Free 156-315.81 Exam Braindumps (page: 37)

Page 36 of 158

The Correlation Unit performs all but the following actions:

  1. Marks logs that individually are not events, but may be part of a larger pattern to be identified later.
  2. Generates an event based on the Event policy.
  3. Assigns a severity level to the event.
  4. Takes a new log entry that is part of a group of items that together make up an event, and adds it to an ongoing event.

Answer(s): C

Explanation:

The Correlation Unit in Check Point Security Management performs several actions, but it does not assign a severity level to the event. The Correlation Unit is responsible for identifying patterns in logs, marking logs that are part of larger patterns, generating events based on the Event policy, and adding new log entries to ongoing events. However, assigning a severity level to an event is typically done through the Event policy configuration, not by the Correlation Unit.


Reference:

Check Point Certified Security Expert R81 Study Guide



What is the difference between SSL VPN and IPSec VPN?

  1. IPSec VPN does not require installation of a resilient VPN client.
  2. SSL VPN requires installation of a resident VPN client.
  3. SSL VPN and IPSec VPN are the same.
  4. IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser.

Answer(s): D

Explanation:

The main difference between SSL VPN (Secure Sockets Layer Virtual Private Network) and IPSec VPN (Internet Protocol Security Virtual Private Network) is in the way they operate:

SSL VPN typically does not require the installation of a resident VPN client. It often relies on a web browser to establish the VPN connection, making it more convenient for remote users who may not want to install dedicated VPN software.
IPSec VPN, on the other hand, often requires the installation of a resident VPN client on the user's device to establish the VPN connection. This client software is necessary for configuring and managing the VPN connection.
Option C, stating that SSL VPN and IPSec VPN are the same, is incorrect because they have distinct characteristics as described above.

Option A is incorrect because it inaccurately suggests that IPSec VPN does not require a resident VPN client, which is not true in most cases.

Option B is incorrect because it wrongly claims that SSL VPN requires the installation of a resident VPN client.


Reference:

Check Point Certified Security Expert R81 Study Guide



Which of the following will NOT affect acceleration?

  1. Connections destined to or originated from the Security gateway
  2. A 5-tuple match
  3. Multicast packets
  4. Connections that have a Handler (ICMP, FTP, H.323, etc.)

Answer(s): B

Explanation:

Check Point's SecureXL technology, which is responsible for acceleration, has certain limitations and conditions under which acceleration may not occur. In this context, the question is asking about factors that will NOT affect acceleration.

Option B, "A 5-tuple match," will not affect acceleration. A 5-tuple match refers to the matching of source IP, source port, destination IP, destination port, and protocol. SecureXL can accelerate traffic that matches these criteria, but it's not a factor that hinders acceleration.

Options A, C, and D can all affect acceleration:

Option A mentions "Connections destined to or originated from the Security gateway," which implies that SecureXL acceleration can apply to these connections. Option C mentions "Multicast packets," and SecureXL may have limitations in handling multicast traffic efficiently.
Option D mentions "Connections that have a Handler (ICMP, FTP, H.323, etc.)," and certain protocols (such as FTP) may require special handling and might not be fully accelerated by SecureXL.


Reference:

Check Point Certified Security Expert R81 Study Guide



The following command is used to verify the CPUSE version:

  1. HostName:0>show installer status build
  2. [Expert@HostName:0]#show installer status
  3. [Expert@HostName:0]#show installer status build
  4. HostName:0>show installer build

Answer(s): A

Explanation:

The correct command to verify the CPUSE (Check Point Update Service Engine) version is:



Option B is incorrect because it uses the "[Expert@HostName:0]#" prompt, which is typically used for expert mode commands, but the CPUSE version can be checked using the "show installer status build" command in standard mode.

Option C is incorrect because it uses the "[Expert@HostName:0]#" prompt, and while it includes the "build" parameter, it's not the standard command to check the CPUSE version.

Option D is incorrect because it uses the "HostName:0>" prompt, but it lacks the "show" command and uses "build" instead of "status build."


Reference:

Check Point Certified Security Expert R81 documentation






Post your Comments and Discuss Checkpoint 156-315.81 exam with other Community members:

156-315.81 Exam Discussions & Posts