EMT Practice Test

1. Question Content...

---

Question1: An administrator wishes to enable Identity Awareness on the Check Point firewalls. However they allow users to use company issued or personal laptops. Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

Question2: With which command can you view the running configuration of Gaia-based system.

Question3: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his desktop with a static IP (10.0.0.19). He wants to move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources installs the policy.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.
3) Changes from static IP address to DHCP for the client PC.
What should John request when he cannot access the web server from his laptop?

Question4: What Identity Agent allows packet tagging and computer authentication?

Question5: When connected to the Check Point R80 Management Server using the SmartConsole the first administrator to connect has a lock on:

Question6: Which two Identity Awareness commands are used to support identity sharing?

Question7: Fill in the blank: ____________ is the Gaia command that turns the server off.

Question8: Which statement is NOT TRUE about Delta synchronization?

Question9: Which of the following commands can be used to remove site-to-site IPSEC Security Associations (SA)?

Question10: MegaCorp's security infrastructure separates Security Gateways geographically. You must request a central license for one remote Security Gateway.
How do you apply the license?

Question11: Fill in the blank: With the User Directory Software Blade, you can create R80 user definitions on a(an)
___________ Server.

Question12: Which is the correct order of a log flow processed by SmartEvent components:

Question13: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using
________.

Question14: Which backup utility captures the most information and tends to create the largest archives?

Question15: True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway

Question16: Which of the following is NOT an attribute of packet acceleration?

Question17: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?

Question18: How do you manage Gaia?

Question19: As a Security Administrator, you must refresh the Client Authentication authorized time-out every time a new user connection is authorized. How do you do this? Enable the Refreshable Timeout setting:

Question20: Fill in the blank: Each cluster has __________ interfaces.

Question21: Which of the following is NOT supported by Bridge Mode Check Point Security Gateway

Question22: To optimize Rule Base efficiency, the most hit rules should be where?

Question23: Which default user has full read/write access?

Question24: Which of the following statements accurately describes the command snapshot?

Question25: When a Security Gateway sends its logs to an IP address other than its own, which deployment option is installed?

Question26: Which options are given on features, when editing a Role on Gaia Platform?

Question27: How is communication between different Check Point components secured in R80? As with all questions, select the best answer.

Question28: Which product correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices?

Question29: Your bank's distributed R77 installation has Security Gateways up for renewal. Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

Question30: Which is a suitable command to check whether Drop Templates are activated or not?

Question31: Which of the following is NOT an authentication scheme used for accounts created through SmartConsole?

Question32: Fill in the blank: Service blades must be attached to a ______________.

Question33: You are about to test some rule and object changes suggested in an R77 news group. Which backup solution should you use to ensure the easiest restoration of your Security Policy to its previous configuration after testing the changes?

Question34: Provide very wide coverage for all products and protocols, with noticeable performance impact.

How could you tune the profile in order to lower the CPU load still maintaining security at good level? Select the BEST answer.

Question35: Which of the following is NOT a tracking option? (Select three)

Question36: NAT can NOT be configured on which of the following objects?

Question37: Review the following screenshot and select the BEST answer.

Question38: Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Question39: What is the order of NAT priorities?

Question40: Fill in the blank: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.

Question41: Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

Question42: Check Point ClusterXL Active/Active deployment is used when:

Question43: The CDT utility supports which of the following?

Question44: In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories. Which of the following is NOT an objects category?

Question45: To view the policy installation history for each gateway, which tool would an administrator use?

Question46: Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?

Question47: Which of the following is NOT a valid application navigation tab in the R80 SmartConsole?

Question48: You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner.
Which of the following activities sh you do first?

Question49: After the initial installation the First Time Configuration Wizard should be run. Select the BEST answer.

Question50: What data MUST be supplied to the SmartConsole System Restore window to restore a backup?

Question51: Which command is used to add users to or from existing roles?

Question52: When using LDAP as an authentication method for Identity Awareness, the query:

Question53: Where is the "Hit Count" feature enabled or disabled in SmartConsole?

Question54: Which of the following methods can be used to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server?

Question55: What is the default time length that Hit Count Data is kept?

Question56: What needs to be configured if the NAT property 'Translate destination on client side' is not enabled in Global properties?

Question57: Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?

Question58: R80 is supported by which of the following operating systems:

Question59: Which of the following technologies extracts detailed information from packets and stores that information in state tables?

Question60: What are types of Check Point APIs available currently as part of R80.10 code?

Question61: The ______ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

Question62: In Unified SmartConsole Gateways and Servers tab you can perform the following functions EXCEPT
________.

Question63: What SmartEvent component creates events?

Question64: Which tool is used to enable cluster membership on a Gateway?

Question65: Which command shows the installed licenses?

Question66: MyCorp has the following NAT rules. You need to disable the NAT function when Alpha-internal networks try to reach the Google DNS (8.8.8.8) server.
What can you do in this case?

