156-215-81 Practice Questions

This answer is correct because these are two valid methods for mutually authenticating the VPN

gateways, which means that both sides of the communication verify each other’s identity using a

shared secret or a public key certificate1. A pre-shared secret is a password or a passphrase that both

gateways know and use to encrypt and decrypt the VPN traffic2. A PKI certificate is a digital

document that contains the public key and other information that helps identify the gateway, such as

the issuer, the subject, and the expiration date3. The certificate is signed by a trusted certificate

authority (CA) that vouches for the authenticity of the gateway3.

The other answers are not correct because they either include invalid or irrelevant methods for

mutual authentication. PKI certificates and Kerberos tickets are not compatible methods for mutual

authentication, because Kerberos tickets are issued by a Kerberos server and not by a CA4. Pre-

shared secrets and Kerberos tickets are also not compatible methods for mutual authentication,

because they use different protocols and encryption algorithms4. PKI certificates and DynamiciD OTP

are not valid methods for mutual authentication, because DynamiciD OTP is a one-time password

that is used for user authentication, not for gateway authentication5.

What is mutual authentication? | Two-way authentication

Mutual authentication - AWS Client VPN

VPN authentication options - Windows Security

Mutual Authentication | Top 3 Methods of Mutual Authentication

Authentication methods and features - Microsoft Entra

RADIUS protocol uses UDP (User Datagram Protocol) to communicate with the gateway. UDP is a

connectionless protocol that does not require a handshake or acknowledgment before sending or

receiving data2.

Reference: 2: [Check Point R81 Identity Awareness Administration Guide], page 14.

The following is considered a “Subscription Blade”, requiring renewal every 1-3 years: IPS blade4. The

IPS blade is a software blade that provides protection against network attacks and exploits by

inspecting traffic and blocking malicious packets. The IPS blade requires a subscription license that

includes updates for the IPS signatures and Geo Protection database. Other subscription blades

include Anti-Bot, Anti-Virus, URL Filtering, Application Control, Threat Emulation, and Threat

Extraction. Reference: Check Point Licensing and Contract Operations User Guide

Address translation rules are used to map an IP address space into another by modifying network

address information in the IP header of packets. Address translation rules have two elements:

original packet and translated packet6. The original packet is the packet before it undergoes address

translation, and the translated packet is the packet after it undergoes address translation. The

original packet and the translated packet may have different source and destination IP addresses,

depending on the type and direction of address translation.

SmartConsole provides a consolidated solution for everything that is necessary for the security of an

organization, such as Security Policy Management and Log Analysis. Security Policy Management is

the process of defining and enforcing rules that control the access and protection of network

resources. Log Analysis is the process of collecting, analyzing, and reporting on log data that is

generated by network devices and applications. SmartConsole is a unified graphical user interface

that allows administrators to manage multiple security functions from a single console. The other

options are not part of SmartConsole, but rather separate software blades or features that can be

integrated with SmartConsole.

A Distinguished Name (DN) is a unique identifier for an entry in an LDAP directory. A DN consists of a

sequence of relative distinguished names (RDNs) separated by commas. Each RDN is composed of an

attribute type and an attribute value, such as cn=John Smith or ou=Sales. A DN can have different

components depending on the structure and schema of the LDAP directory, but some common

components are: Common Name (cn), Country ©, Organizational Unit (ou), Organization (o), State or

Province (st), and Locality (l). User container is not a component of a DN3. Reference: Check Point

R81 Identity Awareness Administration Guide

The INSPECT Engine is a technology that extracts detailed information from packets and stores that

information in state tables. It enables stateful inspection and application layer

filtering12 Reference: INSPECT Engine, Stateful Inspection

When enabling tracking on a rule, the default option is Log. This option generates a log entry for

each connection that matches the rule. The log entry contains information such as the source,

destination, service, action, and time of the connection.

Reference: [Logging and Monitoring R81], [Logging and Monitoring]

The user ID (UID) of a user that has all the privileges of a root user is 0. The root user is the superuser

account that can perform any action on the system, such as changing file ownership, binding to

network ports below 1024, or executing any command. The root user is identified by the UID 0, not

by the name “root”, which is just a convention. It is possible to have another user account with the

name “root”, but not with the same UID 0.

The Check Point Upgrade Service Engine (CPUSE) is a tool that automates the process of upgrading

and installing Check Point products on Gaia OS1. It can also be used to update the Gaia OS itself2.

The other options are not valid tools for this purpose. Reference: Check Point Upgrade Service Engine

(CPUSE) - Gaia Deployment Agent, Check Point R81 Gaia Installation and Upgrade Guide