Check Point Certified Cloud Specialist (CCCS) R81.20 Free Sample Questions
Description
Covers CloudGuard network security fundamentals and reference architectures, deploying and scaling the management server, clustering, adaptive policy, automation, and troubleshooting.
12 free sample questions150 in the full practice test
A bioinformatics startup is migrating its research workloads to AWS. The CISO is reviewing the shared responsibility model to understand where native cloud security ends and where Check Point CloudGuard Network Security begins. Which of the following responsibilities falls strictly on the customer and is directly addressed by deploying CloudGuard Network Security?
Answer and explanation
Correct answer: C
The cloud provider secures the hardware, hypervisor and data centers. The customer secures operating systems, applications and traffic. CloudGuard inspects that traffic and blocks threats, including zero-day attacks.
When evaluating the Check Point CloudGuard portfolio, a security engineer needs to differentiate between Network Security and Posture Management (CSPM). Which of the following use cases is specifically solved by CloudGuard Network Security rather than CloudGuard Posture Management?
Answer and explanation
Correct answer: B
CloudGuard Network Security is an inline gateway. So it can inspect packets and run IPS on traffic into a VPC. Posture Management works through cloud APIs to check settings, such as IAM keys and bucket permissions.
True or False: Check Point CloudGuard Network Security automatically replaces the need for native cloud provider physical security controls, as it operates at the hypervisor level to secure hardware infrastructure.
Answer and explanation
Correct answer: B
False. CloudGuard Network Security is a virtual gateway that runs inside the customer's cloud network. The cloud provider still secures the physical hardware, the facilities and the hypervisor.
A multinational retail bank is migrating its core payment processing application to Azure. The bank's compliance team mandates that all traffic entering the application must undergo deep packet inspection, zero-day threat extraction, and application-level control.
The cloud operations team argues that native Azure Network Security Groups (NSGs) and Azure Firewall Basic are sufficient to meet these requirements while keeping costs low.
As the Lead Security Architect, you must justify the deployment of Check Point CloudGuard Network Security instead of relying solely on the native basic controls. Which of the following provides the most accurate architectural justification for this decision?
Answer and explanation
Correct answer: A
NSGs filter by IP address, port and protocol only. They cannot identify applications or run IPS, Threat Emulation or Threat Extraction. CloudGuard adds this Layer 7 inspection and threat prevention.
While analyzing the security posture of an AWS environment, a consultant notices that the organization relies entirely on AWS Security Groups. Which TWO advanced capabilities will the organization gain by implementing Check Point CloudGuard Network Security Gateways? (Select TWO)
Answer and explanation
Correct answers: C, D
Security Groups allow or block traffic by IP address and port only. CloudGuard inspects the packet content and stops malware and zero-day threats.
Application Control identifies the application in the traffic, not just the port. Security Groups cannot do this, so they cannot block one web application that uses a common port.
A manufacturing enterprise is designing a multi-VNet architecture in Azure. They require all traffic moving between their "HR" VNet and "Finance" VNet to be inspected by a Check Point CloudGuard Gateway. Which architectural model is best suited for this requirement?
Answer and explanation
Correct answer: D
Both VNets peer with a hub VNet that holds the CloudGuard gateway. UDRs in the spokes send traffic between them through the gateway. Direct peering between HR and Finance would skip the gateway.
Register free for 6 more questions
Or unlock all 150 156-561 questions with explanations, timed mode and flashcards.
