Question1: MegaCorps' disaster recovery plan is past due for an update to the backup and restore section to enjoy the benefits of the new distributed R77 installation. You must propose a plan that meets the following required and desired objectives:
Required: Security Policy repository must be backed up no less frequently than every 24 hours.
Desired: Back up R77 components enforcing the Security Policies at least once a week.
Desired: Back up R77 logs at least once a week.
You develop a disaster recovery plan proposing the following:
Use the utility cron to run the command upgrade_export each night on the Security Management
Servers.
Configure the organization's routine backup software to back up files created by the command
upgrade_export.
Configure GAiA back up utility to back up Security Gateways every Saturday night.
Use the utility cron to run the command upgrade_export each Saturday night on the log servers.
Configure an automatic, nightly logswitch.
Configure the organization's routine back up software to back up the switched logs every night.
The corporate IT change review committee decides your plan:
Question2: Which of the following statements is TRUE concerning MEP VPN's?
Question3: You have to uninstall the Check Point SmartWorkflow Software Blade on a Secure Platform system. How can you perform this procedure?
Question4: What process manages the dynamic routing protocols (OSPF, RIP, etc.) on GAiA?
Question5: You enable Sweep Scan Protection and Host port scan in IPS to determine if a large amount of traffic from a specific internal IP address is a network attack, or a user's system is infected with a worm. Will you get all the information you need from these actions?
Question6: Which of the following access options would you NOT use when configuring Captive Portal?
Question7: In Company XYZ, the DLP Administrator defined a new Keywords Data Type that contains a list of secret project names; i.e., Ayalon, Yarkon, Yarden. The threshold is set to At least 2 keywords or phrases. Based on this information, which of the following scenarios will be a match to the Rule Base?
Question8: Fill in the blank with a numeric value. The default port number for standard TCP connections with the LDAP server is
Question9: Which of the following is NOT accelerated by SecureXL?
Question10: You need to publish GaiA routes using the OSPF routing protocol. What is the correct command structure, once entering the route command, to implement OSPF successfully?
Question11: If ClusterXL Load Sharing is enabled with state synchronization enabled, what will happen if one member goes down?
Question12: Which application is used to create a File-Share Application?
Question13: Fill in the blank.
To provide full connectivity upgrade status, use command _____
Question14: You want to create an IKE VPN between two VPN-1 NGX Security Gateways, to protect two networks. The network behind one Gateway is 10.15.0.0/16, and network 192.168.9.0/24 is behind the peer's Gateway.
Which type of address translation should you use, to ensure the two networks access each other through the VPN tunnel?
Question15: What is the advantage for deploying SSL VPN in a DMZ, versus a LAN?
Question16: To backup all events stored in the SmartEvent Server, you should back up the contents of which folder(s)?
Question17: You are reviewing computer information collected in ClientInfo. You can NOT:
Question18: Paul has just joined the MegaCorp security administration team. Natalie, the administrator, creates a new administrator account for Paul in SmartDashboard and installs the policy. When Paul tries to login it fails.
How can Natalie verify whether Paul's IP address is predefined on the security management server?
Question19: How is Smart Workflow disabled?
Question20: Choose all correct statements. SmartUpdate, located on a VPN-1 NGX SmartCenter Server, allows you to:
( 1) Remotely perform a first time installation of VPN-1 NGX on a new machine ( 2) Determine OS patch levels on remote machines ( 3) Update installed Check Point and any OPSEC certified software remotely ( 4) Update installed Check Point software remotely ( 5) Track installed versions of Check Point and OPSEC products ( 6) Centrally manage licenses
Question21: Your primary SmartCenter Server is installed on a Secure PlatformPro machine, which is also a VPN-1 Pro Gateway. You want to implement Management High Availability (HA). You have a spare machine to configure as the secondary SmartCenter Server. How do you configure the new machine to be the standby SmartCenter Server, without making any changes to the existing primary SmartCenter Server? (Changes can include uninstalling and reinstalling.)
Question22: Which of the following uses the same key to decrypt as it does to encrypt?
Question23: Typically, when you upgrade the Security Management Server, you install and configure a fresh R77 installation on a new computer and then migrate the database from the original machine. When doing this, what is required of the two machines? They must both have the same:
Question24: Which component functions as the Internal Certificate Authority for VPN-1 NGX?
Question25: The set of rules that governs the types of objects in the directory and their associated attributes is called the:
Question26: Laura notices the Microsoft Visual Basic Bits Protection is set to inactive. She wants to set the Microsoft Visual Basic Kill Bits Protection and all other Low Performance Impact Protections to Prevent. She asks her manager for approval and stated she can turn theses on.
