156-561 Check Point Certified Cloud Specialist (CCCS) R81.20 Practice Questions
Prepare for 156-561 with more than an answer.
- Exam fee
- $250 USD
- Level
- Specialist (Infinity Specialist Accreditation)
- Valid for
- 2 years
Domains covered on the exam 8
- Introducing CloudGuard12.5%
- CloudGuard Network Security Architectures12.5%
- CloudGuard Network Security Management12.5%
- CloudGuard Network Security Scaling12.5%
- CloudGuard Network Security Clustering in the Cloud12.5%
- CloudGuard Network Security Policy12.5%
- CloudGuard Network Security Automation12.5%
- Troubleshoot CloudGuard Network Security12.5%
- 1
Review the following cloud architecture diagram designed to inspect outbound internet traffic originating from private application subnets.
graph TD AppSubnet[Private App Subnet] -->|UDR/Route Table| FWSubnet[CloudGuard Gateway Subnet] FWSubnet -->|Next Hop| IGW[Internet Gateway] IGW --> Internet((Internet))For the application instances in the Private App Subnet to successfully reach the internet and receive return traffic, what configuration MUST be applied on the CloudGuard Gateway in this specific flow?
Show answer details
Correct answer: C
The app hosts have private IP addresses, and the internet cannot route replies to them. Hide NAT puts the gateway's external IP on the traffic. Replies then come back to the gateway. DNAT is for inbound traffic.
- 2
An organization wants to deploy Check Point CloudGuard Gateways in AWS but prefers not to maintain the underlying operating system and virtual machine infrastructure for the Security Management Server. Which Check Point solution best addresses this requirement?
Show answer details
Correct answer: B
Smart-1 Cloud is Security Management as a Service. Check Point runs, patches and backs up the management server. The customer manages the policy and the gateways. A server on EC2 would still need OS upkeep.
- 3
A security administrator is deploying a new CloudGuard Gateway in an Azure VNet. The Security Management Server is located in an on-premises data center connected via a site-to-site VPN. When attempting to establish Secure Internal Communication (SIC) from SmartConsole to the new gateway, the connection times out.
Assuming the VPN tunnel is up and passing ICMP traffic successfully, what is the most likely cause of the SIC failure?
Show answer details
Correct answer: A
The gateway's CPD process listens for SIC trust setup on TCP 18211. ICMP works, so the route is fine. The likely cause is an NSG rule that blocks TCP 18211 from the Management Server.
- 4
A bioinformatics startup is migrating its research workloads to AWS. The CISO is reviewing the shared responsibility model to understand where native cloud security ends and where Check Point CloudGuard Network Security begins. Which of the following responsibilities falls strictly on the customer and is directly addressed by deploying CloudGuard Network Security?
Show answer details
Correct answer: C
The cloud provider secures the hardware, hypervisor and data centers. The customer secures operating systems, applications and traffic. CloudGuard inspects that traffic and blocks threats, including zero-day attacks.
- 5
When evaluating the Check Point CloudGuard portfolio, a security engineer needs to differentiate between Network Security and Posture Management (CSPM). Which of the following use cases is specifically solved by CloudGuard Network Security rather than CloudGuard Posture Management?
Show answer details
Correct answer: B
CloudGuard Network Security is an inline gateway. So it can inspect packets and run IPS on traffic into a VPC. Posture Management works through cloud APIs to check settings, such as IAM keys and bucket permissions.
- 6
True or False: Check Point CloudGuard Network Security automatically replaces the need for native cloud provider physical security controls, as it operates at the hypervisor level to secure hardware infrastructure.
Show answer details
Correct answer: B
False. CloudGuard Network Security is a virtual gateway that runs inside the customer's cloud network. The cloud provider still secures the physical hardware, the facilities and the hypervisor.
