EMT Practice Test

1. Question Content...

---

Question1: Fill in the blank: The R80 utility fw monitoris used to troubleshoot ___________________.

Question2: Having a look at the output of the "fwaccel conns" command, the F flag is the indicator for a packet
______________.

Question3: Fill in the blank. The tool ____________________ generates a R80 Security Gateway configuration report.

Question4: Which type of SecureXL templates is enabled by default on Security Gateways?

Question5: Which is the correct "fw monitor" syntax for creating a capture file for loading it into WireShark?

Question6: Which of the following ports are used for SIC?

Question7: A Firewall administrator is attempting to push a policy to a new Security Gateway for a remote office but the installation fails. The Management Server IP is 10.1.1.101. Initial troubleshooting shows that policy is successfully transferred to the Gateway. What command would you use to attempt to identify the cause of the issue?

Question8: Your customer is experiencing problems connecting to the Security Management Server via SmartConsole. You suggest testing the connection to the SMS with GuiBedit from the client machine. This connection was successful. Now you suggest enabling debug to investigate possible issues with connections to SMS via SmartConsole. Which process does the customer need to debug on the SMS?

Question9: How can you ensure that a particular service does not use the cluster IP address?

Question10: You issued the command "set ipv6-state on" in order to enable IPv6 protocol on a Security Gateway. The command was executed successfully. After reboot you notice that IPv6 protocol is not enabled. What do you do to permanently enable IPv6 protocol?

Question11: Which one of the following does not belong to an initial status of a critical device?

Question12: Where will the command, "fw monitor -pi -vpn", be inserted into the ctl chain?

Question13: What process(es) should be checked if there is high I/O and you suspect it may be related to the Antivirus Software Blade?

Question14: Which file would you need to make sure you collect when debugging a VPN that fails to establish that is configured to use IKEv2?

Question15: The maximum number of critical devices or pnotes on a cluster member is what?

Question16: Joey's implementing a new R80.10 firewall cluster into the network. During the implementation he notices that the cluster object is in error state in SmartConsole. He tries to figure out the cause of the problem and runs a ClusterXL kernel debug with command: 'fw ctl debug -m cluster + stat pnote conf ccp' ClusterXL kernel debug shows him following info: fwha_set_new_local_state: Old version HA machines exist around so prevent state change to READY.
How can he solve the problem?

Question17: The pepd and pdpd daemons are used by which Software blade?

Question18: While using IPS, the network performance is being impacted on a load sharing cluster with asymmetric routes. What is most likely causing the degradation?

Question19: URL Filtering is an essential part of Web Security in the Gateway. For the Security Gateway to perform a URL lookup when a client makes a URL request, where is the sync-request forwarded from if a sync- request is required?

Question20: In R80 spoofing is defined as a method of:

Question21: The Security Gateway is installed on GAiA R80. The default port for the Web User Interface is
_____________.

Question22: If cluster members are geographically separated and the time to detect a failover needs to be longer, what timer needs to be adjusted?

Question23: If certain services should not use the Cluster Object IP Address, but requires the use of the individual Cluster Member IPs, what steps would be required for configuration?

Question24: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question25: Which of the connections cannot be accelerated with SecureXL?

Question26: For organizations with existing IPv4 networks who wish to move to IPv6, which of the following is a Transition Mechanism that can be used?

Question27: What is the correct command to turn off an IKE debug?

Question28: Which kernel debug flag should you use to troubleshoot NAT connections?

Question29: After determining that the IPS Blade is causing high resource utilization in the gateway, which would be an appropriate strategy to improve IPS performance?

Question30: Which Check Point daemon, if it stops responding or goes down, results in connections from the SmartConsole to the Management Server failing?

Question31: What does CMI stand for in relation to the Access Control Policy?

Question32: Which daemon would you debug if you have issues acquiring identities via identity sharing and identities with other gateways?

Question33: You run "cat/proc/smt_status" on your security gateway and the output shows 'Soft Disable'. How is your system configured in reference to hyper-threading?

Question34: What is the default setting and minimum value of the Sync tick timer?

Question35: What is the name of the table that an administrator would review to investigate a port exhaustion error when using Hide NAT?

Question36: Where does the translation occur with Hide NAT?

Question37: How can you print the session UUID and the UUID of a connection together in fw monitor?

Question38: Which templates for SecureXL are not enabled by default?

Question39: What is enabled by the command "vpn debug mon"?

Question40: Which of the following is correct in a Threat Prevention policy?

Question41: Fill in the blank: The R80 feature _________________ permits blocking specific IP addresses for a specified time period.

Question42: How many layers are incorporated in IPS detection and what are they called?

Question43: Which one of following commands should you run to display HTTPS packet content together with kernel debug?

Question44: Which Check Point utility should be used to assist in analyzing the output of vpn and ike debug?

Question45: Which "fwm" command syntax will instruct the gateway to load its most recent policy?

Question46: Which command should be used to insert fw monitor before secxl_sync module?

Question47: When enabling hyper-threading on a Security Gateway, the administrator needs to make sure there is enough _______________ to support additional CoreXL Firewall instances.

Question48: What does the command "vpn shell tunnels delete all ike" do?

Question49: Which of the following is NOT a special consideration while running fw monitor on production firewall?

Question50: What occurs when Bypass Under Load activated?

Question51: Of how many packets consists Main Mode in Phase 1?

Question52: What effect would change the parameter of fwha_timer_cpha_res to 5 have on a cluster?

Question53: What is the command to check the current status of hyper-threading?

Question54: Which of the following statements is TRUE about R80 management plug-ins?

Question55: What is the difference between Client-Side and Server-Side NAT?

Question56: What is the difference between disabling SecureXL by running "fwaccel off" and disabling it via cpconfig?

Question57: Which of the following inputs is suitable for debugging HTTPS inspection issues?

Question58: Which command is used to enable IPv6 on Security Gateway?

Question59: Which kernel table stores information about NAT connections?