Question1: What are the two types of address translation rules?
Question2: Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256 for IKE phase 2. Why is this a problematic setup?
Question3: Which of the following commands can be used to remove site-to-site IPSEC Security Associations (SA)?
Question4: To enforce the Security Policy correctly, a Security Gateway requires:
Question5: Administrator wishes to update IPS from SmartConsole by clicking on the option "update now" under the IPS tab. Which device requires internet access for the update to work?
Question6: What happens if the identity of a user is known?
Question7: Which information is included in the "Full Log" tracking option, but is not included in the "Log" tracking option?
Question8: You are using SmartView Tracker to troubleshoot NAT entries. Which column do you check to view the
NAT'd source port if you are using Source NAT?
Question9: Which of the following is used to enforce changes made to a Rule Base?
Question10: What is the default shell of Gaia CLI?
Question11: Choose what BEST describes the Policy Layer Traffic Inspection.
Question12: Fill in the blank: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.
Question13: Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?
Question14: Which of the following commands can be used to remove site-to-site IPSEC Security Associations (SA)?
Question15: You have just installed your Gateway and want to analyze the packet size distribution of your traffic with SmartView Monitor.
Unfortunately, you get the message:
"There are no machines that contain Firewall Blade and SmartView Monitor".
What should you do to analyze the packet size distribution of your traffic? Give the BEST answer.
Question16: After the initial installation the First Time Configuration Wizard should be run. Select the BEST answer.
Question17: Which rule is responsible for the user authentication failure?
Question18: Study the Rule base and Client Authentication Action properties screen.
After being authenticated by the Security Gateways, a user starts a HTTP connection to a Web site. What
happens when the user tries to FTP to another site using the command line? The:
Question19: Why would an administrator see the message below?
Question20: Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?
Question21: A new license should be generated and installed in all of the following situations EXCEPT when ________.
Question22: Fill in the blank: RADIUS Accounting gets ______ data from requests generated by the accounting client
Question23: Review the rules. Assume domain UDP is enabled in the implied rules.
What happens when a user from the internal network tries to browse to the internet using HTTP? The user:
Question24: Fill in the blank: Gaia can be configured using the _______ or ______ .
Question25: Which one of the following is the preferred licensing model? Select the Best answer.
Question26: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one
is NOT correct?
Question27: Packages and licenses are loaded from all of these sources EXCEPT
Question28: Which of the following is NOT a SecureXL traffic flow?
Question29: What happens if the identity of a user is known?
Question30: You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic?
Question31: On the following picture an administrator configures Identity Awareness:
After clicking "Next" the above configuration is supported by:
Question32: What does ExternalZone represent in the presented rule?
Question33: Examine the sample Rule Base.
What will be the result of a verification of the policy from SmartConsole?
Question34: You are about to test some rule and object changes suggested in an R77 news group.
Which backup solution should you use to ensure the easiest restoration of your Security
Policy to its previous configuration after testing the changes?
Question35: To enforce the Security Policy correctly, a Security Gateway requires:
Question36: Which feature is NOT provided by all Check Point Mobile Access solutions?
Question37: Which Check Point software blade provides Application Security and identity control?
Question38: Which of the following is NOT a SecureXL traffic flow?
Question39: You are going to perform a major upgrade. Which back up solution should you use to ensure your database can be restored on that device?
Question40: Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.
Question41: Which VPN routing option uses VPN routing for every connection a satellite gateway handles?
Question42: What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.
Question43: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.
Question44: What will be the effect of running the following command on the Security Management Server?
Question45: You have just installed your Gateway and want to analyze the packet size distribution of your traffic with SmartView Monitor.
Unfortunately, you get the message.
"There are no machines that contain Firewall Blade and SmartView Monitor."
What should you do to analyze the packet size distribution of your traffic? Give the BEST answer.
Question46: The default method for destination NAT is _____________, where NAT occurs on the inbound interface closest to the client.
Question47: What will be the effect of running the following command on the Security Management Server?
Question48: The Captive Portal tool:
Question49: Review the following screenshot and select the BEST answer.
Question50: Which policy type is used to enforce bandwidth and traffic control rules?
Question51: Which command is used to obtain the configuration lock in Gaia?
Question52: Which of the following Automatically Generated Rules NAT rules have the lowest implementation priority?
Question53: Which Threat Tool within SmartConsole provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?
Question54: When should you generate new licenses?
