Pass the Checkpoint CCSE R81 156-315.81 Questions and answers with ValidTests

 The recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days is to install Management and SmartEvent on different machines. This is because SmartLog and SmartEvent use different databases and storage methods, and having them on separate machines allows for better performance and scalability. References: [SmartLog Administration Guide]

The WebUI can be used to manage user accounts and assign privileges to users. It can also add users to your Gaia system and edit the home directory of the user. However, it cannot assign user rights to their home directory in the Security Management Server1. References: Check Point Resource Library, page 3.

https://community.checkpoint.com/t5/General-Topics/Check-Point-Inspection-points-iIoO/td-p/34938

The default order of the "fw monitor" inspection points is:

i (input): this is the first inspection point, where packets enter the firewall.

l (local): this is the second inspection point, where packets are processed locally by the firewall, before being forwarded to the next hop.

o (output): this is the third inspection point, where packets are sent out to their final destination.

O (offload): this is the fourth inspection point, where packets are offloaded to hardware acceleration for faster processing.

The valid authentication methods for mutual authenticating the VPN gateways are Pre-shared Secret and PKI Certificates. Pre-shared Secret is a method that uses a secret key that is known only to the two VPN gateways. PKI Certificates is a method that uses digital certificates that are issued by a trusted Certificate Authority (CA) and contain the public key of each VPN gateway. Both methods ensure that the VPN gateways can verify each other’s identity before establishing a secure VPN tunnel. References: [Check Point R81 VPN Administration Guide]

 There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A’s interface issues were resolved and it became operational.

When it re-joins the cluster, it will not become active automatically, since ‘maintain current active cluster member’ option on the cluster object properties is enabled by default. This option prevents a failback to the original active member after a failover, unless the current active member fails or is manually switched over. This option provides stability and avoids unnecessary failovers. References: R77 ClusterXL Administration Guide, page 23.

 When users connect to the Mobile Access portal they are unable to open File Shares.

The log file that you would want to examine is cvpnd.elg. This log file contains information about the Mobile Access VPN daemon, which handles the connections from the Mobile Access portal to the internal resources, such as File Shares, Web Applications, etc. The log file is located in the directory $FWDIR/log/ on the Security Gateway. You can use the command fw log -f cvpnd.elg to view the log file in real time. References: R81 Mobile Access Administration Guide, page 255.

 Gaia can be configured using the command line interface (CLI) or the WebUI. The CLI is a text-based interface that allows users to enter commands and view responses in a terminal window. The CLI can be accessed through a console connection, an SSH connection, or a Telnet connection. The WebUI is a graphical interface that allows users to configure Gaia settings through a web browser. The WebUI can be accessed by entering the IP address of the Gaia device in the browser’s address bar.

The mechanism that can ensure that the Security Gateway can communicate with the Management Server with ease in situations with overwhelmed network resources is called Management Data Plane Separation (MDPS)1. MDPS is a feature that allows a Security Gateway to have isolated Management and Data networks. The network system of each domain (plane) is independent and includes interfaces, routes, sockets, and processes. The Management Plane is a domain that accesses, provisions, and monitors the Security Gateway. The Data Plane is a domain that handles all other traffic1. MDPS has the following benefits2:

It improves the performance and stability of the Security Gateway by separating the management traffic from the data traffic.

It enhances the security of the Security Gateway by preventing any packet from crossing between the planes.

It simplifies the network configuration and troubleshooting by having separate routing tables for each plane. MDPS is supported on Check Point Appliances with R80.40 and higher versions1. It is also supported on Quantum Maestro and Quantum Scalable Chassis with R81.20 and higher versions3. MDPS can be configured using Gaia Clish commands or Gaia Portal1. References: Management Data Plane Separation (MDPS) - Check Point Software, Tip of the Week: Management Data Plane Separation - Check Point CheckMates, Management Data Plane Separation (MDPS) on Maestro R81.20 - Check Point Software

The verified answer is D. 1. Enable Mobile Access blade on the Security Gateway object and complete the wizard 2. Configure Mobile Access parameters in Security Gateway object 3. Add a rule in the Access Control Policy and install policy 4. Connect to the Mobile Access Portal

The basic configuration steps for the Check Point Mobile Access VPN blade are as follows1:

Enable Mobile Access blade on the Security Gateway object and complete the wizard: This step activates the Mobile Access blade on the selected gateway and guides you through the initial configuration, such as defining the portal name, the certificate, and the authentication methods.

Configure Mobile Access parameters in Security Gateway object: This step allows you to customize the Mobile Access settings, such as defining the supported applications, the access roles, the client settings, and the advanced options.

Add a rule in the Access Control Policy and install policy: This step creates a rule that allows the traffic from the Mobile Access portal to the protected resources and installs the policy on the gateway.

Connect to the Mobile Access Portal: This step verifies that the Mobile Access portal is accessible and functional from a web browser or a mobile device.

The other options are incorrect because they do not follow the correct order or include the necessary steps.

References:

Mobile Access Administration Guide R81 - Check Point Software1

 The solution that multi-queue is intended to provide is to improve the efficiency of CoreXL Kernel Instances. Multi-queue is a feature that allows each CoreXL Kernel Instance to process traffic from multiple interfaces, instead of being bound to a single interface. This improves the load balancing and performance of the Security Gateway, especially when there are high traffic volumes or asymmetric routing1. References: 1: Check Point Software, Getting Started, Multi-Queue.

The command “ps aux | grep twd” is used to check the process ID and the processing time of the twd process on the Security Gateway. The ps command displays information about the active processes on the system. The aux option shows all processes for all users, including those without a controlling terminal. The grep command filters the output of the ps command by searching for the pattern “twd”, which is the name of the process that handles VPN traffic encryption and decryption1. The output of the command shows the process ID, CPU usage, memory usage, start time, and other details of the twd process2. Therefore, the correct answer is A.

References: 1: [Check Point Processes and Daemons] 2: [How to troubleshoot VPN issues with cpview utility]

The back end database for Check Point R81 Management uses PostgreSQL, which is an open source relational database management system2. MongoDB, MySQL, and DBMS are not used by Check Point R81 Management. References: 2: Check Point Software, Getting Started, Database.

When configuring Terminal Servers with Identity Awareness, you must configure the same password as a shared secret in both the Terminal Servers Identity Agent on the application server that hosts the Terminal/Citrix services and on the Identity Awareness Gateway. This shared secret enables secure communication and allows the Security Gateway to trust the application server with the Terminal Servers functionality1.

References:

Check Point Software - Configuring Terminal Servers

Check Point Identity Awareness Clients Admin Guide

Check Point Troubleshooting Expert - R81 (CCTE) Reference Materials

Check Point Certified Troubleshooting Expert R81.20 - CCTE

Check Point CCTE Certification Sample Questions and Practice Exam

Check Point Management uses MongoDB as its back-end database. MongoDB is a NoSQL database that offers high performance, high availability, and easy scalability, which are essential for managing the complex and dynamic nature of network security configurations and logs.

 To verify the CPUSE agent build, you can use either of these methods:

In WebUI Status and Actions page

By running the following command in CLISH: show installer status build The CPUSE agent build indicates the version of the CPUSE agent that is installed on the machine. The CPUSE agent is responsible for downloading, verifying, installing, and removing packages on Gaia OS. It is recommended to keep the CPUSE agent up-to-date to ensure a smooth installation and upgrade process. References: [CPUSE Agent]