EMT Practice Test

1. Question Content...

---

Question1: When defining QoS global properties, which option below is not valid?

Question2: Which is a suitable command to check whether Drop Templates are activated or not?

Question3: Office mode means that:

Question4: Which of the following is NOT a component of Check Point Capsule?

Question5: What is the SOLR database for?

Question6: The security Gateway is installed on GAiA R80 The default port for the WEB User Interface is _______ .

Question7: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?

Question8: Fill in the blank: RADIUS protocol uses ______ to communicate with the gateway.

Question9: What is the difference between SSL VPN and IPSec VPN?

Question10: What are the three essential components of the Check Point Security Management Architecture?

Question11: Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES
256 for IKE phase 2. Why is this a problematic setup?

Question12: In R80, Unified Policy is a combination of

Question13: Fill in the blank: Service blades must be attached to a ______________.

Question14: How many users can have read/write access in Gaia at one time?

Question15: In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server (Security Management Server)?

Question16: The IT Management team is interested in the new features of the Check Point R80 Management and wants to upgrade but they are concerned that the existing R77.30 Gaia Gateways cannot be managed by R80 because it is so different. As the administrator responsible for the Firewalls, how can you answer or confirm these concerns?

Question17: Fill in the blank: To build an effective Security Policy, use a ________ and _______ rule.

Question18: Which of the following are types of VPN communicates?

Question19: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

Question20: What are the two high availability modes?

Question21: Which is the correct order of a log flow processed by SmartEvent components:

Question22: Which of the following is a hash algorithm?

Question23: Which statement is NOT TRUE about Delta synchronization?

Question24: Which rule is responsible for the user authentication failure?

Question25: What component of R80 Management is used for indexing?

Question26: Which firewall daemon is responsible for the FW CLI commands?

Question27: The SmartEvent R80 Web application for real-time event monitoring is called:

Question28: When using Monitored circuit VRRP, what is a priority delta?

Question29: Anti-Spoofing is typically set up on which object type?

Question30: Provide very wide coverage for all products and protocols, with noticeable performance impact.

How could you tune the profile in order to lower the CPU load still maintaining security at good level?
Select the BEST answer.

Question31: Administrator wishes to update IPS from SmartConsole by clicking on the option "update now" under the IPS tab. Which device requires internet access for the update to work?

Question32: Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?

Question33: What is the mechanism behind Threat Extraction?

Question34: SandBlast has several functional components that work together to ensure that attacks are prevented in real-time. Which the following is NOT part of the SandBlast component?

Question35: Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ________ all traffic. However, in the Application Control policy layer, the default action is ________ all traffic.

Question36: At what point is the Internal Certificate Authority (ICA) created?

Question37: After the initial installation the First Time Configuration Wizard should be run. Select the BEST answer.

Question38: The following graphic shows:

Question39: Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links. Which component of SandBlast protection is her company using on a Gateway?

Question40: Which of the following statements accurately describes the command snapshot?

Question41: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Question42: What is the appropriate default Gaia Portal address?

Question43: Which path below is available only when CoreXL is enabled?

Question44: Sally has a Hot Fix Accumulator (HFA) she wants to install on her Security Gateway which operates with GAiA, but she cannot SCP the HFA to the system. She can SSH into the Security Gateway, but she has never been able to SCP files to it. What would be the most likely reason she cannot do so?

Question45: When installing a dedicated R80 SmartEvent server, what is the recommended size of the root partition?

Question46: In order to modify Security Policies the administrator can use which of the following tools? Select the BEST answer.

Question47: The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic method.
How many times per day will CPUSE agent check for hotfixes and automatically download them?

Question48: View the rule below. What does the lock-symbol in the left column mean? Select the BEST answer.

Question49: Fill in the blank: Each cluster has __________ interfaces.

Question50: Message digests use which of the following?

Question51: Match the following commands to their correct function. Each command has one function only listed.

Question52: Joey wants to configure NTP on R80 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?

Question53: Your boss wants you to closely monitor an employee suspected of transferring company secrets to the competition. The IT department discovered the suspect installed a WinSCP client in order to use encrypted communication. Which of the following methods is BEST to accomplish this task?

Question54: Which of the following is NOT a back up method?

Question55: Fill in the blank: The R80 feature ________ permits blocking specific IP addresses for a specified time period.

