Pass the Checkpoint CCSE R81 156-315.81 Questions and answers with CertsForce

The Hit Count feature allows tracking the number of connections that each rule matches, regardless of the Track option set for the rule. When you enable Hit Count, the Security Management Server collects the data from supported Security Gateways and displays it in SmartConsole. You can use the Hit Count feature to optimize your rule base by identifying unused or rarely used rules, or rules that match too many connections. 

 DLP and Geo Policy are examples of Shared Policies. Shared Policies are policies that can be applied to multiple gateways or clusters, regardless of their Access Control policy. Shared Policies allow administrators to manage common security settings across different gateways or clusters, such as Data Loss Prevention, Geo Protection, Threat Prevention, HTTPS Inspection, etc. References: R81 Security Management Administration Guide, page 31.

https://community.checkpoint.com/t5/General-Topics/Check-Point-Inspection-points-iIoO/td-p/34938

The default order of the "fw monitor" inspection points is:

i (input): this is the first inspection point, where packets enter the firewall.

l (local): this is the second inspection point, where packets are processed locally by the firewall, before being forwarded to the next hop.

o (output): this is the third inspection point, where packets are sent out to their final destination.

O (offload): this is the fourth inspection point, where packets are offloaded to hardware acceleration for faster processing.

The Check Point history feature in R81 provides the following functions:

View install changes: This function allows you to view the changes that were made in each policy installation, such as added, modified, or deleted rules, objects, settings, etc. You can also compare the changes between different policy installations and filter them by various criteria.

Install specific version: This function allows you to install a specific version of the policy from the history, which can be useful for reverting to a previous policy or testing different policies. You can also view the changes that will be applied by installing a specific version before installing it. References: R81 Security Management Administration Guide, page 85.

 Updatable Objects are a Threat Cloud Service that provides network objects that represent external services, such as Office 365, AWS, GEO locations, and more. These objects are updated automatically by Check Point and do not require policy installation for the changes to take effect. Dynamic Objects are created and maintained locally by the administrator and can be used to define temporary or changing network objects, such as IP addresses, ports, or ranges. Dynamic Objects also do not require policy installation for the changes to take effect. References: Updatable Objects, Updateable Objects and NAT, R80.20 Updatable Domain Objects and CLI Commands.

 Backward Compatibility means that the Management Server is able to manage older Gateways. The lowest supported version is documented in the Release Notes of each version. The Installation and Upgrade Guide only provides information about how to install or upgrade the Management Server and the Gateways, not about the compatibility between them. References: Check Point R81 Release Notes, page 6.

 The CPU load on a Secure Network Distributor (SND) indicates how much processing power is available for distributing traffic among cluster members. If the CPU load is high, it means that the SND is overloaded and cannot handle more traffic efficiently. A good indicator of SND overload is when the Idle CPU percentage is less than 20%. In this case, you may need to add another SND to balance the load or optimize your cluster configuration. References: Getting Started - Check Point Software, section “Monitoring ClusterXL Status”

 In Advanced Permanent Tunnel Configuration, the life_sign_timeout parameter sets the amount of time the tunnel test runs without a response before the peer host is declared ‘down’. The life_sign_polling_interval parameter sets the interval between each tunnel test packet sent to the peer host.

The best way to test if the policy from two weeks ago have the same issue is to install the specific version of the policy from the installation history view of the gateway. This way, you can keep the changes from the last weeks in the management server and revert back to them later if needed. You do not need to take a backup or a snapshot of the gateway or the management server for this purpose. References: [Check Point Security Expert R81 Administration Guide], page 34.

The state of the Management HA when both members have different policies/databases is Collision. This state indicates that there is a conflict between the members and they need to be synchronized manually. The other states are not applicable in this scenario. The Synchronized state indicates that both members have identical policies/databases and are ready for failover. The Never been synchronized state indicates that the members have never been synchronized since they were configured as HA pair. The Lagging state indicates that one member has a newer policy/database than the other member and needs to be synchronized automatically. References: [Management High Availability]

https://sc1.checkpoint.com/documents/R77/CP_R77_SecurityManagement_WebAdminGuide/

html_frameset.htm?topic=documents/R77/CP_R77_SecurityManagement_WebAdminGuide/98838

The command tcpdump is not an internal/native Check Point command. It is a common command-line tool that captures and analyzes network traffic. The other commands are internal/native Check Point commands that perform various functions. For example:

fwaccel on enables SecureXL acceleration on the Security Gateway.

fw ctl debug sets the debug flags for the Firewall kernel module.

cphaprob displays the status and information about ClusterXL or VRRP members.

References: Check Point R81 CLI Reference Guide, pages 11, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27; Check Point R81 Gaia Administration Guide, page 9

An Endpoint Identity Agent is a software component that runs on the user’s device and communicates with the Check Point gateway to provide user identity information. An Endpoint Identity Agent can use different methods for user authentication, such as username/password, Kerberos ticket, or certificate. However, the most common and recommended method is username/password or Kerberos ticket, which allows the user to log in to the device with their domain credentials and automatically authenticate with the gateway without entering additional credentials. This method also supports Single Sign-On (SSO) and Multi-Factor Authentication (MFA) features.

The references are:

Check Point R81 Identity Awareness Administration Guide, page 15

Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 14

Endpoint Identity Agent - Check Point CheckMates

 The Check Point WatchDog daemon (cpwd) invokes and monitors critical processes and attempts to restart them if they fail. The cpwd daemon is responsible for starting processes such as cpd, cpm, fwm, fwd, and others. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The cpm daemon is the Check Point Management Server daemon that handles database operations and policy installation. The fwm daemon is the Firewall Management daemon that handles communication between Security Gateways and Security Management Servers. References: : Check Point Software, Getting Started, WatchDog Daemon; : Check Point Software, Getting Started, Processes.

You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.

The first step to run management API commands on GAIA’s shell is mgmt_login. This command allows you to login to the management server and obtain a session ID, which is required for running other management API commands. You can also specify the user name and password as parameters, or enter them interactively. The session ID is stored in the file $CPDIR/tmp/.api_session by default, unless you specify a different file name. References: R81 Management API Reference Guide, page 15.

 A Policy Package is a set of rules and settings that define how a Security Gateway enforces security on traffic that passes through it. A Policy Package can be created on either the Management Server or the Security Gateway, but it must be installed on both to take effect. When a new Policy Package is created on the Management Server, it must be installed on an existing Security Gateway that has a different Policy Package installed. The message below warns the administrator that installing a new Policy Package will overwrite the existing one on the Security Gateway.

https://www.bing.com/images/blob?bcid=qMoRhR0dzSkGmg

The message also advises the administrator to back up their existing configuration before proceeding with the installation.