156-561 Check Point Certified Cloud Specialist (CCCS) R81.20 Practice Questions
Prepare for 156-561 with more than an answer.
- Exam fee
- $250 USD
- Level
- Specialist (Infinity Specialist Accreditation)
- Valid for
- 2 years
Domains covered on the exam 8
- Introducing CloudGuard12.5%
- CloudGuard Network Security Architectures12.5%
- CloudGuard Network Security Management12.5%
- CloudGuard Network Security Scaling12.5%
- CloudGuard Network Security Clustering in the Cloud12.5%
- CloudGuard Network Security Policy12.5%
- CloudGuard Network Security Automation12.5%
- Troubleshoot CloudGuard Network Security12.5%
- 1
Review the following cloud architecture diagram designed to inspect outbound internet traffic originating from private application subnets.
graph TD AppSubnet[Private App Subnet] -->|UDR/Route Table| FWSubnet[CloudGuard Gateway Subnet] FWSubnet -->|Next Hop| IGW[Internet Gateway] IGW --> Internet((Internet))For the application instances in the Private App Subnet to successfully reach the internet and receive return traffic, what configuration MUST be applied on the CloudGuard Gateway in this specific flow?
Show answer details
Correct answer: C
In an Egress (outbound) traffic flow where private instances access the internet through a CloudGuard Gateway, the gateway must perform Source NAT (often called Hide NAT). Because the application instances have private IPs that are non-routable on the public internet, the gateway must translate the source IP to its own public-facing IP address so that return traffic from the internet can be routed back to the gateway.
- 2
An organization wants to deploy Check Point CloudGuard Gateways in AWS but prefers not to maintain the underlying operating system and virtual machine infrastructure for the Security Management Server. Which Check Point solution best addresses this requirement?
Show answer details
Correct answer: D
Smart-1 Cloud is Check Point's Security Management as a Service (MaaS) offering. It provides the full capabilities of the Security Management Server and SmartConsole without requiring the customer to deploy, maintain, or patch the underlying infrastructure (IaaS) for the management server itself.
- 3
A security administrator is deploying a new CloudGuard Gateway in an Azure VNet. The Security Management Server is located in an on-premises data center connected via a site-to-site VPN. When attempting to establish Secure Internal Communication (SIC) from SmartConsole to the new gateway, the connection times out.
Assuming the VPN tunnel is up and passing ICMP traffic successfully, what is the most likely cause of the SIC failure?
Show answer details
Correct answer: C
Secure Internal Communication (SIC) between a Check Point Security Management Server and a Gateway occurs over TCP port 18209. If ICMP works but SIC fails in a cloud environment, it is highly likely that the cloud provider's native firewall (such as an Azure Network Security Group or AWS Security Group) is missing a rule to allow inbound TCP 18209 from the management server's IP address.
- 4
A bioinformatics startup is migrating its research workloads to AWS. The CISO is reviewing the shared responsibility model to understand where native cloud security ends and where Check Point CloudGuard Network Security begins. Which of the following responsibilities falls strictly on the customer and is directly addressed by deploying CloudGuard Network Security?
Show answer details
Correct answer: C
Under the cloud shared responsibility model, the cloud provider (AWS) is responsible for the 'security OF the cloud' (hardware, virtualization layer, physical data centers). The customer is responsible for 'security IN the cloud', which includes protecting their operating systems, applications, and network traffic. Check Point CloudGuard Network Security fulfills this customer responsibility by providing advanced threat prevention, IPS, and zero-day protection for the workloads.
- 5
When evaluating the Check Point CloudGuard portfolio, a security engineer needs to differentiate between Network Security and Posture Management (CSPM). Which of the following use cases is specifically solved by CloudGuard Network Security rather than CloudGuard Posture Management?
Show answer details
Correct answer: B
CloudGuard Network Security (IaaS gateways) acts as a virtual firewall, actively intercepting and inspecting network traffic for threats using Deep Packet Inspection, IPS, and Application Control. Conversely, CloudGuard Posture Management (CSPM) evaluates cloud control plane configurations (like IAM roles, S3 bucket permissions, and compliance frameworks) via API, but does not sit in the data path to inspect live network packets.
quadrantChart title CloudGuard Portfolio Focus x-axis API-Driven --> Data Path y-axis Configuration --> Threat Prevention quadrant-1 Network Security quadrant-2 Web App & API Protection quadrant-3 Posture Management (CSPM) quadrant-4 Intelligence & Threat Hunting Deep Packet Inspection: [0.8, 0.8] S3 Bucket Checks: [0.2, 0.2] Compliance Rules: [0.1, 0.3] IPS/Anti-Bot: [0.9, 0.9] - 6
True or False: Check Point CloudGuard Network Security automatically replaces the need for native cloud provider physical security controls, as it operates at the hypervisor level to secure hardware infrastructure.
Show answer details
Correct answer: B
False. CloudGuard Network Security is deployed as a virtual appliance (IaaS) within the customer's cloud environment. It does not replace the physical security controls of the cloud provider (AWS, Azure, GCP). Under the shared responsibility model, the cloud provider remains strictly responsible for the physical security of the hardware, facilities, and the hypervisor itself.
