Checkpoint 156-315.81 - Check Point Certified Security Expert R81.20

The verified answer is D. 1. Enable Mobile Access blade on the Security Gateway object and complete the wizard 2. Configure Mobile Access parameters in Security Gateway object 3. Add a rule in the Access Control Policy and install policy 4. Connect to the Mobile Access Portal

The basic configuration steps for the Check Point Mobile Access VPN blade are as follows1:

Enable Mobile Access blade on the Security Gateway object and complete the wizard: This step activates the Mobile Access blade on the selected gateway and guides you through the initial configuration, such as defining the portal name, the certificate, and the authentication methods.

Configure Mobile Access parameters in Security Gateway object: This step allows you to customize the Mobile Access settings, such as defining the supported applications, the access roles, the client settings, and the advanced options.

Add a rule in the Access Control Policy and install policy: This step creates a rule that allows the traffic from the Mobile Access portal to the protected resources and installs the policy on the gateway.

Connect to the Mobile Access Portal: This step verifies that the Mobile Access portal is accessible and functional from a web browser or a mobile device.

The other options are incorrect because they do not follow the correct order or include the necessary steps.

References:

Mobile Access Administration Guide R81 - Check Point Software1

 SDF (Sticky Decision Function) and Flush and ACK are the two correction mechanisms that are available with ClusterXL under R81.20. According to the ClusterXL R81.20 Administration Guide1, correction mechanisms are methods that ClusterXL uses to prevent or recover from out-of-state situations, which occur when different Cluster Members have different information about the connections that they handle1. ClusterXL supports two types of correction mechanisms: SDF and Flush and ACK1.

SDF (Sticky Decision Function) is a mechanism that ensures that packets of the same connection are always handled by the same Cluster Member, regardless of the load balancing algorithm. SDF uses a hash table that maps each connection to a specific Cluster Member, based on the 5-tuple of source IP, destination IP, source port, destination port, and protocol. SDF prevents out-of-state situations by avoiding the switch of Cluster Members for existing connections1.

Flush and ACK is a mechanism that synchronizes the connection tables of different Cluster Members when an out-of-state situation is detected. Flush and ACK works as follows:

When a Cluster Member receives a packet that belongs to an unknown connection, it sends a Flush message to all other Cluster Members, asking them to delete the connection from their tables.

When a Cluster Member receives a Flush message, it checks if it has the connection in its table. If it does, it deletes the connection and sends an ACK message to the sender of the Flush message, indicating that it has performed the deletion.

When a Cluster Member receives an ACK message, it creates a new connection entry in its table for the packet that triggered the Flush message, and processes the packet normally.

If a Cluster Member does not receive any ACK message within a timeout period, it assumes that no other Cluster Member has the connection, and creates a new connection entry in its table for the packet that triggered the Flush message1.

References: : ClusterXL R81.20 Administration Guide

The correct order of a log flow processed by SmartEvent components is: Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client. The Firewall generates logs for traffic and security events. The Log Server receives and stores the logs from the Firewall. The Correlation Unit analyzes the logs and generates SmartEvent events based on predefined or custom rules. The SmartEvent Server Database stores the events generated by the Correlation Unit. The SmartEvent Client displays the events and reports from the SmartEvent Server Database. References: : Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 12; : Check Point Software, Training & Certification, SmartEvent Introduction.

 cp.macro is an electronically signed file used by Check Point to translate the features in the license into a code. It is located in the $FWDIR/conf directory on the Security Management Server. The cp.macro file contains a list of features and their corresponding codes, which are used to generate the license file (.lic) based on the contract file (.xml). The license file (.lic) is then installed on the Security Gateway or Security Management Server to activate the licensed features. References: Check Point R81 Licensing and Contract Administration Guide, page 10

 Resource is not an objects category in SmartConsole. Objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories, such as Network Object, Host, Gateway, Service, Time Object, Custom Application / Site, Limit, and Group. A resource is a type of object that represents an application or content that is accessible through HTTP or HTTPS protocols. A resource can be used to define access rules for users who connect through Identity Awareness or Mobile Access blades.

