EMT Practice Test

1. Question Content...

---

Question1: You are the administrator for Alpha Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.

What does this mean?

Question2: Joey wants to configure NTP on R80 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?

Question3: Which feature in R77 permits blocking specific IP addresses for a specified time period?

Question4: The security Gateway is installed on GAiA R80 The default port for the WEB User Interface is _______ .

Question5: What are the three essential components of the Check Point Security Management Architecture?

Question6: Which command is used to obtain the configuration lock in Gaia?

Question7: On the following graphic, you will find layers of policies.

What is a precedence of traffic inspection for the defined polices?

Question8: Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?

Question9: Examine the following Rule Base.

What can we infer about the recent changes made to the Rule Base?

Question10: During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

Question11: The system administrator of a company is trying to find out why acceleration is not working for the traffic.
The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

Question12: Which command is used to add users to or from existing roles?

Question13: Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .

Question14: Choose what BEST describes a Session.

Question15: Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or a via CLI. Which command should be use in CLI? Choose the correct answer.

Question16: Choose the SmartLog property that is TRUE.

Question17: You are using SmartView Tracker to troubleshoot NAT entries. Which column do you check to view the NAT'd source port if you are using Source NAT?

Question18: Which type of the Check Point license ties the package license to the IP address of the Security Management Server?

Question19: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using
________ .

Question20: When using GAiA, it might be necessary to temporarily change the MAC address of the interface eth 0to
00:0C:29:12:34:56. After restarting the network the old MAC address should be active. How do you configure this change?

Question21: You want to define a selected administrator's permission to edit a layer. However, when you click the + sign in the "Select additional profile that will be able edit this layer" you do not see anything. What is the most likely cause of this problem? Select the BEST answer.

Question22: When using LDAP as an authentication method for Identity Awareness, the query:

Question23: What component of R80 Management is used for indexing?

Question24: Fill in the blank: Licenses can be added to the License and Contract repository ________ .

Question25: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question26: How do you configure the Security Policy to provide uses access to the Captive Portal through an external (Internet) interface?

Question27: Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ________ all traffic. However, in the Application Control policy layer, the default action is ________ all traffic.

Question28: Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Question29: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?

Question30: Which of the following is NOT an option for internal network definition of Anti-spoofing?

Question31: While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?

Question32: Sally has a Hot Fix Accumulator (HFA) she wants to install on her Security Gateway which operates with GAiA, but she cannot SCP the HFA to the system. She can SSH into the Security Gateway, but she has never been able to SCP files to it. What would be the most likely reason she cannot do so?

Question33: MyCorp has the following NAT rules. You need to disable the NAT function when Alpha-internal networks try to reach the Google DNS (8.8.8.8) server.
What can you do in this case?

Question34: What is the order of NAT priorities?

Question35: When you upload a package or license to the appropriate repository in SmartUpdate, where is the package or license stored

Question36: When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

Question37: When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?

Question38: Choose what BEST describes users on Gaia Platform.

Question39: What must a Security Administrator do to comply with a management requirement to log all traffic accepted through the perimeter Security Gateway?

Question40: What does ExternalZone represent in the presented rule?

Question41: Provide very wide coverage for all products and protocols, with noticeable performance impact.

How could you tune the profile in order to lower the CPU load still maintaining security at good level?
Select the BEST answer.

Question42: You have just installed your Gateway and want to analyze the packet size distribution of your traffic with SmartView Monitor.

Unfortunately, you get the message:
"There are no machines that contain Firewall Blade and SmartView Monitor".
What should you do to analyze the packet size distribution of your traffic? Give the BEST answer.

Question43: Katie has been asked to do a backup on the Blue Security Gateway. Which command would accomplish this in the Gaia CLI?

Question44: How many users can have read/write access in Gaia at one time?

Question45: You are about to test some rule and object changes suggested in an R77 news group. Which backup solution should you use to ensure the easiest restoration of your Security Policy to its previous configuration after testing the changes?

Question46: By default, which port does the WebUI listen on?

Question47: Choose the BEST describes the Policy Layer Traffic Inspection?

Question48: Packages and licenses are loaded from all of theses sources EXCEPT

Question49: Which of the following is NOT a back up method?

Question50: Fill in the blank: The tool _______ generates a R80 Security Gateway configuration report.

Question51: Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

Question52: Fill in the blank: The _________ collects logs and sends them to the _________ .

Question53: You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the most likely cause?

Question54: Which of the following technologies extracts detailed information from packets and stores that information in state tables?

Question55: How do you configure an alert in SmartView Monitor?

