オンライン156-315.81テストブレーン問題集とテストエンジン [Q169-Q188]

オンライン156-315.81テストブレーン問題集とテストエンジン

リアルCheckPoint 156-315.81試験問題集には正解634問題と解答があります

質問 # 169
You have successfully backed up Check Point configurations without the OS information. What command would you use to restore this backup?

A. import backup
B. cp_merge
C. restore_backup
D. migrate import

正解：D

解説：
The command migrate import can be used to restore a backup of Check Point configurations without the OS information. This command imports the configuration from a file that was created using the migrate export command, which backs up only the Check Point configuration and not the OS settings. The other commands are either not valid or not suitable for restoring a backup without the OS information. References:
Check Point R81 Installation and Upgrade Guide

質問 # 170
An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server. While configuring the VPN community to specify the pre-shared secret the administrator found that the check box to enable pre-shared secret and cannot be enabled.
Why does it not allow him to specify the pre-shared secret?

A. IPsec VPN blade should be enabled on both Security Gateway.
B. Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS.
C. Pre-shared can only be used while creating a VPN between a third party vendor and Check Point Security Gateway.
D. The Security Gateways are pre-R75.40.

正解：B

解説：
When two Security Gateways are managed by the same Security Management Server, they use certificate based authentication to establish a VPN tunnel. This is because the Security Management Server acts as an internal certificate authority (ICA) that can issue and revoke certificates for the Security Gateways. The Security Management Server also maintains a trust relationship with the Security Gateways, which is based on a one-time password (OTP) that is used to initialize secure internal communication (SIC). Therefore, there is no need to use a pre-shared secret for authentication between two Security Gateways managed by the same SMS.

質問 # 171
You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet. However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet. How can you fix this?

A. On the firewall object, Legacy Authentication screen, check 'Enable Identity Captive Portal'.
B. On the Security Management Server object, check the box 'Identity Logging'.
C. In the Captive Portal screen of Global Properties, check 'Enable Identity Captive Portal'.
D. Right click Accept in the rule, select "More", and then check 'Enable Identity Captive Portal'.

正解：D

解説：
The correct way to enable Identity Captive Portal for a specific rule is to right click Accept in the rule, select "More", and then check 'Enable Identity Captive Portal'. This will allow guest users to see the splash page and accept the Terms of Service before accessing the Internet. Identity Captive Portal is a feature that enables identity awareness for guest users who are not authenticated by other methods, such as Active Directory or Identity Agent. Identity Captive Portal can be enabled globally or per rule, depending on the security policy requirements.

質問 # 172
Gaia has two default user accounts that cannot be deleted. What are those user accounts?

A. Admin and Default
B. Control and Monitor
C. Admin and Monitor
D. Expert and Clish

正解：C

解説：
Gaia has two default user accounts that cannot be deleted: Admin and Monitor. Admin is a superuser account that has full access to all Gaia features and commands. Monitor is a read-only account that can view Gaia configuration and status but cannot make any changes. Both accounts have predefined passwords that can be changed by the Admin user. References: [Check Point R81 Gaia Administration Guide], page 29 SRC: GAIA R81.20 Administration Guide User Management -> Users These users are created by default and cannot be deleted: admin and monitor

質問 # 173
What scenario indicates that SecureXL is enabled?

A. Only one packet in a stream is seen in a fw monitor packet capture
B. Dynamic objects are available in the Object Explorer
C. fwaccel commands can be used in clish
D. SecureXL can be disabled in cpconfig

正解：C

解説：
SecureXL is a technology that accelerates the performance of the Check Point Security Gateway by offloading CPU-intensive operations from the Firewall kernel to the SecureXL device. SecureXL can handle various types of traffic, such as TCP, UDP, ICMP, non-IP, VPN, NAT, etc. SecureXL can also work with various features, such as CoreXL, ClusterXL, QoS, etc.
One way to indicate that SecureXL is enabled is to use the fwaccel commands in clish. Clish is a command-line shell that provides a user-friendly interface for configuring and managing Check Point products. The fwaccel commands are used to control and monitor SecureXL operations, such as enabling or disabling SecureXL, viewing SecureXL statistics, managing SecureXL templates, etc. For example, the command fwaccel stat shows the status of SecureXL, such as whether it is on or off, how many packets are accelerated or not accelerated, etc.
The other options are not valid indicators of SecureXL being enabled:
A) Dynamic objects are available in the Object Explorer: Dynamic objects are objects that represent IP addresses that change over time, such as VPN clients, DHCP clients, etc. Dynamic objects are available in the Object Explorer regardless of whether SecureXL is enabled or not.
B) SecureXL can be disabled in cpconfig: Cpconfig is a command-line tool that allows you to configure various settings of Check Point products, such as administrator password, GUI clients, SNMP extension, etc. SecureXL can be disabled in cpconfig only if it was enabled before. Therefore, this option does not indicate that SecureXL is enabled.
D) Only one packet in a stream is seen in a fw monitor packet capture: Fw monitor is a command-line tool that allows you to capture and analyze network traffic passing through the Security Gateway. Fw monitor shows the traffic at different inspection points in the Firewall kernel. If SecureXL is enabled, some packets may be accelerated by SecureXL and bypass the Firewall kernel inspection. Therefore, fw monitor may not see all packets in a stream. However, this does not mean that only one packet in a stream will be seen by fw monitor. Some packets may still go through the Firewall kernel inspection and be seen by fw monitor. Therefore, this option does not indicate that SecureXL is enabled.
Therefore, the correct answer is C.

