QoS global properties are the settings that apply to all QoS rules and QoS interfaces on the Security Gateway.  They include the following options 1 2 :

Weight : This is the relative importance of a QoS rule compared to other QoS rules. A higher weight means a higher priority. The default weight is 1, and the maximum weight is 1000.

Authenticated timeout : This is the time period in seconds that a connection remains in the QoS rule after the last packet is sent or received. The default timeout is 600 seconds, and the min i mum timeout is 60 seconds.

Schedule : This is the time period in which a QoS rule is active. You can define a schedule for each day of the week, or use the default schedule of always active.

Rate : This is not a valid option for QoS global properties. Rate is an option for QoS rule a c tion, which defines the maximum bandwidth allocated for a QoS rule. The rate can be specified in Kbps, Mbps, or percentage of interface speed.

The WebUI can be used to manage user accounts and assign privileges to users. It can also add users to your Gaia system and edit the home directory of the user.  However, it cannot assign user rights to their home directory in the Security Management Server 1 . References:  Check Point Resource Library , page 3.

The fwd process on the Security Gateway sends logs to the fwd process on the Management Server, where it is forwarded to  fwm  via  cpd . The fwm process is responsible for managing the log files and the cpd process is responsible for communication between processes. The other options are incorrect because they involve processes that are not related to logging or communication.  References:   Check Point Cert i fied Security Expert R81.20 Course Overview ,  sk163413: Support, Support Requests, Training … - Check Point Software ,  Check Point Certified Security Expert R81.20

The process that pulls the application monitoring status from gateways is  cpd 1 .  The cpd process is responsible for the communication between the Security Management Server and the Security Gat e way 2 .  It handles tasks such as policy installation, status reporting, logging, and synchronization 2 .  The cpd process also monitors the application status of the Security Gateway, such as CPU, memory, disk space, and processes 3 .  The cpd process sends this information to the Security Management Server, which displays it in SmartConsole and SmartView Monitor 3 .

The verified answer is B. Automatic proxy ARP configuration can be enabled.

Proxy ARP is a feature that allows a gateway to respond to ARP requests on behalf of another IP address that is not on the same network segment. Proxy ARP is required for manual NAT rules when the NATed IP addresses are not routed to the gateway 1 .

By default, proxy ARP for manual NAT rules has to be configured manually by edi t ing the local.arp file or using the CLISH commands on the gateway 2 . However, since R80.10, there is an option to enable automatic proxy ARP configuration for manual NAT rules by modifying the files $CPDIR/tmp/.CPprofile.sh and $CPDIR/tmp/.CPprofile.csh on the gateway 3 .

fw ctl proxy is a command that displays the proxy ARP table on the gateway, but it does not configure proxy ARP 4 .

Translate Destination on Client Side is a NAT option that determines whether the de s tination IP address is translated before or after the routing decision. It does not affect proxy ARP.

 The NAT property ‘Translate destination or client side’ is used to determine whether the destination IP address of a packet should be translated on the client side or the server side of a connection. If this property is not enabled, then the destination IP address is translated on the server side, which means that the gateway takes care of all details necessary for NAT to work. The gateway will send an ARP request for the translated IP address and will reply to any ARP requests for that address. Therefore, there is no need to configure a host route, use the local.arp file, or enable bi-directional NAT for NAT to work correctly. References:  R81 Security Management Administration Guide , page 1010.

Main Mode in IKEv1 uses  six packets  for negotiation 1 . Main Mode is the default mode for IKE phase I, which establishes a secure channel between the peers.  Main Mode performs the following steps 2 :

The peers exchange their security policies and agree on a common set of parameters.

The peers generate a shared secret key using the Diffie-Hellman algorithm.

The peers authenticate each other using pre-shared keys, digital signatures, or public key encryption. Main Mode is partially encrypted, from the point at which the shared DH key is known to both peers 2 .  Main Mode provides more security than Aggressive Mode, which uses only three pac k ets for negotiation, but is faster and simpler 2 . References:  Check Point gateways always send main IP address as IKE Main Mode ID - Check Point Software ,  IPsec and IKE - Check Point Software

The hostname of the Standby member should not be changed to match the hostname of the Active member, as this would cause a conflict in the network.  The correct procedure is to change the hostname of the Active member to a different name, and then change the Standby member to the original hostname of the Active member 1 . References:  1 : Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 9.

 Establishing SIC between gateways and the management server is a prerequisite for Central Deployment usage, as the CDT tool will not take care of this automatically 1 .  The administrator must have write permission on SmartUpdate, the Security Gateway must have the latest CPUSE Deployment Agent, and the Security Gateway must have a policy installed 2 .  These are the basic requirements for using the Central Deployment Tool (CDT), which is a utility that lets you manage a deployment of software packages from your Management Server to the multiple managed Security gateways and cluster members at the same time 2 .  The CDT can perform various actions, such as installation of software packages, taking snapshots, running shell scripts, pushing/pulling files, and automating the RMA backup and restore process 2 .  The CDT is supported on Check Point Appliances with R80.40 and higher versions 2 . References:  How to keep your Security Gateways up to date - Check Point Software ,  Central Deployment Tool (CDT) - Check Point CheckMates .

 On R81.20 the IPS Blade is managed by the  Threat Prevention policy . The Threat Prevention policy is a unified policy that includes Anti-virus, IPS, Anti-bot, and Threat Emulation software blades. The IPS blade provides protection against network attacks and exploits by inspecting the traffic and blocking malicious packets. The IPS blade can be configured with different profiles and exceptions to suit different security needs. References:  R81 Threat Prevention Administration Guide , page 15.

Cluster Synchronization is a mechanism that allows cluster members to share state i n formation and maintain a consistent security policy. Cluster Synchronization uses two types of synchronization: Full Synchronization and Delta Synchronization. Full Synchr o nization transfers the entire Security Policy and state tables from one cluster member to another. Delta Synchronization transfers only the changes in the state tables.  Cluster Synchronization uses two services for communication: TCP port 256 (CPHA) for Full Sy n chronization and UDP port 8116 for Delta Synchronization 3 . Therefore, the correct a n swer is A.

CoreXL is a technology that improves the performance of the Security Gateway by utili z ing multiple CPU cores for processing traffic. CoreXL creates multiple instances of the firewall kernel (fwk) that run in parallel on different CPU cores.  The number of kernel i n stances can be configured using the cpconfig command on the Security Gateway 3 .  The minimum number of CPU cores required to enable CoreXL is 2, as one core is reserved for SND (Secure Network Distributor) and one core is used for running a kernel i n stance 4 . If the Security Gateway has only one CPU core, CoreXL cannot be enabled. Therefore, the correct answer is C.

The least ideal Synchronization Status for Security Management Server High Availability deployment is Collision. This status indicates that both members have modified the same object independently, resulting in a conflict that needs to be resolved manually. The other statuses are either normal or indicate a temporary delay in synchronization.   References:  High Availability Administration Guide

 The API command  add host name < New HostName > ip-address < ip address >  can be used in a script to create 100 new host objects with different IP addresses. This command adds a new host object with the specified name and IP address to the database. The other commands are either not valid or not suitable for creating new host objects. References: Check Point - Management API reference

The three components for Check Point Capsule are Capsule Workspace, Capsule Docs, and Capsule Cloud. Capsule Workspace is a secure container app that allows users to access corporate data and applications from their mobile devices. Capsule Docs is a solution that protects documents with encryption and granular access control. Capsule Cloud is a cloud-based security service that enforces security policies on devices that are outside the corporate network. References: Check Point Capsule