Question56: If there are two administrators logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available to other administrators? Choose the BEST answer.

Question57: NAT can NOT be configured on which of the following objects?

Question58: Which application should you use to install a contract file?

Question59: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, gateway policy permits access only from Join's desktop which is assigned an IP address 10.0.0.19 via DHCP.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but the limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop. He wants to move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.
John plugged in his laptop to the network on a different network segment and he is not able to connect.
How does he solve this problem?

Question60: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?

Question61: You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities sh you do first?

Question62: Which of the following licenses are considered temporary?

Question63: What is the potential downside or drawback to choosing the Standalone deployment option instead of the Distributed deployment option?

Question64: You are going to upgrade from R77 to R80. Before the upgrade, you want to back up the system so that, if there are any problems, you can easily restore to the old version with all configuration and management files intact. What is the BEST backup method in this scenario?

Question65: Which of these components does NOT require a Security Gateway R77 license?

Question66: Which of the following are types of VPN communicates?

Question67: Where do we need to reset the SIC on a gateway object?

Question68: To fully enable Dynamic Dispatcher on a Security Gateway:

Question69: Which default user has full read/write access?

Question70: You want to reset SIC between smberlin and sgosaka.

In SmartDashboard, you choose sgosaka, Communication, Reset. On sgosaka, you start cpconfig, choose Secure Internal Communication and enter the new SIC Activation Key. The screen reads The SIC was successfully initialized and jumps back to the menu. When trying to establish a connection, instead of a working connection, you receive this error message:

What is the reason for this behavior?

Question71: You believe Phase 2 negotiations are failing while you are attempting to configure a site-to-site VPN with one of your firm's business partners. Which SmartConsole application should you use to confirm your suspicious?

Question72: Which limitation of CoreXL is overcome by using (mitigated by) Multi-Queue?

Question73: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his desktop with a static IP (10.0.0.19). He wants to move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources installs the policy.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.
3) Changes from static IP address to DHCP for the client PC.
What should John request when he cannot access the web server from his laptop?

Question74: A digital signature:

Question75: Which one of the following is true about Threat Extraction?

Question76: Which of these attributes would be critical for a site-to-site VPN?

Question77: Which of the following is NOT an alert option?

Question78: You installed Security Management Server on a computer using GAiA in the MegaCorp home office. You use IP address 10.1.1.1. You also installed the Security Gateway on a second GAiA computer, which you plan to ship to another Administrator at a MegaCorp hub office. What is the correct order for pushing SIC certificates to the Gateway before shipping it?
1. Run cpconfig on the Gateway, select Secure Internal Communication, enter the activation key, and reconfirm.
2. Initialize Internal Certificate Authority (ICA) on the Security Management Server.
3. Configure the Gateway object with the host name and IP addresses for the remote site.
4. Click the Communication button in the Gateway object's General screen, enter the activation key, and click Initialize and OK.
5. Install the Security Policy.

Question79: Administrator Kofi has just made some changes on his Management Server and then clicks on the Publish button in SmartConsole but then gets the error message shown in the screenshot below.
Where can the administrator check for more information on these errors?

Question80: If there is an Accept Implied Policy set to "First", what is the reason Jorge cannot see any logs?

Question81: Fill in the blank: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.

Question82: Which of the following is NOT a license activation method?

Question83: Which rule is responsible for the user authentication failure?

Question84: When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

Question85: ALPHA Corp has a new administrator who logs into the Gaia Portal to make some changes. He realizes that even though he has logged in as an administrator, he is unable to make any changes because all configuration options are greyed out as shown in the screenshot image below. What is the likely cause for this?

Question86: Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES
256 for IKE phase 2. Why is this a problematic setup?

Question87: R80 Security Management Server can be installed on which of the following operating systems?

Question88: Where would an administrator enable Implied Rules logging?

Question89: Which directory holds the SmartLog index files by default?

Question90: Your company enforces a strict change control policy. Which of the following would be MOST effective for quickly dropping an attacker's specific active connection?

Question91: What happens if the identity of a user is known?

Question92: The Gaia operating system supports which routing protocols?

Question93: Which set of objects have an Authentication tab?

Question94: Office mode means that:

Question95: What statement is true regarding Visitor Mode?

Question96: You are unable to login to SmartDashboard. You log into the management server and run #cpwd_admin list with the following output:

What reason could possibly BEST explain why you are unable to connect to SmartDashboard?

Question97: Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?

Question98: The organization's security manager wishes to back up just the Gaia operating system parameters. Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries?

