156-561 Dumps To Pass CheckPoint CCCS Exam in One Day (Updated 209 Questions) [Q108-Q130]

4.7/5 - (3 votes)

156-561 Dumps To Pass CheckPoint CCCS Exam in One Day (Updated 209 Questions)

156-561 Exam Brain Dumps – Study Notes and Theory

CheckPoint 156-561 Exam Syllabus Topics:

Section	Weight	Objectives
Topic 1: Cloud Management and Automation	12%	– Cloud Management Extension (CME) and Smart-1 Cloud – Automation with Terraform, Ansible, CloudGuard API – Provisioning, configuration and policy updates at scale
Topic 2: CloudGuard Network Security on Azure	25%	– Integration with Azure networking: Virtual WAN, Route Server, ARM templates – Deployment and scaling options: VMSS, availability sets – Policy management and traffic control in Azure environments
Topic 3: CloudGuard Posture and Workload Protection	8%	– Compliance assessment: CIS, PCI, HIPAA, NIST, GDPR – Micro-segmentation and workload security
Topic 4: CloudGuard Fundamentals and Architecture	20%	– Cloud security concepts and challenges – Network security architectures in public, private and hybrid clouds – CloudGuard product portfolio and use cases
Topic 5: CloudGuard Network Security on GCP	10%	– Scaling and management in Google Cloud – Deployment and integration with GCP VPC and load balancing
Topic 6: CloudGuard Network Security on AWS	25%	– Traffic inspection, routing and high availability – Deployment models: standalone, cluster, auto-scaling – Integration with AWS services: VPC, Transit Gateway, CloudFormation

NO.108 How many AWS Internet gateways can you define in AWS?

Two per VPC

Unlimited

One per VPC

One per Region

NO.109 The Cluster Control Protocol uses which Protocol/Port Combination?

UDP 256

TCP 8116

UDP 8116

TCP 18197

The Cluster Control Protocol (CCP) uses UDP port 8116 for communication between the members of a cluster. This protocol is responsible for synchronization and state sharing among the cluster members, ensuring that the cluster operates cohesively during failover and load balancing scenarios.

NO.110 One of the limitations in deploying Check Point CloudGuard Cluster High Availability is that:

State synchronization is required and must be done ONLY on a dedicated link

High Availability configurations support only two Security Gateway Members

High Availability configurations support only three Security Gateway members

VMAC mode is mandatory for all cluster interfaces

NO.111 The Auto Scaling solution is an example of which of the following?

Horizontal scaling

Amazon Elastic Kubernetes Service

Vertical scaling

Amazon Elastic Container Service

Auto Scaling in cloud environments, such as AWS, is an example of horizontal scaling. Horizontal scaling involves adding or removing instances (virtual machines or containers) to increase or decrease capacity based on demand, rather than increasing the resources (like CPU or memory) of a single instance, which is known as vertical scaling. Auto Scaling automatically adjusts the number of instances in response to changing traffic or load, making it a form of horizontal scaling.

NO.112 What is Cloud Security according to the Five Pillars?

The ability to support development and run workloads effectively

The ability of a Workload to function correctly and consistently in all expected

The ability to use cloud resources efficiently for meeting system requirements, and maintaining that efficiency as demands changes and technologies evolve

In terms of tie cloud, security is about architecting every workload to prevent

NO.113 One of the five pillars of the framework for cloud security is ‘Performance Efficiency’. The design principles of Performance Efficiency include:

Automatically recover from failure

Adopt a consumption model –

Go Global in minutes –

Apply security at all layers –

erformance Efficiency
* The ability to use cloud resources efficiently for meeting system requirements, and maintaining that efficiency as demand chandes and technologies evolve
* Design Priniciples:
> Democratize advanced technologies
> Go Global in minutes
> Use serverless architectures
> Experiment ore often
> Consider mechanical sympathy

NO.114 Which of the below are not possible in relation to the Check Point licensing model?

You can re-use your existing open server license (BYOL-Bring your own license)

You use the built-in license from the AWS market (PAYG-Pay As You Go)

You use as many CloudGuard licenses as you have virtual cores in the VM (BYOL-Bring your own license)

You use a license for CloudGuard AWS you buy at CP (BYOL-Bring your own license)

NO.115 On Public Cloud, what is included in the BYOL (Bring your own license) package?

1 year subscription includes: Software, Services & Support

1 year subscription for Services & Support

Perpetual licenses for Software only

Perpetual licenses for Software & Services

NO.116 What is the command to retrieve the status of the Management API?

CLISH> show api status

api status

$FWDIR/scripts/cpm_status.sh -t mapi -s DEBUG

$FWDIR/scripts/api_status.sh

The command $FWDIR/scripts/cpm_status.sh -t mapi -s DEBUG is used to retrieve the status of the Management API. It provides detailed status information related to the Management API, which helps in troubleshooting and understanding the current state of the API on the system.

NO.117 What mechanism is used in the Cloud during a ClusterXL fail-over scenario?

The Router Discovery protocol will be used to propagate the new route after a failover scenario.

Cloud clusters perform failovers by making API calls to the CSP.

The Neighbor Discovery protocol will be used to propagate the new cluster node to be forwarded the packets to.

The Gratuitous ARP mechanism will be used to change the MAC address entry in the ARP cache of the router.

In cloud environments, particularly when using IPv6, Neighbor Discovery Protocol (NDP) is used during a ClusterXL failover scenario to propagate the new cluster node. NDP helps in updating the network to reflect the new node and ensures that traffic is correctly forwarded to the active node in the cluster. Unlike traditional on-premises environments that use Gratuitous ARP (GARP), cloud environments typically rely on NDP for handling failovers in IPv6 networks.

NO.118 Adding new Security Gateways as system load increases is an example of __________

Vertical Scaling

Network Scaling

Horizontal Scaling

System Scaling

NO.119 What do CloudGuard cluster members use to perform a failover?

GARP

API calls to the Cloud Service Provider

Private IP

Custom routes

CloudGuard cluster members use a private IP to perform a failover. In the event of a failover, the new active member takes over the private IP address, ensuring that traffic is rerouted correctly and that the failover process is seamless without relying on external mechanisms like GARP or API calls to the Cloud Service Provider.

NO.120 An organization is using an adaptive security policy where a Data Center Object was imported and used in some rules. When the cloud resource represented by this object changes it’s IP address, how will the change be effected on the Security Gateway

If CloudGuard Controller is enabled on the Security Gateway, the gateway will connect with the Cloud account and synchronize all the Data Center Objects used on

With a property functioning configuration, the change will automatically be done on the Security Gateway without any action required by the administrator

The Data Center Object needs to be refreshed in the SmartCansoIe and then a policy install will be required

The change is automatically updated to the Security Management Server and so only a policy install from SmartConsole or with API will be required

NO.121 What is a Spoke function?

To provide isolated environments to deploy applications and services

To provide a separate subnet for applications

To provide a Workload with availability

To provide a Workload with scalability

NO.122 According to best practices what would be the best way to install a Check Point cluster on AWS?

Following the instruction from the relevant Check Point SK

With PowerShell

From AWS Console

From AWS Market Place

NO.123 Which language can be used by users of Cloud Security Posture Management to create custom Security Policies?

eXtensible Markup Language (XML)

Posture Management Language (PML)

Governance Specific Language (GSL)

JavaScript Object Notation (JSON)

CloudGuard Governance Specification Language (GSL) is a syntax to define posture management rules, which can be included in rulesets in the CloudGuard Posture Management.

NO.124 What is an alternative method to double NAT in Azure?

Scaling

System Routes

Peering

User Defined Routes

NO.125 What do Workloads require to automate processes?

API

CLI

CSP Portal

Shell

To effectively enable automation, it needs to be trusted. Trust-based APIs enable self-service integrations with third-party systems and automate policy changes within the scope of their privileges.

NO.126 What platform provides continuous compliance and governance assessments that evaluate public infrastructure according to industry to industry standards and best practices?

Cloud Security Posture Management

CloudGuard laaS Public Cloud

CloudGuard SaaS

CloudGuard laaS Private Cloud

NO.127 What are the languages supported for Cloud Templates?

JSON and YAML

JSON and Python

Python and PERL

YAML and Python

CloudFormation allows you to model your entire cloud environment in text files. You can use open-source declarative languages, such as JSON or YAML, to describe what AWS resources you want to create and configure.

NO.128 What can Data Center Objects represent?

vNets. VPCs or Network Security Groups

Compute. Regions or Availability Zones

Public IP. Private IP NAT or IAM roles

Cloud Data Center. Tags, subnets, or hosts

NO.129 The framework for cloud security consists of five basic components, or pillars. Making small, reversible changes is a design principle of which of these five pillars?

Performance Efficiency

Operational Excellence

Reliability

Cost Optimization

NO.130 The integration of cloud resources into the Security Policy requires establishing a secure connection between_________________

The SDDC, CloudGuard Security Gateways, and the Security Management Server

The SDDC and CloudGuard Security Gateways.

The SDDC and the Security Management Server

CloudGuard Security Gateways and the Security Management Server

A component of Check Point’s Security Management Server, the CloudGuard Controller manages security in public and on-premises environments with one unified management solution.
CloudGuard Controller establishes a trusted relationship with the cloud environment.
The CloudGuard Controller pushes updates to attributes and objects in the Security Policy rules to Check Point Security Gateways.

Loading …