EMT Practice Test

1. Question Content...

---

Question1: What flag option(s) must be used to dump the complete table in friendly format, assuming there are more than one hundred connections in the table?

Question2: You run the command fwaccel conns and notice in the output that all the connections have "F" in the
"flags" column, see below:

What does this mean?

Question3: You want to verify that the majority of your connections are being optimized by SecureXL. What command would you run to establish this information?

Question4: Your company has recently decided to allow remote access for clients. You find that no one is able to connect, although you are confident that your rule set and remote access community has been defined correctly. What is the most likely cause, based on the options below? You have the following debug file:

Question5: Which operating systems support Wire mode?

Question6: How do you add the route entry for the "Enforcement Point Gateway" on the Management Server?

Question7: The command that lists the firewall kernel modules on a Security Gateway is:

Question8: Jerry is a network administrator for ACME Co. Their network contains 5 gateways all managed by a single Management Server. They are currently receiving an exorbitant amount of false positive for traffic traversing their network. Based on this information, what factor do you think is contributing most to the high amount of false positives Jerry is receiving?

Question9: What command verifies which core each gateway interface and firewall instance is currently running on?

Question10: If you need to use a Domain object in the Rule Base, where should this rule be located?

Question11: ACME Corp has a cluster consisting of two 13500 appliances. As the Firewall Administrator, you notice that on an output of top, you are seeing high CPU usage of the cores assigned as SNDs, but low CPU usage on cores assigned to individual fw_worker_X processes. What command should you run next to performance tune your cluster?

Question12: Look at the follow Rule Base display. Rule 5 contains a TIME object. What is the effect on the following rules?

Question13: True or False: It is possible to operate a Security Gateway entirely with IPv6 addressing.

Question14: Which of the following is true about Node / Host objects?

Question15: Which technology is not supported with route-based VPNs?

Question16: You are troubleshooting a VPN issue between your gateway and a partner site and you get a drop log on your gateway that states "Clear text packet should be encrypted". Which of the following would be the best troubleshooting step?

Question17: You are running a debugging session and you have set the debug environment to TDERROR_ALL_ALL=5 using the command export TDERROR_ALL_ALL=5. How do you return the debug value to defaults?

Question18: Henry is attempting to verify VPN connectivity between two hosts, x and y. Of the following commands, which could be BEST used to verify connectivity of this VPN?

Question19: You have set up a manual NAT rule, however fw monitor shows you that the device still uses the automatic Hide NAT rule. How should you correct this?

Question20: Adam wants to find idle connections on his gateway. Which command would be best suited for viewing the connections table?

Question21: What does "cphwd_nat_templates_enabled=1" do when entered into fwkern.conf?

Question22: Which FW-1 kernel flags should be used to properly debug and troubleshoot NAT issues?

Question23: What debug file would you check to see what IKE version is being used?

Question24: When performing a Clean IPS procedure to resolve a corrupt IPS files issue, what file is modified in order for the SDUU process to automatically update the IPS files after completing the procedure?

Question25: Which of the following is NOT a cphaprob status?

Question26: You want to run VPN debug that will generate both ike.elg and vpn.elg files. What is the best command that can be used to achieve this goal?

Question27: Which of the following IPS Layers is responsible for ensuring that only valid retransmission packets are allowed to proceed to destinations?

Question28: Compare these two images to establish which blade/feature was disabled on the firewall.

Question29: Remote VPN clients can initiate connections with internal hosts, but internal hosts are unable to initiate connections with the remote VPN clients, even though the policy is configured to allow it. You think that this is caused by NAT. What command can you run to see if NAT is occurring on a packet?

Question30: What command allows you to monitor IPV6 packets in the kernel module?

Question31: In R77, Under what circumstances would IPS bypass be enforced?

Question32: Where in a fw monitor output would you see source address translation occur in cases of automatic Hide NAT?

Question33: How do you clear the connections table?

Question34: Where would you go to adjust the number of Kernels in CoreXL?

Question35: How does the Check Point Security Administrator enable NAT Templates?

Question36: Which of the following commands shows the high watermark threshold for triggering the cluster under load mechanism in R77?

Question37: Which program could you use to analyze Phase I and Phase II packet exchanges?

Question38: When using Geo Protections, you find there are logs for a country that you believe is incorrect. What file do you review to verify what country Geo Protections should identify the traffic as?

