Free 156-215.80 sample questions

Correct answer: On central firewall AES128 encryption is used for SIC, on Remote firewall 3DES encryption is used for SIC.

Explanation: Gateways above R71 use AES128 for SIC. If one of the gateways is R71 or below, the gateways use 3DES. Reference: http://dl3.checkpoint.com/paid/74/74d596decb6071a4ee642fbdaae7238f/CP_R80_SecurityManagement_AdminGuide.pdf?HashKey=1479584563_6f823c8ea1514609148aa4fec5425db2&xtn=.pdf

Correct answer: If a connection is dropped in Network Layer, it will not be matched against the rules in Data Center Layer.

Based on the R80 SmartConsole screenshot showing policy layers, if a connection is dropped in the Network Layer, it will not be matched against subsequent layers like the Data Center Layer. In Check Point R80's layered policy architecture, policy layers are processed sequentially in order. When a connection is explicitly dropped (denied) by a rule in an earlier layer, the connection terminates and no further layer processing occurs. This is fundamental to R80's ordered layer processing where Accept actions allow continuation to the next layer, while Drop actions immediately terminate processing. The screenshot demonstrates the typical inline layer structure where Network Layer rules are evaluated before Data Center Layer rules.

Correct answer: High Priority Path

High Priority Path is not a valid SecureXL traffic flow in Check Point R80. SecureXL uses three defined traffic flows: Fast Path (for connections that can be accelerated with minimal security processing), Accelerated Path (for connections requiring some security inspection but still benefiting from acceleration), and Slow Path (for connections requiring full security inspection that cannot be accelerated). The Fast Path provides the highest performance for established connections, while the Slow Path handles complex traffic requiring detailed inspection. Medium Path is also not a standard SecureXL flow - the correct flows are specifically Fast Path, Accelerated Path, and Slow Path as implemented in R80's SecureXL acceleration engine.

Correct answers: Address Range Hide NAT; Network Hide NAT

Address Range Hide NAT rules have the lowest implementation priority among Check Point automatic NAT rules. In R80 SmartConsole NAT policy, the automatic NAT rules are processed in a specific priority order: Machine Static NAT (highest priority), then Machine Hide NAT, followed by Network Hide NAT, and finally Address Range Hide NAT (lowest priority). This priority order ensures that more specific rules are matched before broader ones. Address Range Hide NAT applies to ranges of IP addresses and has the broadest scope, which is why it receives the lowest priority to avoid conflicts with more specific NAT configurations.

Network Hide NAT rules have among the lowest implementation priorities in Check Point automatic NAT rule processing. In R80's NAT policy hierarchy, automatic rules are ordered by specificity: Machine Static NAT has the highest priority, followed by Machine Hide NAT, then Network Hide NAT, and finally Address Range Hide NAT at the lowest priority. Network Hide NAT applies to entire network objects and has broader scope than machine-specific rules but more specific scope than address range rules. This priority system in R80 ensures that specific host rules take precedence over network-wide rules, maintaining predictable NAT behavior and avoiding rule conflicts.

Correct answer: Certificates; pre-shared secrets

VPN gateways authenticate using certificates and pre-shared secrets in Check Point R80 environments. These are the two primary authentication methods supported by Check Point VPN infrastructure. Certificate-based authentication provides stronger security through PKI (Public Key Infrastructure) and is preferred for site-to-site VPNs, while pre-shared secrets offer simpler configuration for smaller deployments. In R80 SmartConsole, administrators configure these authentication methods in the VPN communities and gateway objects. Passwords and tokens are used for user authentication in remote access VPNs, not for gateway-to-gateway authentication between Check Point security gateways.

Correct answer: Making packets appear as if they come from an authorized IP address.

Explanation: IP spoofing replaces the untrusted source IP address with a fake, trusted one, to hijack connections to your network. Attackers use IP spoofing to send malware and bots to your protected network, to execute DoS attacks, or to gain unauthorized access. Reference: http://dl3.checkpoint.com/paid/74/74d596decb6071a4ee642fbdaae7238f/CP_R80_SecurityManagement_AdminGuide.pdf?HashKey=1479584563_6f823c8ea1514609148aa4fec5425db2&xtn=.pdf

Correct answer: User Directory

Reference: https://www.checkpoint.com/downloads/product-related/datasheets/DS_UserDirectorySWB.pdf

Correct answer: AppWiki

Explanation: AppWiki Application Classification Library AppWiki enables application scanning and detection of more than 5,000 distinct applications and over 300,000 Web 2.0 widgets including instant messaging, social networking, video streaming, VoIP, games and more. Reference: https://www.checkpoint.com/products/application-control-software-blade/

Correct answer: Shared Policies

Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/126197

Correct answer: Standalone

Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Installation_and_Upgrade_Guide-webAdmin/89230.htm#o98246