質問 # 174
What is the biggest benefit of policy layers?

A. To break one policy into several virtual policies
B. They improve the performance on OS kernel version 3.0
C. Policy Layers and Sub-Policies enable flexible control over the security policy
D. To include Threat Prevention as a sub policy for the firewall policy

正解：C

解説：
The biggest benefit of policy layers is that they enable flexible control over the security policy. Policy layers and sub-policies allow administrators to break one policy into several virtual policies, each with its own set of rules and actions. Policy layers can be ordered, shared, and reused across different policies. Policy layers can also include Threat Prevention as a sub-policy for the firewall policy. References: [Check Point R81 Security Management Guide]

質問 # 175
Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.
Which component of SandBlast protection is her company using on a Gateway?

A. SandBlast Threat Extraction
B. SandBlast Threat Emulation
C. Check Point Protect
D. SandBlast Agent

正解：A

解説：
Explanation
Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.
The component of SandBlast protection that her company is using on a Gateway is SandBlast Threat Extraction. SandBlast Threat Extraction is a software blade that provides protection against malicious files by removing potentially risky elements, such as macros, embedded objects, scripts, etc. The sanitized files are delivered to the users with a notification about the removed elements. SandBlast Threat Extraction can also reconstruct the original files after they are scanned by SandBlast Threat Emulation, which is another software blade that provides protection against malicious files by emulating them in a virtual sandbox and analyzing their behavior. References: R81 Threat Prevention Administration Guide, page 37.

質問 # 176
D18912E1457D5D1DDCBD40AB3BF70D5D
The system administrator of a company is trying to find out why acceleration is not working for the traffic.
The traffic is allowed according to the rule based and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

A. The connection is destined for a server within the network
B. The connection required a Security server
C. The packets are not multicast
D. The packet is the second in an established TCP connection

正解：B

解説：
The most likely reason that the traffic is not accelerated is that the connection required a Security server. A Security server is a Check Point mechanism that inspects traffic that cannot be directly handled by the kernel.
For example, traffic that requires content inspection, such as HTTP, FTP, SMTP, or VPN-1 SecuRemote
/SecureClient. When a connection requires a Security server, it cannot be accelerated by SecureXL, which is a technology that offloads the processing of security operations from the CPU to improve performance. The other options are not relevant for acceleration. References: : Check Point Software, Getting Started, SecureXL; : Check Point Software, Getting Started, Security Servers.

質問 # 177
What are the services used for Cluster Synchronization?

A. No service needed when using Broadcast Mode
B. 8116/UDP for Full Sync and Delta Sync
C. 256H-CP tor Full Sync and 8116/UDP for Delta Sync
D. TCP/256 for Full Sync and Delta Sync

正解：D

質問 # 178
Which command would you use to set the network interfaces' affinity in Manual mode?

A. sim affinity -l
B. sim affinity -m
C. sim affinity -a
D. sim affinity -s

正解：D

解説：
The command that would be used to set the network interfaces' affinity in Manual mode is sim affinity -s. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. Core affinity is a feature that binds network interfaces and SecureXL instances to specific CPU cores, which improves the performance and load balancing of the Security Gateway. Sim affinity -s sets the network interfaces' affinity in Manual mode, which means that administrators can manually assign network interfaces to CPU cores. The other options are either invalid or perform different functions.

質問 # 179
To fully enable Dynamic Dispatcher on a Security Gateway:

A. run fw ctl multik set_mode 9 in Expert mode and then Reboot.
B. run fw multik set_mode 1 in Expert mode and then reboot.
C. Using cpconfig, update the Dynamic Dispatcher value to "full" under the CoreXL menu.
D. Edit/proc/interrupts to include multik set_mode 1 at the bottom of the file, save, and reboot.

正解：A

解説：
To fully enable Dynamic Dispatcher on a Security Gateway, you need to run the following command in Expert mode then reboot:

This command sets the multi-core mode to 9, which means that Dynamic Dispatcher is enabled without Firewall Priority Queues. Dynamic Dispatcher is a feature that optimizes the performance of Security Gateways with multiple CPU cores by dynamically allocating traffic to different cores based on their load and priority. Dynamic Dispatcher can improve the throughput and scalability of the Security Gateway, especially for traffic that is not accelerated by SecureXL. The other commands are not valid or do not enable Dynamic Dispatcher. References: R81 Performance Tuning Administration Guide

質問 # 180
One of major features in R81 SmartConsole is concurrent administration.
Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?