Question39: How do you enable IPv6 support on a R77 gateway running the GAiIA OS?

Question40: While troubleshooting a connectivity issue with an internal web server, you know that packets are getting to the upstream router, but when you run a tcpdump on the external interface of the gateway, the only traffic you observe is ARP requests coming from the upstream router. Does the problem lie on the Check Point Gateway?

Question41: When running a SecureXL debug how do you initialize the debug buffer to 32000?

Question42: One of IPS Layers' main functions are to ensure compliance to well-defined protocol standards, detect anomalies if any exist, and assemble the data for further inspection by other components of the IPS engine. Which component is responsible for these functions?

Question43: What would the following command fw monitor tell you?

Question44: Where can you configure OSPF on a GAiA firewall?

Question45: Which command will NOT display information related to memory usage?

Question46: You are configuring OSPF on your Secure Platform firewall. You are in expert mode and run the commands:
interface vt-Gateway_C
IP ospf 1 area 0.0.0.0
exit
When you run show running-config you do not see your OSPF configuration listed Why?

Question47: How can an administrator stay up-to-date on the status of their VPN Tunnels?

Question48: You are configuring a VTI in a clustered environment. Which of the following must be TRUE?

Question49: You are trying to set "VPN Directional Match" on the VPN column but the "Directional Match Condition" option is not there. Why is this missing?

Question50: While troubleshooting a VPN issue between your gateway and a partner site you see an entry in Smartview Tracker that states "Info: encryption failure: Different community ID: possible NAT problem".
Which of the following is the most likely cause?

Question51: What does the IP Options Strip represent under the fw chain output?

Question52: You want to enable OSPF on Secure Platform, but you notice that the required gated daemon is not running. How can you enable this?

Question53: In the gateway object, under topology you select the "Get All Members Interfaces with Topology" option and your newly configured unnumbered VTIs are not populated. Why is this information missing?

Question54: Your gateway object is currently defined with a max connection count of 25k connections in Smart Dashboard. Which of the following commands would show you the current and peak connection counts?

Question55: Where do you run the command get_ips_statistics.sh from?

Question56: The file ike.elg is a log file used to log IKE negotiations during VPN tunnel establishment. Where is this file located?

Question57: Tom is troubleshooting NAT issues using fw monitor and Wireshark. He tries to initiate a connection from the external network to a DMZ server using the public IP which the firewall translates to the actual IP of the server. He analyzes the captured packets using Wireshark and observes that the destination IP is being changed as required by the firewall but does not see the packet leave the external interface. What could be the reason?

Question58: In IKEView while troubleshooting a VPN issue between your gateway and a partner site you see an entry that states "Invalid ID". Which of the following is the most likely cause?

Question59: What are the kernel parameters that control "Magic MACs"?

Question60: Which command displays compression/decompression statistics?

Question61: Ann wants to hide FTP traffic behind the virtual IP of her cluster. Where is the relevant file table.def located to make this modification?

Question62: What type of connections cannot be templated?

Question63: In Tracker you are troubleshooting a VPN issue between your gateway and a partner site and you get a drop log that states "No proposal chosen" what is the most likely cause?

Question64: When viewing a NAT Table, What represents the second hexadecimal number of the 6-tuple:

Question65: While troubleshooting high CPU usage on cores 3 and 4 on a cluster, you notice the following output of fwaccel stats -s:

What could be a possible cause of the high CPU usage?

Question66: When a cluster member is completely powered down, how will the other member identify if there is network connectivity?

Question67: Which command will you run to list established VPN tunnels?

Question68: You are finding that some users are complaining about slow connection speed. You would like to review a summary of your connections, including which connections are accelerated and those that are not. What command could you use?

Question69: After creating and pushing out a new policy, Joe finds that an old connection is still being allowed that should have been closed after his changes. He wants to delete the connection on the gateway, and looks it up with fw tab -t connections -u. Joe finds the connection he is looking for. What command should Joe use to remove this connection?
<0,a128c22,89,a158508,89,11;10001,2281,25,15b,a1,4ecdfeee,ac,691400ac,7b6,3e,ffffffff,3c,3c,0,0,0,0,0,
0,0,0,0,0,0,0,0,0>

Question70: You are experiencing an issue where Endpoint Connect client connects successfully however, it disconnects every 20 seconds. What is the most likely cause of this issue?