Question67: How would you determine the software version from the CLI?

Question68: Choose the Best place to find a Security Management Server backup file named backup_fw, on a Check Point Appliance.

Question69: Fill in the bank: In Office mode, a Security Gateway assigns a remote client to an IP address once___________.

Question70: What is a role of Publishing?

Question71: All R77 Security Servers can perform authentication with the exception of one. Which of the Security Servers can NOT perform authentication?

Question72: You are the Security Administrator for MegaCorp. In order to see how efficient your firewall Rule Base is, you would like to see how many often the particular rules match. Where can you see it? Give the BEST answer.

Question73: In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?

Question74: You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet. However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet. How can you fix this?

Question75: Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________.

Question76: At what point is the Internal Certificate Authority (ICA) created?

Question77: When configuring Spoof Tracking, which tracking actions can an administrator select to be done when spoofed packets are detected?

Question78: Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or a via CLI. Which command should be use in CLI? Choose the correct answer.

Question79: While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the correct order of steps needed to set up the block?
1) Select Active Mode tab in SmartView Tracker.
2) Select Tools > Block Intruder.
3) Select Log Viewing tab in SmartView Tracker.
4) Set Blocking Timeout value to 60 minutes.
5) Highlight connection that should be blocked.

Question80: What are the three tabs available in SmartView Tracker?

Question81: What Check Point technologies deny or permit network traffic?

Question82: What protocol is specifically used for clustered environments?

Question83: Which of the following is considered to be the more secure and preferred VPN authentication method?

Question84: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question85: Fill in the blanks: Default port numbers for an LDAP server is ______ for standard connections and _______ SSL connections.

Question86: Which Check Point software blade provides Application Security and identity control?

Question87: SandBlast has several functional components that work together to ensure that attacks are prevented in real-time. Which the following is NOT part of the SandBlast component?

Question88: Which of the following is NOT an advantage to using multiple LDAP servers?

Question89: Which of the following firewall modes DOES NOT allow for Identity Awareness to be deployed?

Question90: You are using SmartView Tracker to troubleshoot NAT entries. Which column do you check to view the NAT'd source port if you are using Source NAT?

Question91: What is the purpose of the CPCA process?

Question92: In which deployment is the security management server and Security Gateway installed on the same appliance?

Question93: View the rule below. What does the lock-symbol in the left column mean? Select the BEST answer.

Question94: Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?

Question95: Which of the following ClusterXL modes uses a non-unicast MAC address for the cluster IP address?

Question96: Which R77 GUI would you use to see number of packets accepted since the last policy install?

Question97: What is the BEST method to deploy Identity Awareness for roaming users?

Question98: According to Check Point Best Practice, when adding a non-managed Check Point Gateway to a Check Point security solution what object SHOULD be added? A(n):

Question99: Where do you verify that UserDirectory is enabled?

Question100: You have just installed your Gateway and want to analyze the packet size distribution of your traffic with SmartView Monitor.

Unfortunately, you get the message:
"There are no machines that contain Firewall Blade and SmartView Monitor".
What should you do to analyze the packet size distribution of your traffic? Give the BEST answer.

Question101: Can multiple administrators connect to a Security Management Server at the same time?

Question102: Administrator wishes to update IPS from SmartConsole by clicking on the option "update now" under the IPS tab. Which device requires internet access for the update to work?

Question103: In what way are SSL VPN and IPSec VPN different?

Question104: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

Question105: What is true about the IPS-Blade?

Question106: What is the difference between SSL VPN and IPSec VPN?

Question107: To ensure that VMAC mode is enabled, which CLI command you should run on all cluster members? Choose the best answer.

Question108: When a Security Gateways sends its logs to an IP address other than its own, which deployment option is installed?

Question109: Choose the correct statement regarding Implicit Rules.

Question110: In R80 Management, apart from using SmartConsole, objects or rules can also be modified using:

Question111: Which of the following commands is used to verify license installation?

Question112: Which of the following is NOT an alert option?

Question113: What type of NAT is a one-to-one relationship where each host is translated to a unique address?

Question114: What are the three types of UserCheck messages?

Question115: Which firewall daemon is responsible for the FW CLI commands?

Question116: Which of the following is NOT a valid configuration screen of an Access Role Object?

Question117: When should you generate new licenses?

Question118: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, gateway policy permits access only from Join's desktop which is assigned an IP address 10.0.0.19 via DHCP.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but the limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop. He wants to move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.
John plugged in his laptop to the network on a different network segment and he is not able to connect. How does he solve this problem?

Question119: Fill in the blank: RADIUS protocol uses ______ to communicate with the gateway.

Question120: A Cleanup rule:

Question121: Which of the below is the MOST correct process to reset SIC from SmartDashboard?