Question99: To install a brand new Check Point Cluster, the MegaCorp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster. Which type of cluster is it?

Question100: The Firewall kernel is replicated multiple times, therefore:

Question101: Review the rules. Assume domain UDP is enabled in the implied rules.

What happens when a user from the internal network tries to browse to the internet using HTTP? The user:

Question102: To optimize Rule Base efficiency the most hit rules should be where?

Question103: Which of the following is NOT defined by an Access Role object?

Question104: Fill in the blank: RADIUS Accounting gets ______ data from requests generated by the accounting client

Question105: As a Security Administrator, you must refresh the Client Authentication authorized time-out every time a new user connection is authorized. How do you do this? Enable the Refreshable Timeout setting:

Question106: You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

Question107: What is the appropriate default Gaia Portal address?

Question108: In what way are SSL VPN and IPSec VPN different?

Question109: Which options are given on features, when editing a Role on Gaia Platform?

Question110: Which of the following is NOT a VPN routing option available in a star community?

Question111: Harriet wants to protect sensitive information from intentional loss when users browse to a specific URL:
https://personal.mymail.com, which blade will she enable to achieve her goal?

Question112: Spoofing is a method of:

Question113: Which of the following is NOT an authentication scheme used for accounts created through SmartConsole?

Question114: What is the purpose of Captive Portal?

Question115: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

Question116: What is the difference between an event and a log?

Question117: When defining QoS global properties, which option below is not valid?

Question118: Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.

Question119: Which the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Question120: Which remote Access Solution is clientless?

Question121: Where can administrator edit a list of trusted SmartConsole clients in R80?

Question122: Which is the correct order of a log flow processed by SmartEvent components:

Question123: What are the three conflict resolution rules in the Threat Prevention Policy Layers?

Question124: MegaCorp's security infrastructure separates Security Gateways geographically. You must request a central license for one remote Security Gateway.
How do you apply the license?

Question125: Mesh and Star are two types of VPN topologies. Which statement below is TRUE about these types of communities?

Question126: Which command can you use to verify the number of active concurrent connections?

Question127: What does the "unknown" SIC status shown on SmartConsole mean?

Question128: Fill in the blank: The ________ feature allows administrators to share a policy with other policy packages.

Question129: Fill in the blank: RADIUS protocol uses ______ to communicate with the gateway.

Question130: Tina is a new administrator who is currently reviewing the new Check Point R80 Management console interface. In the Gateways view, she is reviewing the Summary screen as in the screenshot below. What as an 'Open Server'?

Question131: What action can be performed from SmartUpdate R77?

Question132: In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?

Question133: What are the three tabs available in SmartView Tracker?

Question134: Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows them as prioritized security events.

Question135: Which authentication scheme requires a user to possess a token?

Question136: Which of the following is TRUE about the Check Point Host object?

Question137: Which policy type has its own Exceptions section?

Question138: Your boss wants you to closely monitor an employee suspected of transferring company secrets to the competition. The IT department discovered the suspect installed a WinSCP client in order to use encrypted communication. Which of the following methods is BEST to accomplish this task?

Question139: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question140: Fill in the blank: The R80 utility fw monitoris used to troubleshoot _____________

Question141: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question142: AdminA and AdminB are both logged in on SmartConsole. What does it mean if AdminB sees a locked icon on a rule? Choose the BEST answer.

Question143: What port is used for communication to the User Center with SmartUpdate?

Question144: Look at the screenshot below. What CLISH command provides this output?

Question145: Which of these statements describes the Check Point ThreatCloud?

Question146: Which utility shows the security gateway general system information statistics like operating system information and resource usage, and individual software blade statistics of VPN, Identity Awareness and DLP?

Question147: What are the two high availability modes?

Question148: Study the Rule base and Client Authentication Action properties screen.


After being authenticated by the Security Gateways, a user starts a HTTP connection to a Web site. What happens when the user tries to FTP to another site using the command line? The:

Question149: What is NOT an advantage of Packet Filtering?

Question150: Can a Check Point gateway translate both source IP address and destination IP address in a given packet?

Question151: Which of the following is a hash algorithm?

Question152: The most important part of a site-to-site VPN deployment is the ________ .

Question153: The IT Management team is interested in the new features of the Check Point R80 Management and wants to upgrade but they are concerned that the existing R77.30 Gaia Gateways cannot be managed by R80 because it is so different. As the administrator responsible for the Firewalls, how can you answer or confirm these concerns?

Question154: The following graphic shows:

Question155: In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server (Security Management Server)?