Question71: In the policy below, which rule disables SecureXL?

Question72: Your cluster member is showing a state of "Ready". Which of the following is NOT a reason one would expect for this behaviour?

Question73: Which is NOT a valid upgrade method in an R77 GAiA ClusterXL deployment?

Question74: How do you disable IPv6 on an IPSO gateway?

Question75: Which command would a troubleshooter use to verify table connection info (peak, concurrent) and verify information about cluster synchronization state?

Question76: You are configuring dynamic VPN routing using OSPF. You have defined the gateways, created a fully meshed VPN Community that includes all participating Gateways; created a rule to accept OSPF and configured dynamic routing. OSPF adjacencies are not establishing. Which of the following could explain why?

Question77: You are troubleshooting an issue for your HR team. One of the users is using IP 10.10.10.24. They having been trying to access the vacation servers but all connections are failing. You have checked the logs and do not see any dropped traffic. You have a suspicion that the drop is not being logged. What command could you use to confirm this?

Question78: How do you designate the "enforcement point gateway" for the peers involved in "VPN Directional Enforcement"?

Question79: Which of the following is NEVER affected by incorrect OS time and date configuration?

Question80: You would like to configure unnumbered VTIs and your environment uses load sharing clustering. Would this clustering technology be supported by your unnumbered VTI's?

Question81: Which process should you debug when SmartDashboard authentication is rejected?

Question82: What causes the SIP Early NAT chain module to appear in the chain?

Question83: Server A is subject to automatically static NAT and also resides on a network which is subject to automatic Hide NAT. With regards to address translation what will happen when Server A initiates outbound communication?

Question84: Does R77 SmartDashboard support IPv6?

Question85: What do the 'F' flags mean in the output of fwaccel conns?

Question86: Which of the following statements are TRUE about SecureXL?
I. SecureXL is able to accelerate all connections through the firewall.
II. Medium path acceleration will still cause some CPU utilization of CoreXL cores.
III. F2F connections represent "forwarded to firewall" connections that are not accelerated and fully processed through the firewall kernel.
IV. Packets going through SecureXL must be inspected by the firewall kernel before being accelerated.

Question87: Given the screen configuration shown, the failure's probable cause is:

Question88: Where would an administrator set an email alert for a specific permanent VPN tunnel?

Question89: Which Dynamic Routing Protocols are supported in GAiA in a Route-based VPN configuration?

Question90: The command fwaccel stat displays what information?

Question91: Misha is working on a stand-by firewall and deletes the connections table in error. He finds that now the table is out of sync with the Active member. to get them completely synced again, Mish should run the command pair ____________ and __________ .

Question92: With the default ClusterXL settings what will be the state of an active gateway upon using the command ClusterXL_admin up?

Question93: What command can be used to get the following output?

Question94: SecureXL uses templating to accelerate traffic passing through the gateway. What command should you run to determine if Accept, Drop and NAT templating is enabled?

Question95: Which file holds global Kernel values to survive reboot in a Check Point R77 gateway?

Question96: You are attempting to establish an FTP session between your computer and a remote server, but it is not being completed successfully. You think the issue may be due to IPS. Viewing SmartView Tracker shows no drops. How would you confirm if the traffic is actually being dropped by the gateway?

Question97: You are analyzing your firewall logs, /var/log/messages, and repeatedly see the following kernel message:
'kernel: neighbor table overflow'
What is the cause?

Question98: The command _____________ shows which firewall chain modules are active on a gateway.

Question99: From which version can you add Proxy ARP entries through the GAiA portal?

Question100: Why would you not see a CoreXL configuration option in cpconfig?

Question101: From the output of the following cphaprob -i list, what is the most likely cause of the clustering issue?
Cluster B> cphaprob -i list
Built-in Devices:
Device Name: Interface Active Check Current state: OK
Device Name: HA Initialization Current state: OK
Device Name: Recovery Delay Current state: OK
Registered Devices:
Device Name: Synchronization Registration number: 0 Timeout: none Current state: OK Time since last report: 3651.5 sec
Device Name: Filter Registration number: 1 Timeout: none Current state: problem Time since last report:
139 sec
Device Name: routed Registration number: 2 Timeout: none Current state: OK Time since last report:
3651.9 sec
Device Name: cphad Registration number: 3 Timeout: none Current state: OK Time since last report:
3696.5 sec
Device Name: fwd Registration number: 4 Timeout: none Current state: OK Time since last report: 3696.5 sec

Question102: You have just taken over as a firewall administrator. Your company is using Geo Protections on your gateway, but you want to verify that the protections are up-to-date. How can you see when these were updated?

Question103: What command would you use to check if CoreXL is enabled?

Question104: Which command displays FireWall internal statistics about memory and traffic?

Question105: What is the function of the setting "no_hide_services_ports" in the tables.def files?

Question106: In a VPN configuration, the following mode can be used to increase throughput by bypassing firewall enforcement.

Question107: What would be a reason to use the command cphaosu stat?

Question108: You have a requirement to implement a strict security policy. With this in mind, you must create a stealth rule. How will this impact your packet acceleration?

Question109: You have spent time configuring the IPS profile on your primary gateway firewall. You want to ensure that this profile can be applied to all gateway firewalls in your environment. How can you share this information between firewalls?

Question110: Your company has grown significantly over the past few months. You are seeing that new connections are being dropped but note that the connections table is not full. You suspect that the kernel memory allocated to the firewall has reached its full capacity. To check the "Machine Capacity Summary" statistics, you use command:

Question111: You are setting up VPN between two gateways Local-GW and New-GW and want to use shared secret.
For some reason New-GW is not showing up in the shared secret properties under mesh community properties. What is the most likely reason why the New-GW is not displayed?

Question112: What command would give you a summary of all the tables available to the firewall kernel?

Question113: When you perform an install database, the status window is filled with large amounts of text. What could be the cause?

Question114: Your customer reports that the time on the standby cluster member is not correct. After failing over and making it active, the time is now correct. NTP has been configured on both machines, so it is expected that both machines be in sync with the NTP server. Upon investigating, it was found that the standby member was never able to communicate with the NTP server while it was in standby configuration. What could be the problem?

Question115: Where would you find CPU information like model, number of cores, vendor and architecture?

Question116: Which directory below contains the URL Filtering engine update info? Here you can also go to see the status of the URL Filtering and Application Control updates.

Question117: What are the common Best Practices for configuring QoS over a route-based VPN?

Question118: Which command should you use to stop kernel module debugging (excluding SecureXL)?

Question119: what command other than fw ctl pstat, will display your peak concurrent connections?

Question120: In order to perform some connection troubleshooting, you run the command fw monitor -e accept dport
443. You do NOT see the TCP ACK packet. Why is this?

Question121: Tom has a Web server for which he has created a manual NAT rule. The rule is not working. He tries to initiate a connection from the external network to a DMZ server using the public IP which the firewall translates to the actual IP of the server. He analyzes the captured packets using Wireshark and observes that the destination IP is being changed as required by the firewall but does not see the packet leave the internal interface. Which box in Global Properties should be checked?

Question122: CoreXL on IPSO R77.20 does NOT support which of the following features?

Question123: When the IPS 'Bypass under Load' mechanism detects that the certain CPU and memory usage thresholds have been reached, which of the following occurs?

Question124: You have strict IPS corporate guidelines. This is having a performance impact on the firewall. What steps could you take to minimize this impact without compromising the corporate policy?

Question125: A Security Administrator wants to increase the amount of processing cores on a Check Point Security Gateway. He starts by increasing the number of cores, however the number of kernel instances remain the same way. What is the correct process to increase the number of kernel instances?

Question126: The command fw ctl kdebug <params> is used to:

Question127: You would like to import SNORT rules but to comply with corporate policy you need to test the conversion prior to import. How can you do this?

Question128: What would be a reason for changing the "Magic MAC"?

Question129: Which of the following statements about Full HA support with IPv6 is NOT true?

Question130: After disabling SecureXL you ran command fw monitor to help troubleshoot a VPN issue. In your review you note that you only see pre-inbound traffic ("i") and no other traffic after this. Which of the following reasons could explain this output?

Question131: Which definition best describes the file table.def function? It is a placeholder for:

Question132: What should you do after editing fwkern.conf to enable NAT templates?

Question133: The user tried to connect in SmartDashboard and did not work. You started a FWM debug and receive the logs below:

What is the error cause?

