156-915.80: CCSE Update R80 - Free download from ExamHUB

What is the port used for SmartConsole to connect to the Security Management Server:

CPMI port 18191/TCP
CPM port / TCP port 19009
SIC port 18191/TCP
https port 4434/TCP

Correct answer: A

Which is the correct order of a log flow processed by SmartEvents components:

Firewall > Correlation Unit > Log Server > SmartEvent Server Database > SmartEvent Client
Firewall > SmartEvent Server Database > Correlation unit > Log Server > SmartEvent Client
Firewall > Log Server > SmartEvent Server Database > Correlation Unit > SmartEvent Client
Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client

Correct answer: D

Explanation:

In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Mail, Block Source, Block Event Activity, External Script, SNMP Trap
Mail, Block Source, Block Destination, Block Services, SNMP Trap
Mail, Block Source, Block Destination, External Script, SNMP Trap
Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap

Correct answer: A

Explanation:

These are the types of Automatic Reactions:Mail - tell an administrator by email that the event occurred. See Create a Mail Reaction. Block Source - instruct the Security Gateway to block the source IP address from which this event was detected for a configurable period of time . Select a period of time from one minute to more than three weeks. See Create a Block Source Reaction Block Event activity - instruct the Security Gateway to block a distributed attack that emanates from multiple sources, or attacks multiple destinations for a configurable period of time. Select a period of time from one minute to more than three weeks). See Create a Block Event Activity Reaction. External Script - run a script that you provide. See Creating an External Script Automatic Reaction to write a script that can exploit SmartEvent data. SNMP Trap - generate an SNMP Trap. See Create an SNMP Trap Reaction. Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_LoggingAndMonitoring/html_frameset.htm?topic=documents/R80/CP_R80_LoggingAndMonitoring/131915

These are the types of Automatic Reactions:

Mail - tell an administrator by email that the event occurred. See Create a Mail Reaction.
Block Source - instruct the Security Gateway to block the source IP address from which this event was detected for a configurable period of time . Select a
period of time from one minute to more than three weeks. See Create a Block Source Reaction
Block Event activity - instruct the Security Gateway to block a distributed attack that emanates from multiple sources, or attacks multiple destinations for a
configurable period of time. Select a period of time from one minute to more than three weeks). See Create a Block Event Activity Reaction.
External Script - run a script that you provide. See Creating an External Script Automatic Reaction to write a script that can exploit SmartEvent data.
SNMP Trap - generate an SNMP Trap. See Create an SNMP Trap Reaction.

Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_LoggingAndMonitoring/html_frameset.htm?topic=documents/R80/

CP_R80_LoggingAndMonitoring/131915

In R80.10, how do you manage your Mobile Access Policy?

Through the Unified Policy
Through the Mobile Console
From SmartDashboard
From the Dedicated Mobility Tab

Correct answer: C

Explanation:

Reference: http://dl3.checkpoint.com/paid/f7/f78b067c6838c747e1568f139b6e6e8d/CP_R80.10_MobileAccess_AdminGuide.pdf?HashKey=1522170407_805ae0a295fd6664fa23700cc1482686&xtn=.pdf

Reference: http://dl3.checkpoint.com/paid/f7/f78b067c6838c747e1568f139b6e6e8d/CP_R80.10_MobileAccess_AdminGuide.pdf?

HashKey=1522170407_805ae0a295fd6664fa23700cc1482686&xtn=.pdf

Which one of the following is true about Threat Emulation?

Takes less than a second to complete
Works on MS Office and PDF files only
Always delivers a file
Takes minutes to complete (less than 3 minutes)

Correct answer: D

The “MAC magic” value must be modified under the following condition:

There is more than one cluster connected to the same VLAN
A firewall cluster is configured to use Multicast for CCP traffic
There are more than two members in a firewall cluster
A firewall cluster is configured to use Broadcast for CCP traffic

Correct answer: D

Explanation:

Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk25977

Which statement is true regarding redundancy?

System Administrator know when their cluster has failed over and can also see why it failed over by using the cphaprob f it command.
ClusterXL offers three different Load Sharing solutions: Unicast, Broadcast, and Multicast.
Machines in a Cluster XL High Availability configuration must be synchronized.
Both Cluster XL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.

Correct answer: D

Explanation:

Reference: https://www.checkpoint.com/download/public-files/gaia-technical-brief.pdf page 5

Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_ report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links. Which component of SandBlast protection is her company using on a Gateway?

SandBlast Threat Emulation
SandBlast Agent
Check Point Protect
SandBlast Threat Extraction

Correct answer: D

What is the SOLR database for?

Used for full text search and enables powerful matching capabilities
Writes data to the database and full text search
Serves GUI responsible to transfer request to the DLEserver
Enables powerful matching capabilities and writes data to the database

Correct answer: A

Explanation:

What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Stateful Mode
VPN Routing Mode
Wire Mode
Stateless Mode

Correct answer: C

Explanation:

Wire Mode is a VPN-1 NGX feature that enables VPN connections to successfully fail over, bypassing Security Gateway enforcement. This improves performance and reduces downtime. Based on a trusted source and destination, Wire Mode uses internal interfaces and VPN Communities to maintain a private and secure VPN session, without employing Stateful Inspection. Since Stateful Inspection no longer takes place, dynamic-routing protocols that do not survive state verification in non-Wire Mode configurations can now be deployed. The VPN connection is no different from any other connections along a dedicated wire, thus the meaning of "Wire Mode". Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk30974

Wire Mode is a VPN-1 NGX feature that enables VPN connections to successfully fail over, bypassing Security Gateway enforcement. This improves performance and reduces downtime. Based on a trusted source and destination, Wire Mode uses internal interfaces and VPN Communities to maintain a private and secure VPN session, without employing Stateful Inspection. Since Stateful Inspection no longer takes place, dynamic-routing protocols that do not survive state verification in non-Wire Mode configurations can now be deployed. The VPN connection is no different from any other connections along a dedicated wire, thus the meaning of "Wire Mode".

Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk30974

Vendor:	Checkpoint
Exam Code:	156-915.80
Exam Name:	CCSE Update R80
Date:	Apr 01, 2019
File Size:	100 KB

Download CCSE Update R80.156-915.80.PracticeTest.2019-04-01.105q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown