156-541 Check Point Certified Multi-Domain Security Management Specialist - R81 (CCMS) Practice Questions
Prepare for 156-541 with more than an answer.
- Time limit
- 90 minutes
- Questions on the exam
- 75
- Passing score
- not published by Check Point
- Level
- Infinity Specialist Accreditation
- Valid for
- 2 years (all Check Point certifications and accreditations valid 24 months from exam date)
Domains covered on the exam 3
- Multi-Domain Installation and Configuration34%
- Global Domain Global Policy Management33%
- Multi-Domain Troubleshooting33%
- 1
A Managed Security Service Provider (MSSP) uses an MDS to manage policies for 50 different customers. Customer A and Customer B both require a strict block on all outbound Telnet traffic. The MSSP creates a 'Block_Telnet' rule in the Global Domain, above the Domain Layer placeholder.
The MSSP administrator publishes the Global Domain changes and then reassigns the updated Global Policy to Customer A and Customer B's domains.
However, upon testing, Customer A's gateways are still allowing outbound Telnet traffic, while Customer B's gateways are successfully blocking it. Customer B's administrator installed policy after the assignment.
What is the most likely reason for this discrepancy?
Show answer details
Correct answer: E
Assigning or reassigning a global configuration updates the local Domain database and publishes it, but it does not install policy on Security Gateways. Customer A's gateways keep enforcing the previously installed policy until policy is installed from Customer A's Domain Management Server. A global rule above the Domain Layer placeholder is enforced before any local rule, so a local Accept rule cannot bypass it.
- 2
When connected to the Multi-Domain Server via SmartConsole, administrators can view different types of activity logs depending on their context. Which TWO of the following are valid log types that can be queried in this environment? (Select TWO)
Show answer details
Correct answer: A, E
In SmartConsole Logs & Monitor, administrators query Audit Logs, which record administrator actions such as logins, publishing changes and installing policy, and Traffic Logs, which the Security Gateways generate for the connections they accept or drop. Kernel panic, BIOS and BGP routing information are not SmartConsole log types.
In SmartConsole Logs & Monitor, administrators query Audit Logs, which record administrator actions such as logins, publishing changes and installing policy, and Traffic Logs, which the Security Gateways generate for the connections they accept or drop. Kernel panic, BIOS and BGP routing information are not SmartConsole log types.
- 3
True or False: When a Global Administrator assigns a Global Policy to a local Domain, the policy is automatically installed onto all Security Gateways managed by that Domain.
Show answer details
Correct answer: B
False. Assigning a Global Policy only updates the database of the target Domain Management Server (DMS). To enforce the rules on network traffic, the local domain administrator (or a script) must explicitly perform a 'Policy Install' from the DMS to the actual Security Gateways.
- 4
An MDS administrator wants to run a unified query to see all administrative login events across all 15 domains managed by the Multi-Domain Server. To achieve this in SmartConsole, the administrator must:
Show answer details
Correct answer: D
By connecting SmartConsole directly to the MDS context (rather than a specific domain context) and navigating to Logs & Monitor, administrators with appropriate permissions can view aggregated MDS-level activity and audit logs spanning all domains.
- 5
A large enterprise wishes to deploy SmartEvent to correlate threats across its Multi-Domain environment. Because of high log volume (100,000 logs/sec), the architect decides against enabling the SmartEvent blade directly on the MDS appliance. What is the Check Point recommended architecture for integrating SmartEvent into a high-volume MDSM environment?
Show answer details
Correct answer: D
In high-volume environments, enabling SmartEvent on the MDS can cause resource starvation. The best practice is to deploy a Dedicated SmartEvent Server. It is managed via the MDS (often defined in the Global Domain) and correlates logs by fetching them from the MLM or Domain Log Servers.
- 6
A telecommunications enterprise is planning to deploy Check Point Multi-Domain Security Management (MDSM) R81 to manage 15 distinct subsidiary networks. The lead architect needs to explain the functional difference between the Multi-Domain Server (MDS) and the Domain Management Server (DMS) to the implementation team. Which statement accurately describes the relationship and function of these components?