Question156: What are the two types of address translation rules?

Question157: When launching SmartDashboard, what information is required to log into R77?

Question158: The technical-support department has a requirement to access an intranet server. When configuring a User Authentication rule to achieve this, which of the following should you remember?

Question159: Which one of the following is the preferred licensing model? Select the Best answer.

Question160: Which component functions as the Internal Certificate Authority for R77?

Question161: Joey is using the computer with IP address 192.168.20.13. He wants to access web page "www.Check Point.com", which is hosted on Web server with IP address 203.0.113.111. How many rules on Check Point Firewall are required for this connection?

Question162: You are the Security Administrator for MegaCorp. In order to see how efficient your firewall Rule Base is, you would like to see how many often the particular rules match. Where can you see it? Give the BEST answer.

Question163: What happens if the identity of a user is known?

Question164: You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the right protections in place. Check Point has been selected for the security vendor. Which Check Point products protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?

Question165: What is the default shell of Gaia CLI?

Question166: Which SmartConsole component can Administrators use to track changes to the Rule Base?

Question167: Which command can you use to enable or disable multi-queue per interface?

Question168: Administrator wishes to update IPS from SmartConsole by clicking on the option "update now" under the IPS tab. Which device requires internet access for the update to work?

Question169: Which of the following is NOT an advantage to using multiple LDAP servers?

Question170: Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?

Question171: Fill in the blank: Each cluster has __________ interfaces.

Question172: While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the correct order of steps needed to set up the block?
1) Select Active Mode tab in SmartView Tracker.
2) Select Tools > Block Intruder.
3) Select Log Viewing tab in SmartView Tracker.
4) Set Blocking Timeout value to 60 minutes.
5) Highligh connection that should be blocked.

Question173: Which of the following uses the same key to decrypt as it does to encrypt?

Question174: Which of the following is NOT a set of Regulatory Requirements related to Information Security?

Question175: Fill in the blank: A _______ is used by a VPN gateway to send traffic as if it were a physical interface.

Question176: You find a suspicious connection from a problematic host. You decide that you want to block everything from that whole network, not just the problematic host. You want to block this for an hour while you investigate further, but you do not want to add any rules to the Rule Base. How do you achieve this?

Question177: Fill in the blank: The command __________ provides the most complete restoration of a R80 configuration.

Question178: View the rule below. What does the lock-symbol in the left column mean? Select the BEST answer.

Question179: What is the default shell for the command line interface?

Question180: Which of the following statements accurately describes the command snapshot?

Question181: Choose the Best place to find a Security Management Server backup file named backup_fw, on a Check Point Appliance.

Question182: Which NAT rules are prioritized first?

Question183: Which tool CANNOT be launched from SmartUpdate R77?

Question184: Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port. Which CLISH commands are required to be able to change this TCP port?

Question185: Anti-Spoofing is typically set up on which object type?

Question186: What CLI utility allows an administrator to capture traffic along the firewall inspection chain?

Question187: Your bank's distributed R77 installation has Security Gateways up for renewal. Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

Question188: Message digests use which of the following?

Question189: What is the purpose of Priority Delta in VRRP?

Question190: Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?

Question191: The fw monitorutility is used to troubleshoot which of the following problems?

Question192: Where does the security administrator activate Identity Awareness within SmartDashboard?

Question193: What port is used for delivering logs from the gateway to the management server?

Question194: With which command can view the running configuration of Gaia-based system.

Question195: Which of the following is TRUE regarding Gaia command line?

Question196: Fill in the blank: The R80 feature ________ permits blocking specific IP addresses for a specified time period.

Question197: Which of the following commands can be used to remove site-to-site IPSEC Security Associations (SA)?

Question198: When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times.
No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

Question199: Check Point APIs allow system engineers and developers to make changes to their organization's security policy with CLI tools and Web Services for all of the following except:

Question200: The Captive Portal tool:

Question201: A Cleanup rule:

Question202: What is the default method for destination NAT?

Question203: What are types of Check Point APIs available currently as part of R80.10 code?

Question204: Which feature is NOT provided by all Check Point Mobile Access solutions?

Question205: Match the following commands to their correct function. Each command has one function only listed.

Question206: Web Control Layer has been set up using the settings in the following dialogue:

Consider the following policy and select the BEST answer.

Question207: The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic method.
How many times per day will CPUSE agent check for hotfixes and automatically download them?

Question208: Fill in the blank: To build an effective Security Policy, use a ________ and _______ rule.

Question209: Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?