Checkpoint Updated 156-315.81 Exam Questions and Answers by daniyal

 The Threat Prevention software components available on the Check Point Security Gateway are IPS, Anti-Bot, Anti-Virus, Threat Emulation and Threat Extraction. These components provide comprehensive protection against various types of cyber threats, such as network attacks, malware, ransomware, phishing, zero-day exploits, data leakage, and more. IPS is a network security component that detects and prevents malicious traffic based on signatures, behavioral patterns, and anomaly detection. Anti-Bot is a network security component that detects and blocks botnet communications and command-and-control servers. Anti-Virus is a network security component that scans files for known viruses, worms, and trojans. Threat Emulation is a network security component that emulates files in a sandbox environment to detect unknown malware and prevent zero-day attacks. Threat Extraction is a network security component that removes malicious content from files and delivers clean files to users. References: [Check Point R81 Threat Prevention Administration Guide], page 9-10

Policy Types are the different types of security policies that can be configured and enforced on a Check Point gateway. The valid Policy Types in R81.X are:

• Access Control: Defines the rules for allowing or blocking traffic based on source, destination, service, user, and other criteria.
• IPS: Protects the network from known and unknown attacks by inspecting the traffic and applying signatures, protections, and actions.
• QoS: Controls the bandwidth allocation and prioritization for different types of traffic and applications.
• DLP: Prevents the leakage of sensitive data from the network by detecting and blocking data transfers that violate predefined rules.

The references are:

• Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 11
• Check Point Certified Security Administrator R81 - ExperTeach, page 5
• Check Point Cybersecurity BootCamp R81.20 – CCSA & CCSE Training, page 2

The command fw ctl debug 0 will reset the kernel debug options to default settings. This command will disable all the debug flags and clear the debug buffer. It is recommended to use this command before and after performing a kernel debug, to avoid any interference or confusion with other debug outputs. The command fw ctl debug 0 is also equivalent to fw ctl debug -buf 0.

References:

• Best Practices - HTTPS Inspection - Check Point Software, section “How to perform a Kernel Debug”
• LOGGINGAND MONITORING R81 - Check Point Software, page 104

The minimum open server hardware requirements for a Security Management Server/Standalone in R81 are:

• CPU: Intel Core i5-4590 or equivalent (4 cores)
• Memory: 8 GB RAM
• Disk space: 500 GB

The other options do not match the minimum requirements. Option A has insufficient CPU cores, memory and disk space. Option B has excessive CPU cores and disk space. Option D has excessive CPU cores, memory and disk space.

References: Check Point R81 Release Notes, page 6