Question55: Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or a via CLI. Which command should be use in CLI? Choose the correct answer.
remove database lock
Question56: View the rule below. What does the lock-symbol in the left column mean?
Question57: Which authentication scheme requires a user to possess a token?
Question58: Joey is using the computer with IP address 192.168.20.13. He wants to access web page
"www.CheckPoint.com", which is hosted on Web server with IP address 203.0.113.111. How many rules on Check Point Firewall are required for this connection?
Question59: Which GUI tool can be used to view and apply Check Point licenses?
Question60: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?
Question61: One of major features in R80 SmartConsole is concurrent administration. Which of the following is NOT
possible considering that AdminA, AdminB, and AdminC are editing the same Security Policy?
Question62: Look at the screenshot below. What CLISH command provides this output?
Question63: Fill in the blank: The R80 utility fw monitoris used to troubleshoot _____________
Question64: What is the SOLR database for?
Question65: What port is used for delivering logs from the gateway to the management server?
Question66: Which component functions as the Internal Certificate Authority for R77?
Question67: What Identity Agent allows packet tagging and computer authentication?
Question68: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.
Question69: In which deployment is the security management server and Security Gateway installed on the same appliance?
Question70: A Check Point software license consists of a _______ and _______ .
Question71: What does it mean if Bob gets this result on an object search? Refer to the image below.
Question72: Which command is used to add users to or from existing roles?
Question73: Which two Identity Awareness commands are used to support identity sharing?
Question74: View the rule below. What does the lock-symbol in the left column mean? Select the BEST answer.
Question75: How would you determine the software version from the CLI?
Question76: Which feature is NOT provided by all Check Point Mobile Access solutions?
Question77: While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?
Question78: Which feature is NOT provided by all Check Point Mobile Access solutions?
Question79: When should you generate new licenses?
Question80: Assuming you have a Distributed Deployment, what will be the effect of running the following command on the Security Management Server?
Question81: In order to modify Security Policies, the administrator can use which of the following tools?
Question82: While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the correct order of steps needed to set up the block?
1) Select Active Mode tab in SmartView Tracker.
2) Select Tools > Block Intruder.
3) Select Log Viewing tab in SmartView Tracker.
4) Set Blocking Timeout value to 60 minutes.
5) Highligh connection that should be blocked.
Question83: Which application should you use to install a contract file?
Question84: An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.
Which of the following is the BEST explanation for this behavior?
Question85: Consider the Global Properties following settings:
The selected option "Accept Domain Name over UDP (Queries)" means:
Question86: You are the senior Firewall administrator for ABC Corp., and have recently returned from a training course on Check Point's new advanced R80 management platform. You are presenting an in-house overview of the new features of Check Point R80 Management to the other administrators in ABC Corp.
How will you describe the new "Publish" button in R80 Management Console?
Question87: What does it mean if Deyra sees the gateway status:
Choose the BEST answer.
Question88: Which utility allows you to configure the DHCP service on GAIA from the command line?
Question89: Harriet wants to protect sensitive information from intentional loss when users browse to a specific URL: https://personal.mymail.com, which blade will she enable to achieve her goal?
Question90: Which feature is NOT provided by all Check Point Mobile Access solutions?
Question91: You are trying to save a custom log query in R80 SmartView Tracker, but getting the following error:
Could not save <query-name> (Error: Database is Read Only)
Which of the following is a likely explanation for this?
Question92: Which Check Point software blade monitors Check Point devices and provides a picture of network and
security performance?
Question93: Which of the following licenses are considered temporary?
Question94: Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.
Question95: Fill in the blanks: Default port numbers for an LDAP server is ______ for standard connections and
_______ SSL connections.
Question96: Which of the following is NOT a method used by Identity Awareness for acquiring identity?
Question97: Fill in the blank: In order to install a license, it must first be added to the ____________.
Question98: The SIC Status "Unknown" means
Question99: When using Monitored circuit VRRP, what is a priority delta?
Question100: You want to define a selected administrator's permission to edit a layer. However, when you click the + sign in the "Select additional profile that will be able edit this layer" you do not see anything. What is the most likely cause of this problem? Select the BEST answer.
Question101: The technical-support department has a requirement to access an intranet server. When configuring a User Authentication rule to achieve this, which of the following should you remember?
Question102: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to
designated IP addresses to minimize malware infection and unauthorized access risks. Thus, gateway policy
permits access only from Join's desktop which is assigned an IP address 10.0.0.19 via DHCP.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT
department gave the laptop a static IP address, but the limits him to operating it only from his desk. The
current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop. He wants to
move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server
from any machine and from any location.
