156-315.81 Sample Questions & Answers

The HTTPS Inspection policy is the correct place to define bypass rules. Creating rules that match traffic destined for the sensitive financial and healthcare domains and setting their action to 'Bypass' will prevent decryption for compliance purposes.

This is a specific performance-related feature within the gateway's HTTPS Inspection settings. Enabling it allows the gateway to automatically and temporarily bypass inspection when CPU load on the relevant worker processes (fwk) is high, thus preserving network availability and performance.

fw ctl multik stat is the correct command to display real-time statistics for CoreXL, including the number of packets being processed by each firewall instance (worker core). This output allows an administrator to immediately identify an imbalanced distribution caused by the Dynamic Dispatcher.

In a route-based VPN, the concept of a statically defined encryption domain is replaced by the routing table. Any traffic that is routed to the VTI by the gateway's routing table (either via static routes or a dynamic routing protocol like BGP) is considered part of the 'encryption domain' and will be encrypted and sent over the tunnel.

The Security Management Server is responsible for downloading updates for Updatable Objects from Check Point's cloud services. In an environment where the SMS has no direct internet, it must be configured to use a proxy. This is done in the Gaia Portal of the SMS. Once the SMS downloads the updates, it distributes them to the managed Security Gateways during policy installation. The gateways themselves do not need direct internet or proxy access for this specific feature.

This is the Check Point best practice for achieving logging redundancy. By creating a Log Server Cluster object and adding both Log Servers to it, the gateways can be configured to send logs to the cluster. This abstraction layer handles the failover automatically. If the primary defined logger (the local one) fails, the gateway will seamlessly redirect its logs to the other member of the cluster (the remote one), fulfilling all requirements without manual intervention.

The 'NO_PROPOSAL_CHOSEN' error message is a standard IKE notification that indicates the initiating peer sent a set of cryptographic proposals (e.g., AES-256 for encryption, SHA-256 for integrity, Diffie-Hellman group 14 for key exchange) for Phase 1, but the responding peer could not find a matching proposal in its own configuration that it was willing to accept. This points directly to a mismatch in the Phase 1 properties.

The correct and supported method for excluding specific services from state synchronization is to modify the service object's properties in SmartConsole. By unchecking the 'Synchronize connections on cluster' option within the advanced properties of the UDP/53 service object, you instruct the cluster not to sync state table entries for this traffic, which is a best practice for high-volume, stateless protocols like DNS.

The Identity Collector can be configured to parse syslog messages from various sources, including RADIUS servers, to extract user, IP, and event information for identity mapping.

The Identity Collector is designed to query Microsoft Active Directory Domain Controllers for security event logs to identify user logins and map them to IP addresses. This is a primary and common identity source.

Creating an exception within the Threat Prevention Profile is the recommended method. This allows the administrator to specifically exclude the custom application's service (TCP/31337) from IPS inspection. This is more precise than disabling a signature (which might be useful for other traffic) and more secure than bypassing all Threat Prevention for the server.

This statement is true. When VMAC mode is enabled, all cluster members use the same virtual MAC address for the cluster virtual IP address. Upon failover, the new active member starts using this same virtual MAC. Because the MAC address associated with the VIP does not change from the perspective of other network devices, there is no need for gratuitous ARPs or for connected switches and hosts to update their ARP tables, resulting in a faster and more seamless failover.