Exam 156-215.80 topic 1 question 280 discussion

Actual exam question from Checkpoint's 156-215.80

Question #: 280
Topic #: 1

The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

A. There is a virus found. Traffic is still allowed but not accelerated
B. The connection required a Security server
C. Acceleration is not enabled
D. The traffic is originating from the gateway itself

Show Suggested Answer

Suggested Answer: D 🗳️

by Snir at Aug. 12, 2020, 2:01 p.m.

Comments

Submit Cancel

Nikolas

9 months, 3 weeks ago

from CCSE R80 guide: From SecureXL’s perspective, there are three paths of traffic flow: • Firewall Path — Packets and connections that are inspected by the Firewall. These packets and connections are not processed by SecureXL. This path is also referred to as the Slow Path. • Accelerated Path — Packets and connections that are offloaded from the Firewall to SecureXL. These packets and connections are quickly processed. • Medium Path — Packets that cannot use the accelerated path because they require deeper inspection. Although it is not necessary for the Firewall to inspect these packets, they can be offloaded by another feature. For example, packets that are examined by IPS cannot use the accelerated path and can be offloaded to the IPS Passive Streaming Library (PSL), which provides stream reassembly for TCP connections. As a result, SecureXL processes these packets quicker than packets on the slow path. i think this is medium path, because traffic need to be checked by antivirus

upvoted 2 times

CSreventon

9 months ago

I was thinking the same - "All packets that match a rule with a Security Server (e.g., Authentication, Anti-Virus, URL Filtering, Anti-Spam)." - https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk32578 However, after the first session, a template would've been created and despite the AV profile, the subsequent sessions should've been accelerated. So unless there was a virus and it should've been checked by AV and dropped (or allowed ?) or The traffic generated from the Gateway itself.

upvoted 4 times

...