あなたを合格させるCheck Point Certified Security Expert 156-315.81試験問題集で2024年11月24日には628問あります
156-315.81無料試験学習ガイド！（更新された628問あります)
CheckPoint 156-315.81 試験は、Check Pointセキュリティテクノロジーにおける専門知識を検証したいITプロフェッショナルやセキュリティエキスパートにとって、厳しいが報酬の高い認定試験です。この試験に合格することは、CCSE認定を取得するための要件であり、ネットワークセキュリティ分野でのキャリアアップに役立つことがあります。
質問 # 285
What is the purpose of Captive Portal?
- A. It manages user permission in SmartConsole
- B. It provides remote access to SmartConsole
- C. It authenticates users, allowing them access to the Internet and corporate resources
- D. It authenticates users, allowing them access to the Gaia OS
正解：C
解説：
Captive Portal is a feature of Identity Awareness Software Blade that enables you to identify users who are not authenticated by other methods, such as Active Directory or VPN. Captive Portal redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity.
The references are:
Check Point R81 Identity Awareness Administration Guide, page 9
Configuring Browser-Based Authentication in SmartConsole
質問 # 286
True or False: In R81, more than one administrator can login to the Security Management Server with write permission at the same time.
- A. True, every administrator works in a session that is independent of the other administrators.
- B. True, every administrator works on a different database that is independent of the other administrators.
- C. False, this feature has to be enabled in the Global Properties.
- D. False, only one administrator can login with write permission.
正解：A
解説：
Explanation
In R81, more than one administrator can login to the Security Management Server with write permission at the same time. This feature is enabled by default and allows concurrent administration of the security policy.
Every administrator works in a session that is independent of the other administrators. Changes made by one administrator are not visible to others until they are published. Administrators can also lock objects to prevent others from editing them until they are unlocked. References: R81 Security Management Administration Guide, page 43.
質問 # 287
Check Point APIs allow system engineers and developers to make changes to their organization's security policy with CLI tools and Web Services for all the following except:
- A. Create new dashboards to manage 3rd party task
- B. Create products that use and enhance the Check Point Solution
- C. Execute automated scripts to perform common tasks
- D. Create products that use and enhance 3rd party solutions
正解：A
解説：
Check Point APIs let system administrators and developers make changes to the security policy with CLI tools and web-services. You can use an API to:
* Use an automated script to perform common tasks
* Integrate Check Point products with 3rd party solutions
* Create products that use and enhance the Check Point solution
質問 # 288
What is not a purpose of the deployment of Check Point API?
- A. Integrate Check Point products with 3rd party solution
- B. Create products that use and enhance the Check Point solution
- C. Create a customized GUI Client for manipulating the objects database
- D. Execute an automated script to perform common tasks
正解：C
質問 # 289
Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.
- A. 00000003
- B. ffffffff
- C. 00000002
- D. 00000001
正解：D
解説：
Explanation
For Wire mode configuration, chain modules marked with 00000001 will not apply. Wire mode is a special configuration that allows a Security Gateway to pass traffic without inspection, acting as a bridge between two network segments. In Wire mode, only chain modules that are essential for basic functionality are applied, such as VPN, QoS, ClusterXL, and SecureXL. Chain modules that are related to inspection-based Software Blades, such as Firewall, IPS, Application Control, and so on, are skipped. The chain modules that are skipped are marked with 00000001 in the output of fw ctl chain command. References: Wire Mode
質問 # 290
When using the Mail Transfer Agent, where are the debug logs stored?
- A. $FWDIR/bin/emaild.mta. elg
- B. $FWDIR/log/mtad elg
- C. /var/log/mail.mta elg
- D. $CPDIR/log/emaild elg
正解：A
質問 # 291
You need to see which hotfixes are installed on your gateway, which command would you use?
- A. cpinfo -l hotfix
- B. cpinfo -y all
- C. cpinfo -h all
- D. cpinfo -o hotfix
正解：B
質問 # 292
What is the command used to activated Multi-Version Cluster mode?