Question122: Which option would allow you to make a backup copy of the OS and Check Point configuration, without stopping Check Point processes?

Question123: What are the two high availability modes?

Question124: Phase 1 of the two-phase negotiation process conducted by IKE operates in ______ mode.

Question125: You are unable to login to SmartDashboard. You log into the management server and run #cpwd_admin list with the following output:

What reason could possibly BEST explain why you are unable to connect to SmartDashboard?

Question126: What is the purpose of Priority Delta in VRRP?

Question127: After trust has been established between the Check Point components, what is TRUE about name and IP- address changes?

Question128: To install a brand new Check Point Cluster, the MegaCorp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster. Which type of cluster is it?

Question129: To enforce the Security Policy correctly, a Security Gateway requires:

Question130: The Firewall kernel is replicated multiple times, therefore:

Question131: Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the
____________ algorithm.

Question132: In ____________ NAT, the ____________ is translated.

Question133: If the first packet of an UDP session is rejected by a security policy, what does the firewall send to the client?

Question134: Fill in the blank: In order to install a license, it must first be added to the ____________.

Question135: Which GUI tool can be used to view and apply Check Point licenses?

Question136: Using R80 Smart Console, what does a "pencil icon" in a rule mean?

Question137: You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic?

Question138: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question139: Which one of the following is a way that the objects can be manipulated using the new API integration in R80 Management?

Question140: Fill in the blank: The tool _______ generates a R80 Security Gateway configuration report.

Question141: Choose what BEST describes the reason why querying logs now is very fast.

Question142: As you review this Security Policy, what changes could you make to accommodate Rule 4?

Question143: Fill in the blanks: A Check Point software license consists of a _______ and _______ .

Question144: Which command is used to obtain the configuration lock in Gaia?

Question145: Fill in the blank: An identity server uses a ___________ for user authentication.

Question146: Why would an administrator see the message below?

Question147: What statement is true regarding Visitor Mode?

Question148: Which information is included in the "Extended Log" tracking option, but is not included in the "Log" tracking option?

Question149: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?

Question150: Which command can you use to verify the number of active concurrent connections?

Question151: Which of the following is used to enforce changes made to a Rule Base?

Question152: Of all the Check Point components in your network, which one changes most often and should be backed up most frequently?

Question153: You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have received a call by one of the management users stating that they are unable to browse the Internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway. How do you review the logs to see what the problem may be?

Question154: Your internal networks 10.1.1.0/24, 10.2.2.0/24 and 192.168.0.0/16 are behind the Internet Security Gateway.
Considering that Layer 2 and Layer 3 setup is correct, what are the steps you will need to do in SmartConsole in order to get the connection working?

Question155: You are asked to check the status of several user-mode processes on the management server and gateway.
Which of the following processes can only be seen on a Management Server?

Question156: What component of R80 Management is used for indexing?

Question157: Message digests use which of the following?

Question158: What key is used to save the current CPView page in a filename format cpview_"cpview process ID".
cap"number of captures"?

Question159: Which of these attributes would be critical for a site-to-site VPN?

Question160: What is the main difference between Threat Extraction and Threat Emulation?

Question161: Which of the following Automatically Generated Rules NAT rules have the lowest implementation priority?

Question162: Harriet wants to protect sensitive information from intentional loss when users browse to a specific URL:
https://personal.mymail.com, which blade will she enable to achieve her goal?

Question163: Which software blade enables Access Control policies to accept, drop, or limit web site access based on user, group, and/or machine?

Question164: What is the most recommended installation method for Check Point appliances?

Question165: Which feature is NOT provided by all Check Point Mobile Access solutions?

Question166: In order to modify Security Policies the administrator can use which of the following tools? Select the BEST answer.

Question167: Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?

Question168: Which tool CANNOT be launched from SmartUpdate R77?

Question169: Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

Question170: Mesh and Star are two types of VPN topologies. Which statement below is TRUE about these types of communities?

Question171: What is UserCheck?

Question172: Where does the security administrator activate Identity Awareness within SmartDashboard?

Question173: What is the most complete definition of the difference between the Install Policy button on the SmartConsole's tab, and the Install Policy within a specific policy?

Question174: When configuring LDAP User Directory integration, Changes applied to a User Directory template are:

Question175: What is the benefit of Manual NAT over Automatic NAT?

Question176: You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the most likely cause?

Question177: Which of the following is NOT a policy type available for each policy package?

Question178: What is the mechanism behind Threat Extraction?

Question179: What are the three essential components of the Check Point Security Management Architecture?

Question180: Which directory holds the SmartLog index files by default?

Question181: Which utility allows you to configure the DHCP service on GAIA from the command line?

Question182: If there are two administrators logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available to other administrators? Choose the BEST answer.

Question183: Which of the following is NOT a set of Regulatory Requirements related to Information Security?

Question184: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?