EMT Practice Test

1. Question Content...

---

Question1: You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the most likely cause?

Question2: Choose the correct statement regarding Implicit Rules.

Question3: Examine the following Rule Base.

What can we infer about the recent changes made to the Rule Base?

Question4: Which of the following actions do NOT take place in IKE Phase 1?

Question5: What is the default method for destination NAT?

Question6: When defining QoS global properties, which option below is not valid?

Question7: Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port. Which CLISH commands are required to be able to change this TCP port?

Question8: When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

Question9: How would you determine the software version from the CLI?

Question10: When using GAiA, it might be necessary to temporarily change the MAC address of the interface eth 0 to
00:0C:29:12:34:56. After restarting the network the old MAC address should be active. How do you configure this change?

Question11: Assuming you have a Distributed Deployment, what will be the effect of running the following command on the Security Management Server?

Question12: Which feature in R77 permits blocking specific IP addresses for a specified time period?

Question13: What is the order of NAT priorities?

Question14: How many layers make up the TCP/IP model?

Question15: A digital signature:

Question16: Which tool is used to enable cluster membership on a Gateway?

Question17: By default, which port does the WebUI listen on?

Question18: Choose what BEST describes the reason why querying logs now is very fast.

Question19: To install a brand new Check Point Cluster, the MegaCorp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster. Which type of cluster is it?

Question20: According to Check Point Best Practice, when adding a 3rd party gateway to a Check Point security solution what object SHOULD be added? A(n):

Question21: The system administrator of a company is trying to find out why acceleration is not working for the traffic.
The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

Question22: On the following graphic, you will find layers of policies.

What is a precedence of traffic inspection for the defined polices?

Question23: What type of NAT is a one-to-one relationship where each host is translated to a unique address?

Question24: From SecureXL perspective, what are the tree paths of traffic flow:

Question25: Which of the following ClusterXL modes uses a non-unicast MAC address for the cluster IP address?

Question26: The most important part of a site-to-site VPN deployment is the ________ .

Question27: Which Check Point software blade provides Application Security and identity control?

Question28: The Network Operations Center administrator needs access to Check Point Security devices mostly for troubleshooting purposes. You do not want to give her access to the expert mode, but she still should be able to run tcpdump. How can you achieve this requirement?

Question29: What is the benefit of Manual NAT over Automatic NAT?

Question30: The security Gateway is installed on GAiA R80 The default port for the WEB User Interface is _______ .

Question31: The tool _______ generates a R80 Security Gateway configuration report.

Question32: In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories. Which of the following is NOT an objects category?

Question33: In R80, more than one administrator can login to the Security Management Server with SmartConsole with write permission at the same time.

Question34: Which of the following is NOT an integral part of VPN communication within a network?

Question35: The IT Management team is interested in the new features of the Check Point R80.x Management and wants to upgrade but they are concerned that the existing R77.30 Gaia Gateways cannot be managed by R80.x because it is so different. As the administrator responsible for the Firewalls, how can you answer or confirm these concerns?

Question36: Which type of the Check Point license ties the package license to the IP address of the Security Management Server?

Question37: The SIC Status "Unknown" means

Question38: ____________ is the Gaia command that turns the server off.

Question39: Which of the following is NOT an option to calculate the traffic direction?

Question40: Each cluster has __________ interfaces.

Question41: Which tool is used to enable ClusterXL?

Question42: Which Threat Prevention Software Blade provides protection from malicious software that can infect your network computers?

Question43: Which of these statements describes the Check Point ThreatCloud?

Question44: If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsible, which of these steps should NOT be performed:

Question45: Provide very wide coverage for all products and protocols, with noticeable performance impact.

How could you tune the profile in order to lower the CPU load still maintaining security at good level?

Question46: The ______ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

Question47: Office mode means that:

Question48: Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?

Question49: In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Question50: You are going to perform a major upgrade. Which back up solution should you use to ensure your database can be restored on that device?

Question51: Which of the following are types of VPN communities?

Question52: Your company enforces a strict change control policy. Which of the following would be MOST effective for quickly dropping an attacker's specific active connection?

Question53: You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have received a call by one of the management users stating that they are unable to browse the Internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway. How do you review the logs to see what the problem may be?

Question54: The organization's security manager wishes to back up just the Gaia operating system parameters. Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries?

Question55: In ____________ NAT, the ____________ is translated.

Question56: MyCorp has the following NAT rules. You need to disable the NAT function when Alpha-internal networks try to reach the Google DNS (8.8.8.8) server.
What can you do in this case?

Question57: Message digests use which of the following?

Question58: Using the SmartConsole, which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?

Question59: In R80 Management, apart from using SmartConsole, objects or rules can also be modified using:

Question60: To build an effective Security Policy, use a ________ and _______ rule.

Question61: What is the default shell for the command line interface?