Show answer details
Correct answer: B
In the Check Point MDSM architecture, the Multi-Domain Server (MDS) is the physical or virtual appliance that provides the global management framework. The Domain Management Server (DMS) is a virtualized container within the MDS that acts exactly like a standalone Security Management Server for a specific domain/subsidiary, managing its own policies, objects, and gateways.
- 7
A security engineer is tasked with migrating an existing R81.10 Security Management Server (SMS) into a newly deployed R81.10 Multi-Domain Server as a new Domain Management Server (DMS). To accomplish this, the engineer must export the database from the SMS. Which method does the R81.10 Installation and Upgrade Guide specify for this export?
Show answer details
Correct answer: D
For SMS-to-DMS migration in R81.10, export the database on the source Security Management Server with the Management API command 'mgmt_cli -d "System Data" migrate-export-domain file-path .tgz include-logs "false"'. The -d "System Data" option is mandatory. Import it on the MDS with migrate-import-domain, which creates the DMS automatically. 'migrate_server' is the upgrade/backup utility, and 'cma_migrate' imports R7x DMS databases.
- 8
FinTech Corp operates a globally distributed environment requiring High Availability (HA) for its management infrastructure. They have deployed two Multi-Domain Servers (MDS-A in New York, MDS-B in London).
For the 'Payments' domain, they require the Primary DMS to run on MDS-A and a Secondary DMS to run on MDS-B. A network outage isolates the New York data center, making MDS-A entirely unreachable from London.
During the outage, a critical security rule must be added to the Payments domain gateways located in Europe. What is the correct procedure the London administrator must follow to implement this rule?
graph TD subgraph New York DC MDS_A[MDS-A : Active Global] DMS_P[Payments DMS : Primary / Active] end subgraph London DC MDS_B[MDS-B : Standby Global] DMS_S[Payments DMS : Secondary / Standby] end MDS_A -.-> |Sync Failed| MDS_B DMS_P -.-> |Sync Failed| DMS_SShow answer details
Correct answer: E
Domain Management Server failover is manual. A Standby DMS opens in Read Only mode. To make changes while the Active DMS is unreachable, connect to the Standby Payments DMS on MDS-B, go to Menu > Management High Availability and, in the High Availability Status window, click Actions > Set Active. The DMS on MDS-B then becomes Active (Read/Write), so the administrator can add the rule and install policy on the European gateways. If both servers end up Active, the Domain is in Collision mode until one of them is set back to Standby.
- 9
A managed service provider is onboarding a new client and needs to establish a dedicated management environment within their existing R81 Multi-Domain Server infrastructure. Which THREE of the following steps are required to successfully deploy and access a new Domain Management Server (DMS)? (Select THREE)
Show answer details
Correct answer: A, B, D
A new Domain is created as a Domain object in the Multi-Domain Server SmartConsole (Multi-Domain > Domains), together with at least one Domain Management Server that gets its own IP address. To connect to the Domain with SmartConsole, the administrator's computer must be allowed as a GUI (Trusted) client and assigned to the Domain. A dedicated physical NIC per DMS is not required, and cpconfig is not used to allocate memory to Domains.
A new Domain is created as a Domain object in the Multi-Domain Server SmartConsole (Multi-Domain > Domains), together with at least one Domain Management Server that gets its own IP address. To connect to the Domain with SmartConsole, the administrator's computer must be allowed as a GUI (Trusted) client and assigned to the Domain. A dedicated physical NIC per DMS is not required, and cpconfig is not used to allocate memory to Domains.
A new Domain is created as a Domain object in the Multi-Domain Server SmartConsole (Multi-Domain > Domains), together with at least one Domain Management Server that gets its own IP address. To connect to the Domain with SmartConsole, the administrator's computer must be allowed as a GUI (Trusted) client and assigned to the Domain. A dedicated physical NIC per DMS is not required, and cpconfig is not used to allocate memory to Domains.
- 10
True or False: In a Check Point Multi-Domain environment, a single Domain can have multiple active Domain Management Servers (DMS) processing policy installations simultaneously to provide load balancing.
Show answer details
Correct answer: B
False. While a Domain can have multiple Domain Management Servers (DMS) for High Availability, they operate in an Active/Standby configuration for administrative tasks. Only one DMS is Active (read/write) at any given time for a specific domain, preventing split-brain scenarios.