John plugged in his laptop to the network on a different network segment and he is not able to connect. How
does he solve this problem?
Question103: Administrator Kofi has just made some changes on his Management Server and then clicks on the Publish button in SmartConsole but then gets the error message shown in the screenshot below.
Where can the administrator check for more information on these errors?
Question104: After trust has been established between the Check Point components, what is TRUE about name and IP- address changes?
Question105: Provide very wide coverage for all products and protocols, with noticeable performance impact.
How could you tune the profile in order to lower the CPU load still maintaining security at good level?
Select the BEST answer.
Question106: Which of the following is used to initially create trust between a Gateway and Security Management Server?
Question107: What is the potential downside or drawback to choosing the Standalone deployment option instead of the
Distributed deployment option?
Question108: Fill in the blank: The command __________ provides the most complete restoration of a R80 configuration.
Question109: Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?
Question110: Katie has been asked to do a backup on the Blue Security Gateway. Which command would accomplish this in the Gaia CLI?
Question111: You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet. However,
when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of
Service, and cannot access the Internet. How can you fix this?
Question112: Anti-Spoofing is typically set up on which object type?
Question113: Which configuration element determines which traffic should be encrypted into a VPN tunnel vs. sent in the clear?
Question114: Which of the following is NOT a component of a Distinguished Name?
Question115: Which one of the following is the preferred licensing model? Select the Best answer.
Question116: Fill in the blank: Back up and restores can be accomplished through_________.
Question117: In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?
Question118: The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic method.
How many times per day will CPUSE agent check for hotfixes and automatically download them?
Question119: Tina is a new administrator who is currently reviewing the new Check Point R80 Management console interface. In the Gateways view, she is reviewing the Summary screen as in the screenshot below. What as an 'Open Server'?
Question120: Choose what BEST describes users on Gaia Platform.
Question121: In R80 spoofing is defined as a method of:
Question122: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?
Question123: What is the most complete definition of the difference between the Install Policy. . button on the SmartConsoles tab. and the Install Policy... button within a specific policy?
Question124: You are unable to login to SmartDashboard. You log into the management server and run #cpwd_admin list with the following output:
What reason could possibly BEST explain why you are unable to connect to SmartDashboard?
Question125: Web Control Layer has been set up using the settings in the following dialogue:
Consider the following policy and select the BEST answer.
Question126: Packages and licenses are loaded from all of these sources EXCEPT
Question127: You have configured SNX on the Security Gateway. The client connects to the Security Gateway and the user
enters the authentication credentials. What must happen after authentication that allows the client to connect to
the Security Gateway's VPN domain?
Question128: Which of the following is NOT a role of the SmartCenter:
Question129: Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?
Question130: Which SmartConsole component can Administrators use to track changes to the Rule Base?
Question131: Which Check Point software blade provides Application Security and identity control?
Question132: R80 Security Management Server can be installed on which of the following operating systems?
Question133: Fill in the blank: ________information is included in the "Full Log" tracking option, but is not included in the
"Log" tracking option?
Question134: Your bank's distributed R77 installation has Security Gateways up for renewal. Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?
Question135: In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?
Question136: When defining QoS global properties, which option below is not valid?
Question137: Tina is a new administrator who is currently reviewing the new Check Point R80 Management console interface. In the Gateways view, she is reviewing the Summary screen as in the screenshot below. What as an 'Open Server'?
Question138: Identify the ports to which the Client Authentication daemon listens on by default?
Question139: You have just installed your Gateway and want to analyze the packet size distribution of your traffic with SmartView Monitor.
Unfortunately, you get the message:
"There are no machines that contain Firewall Blade and SmartView Monitor".
What should you do to analyze the packet size distribution of your traffic? Give the BEST answer.
Question140: Which tool CANNOT be launched from SmartUpdate R80?
Question141: On the following picture an administrator configures Identity Awareness:
After clicking "Next" the above configuration is supported by:
Question142: ______________ is an R80 component that displays the number of packets accepted, rejected, and dropped on a specific Security Gateway, in real time.
Question143: What is the most recommended installation method for Check Point appliances?
Question144: When configuring Spoof Tracking, which tracking actions can an administrator select to be done when spoofed packets are detected?
Question145: Choose what BEST describes the reason why querying logs now is very fast.
