EMT Practice Test

1. Question Content...

---

Question1: Fill in the blank: A _______ is used by a VPN gateway to send traffic as if it were a physical interface.

Question2: What are the three components for Check Point Capsule?

Question3: If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsible, which of these steps should NOT be performed:

Question4: Which rule is responsible for the user authentication failure?

Question5: Where can you trigger a failover of the cluster members?
1. Log in to Security Gateway CLI and run command clusterXL_admin down.
2. In SmartView Monitor right-click the Security Gateway member and select Cluster member down.
3. Log into Security Gateway CLI and run command cphaprob down.

Question6: What is true about the IPS-Blade?

Question7: Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as
_______

Question8: What is the most recommended installation method for Check Point appliances?

Question9: You have successfully backed up your Check Point configurations without the OS information. What command would you use to restore this backup?

Question10: What is a reason for manual creation of a NAT rule?

Question11: A digital signature:

Question12: Where does the security administrator activate Identity Awareness within SmartDashboard?

Question13: You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

Question14: True or False: The destination server for Security Gateway logs depends on a Security Management Server configuration.

Question15: Which of the following is NOT a role of the SmartCenter:

Question16: Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

Question17: Which NAT rules are prioritized first?

Question18: Which Threat Prevention Profile is not included by default in R80 Management?

Question19: What is the Manual Client Authentication TELNET port?

Question20: Review the rules. Assume domain UDP is enabled in the implied rules.

What happens when a user from the internal network tries to browse to the internet using HTTP? The user:

Question21: You want to verify if there are unsaved changes in GAiA that will be lost with a reboot. What command can be used?

Question22: When using Monitored circuit VRRP, what is a priority delta?

Question23: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

Question24: Which of the following commands can be used to remove site-to-site IPSEC Security Associations (SA)?

Question25: John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole. To make John's changes available to other administrators, and to save the database before installing a policy, what must John do?

Question26: You are using SmartView Tracker to troubleshoot NAT entries. Which column do you check to view the NAT'd source port if you are using Source NAT?

Question27: According to Check Point Best Practice, when adding a non-managed Check Point Gateway to a Check Point security solution what object SHOULD be added? A(n):

Question28: Tom has connected to the R80 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made:

Question29: What is the BEST command to view configuration details of all interfaces in Gaia CLISH?

Question30: What CLI utility allows an administrator to capture traffic along the firewall inspection chain?

Question31: Which of the following uses the same key to decrypt as it does to encrypt?

Question32: MyCorp has the following NAT rules. You need to disable the NAT function when Alpha-internal networks try to reach the Google DNS (8.8.8.8) server.
What can you do in this case?

Question33: Which of the following is NOT a component of a Distinguished Name?

Question34: How do you configure the Security Policy to provide uses access to the Captive Portal through an external (Internet) interface?

Question35: What are the two types of NAT supported by the Security Gateway?

Question36: What is also referred to as Dynamic NAT?

Question37: Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ________ all traffic. However, in the Application Control policy layer, the default action is ________ all traffic.

Question38: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question39: ABC Corp., and have recently returned from a training course on Check Point's new advanced R80 management platform. You are presenting an in-house R80 Management to the other administrators in ABC Corp.

How will you describe the new "Publish" button in R80 Management Console?

Question40: What key is used to save the current CPView page in a filename format cpview_"cpview process ID".
cap"number of captures"?

Question41: Identify the ports to which the Client Authentication daemon listens on by default?

Question42: Which of the following is NOT supported by Bridge Mode Check Point Security Gateway

Question43: What is the order of NAT priorities?

Question44: Which component functions as the Internal Certificate Authority for R77?

Question45: The SIC Status "Unknown" means

Question46: SmartEvent does NOT use which of the following procedures to identity events:

Question47: Fill in the blank: The ________ feature allows administrators to share a policy with other policy packages.

Question48: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

Question49: When using GAiA, it might be necessary to temporarily change the MAC address of the interface eth 0to
00:0C:29:12:34:56. After restarting the network the old MAC address should be active. How do you configure this change?

Question50: When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times.
No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

Question51: To optimize Rule Base efficiency the most hit rules should be where?

Question52: Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

Question53: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question54: Choose what BEST describes users on Gaia Platform.

Question55: What is the mechanism behind Threat Extraction?

Question56: Which of the following commands is used to verify license installation?

Question57: Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?

Question58: Provide very wide coverage for all products and protocols, with noticeable performance impact.

How could you tune the profile in order to lower the CPU load still maintaining security at good level?
Select the BEST answer.

Question59: Which command can you use to enable or disable multi-queue per interface?

Question60: What happens if the identity of a user is known?

Question61: Which of the following is NOT a license activation method?

Question62: Which of the following is NOT a set of Regulatory Requirements related to Information Security?

