156-541 Check Point Certified Multi-Domain Security Management Specialist - R81 (CCMS) Practice Questions
Prepare for 156-541 with more than an answer.
- Time limit
- 90 minutes
- Questions on the exam
- 75
- Passing score
- not published by Check Point
- Level
- Infinity Specialist Accreditation
- Valid for
- 2 years (all Check Point certifications and accreditations valid 24 months from exam date)
Domains covered on the exam 3
- Multi-Domain Installation and Configuration34%
- Global Domain Global Policy Management33%
- Multi-Domain Troubleshooting33%
- 1
What is the primary function of the Global Domain in a Check Point Multi-Domain Security Management (MDSM) environment?
Show answer details
Correct answer: B
The Global Domain is a special management environment in MDSM. Its primary purpose is to allow administrators to define global network objects, security rules, and policies once, and then assign them to multiple local Domain Management Servers (DMS), ensuring consistent corporate governance across the entire enterprise.
- 2
When an administrator assigns a Global Policy to a local domain, how do the global policy layers interact with the local policy layers within the Security Gateway's rulebase?
Show answer details
Correct answer: B
Global Policy Layers have one placeholder (the Domain Layer) for local Domain rules. Global rules placed above the placeholder are enforced before the local rules, and global rules below it are enforced after them. The Global Administrator sets the position of the placeholder in the Global Domain; local rules show in a Domain Layer under a parent rule.
- 3
A Managed Security Service Provider (MSSP) uses an MDS to manage policies for 50 different customers. Customer A and Customer B both require a strict block on all outbound Telnet traffic. The MSSP creates a 'Block_Telnet' rule in the Global Domain, above the Domain Layer placeholder.
The MSSP administrator publishes the Global Domain changes and then reassigns the updated Global Policy to Customer A and Customer B's domains.
However, upon testing, Customer A's gateways are still allowing outbound Telnet traffic, while Customer B's gateways are successfully blocking it. Customer B's administrator installed policy after the assignment.
What is the most likely reason for this discrepancy?
Show answer details
Correct answer: B
Assigning or reassigning a global configuration updates the local Domain database and publishes it, but it does not install policy on Security Gateways. Customer A's gateways keep enforcing the previously installed policy until policy is installed from Customer A's Domain Management Server. A global rule above the Domain Layer placeholder is enforced before any local rule, so a local Accept rule cannot bypass it.
- 4
When connected to the Multi-Domain Server via SmartConsole, administrators can view different types of activity logs depending on their context. Which TWO of the following are valid log types that can be queried in this environment? (Select TWO)
Show answer details
Correct answer: A, B
In SmartConsole Logs & Monitor, administrators query Audit Logs, which record administrator actions such as logins, publishing changes and installing policy, and Traffic Logs, which the Security Gateways generate for the connections they accept or drop. Kernel panic, BIOS and BGP routing information are not SmartConsole log types.
In SmartConsole Logs & Monitor, administrators query Audit Logs, which record administrator actions such as logins, publishing changes and installing policy, and Traffic Logs, which the Security Gateways generate for the connections they accept or drop. Kernel panic, BIOS and BGP routing information are not SmartConsole log types.
- 5
True or False: When a Global Administrator assigns a Global Policy to a local Domain, the policy is automatically installed onto all Security Gateways managed by that Domain.
Show answer details
Correct answer: B
False. Assigning a Global Policy only updates the database of the target Domain Management Server (DMS). To enforce the rules on network traffic, the local domain administrator (or a script) must explicitly perform a 'Policy Install' from the DMS to the actual Security Gateways.
- 6
An MDS administrator wants to run a unified query to see all administrative login events across all 15 domains managed by the Multi-Domain Server. To achieve this in SmartConsole, the administrator must:
Show answer details
Correct answer: B
By connecting SmartConsole directly to the MDS context (rather than a specific domain context) and navigating to Logs & Monitor, administrators with appropriate permissions can view aggregated MDS-level activity and audit logs spanning all domains.
- 7
A large enterprise wishes to deploy SmartEvent to correlate threats across its Multi-Domain environment. Because of high log volume (100,000 logs/sec), the architect decides against enabling the SmartEvent blade directly on the MDS appliance. What is the Check Point recommended architecture for integrating SmartEvent into a high-volume MDSM environment?
Show answer details
Correct answer: A
In high-volume environments, enabling SmartEvent on the MDS can cause resource starvation. The best practice is to deploy a Dedicated SmartEvent Server. It is managed via the MDS (often defined in the Global Domain) and correlates logs by fetching them from the MLM or Domain Log Servers.
- 8
A telecommunications enterprise is planning to deploy Check Point Multi-Domain Security Management (MDSM) R81 to manage 15 distinct subsidiary networks. The lead architect needs to explain the functional difference between the Multi-Domain Server (MDS) and the Domain Management Server (DMS) to the implementation team. Which statement accurately describes the relationship and function of these components?
Show answer details
Correct answer: B
In the Check Point MDSM architecture, the Multi-Domain Server (MDS) is the physical or virtual appliance that provides the global management framework. The Domain Management Server (DMS) is a virtualized container within the MDS that acts exactly like a standalone Security Management Server for a specific domain/subsidiary, managing its own policies, objects, and gateways.
- 9
A security engineer is tasked with migrating an existing R81.10 Security Management Server (SMS) into a newly deployed R81.10 Multi-Domain Server as a new Domain Management Server (DMS). To accomplish this, the engineer must export the database from the SMS. Which method does the R81.10 Installation and Upgrade Guide specify for this export?
Show answer details
Correct answer: A
For SMS-to-DMS migration in R81.10, export the database on the source Security Management Server with the Management API command 'mgmt_cli -d "System Data" migrate-export-domain file-path .tgz include-logs "false"'. The -d "System Data" option is mandatory. Import it on the MDS with migrate-import-domain, which creates the DMS automatically. 'migrate_server' is the upgrade/backup utility, and 'cma_migrate' imports R7x DMS databases.
- 10
FinTech Corp operates a globally distributed environment requiring High Availability (HA) for its management infrastructure. They have deployed two Multi-Domain Servers (MDS-A in New York, MDS-B in London).
For the 'Payments' domain, they require the Primary DMS to run on MDS-A and a Secondary DMS to run on MDS-B. A network outage isolates the New York data center, making MDS-A entirely unreachable from London.
During the outage, a critical security rule must be added to the Payments domain gateways located in Europe. What is the correct procedure the London administrator must follow to implement this rule?
graph TD subgraph New York DC MDS_A[MDS-A : Active Global] DMS_P[Payments DMS : Primary / Active] end subgraph London DC MDS_B[MDS-B : Standby Global] DMS_S[Payments DMS : Secondary / Standby] end MDS_A -.-> |Sync Failed| MDS_B DMS_P -.-> |Sync Failed| DMS_SShow answer details
Correct answer: B
Domain Management Server failover is manual. A Standby DMS opens in Read Only mode. To make changes while the Active DMS is unreachable, connect to the Standby Payments DMS on MDS-B, go to Menu > Management High Availability and, in the High Availability Status window, click Actions > Set Active. The DMS on MDS-B then becomes Active (Read/Write), so the administrator can add the rule and install policy on the European gateways. If both servers end up Active, the Domain is in Collision mode until one of them is set back to Standby.
