CheckPoint 156-215.81 - Questions & Answers

One of the major features in R80.x SmartConsole is concurrent administration, which allows multiple administrators to work on the same Security Policy at the same time. However, only one administrator can edit a rule at a time. If AdminA and AdminB are editing the same rule at the same time, it will cause a conflict and prevent them from saving their changes. Therefore, the correct answer is B. AdminA and AdminB are editing the same rule at the same time.

Identity Awareness uses several methods for acquiring identity, such as Active Directory Query, Identity Agent, Browser-Based Authentication, Terminal Servers, Captive Portal, and RADIUS. Cloud IdP (Identity Provider) is not a method used by Identity Awareness. Therefore, the correct answer is B. Cloud IdP (Identity Provider).

When tunnel test packets no longer invoke a response, SmartView Monitor displays Down for the given VPN tunnel. This means that the VPN tunnel is not operational and there is no IKE or IPsec traffic passing through it. No Response, Inactive, and Failed are not valid statuses for VPN tunnels in SmartView Monitor.
References:
Smart View Monitor displays status for all S2S VPN tunnels - Phase UP

UserCheck is not an identity source used for Identity Awareness. UserCheck is a feature that allows you to interact with users when they trigger Data Loss Prevention or Threat Prevention incidents. Identity Awareness uses different methods to acquire identities, such as AD Query, Identity Agent, Browser-Based Authentication, Terminal Servers, Captive Portal, and RADIUS3 . Therefore, the correct answer is B.
UserCheck.

A Check Point software license consists of a Software blade and a Software container. A Software blade is a modular security feature that delivers security functionality to the gateway or management server. A Software container is a set of Software blades that can be purchased as a bundle.
References:
: Check Point R81 Security Management Administration Guide, page 14.

The type of NAT that is a one-to-one relationship where each host is translated to a unique address is Static NAT. Static NAT maps an unregistered IP address to a registered IP address on a one-to-one basis.
This means that for each internal host, there is a corresponding external address that represents it.
Therefore, the correct answer is B

To achieve the requirement of giving the Network Operations Center administrator access to Check Point Security devices mostly for troubleshooting purposes, but not to the expert mode, and still allowing her to run tcpdump, you need to: Add tcpdump to CLISH using add command. This command adds a new command to the Command Line Interface Shell (CLISH) that allows running tcpdump without entering the expert mode . Create a new access role. This option defines a set of permissions and commands that can be assigned to a user or a group of users. Add tcpdump to the role. This option grants the permission to run tcpdump to the role.
Create new user with any UID and assign role to the user. This option creates a new user account with any User ID (UID) and assigns the role that has tcpdump permission to the user.
References:
[How to add a new command to CLISH], [Check Point R81 Gaia Administration Guide], [Check Point R81 Identity Awareness Administration Guide]

Check Point technologies that deny or permit network traffic are packet filtering, stateful inspection, and application layer firewall, p. 15-16. Packet filtering is a basic firewall technique that examines packets based on their source and destination addresses and ports, p. 13. Stateful inspection is an advanced firewall technique that tracks the state and context of network connections and inspects packets based on their content and sequence p. 13. Application layer firewall is a firewall technique that operates at the application layer of the OSI model and inspects packets based on their application protocols and data, p.
14. , 156-315.81 Checkpoint Exam Info and Free Practice Test

It is possible to have more than one administrator connected to a Security Management Server at once, but objects edited by one administrator will be locked for editing by others until the session is published.
This feature is called concurrent administration and it allows multiple administrators to work on the same security policy at the same time. However, when one administrator edits an object, such as a gateway, a rule, or a network, that object is locked for other administrators until the change is published or discarded.
The lock icon shows which objects are being edited by other administrators and prevents conflicts or overwrites.
References:
[Concurrent Administration], [SmartConsole Overview]

In a Distributed deployment, the Security Gateway and the Security Management software are installed on different computers or appliances. This allows for better scalability and performance.
References:
Check Point Security Management Administration Guide R81