Question146: By default, which port does the WebUI listen on?
Question147: What must a Security Administrator do to comply with a management requirement to log all traffic accepted through the perimeter Security Gateway?
Question148: On the following picture an administrator configures Identity Awareness:
After clicking "Next" the above configuration is supported by:
Question149: Fill in the blank: The _________ software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities.
Question150: You have configured SNX on the Security Gateway. The client connects to the Security
Gateway and the user enters the authentication credentials. What must happen after authentication that allows the client to connect to the Security Gateway's VPN domain?
Question151: Harriet wants to protect sensitive information from intentional loss when users browse to a specific URL:
https://personal.mymail.com, which blade will she enable to achieve her goal?
Question152: Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port. Which CLISH commands are required to be able to change this TCP port?
Question153: Which information is included in the "Full Log" tracking option, but is not included in the "Log" tracking option?
Question154: Access roles allow the firewall administrator to configure Network access according to:
Question155: Provide very wide coverage for all products and protocols, with noticeable performance impact.
How could you tune the profile in order to lower the CPU load still maintaining security at good level? Select the BEST answer.
Question156: What will be the effect of running the following command on the Security Management Server?
Question157: What are types of Check Point APIs available currently as part of R80.10 code?
Question158: Fill in the blank: In order to install a license, it must first be added to the ____________.
Question159: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using
________ .
Question160: A digital signature:
Question161: Which product correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices?
Question162: Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?
Question163: Identify the API that is not supported by Check Point currently.
Question164: An Endpoint identity agent uses a ___________ for user authentication.
Question165: What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.
Question166: The R80 feature ________ permits blocking specific IP addresses for a specified time period.
Question167: The following graphic shows:
Question168: To optimize Rule Base efficiency the most hit rules should be where?
Question169: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using
________.
Question170: What are the three types of UserCheck messages?
Question171: Fill in the blank: Service blades must be attached to a ______________.
Question172: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .
Question173: You have discovered activity in your network. What is the BEST immediate action to take?
Question174: Which of the following is NOT an attribute of packer acceleration?
Question175: The organization's security manager wishes to back up just the Gaia operating system parameters. Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries?
Question176: Which of the following is TRUE regarding Gaia command line?
Question177: Examine the sample Rule Base.
What will be the result of a verification of the policy from SmartConsole?
Question178: Fill in the blank: Back up and restores can be accomplished through_________.
Question179: Provide very wide coverage for all products and protocols, with noticeable performance impact.
How could you tune the profile in order to lower the CPU load still maintaining security at good level? Select the BEST answer.
Question180: When connected to the Check Point R80 Management Server using the SmartConsole the first administrator to connect has a lock on:
Question181: Which of the following is NOT an element of VPN Simplified Mode and VPN Communities?
Question182: Which firewall daemon is responsible for the FW CLI commands?
Question183: Why would an administrator see the message below?
Question184: Choose the Best place to find a Security Management Server backup file named backup_fw, on a Check Point Appliance.
Question185: In which deployment is the security management server and Security Gateway installed on the same
appliance?
Question186: What is the appropriate default Gaia Portal address?
Question187: Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe
logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged
in:
Question188: When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?
Question189: What is the purpose of Captive Portal?
Question190: NAT can NOT be configured on which of the following objects?
Question191: Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.
Question192: Fill in the blank: RADIUS Accounting gets ______ data from requests generated by the accounting client
Question193: What is the purpose of the Clean-up Rule?
Question194: Which of the following is NOT an alert option?
Question195: Web Control Layer has been set up using the settings in the following dialogue:
Consider the following policy and select the BEST answer.
Question196: Why would an administrator see the message below?
Question197: Which of the following is NOT an element of VPN Simplified Mode and VPN Communities?
Question198: Two administrators Dave and Jon both manage R80 Management as administrators for ABC Corp. Jon logged into the R80 Management and then shortly after Dave logged in to the same server. They are both in the Security Policies view. From the screenshots below, why does Dave not have the rule no.6 in his SmartConsole view even though Jon has it his in his SmartConsole view?
Question199: What Check Point tool is used to automatically update Check Point products for the Gaia OS?
Question200: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?
Question201: Jennifer McHanry is CEO of ACME. She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory domain, she cannot identify seamlessly with AD Query.
However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R77 Firewall Rule Base.
To make this scenario work, the IT administrator must:
1) Enable Identity Awareness on a gateway and select Captive Portal as one of the Identity Sources.
