-3 Posture Management (CSPM) quadrant-4 Intelligence & Threat Hunting Deep Packet Inspection: [0.8, 0.8] S3 Bucket Checks: [0.2, 0.2] Compliance Rules: [0.1, 0.3] IPS/Anti-Bot: [0.9, 0.9]

Correct answer: False

False. CloudGuard Network Security is deployed as a virtual appliance (IaaS) within the customer's cloud environment. It does not replace the physical security controls of the cloud provider (AWS, Azure, GCP). Under the shared responsibility model, the cloud provider remains strictly responsible for the physical security of the hardware, facilities, and the hypervisor itself.

Correct answer: Native NSGs operate exclusively at Layer 3 and 4, lacking the ability to perform Layer 7 application control or advanced threat extraction required by the compliance mandate.

This is the optimal answer. Native Network Security Groups (NSGs) in Azure are stateful, Layer 3/4 packet filters. They can block or allow traffic based on IP addresses, ports, and protocols, but they cannot look inside the payload to identify specific applications, nor can they perform advanced functions like Intrusion Prevention (IPS) or Zero-Day Threat Extraction (SandBlast). CloudGuard Network Security provides this required Layer 7 visibility and advanced threat prevention.

Correct answers: Deep packet inspection for malware and zero-day threats; Application Control to block specific web applications regardless of port

AWS Security Groups are stateful firewalls operating at Layer 3/4. They provide stateful inspection of TCP connections and basic IP/port filtering, but they cannot look inside the packet payload. CloudGuard Network Security adds Layer 7 visibility, allowing for deep packet inspection, malware detection, and zero-day threat prevention (SandBlast) which native security groups lack.

AWS Security Groups are stateful firewalls operating at Layer 3/4. They provide stateful inspection of TCP connections and basic IP/port filtering, but they cannot look inside the packet payload. CloudGuard Network Security adds Layer 7 visibility, allowing for deep packet inspection, malware detection, and zero-day threat prevention (SandBlast) which native security groups lack.

Correct answer: Hub-and-Spoke architecture with the CloudGuard Gateway deployed in the Hub VNet.

A Hub-and-Spoke architecture is the standard and most efficient design for East-West traffic inspection in cloud environments. The "HR" and "Finance" VNets act as spokes. Instead of peering them directly to each other (which bypasses inspection), both are peered to a central "Hub" VNet. User Defined Routes (UDRs) in the spoke VNets force inter-spoke traffic through the CloudGuard Gateway residing in the Hub, enabling full security inspection.