EMT Practice Test

1. Question Content...

---

Question1: You want to verify if there are unsaved changes in GAiA that will be lost with a reboot. What command can be used?

Question2: Where does the security administrator activate Identity Awareness within SmartDashboard?

Question3: Which of the following authentication methods can be configured in the Identity Awareness setup wizard?

Question4: What is the command to see cluster status in cli expert mode?

Question5: You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.

What does this mean?

Question6: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Question7: You are using SmartView Tracker to troubleshoot NAT entries. Which column do you check to view the NAT'd source port if you are using Source NAT?

Question8: Provide very wide coverage for all products and protocols, with noticeable performance impact.

How could you tune the profile in order to lower the CPU load still maintaining security at good level?
Select the BEST answer.

Question9: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

Question10: During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

Question11: What are the steps to configure the HTTPS Inspection Policy?

Question12: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question13: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?

Question14: What is the purpose of Captive Portal?

Question15: In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?

Question16: Administrator wishes to update IPS from SmartConsole by clicking on the option "update now" under the IPS tab. Which device requires internet access for the update to work?

Question17: Which of the following are available SmartConsole clients which can be installed from the R77 Windows CD? Read all answers and select the most complete and valid list.

Question18: What happens when you run the command: fw sam -J src [Source IP Address]?

Question19: The SmartEvent R80 Web application for real-time event monitoring is called:

Question20: MegaCorp's security infrastructure separates Security Gateways geographically. You must request a central license for one remote Security Gateway.
How do you apply the license?

Question21: When installing a dedicated R80 SmartEvent server, what is the recommended size of the root partition?

Question22: What is the Manual Client Authentication TELNET port?

Question23: What is the default method for destination NAT?

Question24: Which command is used to add users to or from existing roles?

Question25: What must a Security Administrator do to comply with a management requirement to log all traffic accepted through the perimeter Security Gateway?

Question26: Which of the following is NOT a back up method?

Question27: R80 Security Management Server can be installed on which of the following operating systems?

Question28: If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsible, which of these steps should NOT be performed:

Question29: Fill in the blank: The _________ software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities.

Question30: What happens if the identity of a user is known?

Question31: In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

Question32: Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

Question33: What is the default shell of Gaia CLI?

Question34: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

Question35: The system administrator of a company is trying to find out why acceleration is not working for the traffic.
The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

Question36: Which of the following is NOT an alert option?

Question37: Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

Question38: Fill in the blank: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.

Question39: Which of the following actions do NOT take place in IKE Phase 1?

Question40: In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

Question41: You find that Users are not prompted for authentication when they access their Web servers, even though you have created an HTTP rule via User Authentication. Choose the BEST reason why.

Question42: Where can administrator edit a list of trusted SmartConsole clients in R80?

Question43: You are about to test some rule and object changes suggested in an R77 news group. Which backup solution should you use to ensure the easiest restoration of your Security Policy to its previous configuration after testing the changes?

Question44: When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

Question45: What are the two types of address translation rules?

Question46: While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the correct order of steps needed to set up the block?
1) Select Active Mode tab in SmartView Tracker.
2) Select Tools > Block Intruder.
3) Select Log Viewing tab in SmartView Tracker.
4) Set Blocking Timeout value to 60 minutes.
5) Highlight connection that should be blocked.

Question47: Joey is using the computer with IP address 192.168.20.13. He wants to access web page "www.Check Point.com", which is hosted on Web server with IP address 203.0.113.111. How many rules on Check Point Firewall are required for this connection?

Question48: Which remote Access Solution is clientless?

Question49: Why would an administrator see the message below?

Question50: At what point is the Internal Certificate Authority (ICA) created?

Question51: Which Threat Prevention Profile is not included by default in R80 Management?

Question52: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?

Question53: rd
According to Check Point Best Practice, when adding a 3 party gateway to a Check Point security solution what object SHOULD be added? A(n):

Question54: What component of R80 Management is used for indexing?

Question55: You have configured SNX on the Security Gateway. The client connects to the Security Gateway and the user enters the authentication credentials. What must happen after authentication that allows the client to connect to the Security Gateway's VPN domain?

Question56: Which authentication scheme requires a user to possess a token?