Question134: How can you see a dropped connection and the cause from the kernel?

Question135: The fw tab -t ___________ command displays the NAT table.

Question136: Consider the following Rule Base;

What can be concluded in regards to SecureXL Accept Templates?

Question137: In Check Point, Domain-based VPN's take precedence over route-based VPN. If implementing a route- based VPN, what is one configuration step you must make on the gateway object taking part in the route- based VPN?

Question138: What command would you use for a packet capture on an absolute position for TCP streaming (out) 1ffffe0

Question139: In Wire mode. if a packet reaches the gateway from a trusted source and is destined to a trusted destination, will the firewall do stateful inspection?

Question140: You run the command fw tab -t connections -s on both members in the cluster. Both members report differing values for "vals" and "peaks". Which may NOT be a reason for this difference?

Question141: You are running some diagnostics on your GAIA gateway. You are reviewing the number of fragmented packets; you notice that there are a lot of large and duplicate packets. Which command did you issue to get this information?

Question142: You are a system administrator and would like to configure Geo Protection on your gateway to comply with a new corporate policy. What must you have to do this?

Question143: Which commands will properly set the debug level to maximum and then run a policy install in debug mode for the policy Standard on gateway A-GW from an R77 GAiA Management Server?

Question144: Where do you configure the file user.def to change the encryption domain of the Security Gateway?

Question145: When configuring a Numbered VPN-Tunnel, what parameters are necessary?

Question146: True or False: Software blades perform their inspection primarily through the kernel chain modules.

Question147: What is the corresponding connection template entered into the SecureXL connection table from the connection: "10.0.0.100:1024 > 216.239.59.59:80"

Question148: Extended Cluster Anti-Spoofing checks what value to determine if a packet with the source IP of a gateway in the cluster is being spoofed?

Question149: You are configuring VTIs in a clustered environment. On Peer A the VTI name is VT_Cluster_GWA and on Peer B the VTI name is VT_Cluster_GWB. You find that the route-based tunnel is not coming up. What could be the cause?

Question150: Your Customer would like to enable IPS in his Corporate Cluster, but he is concerned about high CPU usage because if the IPS inspection. What feature would you configure to disable inspection if a high CPU usage develops?

Question151: You are at a customer site, and when you run cphaprob stat you are not seeing a normal ClusterXL Health.
What command could you run verify the number of cores are not matched on both cluster members?

Question152: Which of the these dynamic route protocols CANNOT be used along with VTI (VPN Tunnel Interface).

Question153: Which of the following CANNOT be used as a source/destination for an IPS network exception?

Question154: Under which scenario would you most likely consider the use of Multi-Queue?

Question155: You are having issues with dynamic routing after a failover. The traffic is now coming from the backup and is being dropped as out of state. What is the BEST configuration to avoid stateful inspection dropping your dynamic routing traffic?

Question156: You are running an inventory process within your corporate environment (R77) and need to find out CPU, memory, disk space, and information regarding the software blades enabled. What command could you use to easily gather this information?

Question157: In IPS what does a high confidence rating mean?

Question158: When troubleshooting a VPN site-to-site to a peer, it may be necessary to "down" the tunnel. What is the best method to remove ONLY the tunnel to this peer?

Question159: What VSX components do not support IPv6 in R77 VSX mode?

Question160: Which command can be used to see all active modules on the Security Gateway:

Question161: What considerations are required when configuring IPV6 with Wire mode?

Question162: What is required when changing the configuration of the number of workers in CoreXL?

Question163: A firewall has 8 CPU cores and the correct license. CoreXL is enabled. How could you set kernel instance
#3 to run on processing core #5?

Question164: You are adding a new gateway into your network. You must make sure that it is running the latest Corporate approved IPS profile. How can you get this information to your new gateway?

Question165: What is the best way to see how a firewall is performing while processing packets in the firewall path, including resource usage?

Question166: From a Best Practices perspective, what percentage of your packets should be accelerated?

Question167: How would one enable 'INSPECT debugging' if one suspects IPS false positives?

Question168: You issue the command fwaccel stat and see the following:

What is a possible reason that the "accept templates" is disabled?

Question169: SNORT is a popular open source IDS, you would like to import SNORT rules from plain text into Check Point Smart Center. How can you accomplish this?