- A. set cluster mvc on in Expert Mode
- B. set cluster member mvc on in Clish
- C. set cluster MVC on in Expert Mode
- D. set mvc on on Clish
正解：B
解説：
The command used to activate Multi-Version Cluster mode is set cluster member mvc on in Clish. Multi-Version Cluster mode is a feature that allows cluster members to run different versions of Check Point software during a cluster upgrade. This reduces downtime and simplifies the upgrade process. To enable Multi-Version Cluster mode, the command set cluster member mvc on must be executed on each cluster member in Clish3. The other options are not valid commands for activating Multi-Version Cluster mode. Reference: 3: Check Point Software, Getting Started, Multi-Version Cluster.
質問 # 293
What are valid authentication methods for mutual authenticating the VPN gateways?
- A. PKI Certificates and DynamicID OTP
- B. PKI Certificates and Kerberos Tickets
- C. Pre-Shared Secrets and Kerberos Ticket
- D. Pre-shared Secret and PKI Certificates
正解：D
解説：
Explanation
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RemoteAccessVPN_AdminGuide/T
質問 # 294
With SecureXL enabled, accelerated packets will pass through the following:
- A. Network Interface Card, OSI Network Layer, OS IP Stack, and the Acceleration Device
- B. Network Interface Card and the Acceleration Device
- C. Network Interface Card, Check Point Firewall Kernal, and the Acceleration Device
- D. Network Interface Card, OSI Network Layer, and the Acceleration Device
正解：B
質問 # 295
You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet. However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet. How can you fix this?
- A. On the Security Management Server object, check the box 'Identity Logging'.
- B. On the firewall object, Legacy Authentication screen, check 'Enable Identity Captive Portal'.
- C. Right click Accept in the rule, select "More", and then check 'Enable Identity Captive Portal'.
- D. In the Captive Portal screen of Global Properties, check 'Enable Identity Captive Portal'.
正解：C
解説：
Explanation
The correct way to enable Identity Captive Portal for a specific rule is to right click Accept in the rule, select
"More", and then check 'Enable Identity Captive Portal'. This will allow guest users to see the splash page and accept the Terms of Service before accessing the Internet. Identity Captive Portal is a feature that enables identity awareness for guest users who are not authenticated by other methods, such as Active Directory or Identity Agent. Identity Captive Portal can be enabled globally or per rule, depending on the security policy requirements.
質問 # 296
What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)
- A. Security Gateway's MGNT NIC card is disconnected.
- B. There is a blade reporting a problem.
- C. SmartCenter Server cannot reach this Security Gateway.
- D. VPN software blade is reporting a malfunction.
正解：B
解説：
Explanation
If Deyra sees the gateway status as shown in the image, it means that there is a blade reporting a problem. The red exclamation mark indicates that one or more blades on the gateway have an issue that needs attention. The issue could be related to configuration, license, policy, or other factors. Deyra can hover over the icon to see more details about the problem. References: Training & Certification | Check Point Software, New Courses and Certificates for R81.10 - Check Point CheckMates
質問 # 297
NAT rules are prioritized in which order?
1. Automatic Static NAT
2. Automatic Hide NAT
3. Manual/Pre-Automatic NAT
4. Post-Automatic/Manual NAT rules
- A. 4, 3, 1, 2
- B. 3, 1, 2, 4
- C. 1, 4, 2, 3
- D. 1, 2, 3, 4
正解：D
解説：
Explanation
NAT rules are prioritized in the following order:
Automatic Static NAT: This is the highest priority NAT rule and it translates the source or destination IP address to a different IP address without changing the port number. It is configured in the network object properties.
Automatic Hide NAT: This is the second highest priority NAT rule and it translates the source IP address and port number to a different IP address and port number. It is configured in the network object properties.
Manual/Pre-Automatic NAT: This is the third highest priority NAT rule and it allows you to create custom NAT rules that are not possible with automatic NAT. It is configured in the NAT policy rulebase before the automatic NAT rules.
Post-Automatic/Manual NAT rules: This is the lowest priority NAT rule and it allows you to create custom NAT rules that are not possible with automatic NAT. It is configured in the NAT policy rulebase after the automatic NAT rules.
質問 # 298
How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?
