156-215.80 Sample Questions & Answers

Address Range Hide NAT rules have the lowest implementation priority among Check Point automatic NAT rules. In R80 SmartConsole NAT policy, the automatic NAT rules are processed in a specific priority order: Machine Static NAT (highest priority), then Machine Hide NAT, followed by Network Hide NAT, and finally Address Range Hide NAT (lowest priority). This priority order ensures that more specific rules are matched before broader ones. Address Range Hide NAT applies to ranges of IP addresses and has the broadest scope, which is why it receives the lowest priority to avoid conflicts with more specific NAT configurations.

Network Hide NAT rules have among the lowest implementation priorities in Check Point automatic NAT rule processing. In R80's NAT policy hierarchy, automatic rules are ordered by specificity: Machine Static NAT has the highest priority, followed by Machine Hide NAT, then Network Hide NAT, and finally Address Range Hide NAT at the lowest priority. Network Hide NAT applies to entire network objects and has broader scope than machine-specific rules but more specific scope than address range rules. This priority system in R80 ensures that specific host rules take precedence over network-wide rules, maintaining predictable NAT behavior and avoiding rule conflicts.

VPN gateways authenticate using certificates and pre-shared secrets in Check Point R80 environments. These are the two primary authentication methods supported by Check Point VPN infrastructure. Certificate-based authentication provides stronger security through PKI (Public Key Infrastructure) and is preferred for site-to-site VPNs, while pre-shared secrets offer simpler configuration for smaller deployments. In R80 SmartConsole, administrators configure these authentication methods in the VPN communities and gateway objects. Passwords and tokens are used for user authentication in remote access VPNs, not for gateway-to-gateway authentication between Check Point security gateways.

Explanation:

IP spoofing replaces the untrusted source IP address with a fake, trusted one, to hijack connections to your network. Attackers use IP spoofing to send malware and bots to your protected network, to execute DoS attacks, or to gain unauthorized access.

Reference:

http://dl3.checkpoint.com/paid/74/74d596decb6071a4ee642fbdaae7238f/CP_R80_SecurityManagement_AdminGuide.pdf?HashKey=1479584563_6f823c8ea1514609148aa4fec5425db2&xtn=.pdf

Reference:

https://www.checkpoint.com/downloads/product-related/datasheets/DS_UserDirectorySWB.pdf

Explanation:

AppWiki Application Classification Library

AppWiki enables application scanning and detection of more than 5,000 distinct applications and over 300,000 Web 2.0 widgets including instant messaging, social networking, video streaming, VoIP, games and more.

Reference: https://www.checkpoint.com/products/application-control-software-blade/

Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/126197

Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Installation_and_Upgrade_Guide-webAdmin/89230.htm#o98246

Explanation:
Clientless - Users connect through a web browser and use HTTPS connections. Clientless solutions usually supply access to web-based corporate resources.

Reference: https://sc1.checkpoint.com/documents/R80/CP_R80BC_Firewall/html_frameset.htm?topic=documents/R80/CP_R80BC_Firewall/92704

A management plug-in interacts with a Security Management Server to provide new features and support for new products in R80 environments. Management plug-ins extend SmartConsole functionality by adding support for third-party security products, new Check Point blades, or custom security solutions. These plug-ins integrate directly with the R80 management infrastructure, allowing administrators to manage additional security components through the familiar SmartConsole interface. Examples include plug-ins for endpoint security, threat intelligence feeds, or specialized security appliances that can be managed alongside Check Point gateways through a unified management platform.

Explanation:
Configuring Gaia for the First Time In This Section:
Running the First Time Configuration Wizard in WebUI Running the First Time Configuration Wizard in CLI
After you install Gaia for the first time, use the First Time Configuration Wizard to configure the system and the Check Point products on it.

Reference: https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_AdminWebAdminGuide/html_frameset.htm?topic=documents/R77/CP_R77_Gaia_AdminWebAdminGuide/112568