Question170: What is the log file that shows the processes that participate in the tunnel initiation stage?

Question171: What does the command fwaccel templates do?

Question172: What would be considered Best Practice to determine which IPS protections you can safely disable for your environment?

Question173: In IPS which of the two initial profiles is the more resource intensive?

Question174: What is the best way to see how much traffic went through the firewall that was TCP, UDP and ICMP?

Question175: When VPN user-based authentication fails, which of the following debug logs is essential to understanding the issue?

Question176: What type(s) of VTI interfaces do Edge gateways support?

Question177: You find that your open server SecurePlatform system is lagging although you know you have plenty of memory and the complexity of the Rule Base has not changed significantly. You think that upgrading the CPU frequency speed could help your performance. Which command could help you see what speed and model of CPU you are using?

Question178: What command show the same information as fwaccel stats -l?

Question179: You are configuring dynamic routing on Secure Platform, as the administrator you run the command pro enable and reboot. You are confident that your configuration has been done correctly. When you check, you find the dynamic routing daemon has not started. What is the likely cause of this issue?

Question180: In the process of troubleshooting traffic issues across a VPN tunnel, you notice on the output of fw monitor
-e host(172.21.1.10), accept; that packets are going through the inbound chain (i > I) and then disappearing after the outbound chain (o > __), while you were expecting to see the packet leave on O.
What could be causing this issue?

Question181: In some situations, switches may not play nicely with a Check Point Cluster and it is necessary to change from multicast to broadcast. What command should you invoke to correct the issue?

Question182: If the number of Firewall Workers for CoreXL is set higher on one member of a cluster than the other, the cluster will be in what state?

Question183: Which command clears all the connection table entries on a Security Gateway?

Question184: You are a system administrator and you are working with Support. Support asked you to enable kernel core dumps on the files. You are unsure if this has already been set. You run the command chkconfig -list kdump. Does the screen capture tell you if kernel dumps are enabled on this gateway?

Question185: Your customer has an R77 Multi-domain Management Server managing a mix of firewalls of R70 and R77 versions. A change was made to the file $FWDIR/lib/tables.def on one of the domains. However, it was found that the change was not applied to the R70 firewalls. What could be the problem?

Question186: What is the difference between "connection establishment acceleration" (templating) and "traffic acceleration"?

Question187: Where can you configure Wire mode?

Question188: Given the following IKEView output, what do we know about QuickMode Packet 1?

Question189: What happens to manual changes in the file $FWDIR/conf/local.arp when adding Proxy ARP entries through the GAiA portal or Clish?

Question190: Your customer has a well optimized Rule Base with most traffic accelerated by SecureXL. They are still seeing slow performance. They are using an 8 core machine. They see the following output from fw ctl affinity -l. What could be done to improve performance with this deployment?

Question191: Why would you choose to combine dynamic routing protocols and VPNs?

Question192: When optimizing a customer firewall Rule Base, what is the BEST way to start the analysis?

Question193: What is the log file that shows the keep alive packets during the debug process?

Question194: How many sync interfaces are supported on Check Point R77 GAiA?

Question195: You have configured IPS on your network; you find you are being overwhelmed with what you believe are false positives. You investigated this traffic and confirmed they are false positives. What can you do to stop these IPS alerts?

Question196: How does the "Directional Enforcement" rule manage subsequent packet inspection?

Question197: How to check the overall SecureXL statistics:

Question198: What command displays the Connections Table for a specified CoreXL firewall instance?

Question199: Which information CANNOT be displayed by issuing the command cat /proc/cpuinfo?

Question200: What is the limit to the number of VPN directions that can be configured in a single rule?

Question201: When viewing connections using the command fw tab -t connections, all entries are displayed with a 6- tuple key, the elements of the 6-tuple include the following EXCEPT:

Question202: Where can you configure Wire mode?

Question203: OF the following, which is NOT a kernel parameter relating to the IPS "Bypass Under Load" settings:

Question204: You have to establish a VPN communication between 2 spokes, routed through the Hub gateway. Where do you configure VPN routing?

Question205: For URL Filtering in the Cloud in R75 and above, what table is used to contain the URL Filtering cache values?

Question206: Where do you configure VTIs on your R77 gateway in VSX mode?

Question207: "Tuning" IPS protections to suit the specific needs of an environment can be accomplished by all of the following EXCEPT:

Question208: What command would you use to determine if a particular connection is being accelerated by SecureXL?

