The User Directory Software Blade allows you to create user definitions on an LDAP server, such as Active Directory, and use them in your security policy. You can also integrate with other user authentication methods, such as SecurID, RADIUS, or TACACS+, but you cannot create user definitions on those servers.

The references are:

Check Point Certified Security Expert R81.20 (CCSE) Core Training , slide 13

Check Point R81 Quantum Security Gateway Guide , page 139

Check Point R81 Identity Awareness Administration Guide , page 9

 The base level encryption key used by Capsule Docs is RSA 2048. This means that Capsule Docs uses a 2048-bit RSA public key encryption algorithm to encrypt and decrypt documents. RSA is an asymmetric encryption algorithm that uses two keys: a public key that can be shared with anyone, and a private key that must be kept secret. AES, SHA-256, and RSA 1024 are not the base level encryption keys used by Capsule Docs. References: : Check Point Software, Getting Started, Capsule Docs Encryption.

Identity Awareness maps users and computer identities, enabling enforcement of Access Control policy rules and auditing data based on identity.  It is an easy-to-deploy and scalable solution that works for both Active Directory and non-Active Directory based networks, including employees and guest users 1 .  By considering network location, user identity, and machine identity, organiz a tions can control access between different segments in the network using an identity-based pol i cy 2 .

A minimal effort upgrade is a process of upgrading the Security Gateway software without changing the configuration or policy. It is done by using the CPUSE (Check Point Update Service Engine) tool, which is available in the Gaia Portal or CLI. The CPUSE tool performs a pre-upgrade verification to check the compatibility and readiness of the system for the upgrade. If the verification passes, the CPUSE tool installs the new software package and reboots the system. During the reboot, there is a short network downtime, but it does not affect the existing connections. All connections that were initiated before the upgrade will be handled normally by the upgraded gateway. The minimal effort upgrade preserves the existing configuration and policy, so there is no need to reinstall the policy or reconfigure the gateway after the upgrade.

Endpoint Security VPN is a lightweight remote access client that supports Windows and macOS computers. It provides secure connectivity to corporate resources using L2TP/IPSec, SSL, or Check Point’s proprietary VPN protocol. Endpoint Security VPN also integrates with other Endpoint Security products such as SandBlast Agent, Full Disk Encryption, Media Encryption, and Firewall. References:  Check Point R81 Endpoint Security VPN Administration Guide , page 5

The upgrade process for a Management High Availability Cluster is to first upgrade the Standby Management Server, then perform a failover and upgrade the Active Management Server. This way, the cluster can maintain its functionality and synchronization during the upgrade.

The references are:

Check Point R81 Upgrade Guide , page 17

Check Point Certified Security Expert R81.20 (CCSE) Core Training , slide 10

The minimum open server hardware requirements for a Security Management Server/Standalone in R81 are:

CPU: Intel Core i5-4590 or equivalent (4 cores)

Memory: 8 GB RAM

Disk space: 500 GB

The other options do not match the minimum requirements. Option A has insufficient CPU cores, memory and disk space. Option B has excessive CPU cores and disk space. Option D has excessive CPU cores, memory and disk space.

 Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or on specific tunnels in the community. Permanent VPN tunnels are always active and prevent VPN tunnel negotiation failures due to idle time or traffic volume. You can configure permanent VPN tunnels in SmartConsole by selecting the Permanent Tunnel option in the VPN Community Properties window.

 There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A’s interface issues were resolved and it became operational.

When it re-joins the cluster, it will not become active automatically, since ‘maintain cu r rent active cluster member’ option on the cluster object properties is enabled by default. This option prevents a failback to the original active member after a failover, unless the current active member fails or is manually switched over. This option provides stability and avoids unnecessary failovers. References:  R77 ClusterXL Administration Guide , page 23.

 The command to add users to or from existing roles is  add rba user < User Name > roles < List > . This command allows you to assign one or more roles to a user in the Gaia database. Roles are collections of permissions that define what actions a user can perform on the system. You can use predefined roles or create your own custom roles. To remove a role from a user, you can use the command  delete rba user < User Name > roles < List > . 

The correct order of a log flow processed by SmartEvent components is: Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client. The Firewall generates logs for traffic and security events. The Log Server receives and stores the logs from the Firewall. The Correlation Unit analyzes the logs and generates SmartEvent events based on predefined or custom rules. The SmartEvent Server Database stores the events generated by the Correlation Unit. The SmartEvent Client displays the events and reports from the SmartEvent Server Database. References: : Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 12; : Check Point Software, Training & Certification, SmartEvent Introduction.

The correct answer is B. R80.10 and later.

According to the Check Point documentation 1 , the Multi-Version Cluster Upgrade (MVC) is a new feature in R80.40 and higher that replaces the Connectivity Upgrade (CU) method. MVC allows you to upgrade a cluster to a newer version without a loss in connectivity and test the new version on some of the cluster members before you decide to upgrade the rest of the cluster members. The MVC feature supports the fo l lowing destination versions 2 :

R80.10

R80.20

R80.30

R80.40

R81

R81.20

The other options are incorrect because they are either not supported by MVC or they are older than the source version (R80.40).

 The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, the syntax is  field_name:string . For example, to search for all rules that have a comment containing “VPN”, the syntax is  comment:VPN .  The other options are not valid syntaxes for searching for a value in a field 3 . References:  3 : Check Point Software, Getting Started, Searching for Text Strings.

 Gaia has two default user accounts that cannot be deleted: Admin and Monitor. Admin is a superuser account that has full access to all Gaia features and commands. Monitor is a read-only account that can view Gaia configuration and status but cannot make any changes. Both accounts have predefined passwords that can be changed by the Admin user. References: [Check Point R81 Gaia Administration Guide] , page 29

SRC: GAIA R81.20 Administration Guide User Management - > Users These users are created by default and cannot be deleted: admin and monitor

You can disable the SecureXL mechanism temporarily for further diagnostic by running  fwaccel off  on the Security Gateway 1 .  This command disables SecureXL, which is an acceleration solution that maximizes the performance of the Firewall by offloading CPU-intensive operations to the S e cureXL device 2 .  Disabling SecureXL can help you troubleshoot connectivity or policy issues, as it for c es all traffic to go through the Firewall kernel and bypass the SecureXL device 1 .  To run this command, you need to access the Security Gateway in expert mode and run  fwaccel off 1 .  To enable S e cureXL again, you can run  fwaccel on 1 .  Note that disabling SecureXL may affect the performance of the Security Gateway, so use it with caution and only when necessary 1 .