A. AdminA and AdminB are editing the same rule at the same time.
B. AdminA, AdminB and AdminC are editing three different rules at the same time.
C. A lock icon next to a rule informs that any Administrator is working on this particular rule.
D. A lock icon shows that a rule or an object is locked and will be available.

正解：A

解説：
Explanation
One of the major features in R81 SmartConsole is concurrent administration. This feature allows multiple administrators to work on the same Security Policy simultaneously, without blocking each other or creating conflicts. Concurrent administration improves the efficiency and productivity of security management operations1.
However, not all of the options given are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. The correct answer is B. AdminA and AdminB are editing the same rule at the same time. This is not possible because concurrent administration uses a locking mechanism to prevent multiple administrators from modifying the same rule or object at the same time. When an administrator clicks on a rule or an object, it becomes locked and a lock icon appears next to it. The lock icon shows the name of the administrator who is working on that rule or object, and prevents other administrators from editing it until it is unlocked12.
Therefore, the other options are possible considering that AdminA, AdminB and AdminC are editing the same Security Policy. Option A is possible because a lock icon shows that a rule or an object is locked and will be available when the administrator who locked it finishes working on it or logs out of SmartConsole12. Option C is possible because a lock icon next to a rule informs that any administrator is working on this particular rule, and hovering over the lock icon will show the name of that administrator12. Option D is possible because AdminA, AdminB and AdminC are editing three different rules at the same time, which does not create any conflicts or blockages12.

質問 # 181
The Security Gateway is installed on GAIA R81. The default port for the Web User Interface is ______ .

A. TCP 257
B. TCP 4433
C. TCP 443
D. TCP 18211

正解：C

質問 # 182
Which command shows only the table names of all kernel tables?

A. fw tab -n
B. fw tab -s
C. fw tab -k
D. fwtab-t

正解：D

質問 # 183
John detected high load on sync interface. Which is most recommended solution?

A. For FTP connections - do not sync
B. For short connections like http service - do not sync
C. For short connections like icmp service - delay sync for 2 seconds
D. Add a second interface to handle sync traffic

正解：A

解説：
The most recommended solution for high load on sync interface is to exclude FTP connections from synchronization. This is because FTP connections are usually long-lived and consume a lot of bandwidth and resources on the sync interface. By excluding FTP connections from synchronization, the load on the sync interface can be reduced and the performance of the cluster can be improved. References: Synchronization Optimization

質問 # 184
The customer has about 150 remote access user with a Windows laptops. Not more than 50 Clients will be connected at the same time. The customer want to use multiple VPN Gateways as entry point and a personal firewall. What will be the best license for him?

A. He will need Capsule Connect using MEP (multiple entry points).
B. He will need Harmony Endpoint because of the personal firewall.
C. Because the customer uses only Windows clients SecuRemote will be sufficient and no additional license is needed
D. Mobile Access license because he needs only a 50 user license, license count is per concurrent user.

正解：B

解説：
Harmony Endpoint is a solution that provides comprehensive protection for endpoint devices against cyber threats. Harmony Endpoint includes a personal firewall that controls the network traffic to and from the endpoint device, based on predefined rules and policies. Harmony Endpoint also integrates with Check Point's VPN solutions to provide secure remote access to corporate resources1. Therefore, the customer will need Harmony Endpoint because of the personal firewall requirement.

質問 # 185
With Mobile Access enabled, administrators select the web-based and native applications that can be accessed by remote users and define the actions that users can perform the applications. Mobile Access encrypts all traffic using:

A. HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender.
B. HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, no additional software is required.
C. HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, no additional software is required.
D. HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, they need to install the SSL Network Extender.

正解：A

解説：
Mobile Access encrypts all traffic using HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL Network Extender, which is a lightweight VPN client that creates a secure SSL tunnel to the Mobile Access gateway.
The SSL Network Extender supports various types of native applications, such as email clients, file sharing, and remote desktop. References: Mobile Access Administration Guide, SSL Network Extender

質問 # 186
What are types of Check Point APIs available currently as part of R81.10 code?

A. OSE API, OPSEC SDK API, Threat Extraction API and Policy Editor API
B. CPMI API, Management API, Threat Prevention API and Identity Awareness Web Services API
C. Management API, Threat Prevention API, Identity Awareness Web Services API and OPSEC SDK API
D. Security Gateway API Management API, Threat Prevention API and Identity Awareness Web Services API

正解：C

質問 # 187
Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port. Which CLISH commands are required to be able to change this TCP port?