Question57: You find a suspicious connection from a problematic host. You decide that you want to block everything from that whole network, not just the problematic host. You want to block this for an hour while you investigate further, but you do not want to add any rules to the Rule Base. How do you achieve this?

Question58: Which one of the following is true about Threat Extraction?

Question59: Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ________ all traffic. However, in the Application Control policy layer, the default action is ________ all traffic.

Question60: Which R77 GUI would you use to see number of packets accepted since the last policy install?

Question61: Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?

Question62: Fill in the blanks: A security Policy is created in _________ , stored in the _________ , and Distributed to the various __________ .

Question63: A Cleanup rule:

Question64: Which of the following is NOT an advantage to using multiple LDAP servers?

Question65: All R77 Security Servers can perform authentication with the exception of one. Which of the Security Servers can NOT perform authentication?

Question66: What is the appropriate default Gaia Portal address?

Question67: Which of the following is NOT an attribute of packer acceleration?

Question68: What is also referred to as Dynamic NAT?

Question69: What is NOT an advantage of Packet Filtering?

Question70: Your boss wants you to closely monitor an employee suspected of transferring company secrets to the competition. The IT department discovered the suspect installed a WinSCP client in order to use encrypted communication. Which of the following methods is BEST to accomplish this task?

Question71: Where would an administrator enable Implied Rules logging?

Question72: Which of the following describes how Threat Extraction functions?

Question73: Please choose correct command syntax to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI?

Question74: When defining QoS global properties, which option below is not valid?

Question75: Office mode means that:

Question76: Which type of the Check Point license ties the package license to the IP address of the Security Management Server?

Question77: You want to store the GAiA configuration in a file for later reference. What command should you use?

Question78: On the following picture an administrator configures Identity Awareness:

After clicking "Next" the above configuration is supported by:

Question79: VPN gateways must authenticate to each other prior to exchanging information. What are the two types of credentials used for authentication?

Question80: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question81: Using ClusterXL, what statement is true about the Sticky Decision Function?

Question82: Your users are defined in a Windows 2008 R2 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R77?

Question83: What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.

Question84: Fill in the blank: The ________ feature allows administrators to share a policy with other policy packages.

Question85: Which NAT rules are prioritized first?

Question86: Vanessa is a Firewall administrator. She wants to test a backup of her company's production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment. Which details she need to fill in System Restore window before she can click OK button and test the backup?

Question87: Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows them as prioritized security events.

Question88: Which of the following is NOT an alert option?

Question89: Which method below is NOT one of the ways to communicate using the Management API's?

Question90: John is using Management HA. Which Smartcenter should be connected to for making changes?

Question91: In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

Question92: Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic. Assuming acceleration is enable which path is handling the traffic?

Question93: You manage a global network extending from your base in Chicago to Tokyo, Calcutta and Dallas.
Management wants a report detailing the current software level of each Enterprise class Security Gateway.
You plan to take the opportunity to create a proposal outline, listing the most cost-effective way to upgrade your Gateways. Which two SmartConsole applications will you use to create this report and outline?

Question94: You have just installed your Gateway and want to analyze the packet size distribution of your traffic with SmartView Monitor.

Unfortunately, you get the message:
"There are no machines that contain Firewall Blade and SmartView Monitor".
What should you do to analyze the packet size distribution of your traffic? Give the BEST answer.

Question95: Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?

Question96: Which set of objects have an Authentication tab?

Question97: Which Check Point software blade provides protection from zero-day and undiscovered threats?

Question98: R80.10 management server can manage gateways with which versions installed?

Question99: In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Question100: Identify the API that is not supported by Check Point currently.

Question101: As you review this Security Policy, what changes could you make to accommodate Rule 4?

Question102: Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in:

Question103: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

Question104: Which Threat Prevention Profile is not included by default in R80 Management?

Question105: When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times.
No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

Question106: Which statement is NOT TRUE about Delta synchronization?

Question107: Fill in the blank: RADIUS Accounting gets ______ data from requests generated by the accounting client

Question108: Jennifer McHanry is CEO of ACME. She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory domain, she cannot identify seamlessly with AD Query. However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R77 Firewall Rule Base.
To make this scenario work, the IT administrator must:
1) Enable Identity Awareness on a gateway and select Captive Portal as one of the Identity Sources.
2) In the Portal Settings window in the User Access section, make sure that Name and password login is selected.
3) Create a new rule in the Firewall Rule Base to let Jennifer McHanry access network destinations. Select accept as the Action.
4) Install policy.
Ms McHanry tries to access the resource but is unable. What should she do?