Question209: You are attempting to establish a VPN tunnel between a Check Point gateway and a 3rd party vendor.
When attempting to send traffic to the peer gateway it is failing. You look in SmartView Tracker and see that the failure is due to "Encryption failure: no response from peer". After running a VPN debug on the problematic gateway, what is one of the files you would want to analyze?

Question210: Of the following answer choices, which best describes a possible effect of expanding the connections table?

Question211: When you have your directional VPN enforcement rule set to "Internal_Clear" , what does this represent?

Question212: Which file should be edited to modify ClusterXL VIP Hide NAT rules, and where?

Question213: Your ARP cache is overflowing negatively impacting users experience on your network. Which command can you issue to increase the ARP cache on the fly? You do not need this to survive reboot.

Question214: Which of the following items is NOT part of the columns of the chain modules?

Question215: In your SecurePlatform configuration you need to set up a manual static NAT entry. After creating the proper NAT rule what step needs to be completed?

Question216: You are troubleshooting a Security Gateway, attempting to determine which chain is causing a problem.
What command would you use to show all the chains through which traffic passed?

Question217: Which of the following BEST describes the command fw ctl chain function?

Question218: What is one way to check cluster status on two gateways running in HA mode?

Question219: What will be the outcome if you set the kernel parameters cphwd_nat_templates_enabled and cphwd_nat_templates_support?

Question220: In an HA cluster, you modify the number of cores given to CoreXL on only one member using cpconfig and then issue a reboot. What is the expected ClusterXL status of this member when it comes up?

Question221: How do you set up Port Address Translation?

Question222: The command fw monitor -p all displays what type of information?

Question223: What mechanism solves asymmetric routing issues in a load sharing cluster?

Question224: What file contains IKEv2 debug messages?

Question225: You are using an IPV6 environment and find that you need additional access control and want to set up some directional VPN rules. How can you restrict access based on destination?

Question226: According to this Rule Base, templates will be created until which rule?

Question227: What command should a firewall administrator use to begin debugging SecureXL?

Question228: When are rules that include identity awareness access roles accelerated through SecureXL?

Question229: Since R76 GAiA, what is the method for configuring proxy ARP entries for manual NAT rules?

Question230: The "Hide internal networks behind the Gateway's external IP" option is selected. What defines what traffic will be NATted?

Question231: What is the command to check how many connections the firewall has detected for the SecureXL device?

Question232: Running the command fw ctl pstat -l would return what information?

Question233: Which of these commands can be used to display the IPv6 routes?

Question234: A firewall administrator knows the details of the packet header for an already established connection going through a firewall. What command will show if SecureXL will accelerate that packet?

Question235: In a production environment, your gateway is configured to apply a Hide NAT for all internal traffic destined to the Internet. However, you are setting up a VPN tunnel with a remote gateway, and you are concerned about the encryption domain that you need to define on the remote gateway. Does the remote gateway need to include your production gateway's external IP in its encryption domain?

Question236: Which of these commands can be used to display the IPv6 status?

Question237: The 'Maximum Entries' value in the GAiA Portal corresponds to the 'gc_thresh3' parameter in the Linux kernel and has value of 1024. Knowing this, you know that gc_thresh2 and gc_thresh1 if are automatically set to the values:

Question238: "If the machine is under stress, we do not want to leave the stress condition due to a single measurement (which could be an anomaly), but rather wait for a given length of time, before changing the condition." ...
describes which of the following "Bypass under Load" setting kernel parameters?

Question239: While troubleshooting a DHCP relay issue, you run a fw ctl zdebug drop and see the following output:
;[cpu_1];[fw_0];fw_log_drop: Packet proto=17 10.216.14.108:67 > 172.31.2.1:67 dropped by fw_handle_first_packet Reason: fwconn_init_links (INBOUND) failed;
Where 10.216.14.108 is the IP address of the DHCP server and 172.31.2.1 is the VIP of the Cluster. What is the most likely cause of this drop?

Question240: Certain rules will disable connection rate acceleration (templates) in the Rule Base. What command should be used to determine on what rule templates are disabled?