 The Check Point WatchDog daemon (cpwd) invokes and monitors critical processes and attempts to restart them if they fail. The cpwd daemon is responsible for starting processes such as cpd, cpm, fwm, fwd, and others. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The cpm daemon is the Check Point Management Server daemon that handles database operations and policy installation. The fwm daemon is the Firewall Management daemon that handles communication between Security Gateways and Security Management Servers. References: : Check Point Software, Getting Started, WatchDog Daemon; : Check Point Software, Getting Started, Processes.

 SecureXL uses templates to accelerate the connection rate by creating a connection entry in the SecureXL Connections Table without notifying the Firewall kernel for a predefined period of time1. This reduces the load on the Firewall kernel and improves the performance of new connections1. SecureXL uses five attributes to identify a connection and create a template: source address, destination address, source port, destination port, and protocol2. These attributes form a unique 5-tuple that defines a connection2.

References: : ATRG: SecureXL for R80.20 and higher : Performance Tuning Administration Guide R80

This VPN routing option uses VPN routing for every connection a satellite gateway handles, regardless of the destination. This means that all traffic from the satellite gateway will go through the VPN tunnel to the center gateway, and then be routed to the appropriate destination, whether it is another satellite, the Internet, or another VPN target. This option provides the highest level of security and control, but also consumes more bandwidth and processing power.

 In the R81 SmartConsole, Permissions and Administrators are defined on the Manage and Settings tab. The Manage and Settings tab allows administrators to configure various settings and options for the SmartConsole, such as global properties, network objects, services, users and user groups, permissions, licenses, certificates, etc. To define Permissions and Administrators, the administrator can go to the Manage and Settings tab and select Permissions and Administrators from the left pane. This will open a window where the administrator can create, edit, or delete administrators and roles, assign permissions and access profiles, enable multi-domain support, etc.

The other options are incorrect because:

The Security Policies tab allows administrators to create, edit, or delete security policies for different blades, such as Access Control, Threat Prevention, Identity Awareness, Mobile Access, etc. It also allows administrators to install policies on selected gateways or servers.

The Logs and Monitor tab allows administrators to view, filter, analyze, or export logs and reports for different blades, such as Access Control, Threat Prevention, Identity Awareness, Mobile Access, etc. It also allows administrators to monitor the status and performance of gateways and servers.

The Gateways and Servers tab allows administrators to add, edit, or delete gateways and servers that are managed by the Security Management Server or the Multi-Domain Security Management Server. It also allows administrators to view the details and configuration of each gateway or server.

Threat Prevention has three out-of-the-box profiles: Basic, Optimized, and Strict. These profiles define the default actions for different threat prevention blades, such as Anti-Virus, Anti-Bot, IPS, etc. You cannot change the settings of these profiles, but you can clone them and create new profiles with customized settings. References: Training & Certification | Check Point Software, CCSE section

According to the Check Point R81.20 documentation, the central deployment feature allows you to install up to 10 packages simultaneously on multiple gateways1.

References1: Check Point R81.20 Administration Guide, page 35.

 The correct command for checking the Deployment Agent status over the GAIA CLISH is “show installer status”. This command displays information about the Deployment Agent such as its version, status, last update time, and last operation result. The other commands are either invalid or irrelevant for this purpose. References: [Check Point Security Expert R81 Installation and Upgrade Guide], page 23.

 The command to add users to or from existing roles is add rba user roles . This command allows you to assign one or more roles to a user in the Gaia database. Roles are collections of permissions that define what actions a user can perform on the system. You can use predefined roles or create your own custom roles. To remove a role from a user, you can use the command delete rba user roles . 

The Log “Views” tab shows the details of a selected log when SmartEvent is correlating events. You can select a log from the Logs tab and click on the Views tab to see more information about the log, such as source, destination, service, action, blade, rule number, etc. You can also customize the columns and filters in the Views tab to display only the relevant fields for your analysis. References: [SmartEvent User Guide]

 If a “ping”-packet is dropped by FW1 Policy, you will see this packet in “fw monitor” on one inspection point only: “i”. The “i” inspection point represents the inbound traffic before any rule processing. Since the packet is dropped by FW1 Policy, it will not pass through any other inspection points, such as “l” (after rule processing), “o” (outbound before rule processing), or “O” (outbound after rule processing). References: : Check Point Software, Getting Started, fw monitor.