2) In the Portal Settings window in the User Access section, make sure that Name and password login is selected.
3) Create a new rule in the Firewall Rule Base to let Jennifer McHanry access network destinations. Select accept as the Action.
4) Install policy.
Ms McHanry tries to access the resource but is unable. What should she do?
Question202: Which of the following is NOT a VPN routing option available in a star community?
Question203: Fill in the blank: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.
Question204: Which command is used to obtain the configuration lock in Gaia?
Question205: Which Check Point software blade prevents malicious files from entering a network using virus signatures and
anomaly-based protections from ThreatCloud?
Question206: Choose the Best place to find a Security Management Server backup file named backup_fw, on a Check Point Appliance.
Question207: Which statement is TRUE of anti-spoofing?
Question208: Fill in the blank: Once a license is activated, a ________ should be installed.
Question209: Look at the following screenshot and select the BEST answer.
Question210: Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.
Question211: Which two Identity Awareness commands are used to support identity sharing?
Question212: Which of the following is NOT an alert option?
Question213: Which policy type is used to enforce bandwidth and traffic control rules?
Question214: As you review this Security Policy, what changes could you make to accommodate Rule 4?
Question215: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:
Question216: The organization's security manager wishes to back up just the Gaia operating system parameters such as interface details, Static routes and Proxy ARP entries. Which command would be BEST suited to accomplish this task?
Question217: Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.
Question218: With which command can view the running configuration of Gaia-based system.
Question219: Which utility shows the security gateway general system information statistics like operating system information and resource usage, and individual software blade statistics of VPN, Identity Awareness and DLP?
Question220: Look at the following screenshot and select the BEST answer.
Question221: Which option, when applied to a rule, allows all encrypted and non-VPN traffic that matches the rule?
Question222: Where can administrator edit a list of trusted SmartConsole clients in R80?
Question223: An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server. While configuring the VPN community to specify the pre-shared secret the administrator found that the check box to enable pre-shared secret is shared and cannot be enabled. Why does it not allow him to specify the pre-shared secret?
Question224: Which Check Point software blade provides protection from zero-day and undiscovered threats?
Question225: Examine the following Rule Base.
What can we infer about the recent changes made to the Rule Base?
Question226: Phase 1 of the two-phase negotiation process conducted by IKE operates in ______ mode.
Question227: What SmartEvent component creates events?
Question228: Fill in the blanks: A Check Point software license consists of a _______ and _______ .
Question229: Administrator Kofi has just made some changes on his Management Server and then clicks on the Publish button in SmartConsole but then gets the error message shown in the screenshot below.
Where can the administrator check for more information on these errors?
Question230: When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?
Question231: The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.
What is the most likely reason that the traffic is not accelerated?
Question232: You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.
What does this mean?
Question233: Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing
deployment is referred to as a ________ cluster.
Question234: In which deployment is the security management server and Security Gateway installed on the same appliance?
Question235: Which of the following is NOT a valid application navigation tab in the R80 SmartConsole?
Question236: Fill in the blank: Each cluster has __________ interfaces.
Question237: A _______ is used by a VPN gateway to send traffic as if it was a physical interface.
Question238: Which feature in R77 permits blocking specific IP addresses for a specified time period?
Question239: Once a certificate is revoked from the Security GateWay by the Security Management Server, the certificate information is _______.
Question240: What is Consolidation Policy?
Question241: Default port numbers for an LDAP server is ______ for standard connections and _______ SSL connections.
Question242: Administrator wishes to update IPS from SmartConsole by clicking on the option "update now" under the IPS tab. Which device requires internet access for the update to work?
Question243: You want to define a selected administrator's permission to edit a layer. However, when you click the + sign in the "Select additional profile that will be able edit this layer" you do not see anything. What is the most likely cause of this problem? Select the BEST answer.
Question244: Match the following commands to their correct function. Each command has one function only listed.
Question245: From the Gaia web interface, which of the following operations CANNOT be performed on a Security Management Server?
Question246: John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole. To make John's changes available to other administrators, and to save the database before installing a policy, what must John do?
Question247: NAT can NOT be configured on which of the following objects?
Question248: What does it mean if Deyra sees the gateway status:
Question249: What is Consolidation Policy?
Question250: Which rule is responsible for the user authentication failure?
Question251: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?
Question252: When an encrypted packet is decrypted, where does this happen?
