When doing a Stand-Alone Installation, you would install the Security Management Server with none

of the other Check Point architecture components. A Stand-Alone Installation is a type of installation

that combines the Security Management Server and the Security Gateway on one computer or

appliance3, p. 14. SmartConsole, SecureClient, and SmartEvent are not Check Point architecture

components, but software applications that can be installed separately. Reference: Check Point CCSA

- R81: Practice Test & Explanation, [Check Point Installation and Upgrade Guide R81]

Phase 1 of the two-phase negotiation process conducted by IKE operates in Main mode or

Aggressive mode12. Main mode is more secure than Aggressive mode, as it protects the identities of

the peers and uses six messages to establish the IKE SA13. Authentication, Quick, and High Alert are

not valid modes for IKE phase 1.

Reference: Understand IPsec IKEv1 Protocol, Internet Key Exchange for IPsec VPNs Configuration

Guide, Internet Key Exchange

If Deyra sees the gateway status as shown in the image, it means that there is a blade reporting a

problem. The red “X” in the status column indicates that one or more blades on the Security Gateway

have a problem that requires attention. The other options are not correct, as they do not match the

status shown in the image. If the SmartCenter Server cannot reach this Security Gateway, the status

column would show a yellow triangle with an exclamation mark. If the VPN software blade is

reporting a malfunction, the blades column would show a red “X” on the VPN icon. If the Security

Gateway’s MGNT NIC card is disconnected, the IP column would show “N/A” instead of the IP

address.

Reference: Remote Access VPN R81 Administration Guide, Check Point R81.10

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/CheckPoint_156-215.81/page_73_img_1.jpg

The BEST way to tune the profile in order to lower the CPU load still maintaining security at good

level is to set the Performance Impact to Medium or lower. This will reduce the number of packets

that are inspected by the Threat Prevention blades, while still providing a high level of protection .

Setting High Confidence to Low and Low Confidence to Inactive will lower the security level, as it will

allow more traffic that may be malicious. The problem is likely with the Threat Prevention Profile, as

it can have a significant impact on the CPU utilization of the Security Gateway. Adding more memory

to the appliance will not solve the problem, as memory is not the bottleneck in this case. Setting the

Performance Impact to Very Low Confidence to Prevent will increase the CPU load, as it will inspect

more packets and block more traffic that may be false positives.

Reference: Threat Prevention Administration Guide, Check Point R81.10

To ensure that VMAC mode is enabled, you should run the command fw ctl get int

fwha_vmac_global_param_enabled on all cluster members and check that the result of the

command returns the value 11. This command shows the current value of the global kernel

parameter fwha_vmac_global_param_enabled, which controls whether VMAC mode is enabled or

disabled. VMAC mode is a feature that associates a Virtual MAC address with each Virtual IP address

of the cluster, which reduces the need for Gratuitous ARP packets and improves failover

performance1. The other options are incorrect. Option A is not a valid command. Option C is a

command to show the status of cluster interfaces, not VMAC mode2. Option D is a command to

show the value of a different global kernel parameter, fwha_vmac_global_param_enabled, which

controls whether VMAC mode is enabled for all interfaces or only for non-VLAN interfaces1.

Reference: How to enable ClusterXL Virtual MAC (VMAC) mode, cphaprob

If AdminB sees a lock icon on a rule, it means that the rule is locked by AdminA and will be made

available if the session is published. A session is a set of changes made by an administrator in

SmartConsole. A session can be published to save and share the changes with other administrators,

or discarded to cancel the changes and unlock the objects1.

Reference: 1: Check Point R81 Security Management Administration Guide, page 18.

In Check Point SmartConsole, when multiple administrators work on security policies, a lock icon

appears on rules or objects that are being modified.

If AdminB sees a lock, it means that AdminA is currently editing the rule, and it is locked for others.

Once AdminA publishes the session, the rule becomes available to other administrators.

Option B (incorrect): Saving a session does not release the lock; it must be published.

Option C (incorrect): The lock is not caused by AdminB but by another user (AdminA).

Option D (incorrect): A lock appears when another user (AdminA) is editing, not the current user.

Thus, the correct answer is A. Rule is locked by AdminA and will be made available if the session is

published.

Reference:

Check Point documentation confirms that SmartConsole locks a rule when another administrator is

editing it, and the rule is unlocked upon publishing the session .

The communication between different Check Point components is secured in R80 by using SIC. SIC

stands for Secure Internal Communication and it is a mechanism that ensures the authenticity and

confidentiality of communication between Check Point components, such as Security Gateways,

Security Management Servers, Log Servers, etc. SIC uses certificates issued by the Internal CA (ICA)

and encryption algorithms such as AES-25634. Reference: Check Point R81 Quantum Security

Gateway Guide, Check Point R81 Quantum Security Management Administration Guide

The Threat Prevention Software Blade that provides protection from malicious software that can

infect your network computers is Anti-Virus. Anti-Virus is a software blade that scans files and traffic

for viruses, worms, trojans, spyware, and other malware. Anti-Virus can block or clean infected files

and prevent malware outbreaks. IPS is a software blade that provides protection from network

attacks and exploits. Anti-Malware is not a software blade, but rather a term that refers to any

software that can detect and remove malware. Content Awareness is a software blade that provides

visibility and control over data that enters or leaves the network based on file types, data types, and

keywords.

Reference: [Anti-Virus Software Blade], [IPS Software Blade], [What is Anti-Malware?], [Content

Awareness Software Blade]

In order to modify Security Policies, the administrator can use SmartConsole or mgmt_cli (API) on

any computer where SmartConsole is installed. SmartConsole is a graphical tool that allows the

administrator to create, edit, and manage security policies using a web browser. mgmt_cli (API) is a

command-line tool that allows the administrator to perform the same tasks using commands and

scripts. Both tools can connect to the Security Management Server remotely from any computer that

has SmartConsole installed.

Reference: [SmartConsole Overview], [mgmt_cli (API)]