Question109: Which the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Question110: When launching SmartDashboard, what information is required to log into R77?

Question111: Where do you verify that UserDirectory is enabled?

Question112: Which of the following are types of VPN communicates?

Question113: How many packets does the IKE exchange use for Phase 1 Main Mode?

Question114: What is the benefit of Manual NAT over Automatic NAT?

Question115: Which path below is available only when CoreXL is enabled?

Question116: Which of these statements describes the Check Point ThreatCloud?

Question117: The IT Management team is interested in the new features of the Check Point R80 Management and wants to upgrade but they are concerned that the existing R77.30 Gaia Gateways cannot be managed by R80 because it is so different. As the administrator responsible for the Firewalls, how can you answer or confirm these concerns?

Question118: Which feature is NOT provided by all Check Point Mobile Access solutions?

Question119: Choose the correct statement regarding Implicit Rules.

Question120: The organization's security manager wishes to back up just the Gaia operating system parameters. Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries?

Question121: Look at the following screenshot and select the BEST answer.

Question122: When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?

Question123: After the initial installation the First Time Configuration Wizard should be run. Select the BEST answer.

Question124: What are the three essential components of the Check Point Security Management Architecture?

Question125: You want to define a selected administrator's permission to edit a layer. However, when you click the + sign in the "Select additional profile that will be able edit this layer" you do not see anything. What is the most likely cause of this problem? Select the BEST answer.

Question126: Fill in the blank: A _______ is used by a VPN gateway to send traffic as if it were a physical interface.

Question127: Fill in the blank: The R80 utility fw monitoris used to troubleshoot _____________

Question128: Which information is included in the "Full Log" tracking option, but is not included in the "Log" tracking option?

Question129: Which of the following licenses are considered temporary?

Question130: From SecureXL perspective, what are the tree paths of traffic flow:

Question131: Which of the following firewall modes DOES NOT allow for Identity Awareness to be deployed?

Question132: What port is used for communication to the User Center with SmartUpdate?

Question133: Match the following commands to their correct function. Each command has one function only listed.

Question134: What port is used for delivering logs from the gateway to the management server?

Question135: Which policy type is used to enforce bandwidth and traffic control rules?

Question136: You are unable to login to SmartDashboard. You log into the management server and run #cpwd_admin list with the following output:

What reason could possibly BEST explain why you are unable to connect to SmartDashboard?

Question137: What command would show the API server status?

Question138: In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server (Security Management Server)?

Question139: Fill in the blank: Once a license is activated, a ________ should be installed.

Question140: Which of these attributes would be critical for a site-to-site VPN?

Question141: Katie has been asked to do a backup on the Blue Security Gateway. Which command would accomplish this in the Gaia CLI?

Question142: Which of the below is the MOST correct process to reset SIC from SmartDashboard?

Question143: While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?

Question144: What SmartEvent component creates events?

Question145: In R80, Unified Policy is a combination of

Question146: On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

Question147: What is the difference between an event and a log?

Question148: Fill in the blank: Licenses can be added to the License and Contract repository ________ .

Question149: Web Control Layer has been set up using the settings in the following dialogue:

Consider the following policy and select the BEST answer.

Question150: In order to modify Security Policies the administrator can use which of the following tools? Select the BEST answer.

Question151: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

Question152: What are the two high availability modes?

Question153: Which SmartConsole component can Administrators use to track changes to the Rule Base?

Question154: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question155: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Question156: You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities sh you do first?

Question157: SandBlast has several functional components that work together to ensure that attacks are prevented in real-time. Which the following is NOT part of the SandBlast component?

Question158: Which of the following is NOT a set of Regulatory Requirements related to Information Security?

Question159: Which tool CANNOT be launched from SmartUpdate R77?

Question160: Which of the following is NOT a valid option when configuring access for Captive Portal?

Question161: Using R80 Smart Console, what does a "pencil icon" in a rule mean?