Question56: If there is an Accept Implied Policy set to "First", what is the reason Jorge cannot see any logs?

Question57: To ensure that VMAC mode is enabled, which CLI command you should run on all cluster members?
Choose the best answer.

Question58: You are the Security Administrator for MegaCorp. In order to see how efficient your firewall Rule Base is, you would like to see how many often the particular rules match. Where can you see it? Give the BEST answer.

Question59: Which information is included in the "Full Log" tracking option, but is not included in the "Log" tracking option?

Question60: Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

Question61: Why would an administrator see the message below?

Question62: When an encrypted packet is decrypted, where does this happen?

Question63: Web Control Layer has been set up using the settings in the following dialogue:

Consider the following policy and select the BEST answer.

Question64: Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?

Question65: Look at the screenshot below. What CLISH command provides this output?

Question66: In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

Question67: Which policy type is used to enforce bandwidth and traffic control rules?

Question68: Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in:

Question69: Using ClusterXL, what statement is true about the Sticky Decision Function?

Question70: Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

Question71: MegaCorp's security infrastructure separates Security Gateways geographically. You must request a central license for one remote Security Gateway.
How do you apply the license?

Question72: If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsible, which of these steps should NOT be performed:

Question73: Choose what BEST describes a Session.

Question74: What is the benefit of Manual NAT over Automatic NAT?

Question75: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

Question76: What statement is true regarding Visitor Mode?

Question77: Fill in the blank: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.

Question78: The Gaia operating system supports which routing protocols?

Question79: Under which file is the proxy arp configuration stored?

Question80: Which feature in R77 permits blocking specific IP addresses for a specified time period?

Question81: Which of the following is NOT an alert option?

Question82: You are asked to check the status of several user-mode processes on the management server and gateway. Which of the following processes can only be seen on a Management Server?

Question83: Fill in the blank: The ________ feature allows administrators to share a policy with other policy packages.

Question84: Katie has been asked to do a backup on the Blue Security Gateway. Which command would accomplish this in the Gaia CLI?

Question85: What are the three components for Check Point Capsule?

Question86: There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically?

Question87: What are the two types of address translation rules?

Question88: In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Question89: Which authentication scheme requires a user to possess a token?

Question90: While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?

Question91: You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the most likely cause?

Question92: The organization's security manager wishes to back up just the Gaia operating system parameters. Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries?

Question93: Fill in the blanks: A security Policy is created in _________ , stored in the _________ , and Distributed to the various __________ .

Question94: Fill in the blank: An LDAP server holds one or more ______________.

Question95: Where can administrator edit a list of trusted SmartConsole clients in R80?

Question96: The fw monitorutility is used to troubleshoot which of the following problems?

Question97: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Question98: Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic. Assuming acceleration is enable which path is handling the traffic?

Question99: Fill in the blanks: The Application Layer Firewalls inspect traffic through the ________ layer(s) of the TCP/ IP model and up to and including the ________ layer.

Question100: When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

Question101: Which of the following is TRUE about the Check Point Host object?

Question102: MyCorp has the following NAT rules. You need to disable the NAT function when Alpha-internal networks try to reach the Google DNS (8.8.8.8) server.
What can you do in this case?

Question103: You are unable to login to SmartDashboard. You log into the management server and run #cpwd_admin list with the following output:

What reason could possibly BEST explain why you are unable to connect to SmartDashboard?

Question104: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question105: What Identity Agent allows packet tagging and computer authentication?

Question106: What is the potential downside or drawback to choosing the Standalone deployment option instead of the Distributed deployment option?

Question107: Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows them as prioritized security events.

Question108: Which of the following is NOT defined by an Access Role object?

Question109: What SmartEvent component creates events?

Question110: What must a Security Administrator do to comply with a management requirement to log all traffic accepted through the perimeter Security Gateway?

Question111: The system administrator of a company is trying to find out why acceleration is not working for the traffic.
The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

Question112: Which of the following licenses are considered temporary?

Question113: Joey is using the computer with IP address 192.168.20.13. He wants to access web page "www.Check Point.com", which is hosted on Web server with IP address 203.0.113.111. How many rules on Check Point Firewall are required for this connection?

Question114: What is the default method for destination NAT?

