156-215.80 Study Guides 2021

NEW QUESTION 1
While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?

• A. Security Gateways is not part of the Domain
• B. SmartConsole machine is not part of the domain
• C. SMS is not part of the domain
• D. Identity Awareness is not enabled on Global properties

Answer: B

Explanation: To enable Identity Awareness:
Log in to SmartDashboard.
From the Network Objects tree, expand the Check Poinbtranch.
Double-click the Security Gateway on which to enable Identity Awareness.
In the Software Blades section, select Identity Awarenesosn the Network Security tab. The Identity Awareness Configuration wizard opens.
Select one or more options. These options set the methods for acquiring identities of managed and unmanaged assets.
AD Query - Lets the Security Gateway seamlessly identify Active Directory users and computers.
Browser-Based Authentication - Sends users to a Web page to acquire identities from unidentified users. If Transparent Kerberos Authentication is configured, AD users may be identified transparently.
Terminal Servers - Identify users in a Terminal Server environment (originating from one IP address).
See Choosing Identity Sources.
Note - When you enable Browser-Based Authentication on a Security Gateway that is on an IP Series appliance, make sure to set the Voyager management application port to a port other than 443 or 80.
Click Next.
The Integration With Active Directory window opens.
When SmartDashboard is part of the domain, SmartDashboard suggests this domain automatically. If you select this domain, the system creates an LDAP Account Unit with alolf the domain controllers in the organization's Active Directory.

NEW QUESTION 2
Which set of objects have an Authentication tab?

• A. Templates, Users
• B. Users, Networks
• C. Users, User Group
• D. Networks, Hosts

Answer: A

NEW QUESTION 3
A Cleanup rule:

• A. logs connections that would otherwise be dropped without logging by default.
• B. drops packets without logging connections that would otherwise be dropped and logged by default.
• C. logs connections that would otherwise be accepted without logging by default.
• D. drops packets without logging connections that would otherwise be accepted and logged by default.

Answer: A

NEW QUESTION 4
SandBlast has several functional components that work together to ensure that attacks are prevented in real-time. Which the following is NOT part of the SandBlast component?

• A. Threat Emulation
• B. Mobile Access
• C. Mail Transfer Agent
• D. Threat Cloud

Answer: C

NEW QUESTION 5
Which Check Point feature enables application scanning and the detection?

• A. Application Dictionary
• B. AppWiki
• C. Application Library
• D. CPApp

Answer: B

Explanation: AppWiki Application Classification Library
AppWiki enables application scanning and detection of more than 5,000 distinct applications and over 300,000 Web 2.0 widgets including instant messaging, social networking, video streaming, VoIP, games and more.

NEW QUESTION 6
What key is used to save the current CPView page in a filename format cpview_"cpview process ID".cap"number of captures"?

• A. S
• B. W
• C. C
• D. Space bar

Answer: B

NEW QUESTION 7
To enforce the Security Policy correctly, a Security Gateway requires:

• A. a routing table
• B. awareness of the network topology
• C. a Demilitarized Zone
• D. a Security Policy install

Answer: B

Explanation: The network topology represents the internal network (both the LAN and the DMZ) protected by the gateway. The gateway must be aware of the layout of the network topology to:
Correctly enforce the Security Policy.
Ensure the validity of IP addresses for inbound and outbound traffic.
Configure a special domain for Virtual Private Networks.

NEW QUESTION 8
While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the correct order of steps needed to set up the block?
1) Select Active Mode tab in SmartView Tracker.
2) Select Tools > Block Intruder.
3) Select Log Viewing tab in SmartView Tracker.
4) Set Blocking Timeout value to 60 minutes.
5) Highlight connection that should be blocked.

• A. 1, 2, 5, 4
• B. 3, 2, 5, 4
• C. 1, 5, 2, 4
• D. 3, 5, 2, 4

Answer: C

NEW QUESTION 9
Fill in the blank: An LDAP server holds one or more ______.

• A. Server Units
• B. Administrator Units
• C. Account Units
• D. Account Server

Answer: C

NEW QUESTION 10
An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.
Which of the following is the BEST Explanation: for this behavior?

• A. The setting Log does not capture this level of detail for GR
• B. Set the rule tracking action to Audit since certain types of traffic can only be tracked this way.
• C. The log unification process is using a LUUID (Log Unification Unique Identification) that has become corrup
• D. Because it is encrypted, the R77 Security Gateway cannot distinguish between GRE session
• E. This is a known issue with GR
• F. Use IPSEC instead of the non-standard GRE protocol for encapsulation.
• G. The Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracke
• H. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.
• I. The Log Server is failing to log GRE traffic properly because it is VPN traffi
• J. Disable all VPN configuration to the partner site to enable proper logging.

Answer: C

NEW QUESTION 11
Which option would allow you to make a backup copy of the OS and Check Point configuration, without stopping Check Point processes?

• A. All options stop Check Point processes
• B. backup
• C. migrate export
• D. snapshot

Answer: D

NEW QUESTION 12
What SmartEvent component creates events?

• A. Consolidation Policy
• B. Correlation Unit
• C. SmartEvent Policy
• D. SmartEvent GUI

Answer: B

NEW QUESTION 13
Fill in the blank: The R80 feature _____ permits blocking specific IP addresses for a specified time period.

• A. Block Port Overflow
• B. Local Interface Spoofing
• C. Suspicious Activity Monitoring
• D. Adaptive Threat Prevention

Answer: C

Explanation: Suspicious Activity Rules Solution
Suspicious Activity Rules is a utility integrated into SmartView Monitor that is used to modify access privileges upon detection of any suspicious network activity (for example, several attempts to gain unauthorized access).
The detection of suspicious activity is based on the creation of Suspicious Activity rules. Suspicious Activity rules are Firewall rules that enable the system administrator to instantly block suspicious connections that are not restricted by the currently enforced security policy. These rules, once set (usually with an expiration date), can be applied immediately without the need to perform an Install Policy operation

NEW QUESTION 14
Which two of these Check Point Protocols are used by ?

• A. ELA and CPD
• B. FWD and LEA
• C. FWD and CPLOG
• D. ELA and CPLOG

Answer: B

NEW QUESTION 15
Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via
e-m ail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links. Which component of SandBlast protection is her company using on a Gateway?

• A. SandBlast Threat Emulation
• B. SandBlast Agent
• C. Check Point Protect
• D. SandBlast Threat Extraction

Answer: D

NEW QUESTION 16
What action can be performed from SmartUpdate R77?

• A. upgrade_export
• B. fw stat -1
• C. cpinfo
• D. remote_uninstall_verifier

Answer: C

NEW QUESTION 17
A client has created a new Gateway object that will be managed at a remote location. When the client attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install On check box. What should you look for?

• A. Secure Internal Communications (SIC) not configured for the object.
• B. A Gateway object created using the Check Point > Externally Managed VPN Gateway option from the Network Objects dialog box.
• C. Anti-spoofing not configured on the interfaces on the Gateway object.
• D. A Gateway object created using the Check Point > Secure Gateway option in the network objects, dialog box, but still needs to configure the interfaces for the Security Gateway object.

Answer: B