Question162: According to Check Point Best Practice, when adding a non-managed Check Point Gateway to a Check Point security solution what object SHOULD be added? A(n):

Question163: Which of the following is a hash algorithm?

Question164: Which application should you use to install a contract file?

Question165: Which of the following is NOT a VPN routing option available in a star community?

Question166: Which of the following is TRUE about the Check Point Host object?

Question167: There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically?

Question168: AdminA and AdminB are both logged in on SmartConsole. What does it mean if AdminB sees a locked icon on a rule? Choose the BEST answer.

Question169: Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links. Which component of SandBlast protection is her company using on a Gateway?

Question170: Your company enforces a strict change control policy. Which of the following would be MOST effective for quickly dropping an attacker's specific active connection?

Question171: The CDT utility supports which of the following?

Question172: You are asked to check the status of several user-mode processes on the management server and gateway. Which of the following processes can only be seen on a Management Server?

Question173: Fill in the blank: Each cluster has __________ interfaces.

Question174: You have two rules, ten users, and two user groups in a Security Policy. You create database version 1 for this configuration. You then delete two existing users and add a new user group. You modify one rule and add two new rules to the Rule Base. You save the Security Policy and create database version 2. After a while, you decide to roll back to version 1 to use the Rule Base, but you want to keep your user database.
How can you do this?

Question175: Choose what BEST describes a Session.

Question176: What is true about the IPS-Blade?

Question177: The most important part of a site-to-site VPN deployment is the ________ .

Question178: Fill in the blanks: The Application Layer Firewalls inspect traffic through the ________ layer(s) of the TCP/ IP model and up to and including the ________ layer.

Question179: Choose what BEST describes users on Gaia Platform.

Question180: An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG.
Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep- alive packet every minute.
Which of the following is the BEST explanation for this behavior?

Question181: Which is a suitable command to check whether Drop Templates are activated or not?

Question182: Session unique identifiers are passed to the web api using which http header option?

Question183: What does ExternalZone represent in the presented rule?

Question184: How do you configure an alert in SmartView Monitor?

Question185: If the first packet of an UDP session is rejected by a security policy, what does the firewall send to the client?

Question186: Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?

Question187: Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Question188: SmartEvent does NOT use which of the following procedures to identity events:

Question189: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question190: Under which file is the proxy arp configuration stored?

Question191: The following graphic shows:

Question192: A digital signature:

Question193: You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

Question194: A client has created a new Gateway object that will be managed at a remote location. When the client attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install On check box. What should you look for?

Question195: What is the difference between SSL VPN and IPSec VPN?

Question196: Fill in the blank: RADIUS protocol uses ______ to communicate with the gateway.

Question197: Fill in the blanks: A Check Point software license consists of a _______ and _______ .

Question198: Which firewall daemon is responsible for the FW CLI commands?

Question199: What is the main difference between Threat Extraction and Threat Emulation?

Question200: Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

Question201: Fill in the blank: The command __________ provides the most complete restoration of a R80 configuration.

Question202: You are going to upgrade from R77 to R80. Before the upgrade, you want to back up the system so that, if there are any problems, you can easily restore to the old version with all configuration and management files intact. What is the BEST backup method in this scenario?

Question203: Which of the following is NOT an alert option?

Question204: What is Consolidation Policy?

Question205: Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.

Question206: Fill in the blank: The R80 feature ________ permits blocking specific IP addresses for a specified time period.

Question207: The Gaia operating system supports which routing protocols?

Question208: Which command is used to obtain the configuration lock in Gaia?

Question209: What are the three components for Check Point Capsule?

Question210: If there is an Accept Implied Policy set to "First", what is the reason Jorge cannot see any logs?

Question211: Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as
_______

Question212: What is the mechanism behind Threat Extraction?

Question213: Which of the following is NOT an element of VPN Simplified Mode and VPN Communities?

Question214: How Capsule Connect and Capsule Workspace differ?

Question215: The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic method.
How many times per day will CPUSE agent check for hotfixes and automatically download them?

Question216: Look at the screenshot below. What CLISH command provides this output?

Question217: Joey wants to configure NTP on R80 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?

Question218: Which is the correct order of a log flow processed by SmartEvent components:

Question219: Which command can you use to verify the number of active concurrent connections?