Question253: When configuring Spoof Tracking, which tracking actions can an administrator select to be done when spoofed packets are detected?
Question254: Which policy type has its own Exceptions section?
Question255: What is Identity Sharing?
Question256: There are ________ types of software containers ________.
Question257: At what point is the Internal Certificate Authority (ICA) created?
Question258: ALPHA Corp has a new administrator who logs into the Gaia Portal to make some changes. He realizes that even though he has logged in as an administrator, he is unable to make any changes because all configuration options are greyed out as shown in the screenshot image below. What is the likely cause for this?
Question259: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?
Question260: Vanessa is firewall administrator in her company; her company is using Check Point firewalls on central and remote locations, which are managed centrally by R80 Security Management Server. One central location has an installed R77.30 Gateway on Open server. Remote location is using Check Point UTM-1 570 series appliance with R71. Which encryption is used in Secure Internal Communication (SIC) between central management and firewall on each location?
Question261: Vanessa is attempting to log into the Gaia Web Portal. She is able to login successfully. Then she tries the same username and password for SmartConsole but gets the message in the screenshot image below. She has checked that the IP address of the Server is correct and the username and password she used to login into Gaia is also correct.
What is the most likely reason?
Question262: Fill in the blank: RADIUS protocol uses ______ to communicate with the gateway.
Question263: Tina is a new administrator who is currently reviewing the new Check Point R80 Management console interface. In the Gateways view, she is reviewing the Summary screen as in the screenshot below. What as an
'Open Server'?
Question264: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows them as prioritized security events.
Question265: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?
Question266: Fill in the blank: An identity server uses a ___________ for user authentication.
Question267: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?
Question268: What does it mean if Bob gets this result on an object search? Refer to the image below.
Choose the BEST answer.
Question269: Which option in a firewall rule would only match and allow traffic to VPN gateways for one Community in
common?
Question270: From SecureXL perspective, what are the tree paths of traffic flow:
Question271: Look at the following screenshot and select the BEST answer.
Question272: Which of the following is TRUE about the Check Point Host object?
Question273: AdminA and AdminB are both logged in on SmartConsole. What does it mean if AdminB sees a locked icon on a rule? Choose the BEST answer.
Question274: Fill in the blank: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.
Question275: On the following graphic, you will find layers of policies.
What is a precedence of traffic inspection for the defined polices?
Question276: Which options are given on features, when editing a Role on Gaia Platform?
Question277: Which of the following are types of VPN communities?
Question278: Choose what BEST describes users on Gaia Platform.
Question279: Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or a via CLI. Which command should be use in CLI? Choose the correct answer.
Question280: To optimize Rule Base efficiency the most hit rules should be where?
Question281: You want to reset SIC between smberlin and sgosaka.
In SmartDashboard, you choose sgosaka, Communication, Reset. On sgosaka, you start cpconfig, choose Secure Internal Communication and enter the new SIC Activation Key. The screen reads The SIC was successfully initialized and jumps back to the menu. When trying to establish a connection, instead of a working connection, you receive this error message:
What is the reason for this behavior?
Question282: Administrator wishes to update IPS from SmartConsole by clicking on the option "update now" under the IPS tab. Which device requires internet access for the update to work?
Question283: What are the three essential components of the Check Point Security Management Architecture?
Question284: Which repositories are installed on the Security Management Server by SmartUpdate?
Question285: Web Control Layer has been set up using the settings in the following dialogue:
Consider the following policy and select the BEST answer.
Question286: ALPHA Corp has a new administrator who logs into the Gaia Portal to make some changes. He realizes that even though he has logged in as an administrator, he is unable to make any changes because all configuration options are greyed out as shown in the screenshot image below. What is the likely cause for this?
Question287: Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links. Which component of SandBlast protection is her company using on a Gateway?
Question288: You want to reset SIC between smberlin and sgosaka.
In SmartDashboard, you choose sgosaka, Communication, Reset. On sgosaka, you start cpconfig, choose Secure Internal Communication and enter the new SIC Activation Key.
The screen reads The SIC was successfully initialized and jumps back to the menu. When trying to establish a connection, instead of a working connection, you receive this error message:
What is the reason for this behavior?
Question289: Fill in the blank: To create policy for traffic to or from a particular location, use the _____________.
Question290: When using GAiA, it might be necessary to temporarily change the MAC address of the interface eth 0 to 00:0C:29:12:34:56. After restarting the network the old MAC address should be active. How do you configure this change?