Question115: What action can be performed from SmartUpdate R77?

Question116: In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?

Question117: Which of the following is NOT an attribute of packer acceleration?

Question118: You want to define a selected administrator's permission to edit a layer. However, when you click the + sign in the "Select additional profile that will be able edit this layer" you do not see anything. What is the most likely cause of this problem? Select the BEST answer.

Question119: Which utility shows the security gateway general system information statistics like operating system information and resource usage, and individual software blade statistics of VPN, Identity Awareness and DLP?

Question120: R80.10 management server can manage gateways with which versions installed?

Question121: On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

Question122: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?

Question123: Can a Check Point gateway translate both source IP address and destination IP address in a given packet?

Question124: Which NAT rules are prioritized first?

Question125: What is NOT an advantage of Packet Filtering?

Question126: Which one of the following is true about Threat Extraction?

Question127: Fill in the blank: The command __________ provides the most complete restoration of a R80 configuration.

Question128: To install a brand new Check Point Cluster, the MegaCorp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster. Which type of cluster is it?

Question129: What does ExternalZone represent in the presented rule?

Question130: You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.

What does this mean?

Question131: What is the purpose of Captive Portal?

Question132: What is the default shell of Gaia CLI?

Question133: What CLI utility allows an administrator to capture traffic along the firewall inspection chain?

Question134: What is true about the IPS-Blade?

Question135: Look at the following screenshot and select the BEST answer.

Question136: Study the Rule base and Client Authentication Action properties screen.


After being authenticated by the Security Gateways, a user starts a HTTP connection to a Web site. What happens when the user tries to FTP to another site using the command line? The:

Question137: Fill in the blank: The _________ collects logs and sends them to the _________ .

Question138: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question139: Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?

Question140: The Captive Portal tool:

Question141: Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Question142: Which SmartConsole component can Administrators use to track changes to the Rule Base?

Question143: Which of the following describes how Threat Extraction functions?

Question144: On the following picture an administrator configures Identity Awareness:

After clicking "Next" the above configuration is supported by:

Question145: Your bank's distributed R77 installation has Security Gateways up for renewal. Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

Question146: Identify the API that is not supported by Check Point currently.

Question147: What command would show the API server status?

Question148: How Capsule Connect and Capsule Workspace differ?

Question149: The CDT utility supports which of the following?

Question150: Fill in the blank: The _________ software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities.

Question151: Fill in the blank: The R80 utility fw monitoris used to troubleshoot _____________

Question152: Using R80 Smart Console, what does a "pencil icon" in a rule mean?

Question153: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using
________ .

Question154: Choose the SmartLog property that is TRUE.

Question155: In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

Question156: Which two of these Check Point Protocols are used by _____ ?

Question157: Fill in the blank: A _______ is used by a VPN gateway to send traffic as if it were a physical interface.

Question158: Which of the following is NOT an element of VPN Simplified Mode and VPN Communities?

Question159: Which of these statements describes the Check Point ThreatCloud?

Question160: What is the best sync method in the ClusterXL deployment?

Question161: The most important part of a site-to-site VPN deployment is the ________ .

Question162: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question163: Which default user has full read/write access?

Question164: Which directory holds the SmartLog index files by default?

Question165: Which feature is NOT provided by all Check Point Mobile Access solutions?

Question166: What is the difference between an event and a log?

Question167: Which of these components does NOT require a Security Gateway R77 license?

Question168: Mesh and Star are two types of VPN topologies. Which statement below is TRUE about these types of communities?

Question169: During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

Question170: R80 Security Management Server can be installed on which of the following operating systems?

Question171: You are going to upgrade from R77 to R80. Before the upgrade, you want to back up the system so that, if there are any problems, you can easily restore to the old version with all configuration and management files intact. What is the BEST backup method in this scenario?

Question172: Where do we need to reset the SIC on a gateway object?

Question173: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

Question174: Please choose correct command syntax to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI?

Question175: John is using Management HA. Which Smartcenter should be connected to for making changes?

Question176: Which of the following is NOT an advantage to using multiple LDAP servers?

Question177: What port is used for delivering logs from the gateway to the management server?

Question178: You want to verify if there are unsaved changes in GAiA that will be lost with a reboot. What command can be used?

Question179: You want to reset SIC between smberlin and sgosaka.

