156-315.81.20 Sample Questions & Answers

A system administrator is analyzing the output of fw ctl pstat on an R81.20 Security Gateway experiencing high CPU utilization. They need to understand the relationship between the SecureXL, Medium Path, and Firewall Path (Slow Path). The following ASCII diagram illustrates the packet processing flow:

Packet IN
|
v
+---------------+
| SecureXL | --- (Accelerated Path) --> Packet OUT
+---------------+
|
v
+---------------+
| Medium Path |
| (Passive Str.)| --- (Inspection) -------> SecureXL Template -> Packet OUT
+---------------+
|
v
+---------------+
| Firewall Path |
| (Slow Path) | --- (Full Inspection) ---> Medium Path -> Packet OUT
+---------------+

Based on the diagram and Check Point's performance tuning architecture, which statement accurately describes the HyperFlow feature's role?

An administrator is configuring a new R81.20 cluster and wants to use the migrate_server command to export the configuration from an existing R81 Security Management Server. The goal is to perform a clean installation on new hardware and then import the configuration. What is the correct command syntax to initiate the export process on the source Security Management Server?

A DevOps team requires the ability to programmatically add and remove IP addresses from a security policy rule that grants access to a staging environment. They want to avoid giving the team SmartConsole access and need a solution that allows for rapid, automated updates without requiring a full policy installation for every change. Which R81.20 object type is best suited to meet these requirements?

A security engineer is troubleshooting a site-to-site VPN between an R81.20 Security Gateway and a third-party cloud provider. The cloud provider requires IKEv2 and mandates the use of specific, strong cryptographic algorithms for both IKE and IPsec phases. The engineer observes in the logs that the tunnel fails to establish during Phase 2 negotiations. The error message indicates a 'NO_PROPOSAL_CHOSEN' payload. What is the most likely cause of this issue?

A retail company is expanding its use of IoT devices, including PoS terminals and inventory scanners. These devices communicate with cloud services over HTTPS. The security team needs to enforce a strict security policy that allows these devices to communicate ONLY with necessary, predefined FQDNs. They also need to apply IPS protections to this traffic. The solution must not rely on maintaining static IP lists for the cloud services and must be efficient.

Which THREE Check Point features should be combined in the policy to achieve this? (Select THREE)

An administrator is managing an R81.20 environment where policy installation times have become unacceptably long. An investigation reveals that the 'Verifying' and 'Generating' stages of the installation process are taking the most time. The security policy contains thousands of rules and objects. Which R81.20 feature is specifically designed to reduce policy installation time by optimizing these stages?

A university provides remote access to its digital library for students and faculty using the Mobile Access Blade on an R81.20 gateway. The university wants to implement a security policy where users connecting from university-managed laptops are granted access to a wider range of resources than users connecting from personal devices (BYOD). The managed laptops all have a specific client certificate installed. Which Mobile Access feature should be configured to enforce this policy?

Case Study

Company Background:
Global PetroCorp runs a large-scale industrial control system (ICS) network to manage its oil refineries. The network is physically isolated, but a new initiative requires connecting it to the corporate network to pull production data for business analytics. The corporate network is managed by a central R81.20 Security Management Server (SMS) and protected by a cluster of Security Gateways.

Technical Challenge:
The ICS network uses legacy devices that are highly sensitive to network latency and jitter. Standard security scanning could cause them to malfunction. The connection to the corporate network is via a single, high-speed link. The primary concern is preventing any threats from the corporate network from pivoting into the critical ICS environment. The solution must provide deep visibility into the specific ICS protocols being used, such as Modbus and DNP3, and enforce a strict least-privilege policy based on these protocols.

Requirements:

1. Provide robust threat prevention for traffic entering the ICS network.
2. Must not introduce any active scanning or traffic that could disrupt sensitive ICS devices.
3. Must provide application-layer visibility and control of ICS-specific protocols.
4. The solution must be centrally managed from the existing R81.20 SMS.

Diagram of Proposed Architecture:

Corporate Network
|
v
+-----------------------+
| R81.20 Gateway Cluster|
+-----------------------+
|
v
+-----------------------+ +----------------------+
| ICS Security GW |---->| ICS/SCADA Network |
| (TAP/Passive Mode) | | (Modbus, DNP3, etc.) |
+-----------------------+ +----------------------+

Which Check Point solution or feature set should be implemented for the 'ICS Security GW' to meet all of Global PetroCorp's stringent requirements?

A security administrator needs to configure Identity Awareness on an R81.20 gateway. The goal is to acquire identity information from Active Directory without installing any Check Point components on the Domain Controllers. The solution should also be able to gather identity data from syslog messages sent by a RADIUS server. Which Identity Awareness acquisition source should be configured to meet both requirements?

True or False: In an R81.20 Management High Availability deployment, the synchronization of the management database between the primary and standby servers is an automatic process, while the failover of the active server role must be initiated manually by an administrator.