- A. By dropping traffic from websites identified through ThreatCloud Verification and URL Caching
- B. By dropping traffic that is not proven to be from clean websites in the URL Filtering blade
- C. By allowing traffic from websites that are known to run Antivirus Software on servers regularly
- D. By matching logs against ThreatCloud information about the reputation of the website
正解：D
解説：
Explanation
The Anti-Virus feature of the Threat Prevention policy blocks traffic from infected websites by matching logs against ThreatCloud information about the reputation of the website. ThreatCloud is a collaborative network that collects and analyzes threat data from millions of sources worldwide. It assigns a reputation score to each website based on its malicious activity and behavior. If a website has a low reputation score, it is considered infected and blocked by the Anti-Virus blade. References: Training & Certification | Check Point Software, CCSE section
質問 # 299
What is the command to check the status of the SmartEvent Correlation Unit?
- A. cpstat cpsead
- B. fw ctl get int cpsead_stat
- C. fw ctl stat cpsemd
- D. cp_conf get_stat cpsemd
正解：A
解説：
The SmartEvent Correlation Unit is responsible for analyzing the log entries and identifying events from them. It runs on the Log Server machine or on a dedicated machine1. To check the status of the SmartEvent Correlation Unit, you can use the command cpstat cpsead on the machine where it is installed. This command will show you information such as the number of logs processed, the number of events generated, the CPU and memory usage, and the status of the connection to the SmartEvent Server23.
質問 # 300
What is the minimum amount of RAM needed for a Threat Prevention Appliance?
- A. It depends on the number of software blades enabled
- B. 8GB with Gaia in 64-bit mode
- C. 6 GB
- D. 4 GB
正解：D
解説：
According to the Check Point Resource Library, the minimum amount of RAM needed for a Threat Prevention Appliance is 4 GB. This applies to both physical and virtual appliances. The other options are either incorrect or irrelevant. Reference: Check Point Resource Library
質問 # 301
SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's machine via the web browser. What are the two modes of SNX?
- A. Virtual Adapter and Mobile App
- B. Network and Application
- C. Network and Layers
- D. Application and Client Service
正解：B
質問 # 302
In the Firewall chain mode FFF refers to:
- A. Stateless Packets
- B. All Packets
- C. Stateful Packets
- D. No Match
正解：B
解説：
In the Firewall chain mode FFF refers to all packets. Firewall chain mode is a feature that allows administrators to define how packets are processed by different firewall kernel modules in inbound and outbound directions. FFF is one of the predefined chain modes that applies all firewall kernel modules (Firewall, VPN, IPS, etc.) to all packets, regardless of their state or connection. This mode provides maximum security, but also consumes more CPU resources.
質問 # 303
Which of the following is NOT a valid type of SecureXL template?
- A. Accept Template
- B. Deny template
- C. NAT Template
- D. Drop Template
正解：B
質問 # 304
The log server sends what to the Correlation Unit?
- A. Authentication requests
- B. CPMI dbsync
- C. Logs
- D. Event Policy
正解：C
解説：
Explanation
The log server sends logs to the Correlation Unit. The Correlation Unit analyzes the logs and generates events based on the event policy. The events are then sent to the SmartEvent Server, which displays them in the SmartEvent GUI. References: [SmartEvent Administration Guide]
質問 # 305
Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called:
- A. cpexport
- B. cpsizeme
- C. sysinfo
- D. cpinfo
正解：D
解説：
Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called cpinfo. Cpinfo is a utility that collects diagnostic data on a Check Point gateway, management server, or log server. It generates a file that contains information such as product version, license details, OS details, network configuration, installed hotfixes, status of Check Point processes, firewall tables, etc. This file can be used by Check Point Support to troubleshoot issues or analyze performance. Reference: [Cpinfo Utility]
質問 # 306
View the rule below. What does the lock-symbol in the left column mean? (Choose the BEST answer.)
- A. Another user has locked the rule for editing.
- B. The current administrator has read-only permissions to Threat Prevention Policy.
- C. The current administrator is logged in as read-only because someone else is editing the policy.
- D. Configuration lock is present. Click the lock symbol to gain read-write access.
正解：A
解説：
https://sc1.checkpoint.com/documents/R81/CP_R81_SecMGMT/html_frameset.htm?topic=documents/R81/CP_R81_SecMGMT/124265
質問 # 307
......
156-315.81問題集はCheck Point Certified Security Expert認証済み試験問題と解答：https://www.passtest.jp/CheckPoint/156-315.81-shiken.html
実際に出ると確認された156-315.81試験問題集と解答で156-315.81無料更新：https://drive.google.com/open?id=1FOE6kT5P8NZZZ236AxOdNZWyw0hB_Voq