Question62: Which is the correct order of a log flow processed by SmartEvent components:

Question63: Which of the following is NOT an alert option?

Question64: Choose the Best place to find a Security Management Server backup file named backup_fw, on a Check Point Appliance.

Question65: What are the three authentication methods for SIC?

Question66: You are about to test some rule and object changes suggested in an R77 news group. Which backup solution should you use to ensure the easiest restoration of your Security Policy to its previous configuration after testing the changes?

Question67: What action can be performed from SmartUpdate R77?

Question68: Which options are given on features, when editing a Role on Gaia Platform?

Question69: Which of the following describes how Threat Extraction functions?

Question70: Which of the following is NOT defined by an Access Role object?

Question71: Which of the following is NOT a role of the SmartCenter:

Question72: Which type of attack can a firewall NOT prevent?

Question73: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

Question74: Licenses can be added to the License and Contract repository ________ .

Question75: R80.10 management server can manage gateways with which versions installed?

Question76: Where is the "Hit Count" feature enabled or disabled in SmartConsole?

Question77: Which option in a firewall rule would only match and allow traffic to VPN gateways for one Community in common?

Question78: If there is an Accept Implied Policy set to "First", what is the reason Jorge cannot see any logs?

Question79: R80 Security Management Server can be installed on which of the following operating systems?

Question80: Which limitation of CoreXL is overcome by using (mitigated by) Multi-Queue?

Question81: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Question82: An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server (SMS). While configuring the VPN community to specify the pre-shared secret, the administrator did not find a box to input the pre-shared secret. Why does it not allow him to specify the pre-shared secret?

Question83: Identify the ports to which the Client Authentication daemon listens on by default?

Question84: What is the most complete definition of the difference between the Install Policy button on the SmartConsole's tab, and the Install Policy button within a specific policy?

Question85: To create policy for traffic to or from a particular location, use the _____________.

Question86: Which statement is TRUE of anti-spoofing?

Question87: Which of these attributes would be critical for a site-to-site VPN?

Question88: Examine the sample Rule Base.

What will be the result of a verification of the policy from SmartConsole?

Question89: Which of the following is NOT an advantage to using multiple LDAP servers?

Question90: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.

Question91: What is the purpose of the Stealth Rule?

Question92: What happens if the identity of a user is known?

Question93: Tom has connected to the R80 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made:

Question94: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?

Question95: To optimize Rule Base efficiency, the most hit rules should be where?

Question96: An identity server uses a ___________ for user authentication.

Question97: ________information is included in the "Full Log" tracking option, but is not included in the "Log" tracking option?

Question98: Which of the following is the most secure means of authentication?

Question99: Which of the following is NOT an element of VPN Simplified Mode and VPN Communities?

Question100: You have successfully backed up your Check Point configurations without the OS information. What command would you use to restore this backup?

Question101: Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance?

Question102: Which component functions as the Internal Certificate Authority for R77?

Question103: You want to verify if there are unsaved changes in GAiA that will be lost with a reboot. What command can be used?

Question104: The _________ software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities.

Question105: What are the three essential components of the Check Point Security Management Architecture?

Question106: Which one of the following is the preferred licensing model?

Question107: The Captive Portal tool:

Question108: Which software blade enables Access Control policies to accept, drop, or limit web site access based on user, group, and/or machine?

Question109: The "Hit count" feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits even if the Track option is set to "None"?

Question110: Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

Question111: In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?

Question112: What is true about the IPS-Blade?

Question113: You are the Security Administrator for MegaCorp. In order to see how efficient your firewall Rule Base is, you would like to see how many often the particular rules match. Where can you see it? Give the BEST answer.

Question114: Vanessa is a Firewall administrator. She wants to test a backup of her company's production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment. Which details she need to fill in System Restore window before she can click OK button and test the backup?

Question115: An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG.
Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the
1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.
Which of the following is the BEST explanation for this behavior?

Question116: What licensing feature automatically verifies current licenses and activates new licenses added to the License and Contracts repository?

Question117: Anti-Spoofing is typically set up on which object type?

Question118: When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times. No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

Question119: Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Question120: A new license should be generated and installed in all of the following situations EXCEPT when ________.

Question121: John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole. To make John's changes available to other administrators, and to save the database before installing a policy, what must John do?

Question122: Which NAT rules are prioritized first?

Question123: An administrator wishes to enable Identity Awareness on the Check Point firewalls. However they allow users to use company issued or personal laptops. Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

Question124: The Administrator wishes to update IPS protections from SmartConsole by clicking on the option "Update Now" under the Updates tab in Threat Tools. Which device requires internet access for the update to work?

Question125: What is the difference between an event and a log?

Question126: Which SmartConsole component can Administrators use to track changes to the Rule Base?

