Sure Pass Exam 156-315.81 PDF

The Access Control policy supports two policy layers. These are the Network layer and the Application & URL Filtering layer. The Network layer contains rules that control the network traffic based on the source, destination, service, and action. The Application & URL Filtering layer contains rules that control the application and web access based on the application, site category, and user identity12.

The Access Control policy can also use inline layers, which are sub-policies that are embedded within a rule. Inline layers allow more granular control over specific traffic or scenarios, such as VPN, Mobile Access, or different user groups13. However, inline layers are not considered as separate policy layers, but rather as extensions of the parent rule4.

Therefore, the correct answer is A. The Access Control policy supports two policy layers.

References:

• 1, Policy Layers in R80.x - Check Point CheckMates
• 2, Access Control policies, layers, and rules | Check Point Firewall …
• 3, Chapter 8: Introduction to Policies, Layers, and Rules - Check Point …
• 4, Creating an Access Control Policy - Check Point Software

The tool that is used to enable ClusterXL is cpconfig. ClusterXL is a software-based Load Sharing and High Availability solution that distributes network traffic between clusters of redundant Security Gateways1. ClusterXL can be enabled on Check Point Security Gateways running on Gaia OS, SecurePlatform OS, IPSO OS, or X-Series XOS2.

To enable ClusterXL, the administrator must run the cpconfig command on each cluster member and select the option to enable ClusterXL. This will prompt the administrator to choose the ClusterXL mode (High Availability or Load Sharing) and the Cluster Control Protocol (CCP) mode (Broadcast or Multicast). After enabling ClusterXL, the administrator must reboot the cluster members for the changes to take effect34.

Therefore, the correct answer is B. The tool that is used to enable ClusterXL is cpconfig.

References:

• 1, Introduction to ClusterXL - Check Point Software
• 2, ClusterXL Requirements and Compatibility - Check Point Software
• 3, Configuring ClusterXL - Check Point Software
• 4, How to configure ClusterXL - Check Point Software Technologies

The default port used by the AMON server when using CPSTAT is 18192. CPSTAT is a command-line tool that allows administrators to monitor various statistics and status information about Check Point products and components, such as CPU usage, memory usage, policy installation, cluster state, etc. CPSTAT uses AMON (Advanced Monitoring) protocol to communicate with AMON server, which is a daemon that runs on Security Gateways or Management Servers and collects and provides AMON data. By default, AMON server listens on TCP port 18192 for incoming CPSTAT requests.

The correct statement about Security Gateway and Security Management Server failover in Check Point R81.X in terms of Check Point Redundancy driven solution is: Security Gateway failover is an automatic procedure but Security Management Server failover is a manual procedure. Security Gateway failover is a feature that allows a cluster of Security Gateways to provide high availability and load balancing for network traffic. If one Security Gateway fails or becomes unreachable, another Security Gateway in the cluster automatically takes over its role and handles the traffic without interrupting the service. Security Management Server failover is a feature that allows a backup Security Management Server to take over the role of the primary Security Management Server in case of failure or disaster. However, this feature requires manual intervention to activate the backup server and restore the database from a backup file.