Question63: Which of the following is used to initially create trust between a Gateway and Security Management Server?

Question64: You are going to perform a major upgrade. Which back up solution should you use to ensure your database can be restored on that device?

Question65: Using R80 Smart Console, what does a "pencil icon" in a rule mean?

Question66: In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

Question67: Which of the following is a hash algorithm?

Question68: What Identity Agent allows packet tagging and computer authentication?

Question69: In Unified SmartConsole Gateways and Servers tab you can perform the following functions EXCEPT

Question70: When configuring LDAP User Directory integration, Changes applied to a User Directory template are:

Question71: Tina is a new administrator who is currently reviewing the new Check Point R80 Management console interface. In the Gateways view, she is reviewing the Summary screen as in the screenshot below. What as an 'Open Server'?

Question72: Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links. Which component of SandBlast protection is her company using on a Gateway?

Question73: In R80 spoofing is defined as a method of:

Question74: What licensing feature is used to verify licenses and activate new licenses added to the License and Contracts repository?

Question75: After trust has been established between the Check Point components, what is TRUE about name and IP- address changes?

Question76: Which of these components does NOT require a Security Gateway R77 license?

Question77: What two ordered layers make up the Access Control Policy Layer?

Question78: Fill in the blank: RADIUS Accounting gets ______ data from requests generated by the accounting client

Question79: When defining QoS global properties, which option below is not valid?

Question80: Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or a via CLI. Which command should be use in CLI? Choose the correct answer.

Question81: Which of the following statements is TRUE about R80 management plug-ins?

Question82: What are the three tabs available in SmartView Tracker?

Question83: Which two of these Check Point Protocols are used by _____ ?

Question84: Which option would allow you to make a backup copy of the OS and Check Point configuration, without stopping Check Point processes?

Question85: A Cleanup rule:

Question86: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question87: How do you configure an alert in SmartView Monitor?

Question88: Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES
256 for IKE phase 2. Why is this a problematic setup?

Question89: The SmartEvent R80 Web application for real-time event monitoring is called:

Question90: Phase 1 of the two-phase negotiation process conducted by IKE operates in ______ mode.

Question91: What Check Point tool is used to automatically update Check Point products for the Gaia OS?

Question92: To install a brand new Check Point Cluster, the MegaCorp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster. Which type of cluster is it?

Question93: On the following picture an administrator configures Identity Awareness:

After clicking "Next" the above configuration is supported by:

Question94: Which of the following are available SmartConsole clients which can be installed from the R77 Windows CD? Read all answers and select the most complete and valid list.

Question95: Can a Check Point gateway translate both source IP address and destination IP address in a given packet?

Question96: Joey is using the computer with IP address 192.168.20.13. He wants to access web page
"www.CheckPoint.com", which is hosted on Web server with IP address 203.0.113.111. How many rules on Check Point Firewall are required for this connection?

Question97: Which of the following is the most secure means of authentication?

Question98: What does it mean if Deyra sees the gateway status:

Choose the BEST answer.

Question99: Where can administrator edit a list of trusted SmartConsole clients in R80?

Question100: Which feature in R77 permits blocking specific IP addresses for a specified time period?

Question101: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using
________ .

Question102: You manage a global network extending from your base in Chicago to Tokyo, Calcutta and Dallas.
Management wants a report detailing the current software level of each Enterprise class Security Gateway.
You plan to take the opportunity to create a proposal outline, listing the most cost-effective way to upgrade your Gateways. Which two SmartConsole applications will you use to create this report and outline?

Question103: Fill in the blank: ________information is included in the "Full Log" tracking option, but is not included in the
"Log" tracking option?

Question104: Why would an administrator see the message below?

Question105: Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

Question106: Which of the following ClusterXL modes uses a non-unicast MAC address for the cluster IP address.

Question107: What must a Security Administrator do to comply with a management requirement to log all traffic accepted through the perimeter Security Gateway?

Question108: A client has created a new Gateway object that will be managed at a remote location. When the client attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install On check box. What should you look for?

Question109: Fill in the blank: Service blades must be attached to a ______________.

Question110: Which deployment adds a Security Gateway to an existing environment without changing IP routing?

Question111: Which of the following technologies extracts detailed information from packets and stores that information in state tables?

Question112: What does ExternalZone represent in the presented rule?

Question113: Packages and licenses are loaded from all of these sources EXCEPT

Question114: Which Check Point feature enables application scanning and the detection?

Question115: There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically?

Question116: In which scenario is it a valid option to transfer a license from one hardware device to another?

Question117: R80.10 management server can manage gateways with which versions installed?

Question118: What are the advantages of a "shared policy" in R80?

Question119: Which of these attributes would be critical for a site-to-site VPN?