156-561 Sample Questions & Answers
CloudGuard network security spans eight equally weighted areas, from reference architectures and auto-scaling the management server to cloud clustering for high availability, adaptive policy, deployment automation, and gateway troubleshooting.
Launch the full 156-561 simulator →Showing 6 of 12 free samples.
- Question 1Advanced
Introducing CloudGuard · CloudGuard Network Security fundamentals
A multinational retail bank is migrating its core payment processing application to Azure. The bank's compliance team mandates that all traffic entering the application must undergo deep packet inspection, zero-day threat extraction, and application-level control.
The cloud operations team argues that native Azure Network Security Groups (NSGs) and Azure Firewall Basic are sufficient to meet these requirements while keeping costs low.
As the Lead Security Architect, you must justify the deployment of Check Point CloudGuard Network Security instead of relying solely on the native basic controls. Which of the following provides the most accurate architectural justification for this decision?
Show answer & explanation
Correct answer: A
NSGs filter by IP address, port and protocol only. They cannot identify applications or run IPS, Threat Emulation or Threat Extraction. CloudGuard adds this Layer 7 inspection and threat prevention.
- Question 2IntermediateSelect 2
Introducing CloudGuard · CloudGuard Network Security fundamentals
While analyzing the security posture of an AWS environment, a consultant notices that the organization relies entirely on AWS Security Groups. Which TWO advanced capabilities will the organization gain by implementing Check Point CloudGuard Network Security Gateways? (Select TWO)
Show answer & explanation
Correct answers: C, D
Security Groups allow or block traffic by IP address and port only. CloudGuard inspects the packet content and stops malware and zero-day threats.
Application Control identifies the application in the traffic, not just the port. Security Groups cannot do this, so they cannot block one web application that uses a common port.
- Question 3Intermediate
CloudGuard Network Security Architectures · Cloud security reference architectures
A manufacturing enterprise is designing a multi-VNet architecture in Azure. They require all traffic moving between their "HR" VNet and "Finance" VNet to be inspected by a Check Point CloudGuard Gateway. Which architectural model is best suited for this requirement?
Show answer & explanation
Correct answer: D
Both VNets peer with a hub VNet that holds the CloudGuard gateway. UDRs in the spokes send traffic between them through the gateway. Direct peering between HR and Finance would skip the gateway.
- Question 4Intermediate
CloudGuard Network Security Architectures · Cloud security reference architectures
When integrating Check Point CloudGuard Network Security with AWS Transit Gateway (TGW) for East-West inspection, which AWS service is commonly utilized alongside CloudGuard Auto Scaling to ensure symmetric routing and high throughput without requiring Source NAT (SNAT)?
Show answer & explanation
Correct answer: A
Gateway Load Balancer keeps all packets of a flow on one gateway. It carries them in GENEVE tunnels with the original IP addresses. Replies come back through the same gateway, so no Source NAT is needed.
- Question 5Beginner
CloudGuard Network Security Architectures · Cloud security reference architectures
A cloud architect is designing an architecture to protect web servers hosted in a public cloud. They decide to place a public-facing load balancer that receives traffic from the internet and forwards it to the Check Point CloudGuard Gateway cluster, which then inspects and routes it to the web servers. This specific flow is best described as:
Show answer & explanation
Correct answer: D
Traffic from the internet comes into the cloud through a public load balancer and the gateways. That is ingress traffic. Egress is outbound traffic, and East-West is traffic between internal networks.
- Question 6Beginner
CloudGuard Network Security Architectures · Cloud security reference architectures
The architectural pattern where traffic moving laterally between two subnets or VNets/VPCs is redirected through a CloudGuard Gateway for inspection is known as ________ inspection.
Show answer & explanation
Correct answer: B
East-West traffic moves sideways between internal subnets, VNets or VPCs. Inspecting it can stop a threat from spreading between segments. North-South traffic enters or leaves the cloud.
Ready for the real thing?
The full 156-561 simulator has every exam-style question, timed mode, and instant scoring.