In SmartDashboard, you choose sgosaka, Communication, Reset. On sgosaka, you start cpconfig, choose Secure Internal Communication and enter the new SIC Activation Key. The screen reads The SIC was successfully initialized and jumps back to the menu. When trying to establish a connection, instead of a working connection, you receive this error message:

What is the reason for this behavior?

Question180: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

Question181: From SecureXL perspective, what are the tree paths of traffic flow:

Question182: What are the three tabs available in SmartView Tracker?

Question183: Which command is used to add users to or from existing roles?

Question184: Which of the following is NOT a VPN routing option available in a star community?

Question185: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, gateway policy permits access only from Join's desktop which is assigned an IP address 10.0.0.19 via DHCP.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but the limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop. He wants to move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.
John plugged in his laptop to the network on a different network segment and he is not able to connect.
How does he solve this problem?

Question186: Which tool CANNOT be launched from SmartUpdate R77?

Question187: Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.

Question188: Which set of objects have an Authentication tab?

Question189: What are the steps to configure the HTTPS Inspection Policy?

Question190: What is the main difference between Threat Extraction and Threat Emulation?

Question191: Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?

Question192: SmartEvent does NOT use which of the following procedures to identity events:

Question193: Fill in the blanks: A Check Point software license consists of a _______ and _______ .

Question194: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

Question195: Which of the following is NOT a set of Regulatory Requirements related to Information Security?

Question196: You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities sh you do first?

Question197: When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times.
No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

Question198: You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the right protections in place. Check Point has been selected for the security vendor. Which Check Point products protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?

Question199: Which of the following commands is used to monitor cluster members?

Question200: Which method below is NOT one of the ways to communicate using the Management API's?

Question201: What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.

Question202: Session unique identifiers are passed to the web api using which http header option?

Question203: Fill in the blank: Licenses can be added to the License and Contract repository ________ .

Question204: Which Check Point software blade provides protection from zero-day and undiscovered threats?

Question205: What happens if the identity of a user is known?

Question206: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question207: Fill in the blank: RADIUS Accounting gets ______ data from requests generated by the accounting client

Question208: When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?

Question209: Which application should you use to install a contract file?

Question210: If the first packet of an UDP session is rejected by a security policy, what does the firewall send to the client?

Question211: Which command is used to obtain the configuration lock in Gaia?

Question212: Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

Question213: Which of the following is NOT an option to calculate the traffic direction?

Question214: You want to store the GAiA configuration in a file for later reference. What command should you use?

Question215: Choose what BEST describes users on Gaia Platform.

Question216: Can multiple administrators connect to a Security Management Server at the same time?

Question217: Which type of the Check Point license ties the package license to the IP address of the Security Management Server?

Question218: Which of the following is NOT an option for internal network definition of Anti-spoofing?

Question219: AdminA and AdminB are both logged in on SmartConsole. What does it mean if AdminB sees a locked icon on a rule? Choose the BEST answer.

Question220: Which Threat Prevention Profile is not included by default in R80 Management?

Question221: When using LDAP as an authentication method for Identity Awareness, the query:

Question222: Vanessa is a Firewall administrator. She wants to test a backup of her company's production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment. Which details she need to fill in System Restore window before she can click OK button and test the backup?

Question223: Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as
_______

Question224: You installed Security Management Server on a computer using GAiA in the MegaCorp home office. You use IP address 10.1.1.1. You also installed the Security Gateway on a second GAiA computer, which you plan to ship to another Administrator at a MegaCorp hub office. What is the correct order for pushing SIC certificates to the Gateway before shipping it?
1. Run cpconfig on the Gateway, select Secure Internal Communication, enter the activation key, and reconfirm.
2. Initialize Internal Certificate Authority (ICA) on the Security Management Server.
3. Configure the Gateway object with the host name and IP addresses for the remote site.
4. Click the Communication button in the Gateway object's General screen, enter the activation key, and click Initialize and OK.
5. Install the Security Policy.

Question225: What is the command to see cluster status in cli expert mode?

Question226: Fill in the blank: Once a license is activated, a ________ should be installed.

Question227: In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

Question228: You have successfully backed up your Check Point configurations without the OS information. What command would you use to restore this backup?

Question229: Which remote Access Solution is clientless?