Question241: You have created a number of profiles and activated the relevant protections. Afterwards, you decide that the 'Enterprise gateway' should allow instant messaging. The current profile enabled for Enterprise gateway blocks instant messaging. The profile for the Enterprise gateway is currently being used on the Voyager gateway and the Bird of Prey gateway. What is the best process for making this change on the Enterprise gateway only?

Question242: When are rules that include Identity Awareness Access (IDA) roles accelerated through SecureXL?

Question243: What operating systems support unnumbered VTIs?

Question244: A fwm debug provides the following output. What prevents the customer from logging into SmartDashboard?

Question245: What steps can be taken if IPS is causing a High Performance Impact?

Question246: The CoreXL software architecture includes the Secure Network Dispatcher (SND). One of the responsibilities of SND is to:

Question247: A new packet has arrived to a firewall's interface. The packet was compared with the connection table and there is no match. What process does the firewall start with that connection?

Question248: Which routing protocols are not supported with GAIA OS running VTIs?

Question249: You have a user-defined SMTP trap configured to send an alert to your mail server, and you also have SmartView Monitor configured to trigger the alert whenever policy is pushed to your gateway. However, you are not getting any mails even when you test for pushing policy. What process should you troubleshoot on the Management Server?

Question250: Which feature is not supported with unnumbered VTI?

Question251: PXL is considered to be what type of acceleration?

Question252: Which command should you run to debug the VPN-1 kernel module?

Question253: Your customer receives an alert from their network operation center, they are seeing ARP and Ping scans of their network originating from the firewall. What could be the reason for the behaviour?

Question254: Which of the following IPS Layers is a set of signatures and/or handlers, where:
?Signature is a malicious pattern that is searched for.
?Handler is the INSPECT code that performs more complex inspection.

Question255: How would you determine the value of 'Maximum concurrent connections' of the NAT Table?

Question256: You run the commands:
fw ctl debug 0
fw ctl debug -buf 32000
Which of the following commands would be best to troubleshoot a clustering issue?

Question257: You are in VPN troubleshooting with a Partner and you suspect a mismatch configuration in Diffie-Hellman (DH) group to Phase1. After starting a vpn debug, in which packet would you look to analyze this option in your debug file?

Question258: John is a Security Administrator of a Check Point platform. He has a mis-configuration issue that points to the Rule Base. To obtain information about the issue, John runs the command:

Question259: In order to prevent outgoing NTP traffic from being hidden behind a Cluster IP you should?

Question260: You are trying to troubleshoot a NAT issue on your network, and you use a kernel debug to verify a connection is correctly translated to its NAT address. What flags should you use for the kernel debug?

Question261: When troubleshooting a performance problem on multicore firewall that is using CoreXL, what command checks the number of connections each core is processing?

Question262: You have just configured HA and find that connections are not being synced. When you have a failover, users complain that they are losing their connections. What command could you run to see the state synchronization statistics?

Question263: The current release of Check Point R77, what is a potential performance-related drawback to using Virtual Tunnel Interfaces (VTI) rather than Domain-based VPNs?

Question264: Which flag in the fw monitor command is used to print the position of the kernel chain?

Question265: Which of the following is true when IPv6 is enabled on a Security Gateway?

Question266: What command would you use to view which debugs are set in your current working environment?

Question267: What utility would you use to configure route-based VPNs?

Question268: Jane wants to create a VPN using OSPF. Which VPN configuration would you recommend she use?

Question269: Which of the following is a valid synchronization status as an output to fw ctl pstat?

Question270: Which command will allow you to change firewall affinity and survive a reboot with no further modification?

Question271: What is the method to change the number of cores that CoreXL will use?

Question272: What does the output of the commands fw ctl multik stat and fw6ctl multik stat show?

Question273: Check Point Best Practices suggest that when you finish a kernel debug, you should run the command
_____________________ .

Question274: When performing a fwm debug, to which directory are the logs written?

Question275: Using the default values in R77 how many kernel instances will there be on a 16-core gateway?

Question276: Which of the following IPS Layers is the "brain" of the IPS? That is, what coordinates between different components, decides which protections should run on a certain packet, decides the final action to be performed on the packet and issues an event log?

Question277: To check what is currently set in the Firewall kernel debug input the command:

Question278: When using the command fw monitor, what command ensures the capture is accurate?

Question279: When finished running a debug on the Management Server using the command fw debug fwm on how do you turn this debug off?