But he wants Laura to make sure no high Performance Impacted Protections are turned on while changing this setting.
Using the out below, how would Laura change the Default_Protection on Performance Impact Protections classified as low from inactive to prevent until meeting her other criteria?
Question27: You plan to incorporate OPSEC servers, such as Web sense and Trend Micro, to do content filtering.
Which segment is the BEST location for these OPSEC servers, when you consider Security Server performance and data security?
Question28: In which ClusterXL Load Sharing mode, does the pivot machine get chosen automatically by ClusterXL?
Question29: You are preparing computers for a new ClusterXL deployment.
For your cluster, you plan to use three machines with the following configurations:
Are these machines correctly configured for a ClusterXL deployment?
Question30: A customer calls saying that a Load Sharing cluster shows drops with the error First packet is not SYN.
Complete the following sentence. You will recommend:
Question31: How should Check Point packages be uninstalled?
Question32: Where multiple SmartDirectory servers exist in an organization, a query from one of the clients for user information is made to the servers based on a priority. By what category can this priority be defined?
Question33: When using a template to define a user in SmartDirectory, the user's password should be defined in the
_____ object.
Question34: The Management Portal allows all of the following EXCEPT:
Question35: What is the consequence of clearing the "Log VoIP Connection" box in Global Properties?
Question36: The Management Portal Software Blade allows users to
Question37: Fill in the blank.
You can set Acceleration to ON or OFF using command syntax _____.
Question38: Review the cphaprob state command output from a New Mode High Availability cluster member. Which machine has the highest priority?
Exhibit:
Question39: For best performance in Event Correlation, you should use:
Question40: Which of these is a type of acceleration in SecureXL?
Question41: You have just upgraded your Load Sharing gateway cluster (both members) from NGX R65 to R77.
cphaprob stat shows:
Cluster Mode: New High Availability (Active Up)
Member Unique Address Assigned Load State
1 (local) 172.16.185.21 100% Active
2 172.16.185.22 0% Ready
Which of the following is NOT a possible cause of this?
Question42: Use the table to match the BEST Management High Availability synchronication-status descriptions for your Security Management Server (SMS).
Question43: Which of the following are valid PKI architectures?
Question44: What is the command to upgrade a SecurePlatform NG with Application Intelligence (Al) R55 SmartCenter Server to VPN-1 NGX using a CD?
Question45: Which OPSEC server is used to prevent users from accessing certain Web sites?
Question46: John is the Security Administrator in his company. He installs a new R77 Security Management Server and a new R77 Gateway. He now wants to establish SIC between them. After entering the activation key, he gets the following message in SmartDashboard - "Trust established" SIC still does not seem to work because the policy won't install and interface fetching does not work. What might be a reason for this?
Question47: Robert has configured a Common Internet File System (CIFS) resource to allow access to the public partition of his company's file server, on \\erisco\goldenapple\files\public.
Robert receives reports that users are unable to access the shared partition, unless they use the file server's IP address.
Which of the following is a possible cause?
Question48: The User Directory Software Blade is used to integrate which of the following with a R77 Security Gateway?
Question49: What is NOT true about Management Portal?
Question50: Identify the correct step performed by SmartUpdate to upgrade a remote Security Gateway.
Question51: Which of the following commands shows full synchronization status?
Question52: Which of the following actions is most likely to improve the performance of Check Point QoS?
Question53: If SmartWorkflow is configured to work without Sessions or Role Segregation, how does the SmartDashboard function?
Question54: MultiCorp is located in Atlanta. It has a branch office in Europe, Asia, and Africa.
Each location has its own AD controller for local user login.
How many AD queries have to be configured?
Question55: Which of the following components contains the Events Data Base?
Question56: Which specific R77 GUI would you use to view the length of time a TCP connection was open?
Question57: Which of the following provides a unique user ID for a digital Certificate?
Question58: The file snapshot generates is very large, and can only be restored to:
Question59: When Load Sharing Multicast mode is defined in a ClusterXL cluster object, how are packets being handled by cluster members?
Question60: Which of the following TCP port numbers is used to connect the VPN-1 Gateway to the Content Vector Protocol (CVP) server?
Question61: The challenges to IT involve deployment, security, management, and what else?
Question62: Which type of VPN routing relies on a VPN Tunnel Interface (VTI) to route traffic?
Question63: You can NOT use SmartDashboard's SmartDirectory features to connect to the LDAP server.
What should you investigate?
1) Verify you have read-only permissions as administrator for the operating system.