Question127: Jennifer McHanry is CEO of ACME. She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory domain, she cannot identify seamlessly with AD Query. However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R77 Firewall Rule Base.
To make this scenario work, the IT administrator must:
1) Enable Identity Awareness on a gateway and select Captive Portal as one of the Identity Sources.
2) In the Portal Settings window in the User Access section, make sure that Name and password login is selected.
3) Create a new rule in the Firewall Rule Base to let Jennifer McHanry access network destinations. Select accept as the Action.
4) Install policy.
Ms McHanry tries to access the resource but is unable. What should she do?

Question128: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question129: In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

Question130: What does it mean if Bob gets this result on an object search? Refer to the image below.

Question131: Which command is used to obtain the configuration lock in Gaia?

Question132: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?

Question133: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question134: View the rule below. What does the lock-symbol in the left column mean?

Question135: Which Threat Prevention Profile is not included by default in R80 Management?

Question136: Which method below is NOT one of the ways to communicate using the Management API's?

Question137: Where do we need to reset the SIC on a gateway object?

Question138: At what point is the Internal Certificate Authority (ICA) created?

Question139: Which of the following are available SmartConsole clients which can be installed from the R77 Windows CD?
Read all answers and select the most complete and valid list.

Question140: You believe Phase 2 negotiations are failing while you are attempting to configure a site-to-site VPN with one of your firm's business partners. Which SmartConsole application should you use to confirm your suspicious?

Question141: Which of the following methods can be used to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server?

Question142: Which command can you use to enable or disable multi-queue per interface?

Question143: In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

Question144: When an encrypted packet is decrypted, where does this happen?

Question145: Two administrators Dave and Jon both manage R80 Management as administrators for ABC Corp. Jon logged into the R80 Management and then shortly after Dave logged in to the same server. They are both in the Security Policies view. From the screenshots below, why does Dave not have the rule no.6 in his SmartConsole view even though Jon has it his in his SmartConsole view?

Question146: What is the most recommended installation method for Check Point appliances?

Question147: What is the main difference between Threat Extraction and Threat Emulation?

Question148: What does ExternalZone represent in the presented rule?

Question149: According to Check Point Best Practice, when adding a non-managed Check Point Gateway to a Check Point security solution what object SHOULD be added? A(n):

Question150: Which of the following describes how Threat Extraction functions?

Question151: SmartEvent does NOT use which of the following procedures to identity events:

Question152: Which of the following commands is used to verify license installation?

Question153: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.

Question154: Please choose correct command syntax to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI?

Question155: When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

Question156: Which option, when applied to a rule, allows all encrypted and non-VPN traffic that matches the rule?

Question157: Which command can you use to verify the number of active concurrent connections?

Question158: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question159: What key is used to save the current CPView page in a filename format cpview_"cpview process ID".
cap"number of captures"?

Question160: A client has created a new Gateway object that will be managed at a remote location. When the client attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install On check box. What should you look for?

Question161: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.

Question162: Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

Question163: To view the policy installation history for each gateway, which tool would an administrator use?

Question164: Which repositories are installed on the Security Management Server by SmartUpdate?

Question165: When configuring LDAP User Directory integration, Changes applied to a User Directory template are:

Question166: Tina is a new administrator who is currently reviewing the new Check Point R80 Management console interface. In the Gateways view, she is reviewing the Summary screen as in the screenshot below. What as an
'Open Server'?

Question167: VPN gateways authenticate using ___________ and ___________ .

Question168: You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic?

Question169: How do you configure an alert in SmartView Monitor?

Question170: Vanessa is firewall administrator in her company; her company is using Check Point firewalls on central and remote locations, which are managed centrally by R80 Security Management Server. One central location has an installed R77.30 Gateway on Open server. Remote location is using Check Point UTM-1 570 series appliance with R71. Which encryption is used in Secure Internal Communication (SIC) between central management and firewall on each location?

Question171: Which of the following is NOT a valid configuration screen of an Access Role Object?

Question172: Browser-based Authentication sends users to a web page to acquire identities using ________.

Question173: When you upload a package or license to the appropriate repository in SmartUpdate, where is the package or license stored

Question174: Where can administrator edit a list of trusted SmartConsole clients in R80?

Question175: Which of the following is used to enforce changes made to a Rule Base?

Question176: What is the purpose of the Clean-up Rule?

Question177: When configuring Spoof Tracking, which tracking actions can an administrator select to be done when spoofed packets are detected?

Question178: What is the default shell of Gaia CLI?

Question179: You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

Question180: Check Point ClusterXL Active/Active deployment is used when:

Question181: When defining group-based access in an LDAP environment with Identity Awareness, what is the BEST object type to represent an LDAP group in a Security Policy?

Question182: The R80 utility fw monitor is used to troubleshoot _____________

Question183: VPN gateways must authenticate to each other prior to exchanging information. What are the two types of credentials used for authentication?