Checkpoint Updated 156-315.81 Exam Questions and Answers by zane

The correct answer is B. R80.10 and later.

According to the Check Point documentation1, the Multi-Version Cluster Upgrade (MVC) is a new feature in R80.40 and higher that replaces the Connectivity Upgrade (CU) method. MVC allows you to upgrade a cluster to a newer version without a loss in connectivity and test the new version on some of the cluster members before you decide to upgrade the rest of the cluster members. The MVC feature supports the following destination versions2:

• R80.10
• R80.20
• R80.30
• R80.40
• R81
• R81.20

The other options are incorrect because they are either not supported by MVC or they are older than the source version (R80.40).

References:

• Multi-Version Cluster (MVC) replaces Connectivity Upgrade (CU) in R80.401
• ClusterXL upgrade methods and paths2

An Endpoint Identity Agent is a software component that runs on the user’s device and communicates with the Check Point gateway to provide user identity information. An Endpoint Identity Agent can use different methods for user authentication, such as username/password, Kerberos ticket, or certificate. However, the most common and recommended method is username/password or Kerberos ticket, which allows the user to log in to the device with their domain credentials and automatically authenticate with the gateway without entering additional credentials. This method also supports Single Sign-On (SSO) and Multi-Factor Authentication (MFA) features.

The references are:

• Check Point R81 Identity Awareness Administration Guide, page 15
• Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 14
• Endpoint Identity Agent - Check Point CheckMates

VLAN Tag is not an attribute of packet acceleration. Packet acceleration is a feature of SecureXL that allows certain packets to bypass the Firewall kernel and be processed by a more efficient mechanism. Packet acceleration is based on templates that match packets based on four attributes: Source IP address, Destination IP address, Protocol, and Destination port. If a packet matches an existing template, it is accelerated; otherwise, it is sent to the Firewall path for inspection. References: [SecureXL Mechanism]

 If the first packet of a UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), nothing is sent back through the kernel. This is because UDP is a connectionless protocol that does not require an acknowledgement from the receiver. Therefore, if a UDP packet is dropped by the Firewall, the sender will not receive any feedback or notification. References: UDP Protocol