Question291: The "Hit count" feature allows tracking the number of connections that each rule matches. Will the Hit count
feature work independently from logging and Track the hits even if the Track option is set to "None"?
Question292: Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?
Question293: Fill in the blank:_________________information is included in "Full Log" tracking option, but is not included in "Log" tracking option?
Question294: By default, which port does the WebUI listen on?
Question295: You are unable to login to SmartDashboard. You log into the management server and run #cpwd_admin list with the following output:
What reason could possibly BEST explain why you are unable to connect to SmartDashboard?
Question296: Which of the following uses the same key to decrypt as it does to encrypt?
Question297: Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?
Question298: Fill in the blank: Once a license is activated, a ________ should be installed.
Question299: Fill in the blanks: VPN gateways authenticate using ___________ and ___________ .
Question300: At what point is the Internal Certificate Authority (ICA) created?
Question301: Tina is a new administrator who is currently reviewing the new Check Point R80 Management console interface. In the Gateways view, she is reviewing the Summary screen as in the screenshot below. What as an
'Open Server'?
Question302: Which VPN routing option uses VPN routing for every connection a satellite gateway handles?
Question303: You are going to perform a major upgrade. Which back up solution should you use to ensure your database
can be restored on that device?
Question304: Fill in the blank: Licenses can be added to the License and Contract repository ________ .
Question305: John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole. To make John's changes available to other administrators, and to save the database before installing a policy, what must John do?
Question306: Fill in the blank: The R80 utility fw monitoris used to troubleshoot _____________
Question307: There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically?
Question308: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?
Question309: You are using SmartView Tracker to troubleshoot NAT entries. Which column do you check to view the NAT'd source port if you are using Source NAT?
Question310: What is the most complete definition of the difference between the Install Policy button on the SmartConsole's tab, and the Install Policy button within a specific policy?
Question311: Provide very wide coverage for all products and protocols, with noticeable performance impact.
How could you tune the profile in order to lower the CPU load still maintaining security at good level?
Select the BEST answer.
Question312: Sally has a Hot Fix Accumulator (HFA) she wants to install on her Security Gateway which operates with
GAiA, but she cannot SCP the HFA to the system. She can SSH into the Security Gateway, but she has never
been able to SCP files to it. What would be the most likely reason she cannot do so?
Question313: The following graphic shows:
Question314: You want to reset SIC between smberlin and sgosaka.
In SmartDashboard, you choose sgosaka, Communication, Reset. On sgosaka, you start cpconfig, choose Secure Internal Communication and enter the new SIC Activation Key. The screen reads The SIC was successfully initialized and jumps back to the menu. When trying to establish a connection, instead of a working connection, you receive this error message:
What is the reason for this behavior?
Question315: Fill in the blanks: A security Policy is created in _________ , stored in the _________ , and Distributed to the various __________ .
Question316: How is communication between different Check Point components secured in R80? As with all questions, select the best answer.
Question317: In the Network policy layer, the default action for the Implied last rule is ________ all traffic. However, in the Application Control policy layer, the default action is ________ all traffic.
Question318: Web Control Layer has been set up using the settings in the following dialogue:
Consider the following policy and select the BEST answer.
Question319: Which utility shows the security gateway general system information statistics like operating system
information and resource usage, and individual software blade statistics of VPN, Identity Awareness and
DLP?
Question320: Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and
shows them as prioritized security events.
Question321: Which of the following is NOT an authentication scheme used for accounts created through SmartConsole?
Question322: Which of the following is NOT a back up method?
Question323: Where is the "Hit Count" feature enabled or disabled in SmartConsole?
Question324: What is the best sync method in the ClusterXL deployment?
Question325: Choose what BEST describes users on Gaia Platform.
Question326: Please choose correct command syntax to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI?
Question327: By default, which port does the WebUI listen on?
Question328: Which of the following is NOT a tracking option? (Select three)
Question329: You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule
Base. Which of the following is the most likely cause?
Question330: Which of the following is TRUE about the Check Point Host object?
Question331: When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times. No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?
Question332: VPN gateways authenticate using ___________ and ___________ .
Question333: Consider the Global Properties following settings:
The selected option "Accept Domain Name over UDP (Queries)" means:
Question334: Consider the Global Properties following settings:
The selected option "Accept Domain Name over UDP (Queries)" means:
Question335: Which command is used to add users to or from existing roles?
Question336: Fill in the blank: An LDAP server holds one or more ______________.
Question337: The IT Management team is interested in the new features of the Check Point R80 Management and wants to upgrade but they are concerned that the existing R77.30 Gaia Gateways cannot be managed by R80 because it is so different. As the administrator responsible for the Firewalls, how can you answer or confirm these concerns?
Question338: SandBlast has several functional components that work together to ensure that attacks are prevented in
real-time. Which the following is NOT part of the SandBlast component?
Question339: What is the Manual Client Authentication TELNET port?
Question340: Each cluster has __________ interfaces.
Question341: Jack works for a managed service provider and he has been tasked to create 17 new policies for several new customers. He does not have much time. What is the BEST way to do this with R80 security management?
Question342: Which of the following is NOT a component of Check Point Capsule?
Question343: Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in:
Question344: In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite
VPN gateway?
Question345: You are unable to login to SmartDashboard. You log into the management server and run #cpwd_admin list with the following output:
What reason could possibly BEST explain why you are unable to connect to SmartDashboard?
Question346: How many users can have read/write access in Gaia at one time?
Question347: Fill in the blank: The command __________ provides the most complete restoration of a
R80 configuration.
Question348: Which policy type has its own Exceptions section?
Question349: You manage a global network extending from your base in Chicago to Tokyo, Calcutta and Dallas.
Management wants a report detailing the current software level of each Enterprise class Security Gateway.
You plan to take the opportunity to create a proposal outline, listing the most cost-effective way to upgrade your Gateways. Which two SmartConsole applications will you use to create this report and outline?
Question350: The most important part of a site-to-site VPN deployment is the ________ .
Question351: In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?
Question352: Which VPN routing option uses VPN routing for every connection a satellite gateway handles?
Question353: Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or a via CLI. Which command should be use in CLI? Choose the correct answer.
Question354: What does ExternalZone represent in the presented rule?
Question355: What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.
Question356: Choose the correct statement regarding Implicit Rules.
Question357: You have discovered activity in your network. What is the BEST immediate action to take?
Question358: You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.
What does this mean?
Question359: Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?
Question360: Identify the ports to which the Client Authentication daemon listens on by default?
Question361: You want to verify if there are unsaved changes in GAiA that will be lost with a reboot. What command can be used?
Question362: In which scenario is it a valid option to transfer a license from one hardware device to another?
Question363: Fill in the blank: The R80 utility fw monitor is used to troubleshoot _____________
Question364: Fill in the blank: An identity server uses a ___________ for user authentication.
Question365: A(n) _____ rule is created by an administrator and is located before the first and before last rules in the Rule Base.
Question366: The IT Management team is interested in the new features of the Check Point R80 Management and wants to upgrade but they are concerned that the existing R77.30 Gaia Gateways cannot be managed by R80 because it is so different. As the administrator responsible for the Firewalls, how can you answer or confirm these concerns?
Question367: Your users are defined in a Windows 2008 R2 Active Directory server.
You must add LDAP users to a Client Authentication rule.
Which kind of user group do you need in the Client Authentication rule in R77?
Question368: An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG.
Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the
1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.
Which of the following is the BEST explanation for this behavior?
Question369: Web Control Layer has been set up using the settings in the following dialogue:
Consider the following policy and select the BEST answer.
Question370: Fill in the blank: RADIUS Accounting gets ______ data from requests generated by the accounting client
Question371: Administrator Kofi has just made some changes on his Management Server and then clicks on the Publish button in SmartConsole but then gets the error message shown in the screenshot below.
Where can the administrator check for more information on these errors?
Question372: What are the three essential components of the Check Point Security Management Architecture?
Question373: In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?
Question374: Fill in the blank: With the User Directory Software Blade, you can create R80 user definitions on a(an)
___________ Server.
Question375: Fill in the blank: The tool _______ generates a R80 Security Gateway configuration report.
Question376: Which options are given on features, when editing a Role on Gaia Platform?
Question377: You are using SmartView Tracker to troubleshoot NAT entries. Which column do you check to view the NAT'd source port if you are using Source NAT?
Question378: How is communication between different Check Point components secured in R80? As with all questions, select the best answer.
Question379: Which information is included in the "Full Log" tracking option, but is not included in the "Log" tracking option?
Question380: You want to define a selected administrator's permission to edit a layer. However, when you click the + sign in the "Select additional profile that will be able edit this layer" you do not see anything. What is the most likely cause of this problem? Select the BEST answer.