2) Verify there are no restrictions blocking SmartDashboard's User Manager from connecting to the LDAP server.
3) Check that the login Distinguished Name configured has at least write permission in the access control configuration of the LDAP server.
Question64: John is upgrading a cluster from NGX R65 to R77. John knows that you can verify the upgrade process using the pre-upgrade verifier tool. When John is running Pre-Upgrade Verification, he sees the warning message:
Title: Incompatible pattern.
What is happening?
Question65: When configuring an LDAP Group object, which option should you select if you do NOT want the gateway to reference the groups defined on the LDAP server for authentication purposes?
Question66: Which of the following is NOT a restriction for connection template generation?
Question67: When using migrate to upgrade a Secure Management Server, which of the following is included in the migration?
Question68: Which Check Point product is used to create and save changes to a Log Consolidation Policy?
Question69: Review the following list of actions that Security Gateway R75 can take when it controls packets. The Policy Package has been configured for Simplified Mode VPN. Select the response below that includes the available actions:
Question70: Which procedure enables the SSL VPN blade on the gateway?
Question71: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question72: Where do you define NAT properties so that NAT is performed either client side or server side? In SmartDashboard under:
Question73: A ClusterXL configuration is limited to _____ members.
Question74: MegaCorp is running Smartcenter R70, some Gateways at R65 and some other Gateways with R60.
Management wants to upgrade to the most comprehensive IPv6 support. What should the administrator do first?
Question75: To change the default port of the Management Portal:
Question76: Exhibit:
What cluster mode is represented in this case?
Question77: Which of the following QoS rule action properties is an Advanced action type, only available in Traditional mode?
Question78: MegaCorp plans to upgrade all of its firewalls. Currently the corporation is a mixture of SecurePlatform and IPSO machines running R71, to the latest code level of GAiA. Many of the firewalls are using VTIs to allow advanced routing configuration to propagate through all the networks. What will the Acme company need to do to make sure VTIs will work once moved to GAiA?
Question79: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend before major changes, such as upgrades?
Question80: Which of the following commands can be used to bind a NIC to a single processor when using a Performance Pack onSecure Platform?
Question81: The following graphic illustrates which command being issued on Secure Platform?
Question82: User definitions are stored in _____.
Question83: MEP VPN's use the Proprietary Probing Protocol to send special UDP RDP packets to port ____ to discover if an IP is accessible.
Question84: A connection is said to be Sticky when:
Question85: Which statement defines Public Key Infrastructure? Security is provided:
Question86: Where do you verify that SmartDirectory is enabled?
Question87: In SmartWorkflow, what is NOT a valid possibility?
Question88: The SmartEvent Correlation Unit:
Question89: If using AD Query for seamless identity data reception from Microsoft Active Directory (AD), which of the following methods is NOT Check Point recommended?
Question90: When using SmartWorkflow, how many sessions can be in progress at the same time?
Question91: What utility would you use to configure route-based VPNs?
Question92: The London office just upgraded their DNS servers so their Gateway needs to be updated with the new settings. What would be the BEST way for Henry to change the DNS settings for London's Gateway?
Question93: Your customer asks you about the Performance Pack.
You explain to him that a Performance Pack is a software acceleration product which improves the performance of the Security Gateway.
You may enable or disable this acceleration by either:
1) the command:cpconfig
2) the command: fwaccel on ff
What is the difference between these two commands?
Question94: Which procedure creates a new administrator in Smart Workflow?
Question95: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question96: Identify the correct step performed by SmartUpdate to upgrade a remote Security Gateway.
Question97: Check Point Clustering protocol, works on:
Question98: Your online bookstore has customers connecting to a variety of Web servers to place or change orders and check order status. You ran penetration tests through the Security Gateway to determine if the Web servers were protected from a recent series of cross-site scripting attacks. The penetration testing indicated the Web servers were still vulnerable.
You have checked every box in the Web Intelligence tab, and installed the Security Policy.
What else might you do to reduce the vulnerability?
Question99: In a Management High Availability (HA) configuration, you can configure synchronization to occur automatically, when:
1 . The Security Policy is installed.
2 . The Security Policy is saved.
3 . The Security Administrator logs in to the secondary SmartCenter Server, and changes its status to active.
4 . A scheduled event occurs.
5 . The user database is installed.
Select the BEST response for the synchronization sequence. Choose one.
Question100: Which describes the function of the account unit?
Question101: How are cached usernames and passwords cleared from the memory of a Security Gateway?
Question102: An organization may be distributed across several SmartDirectory (LDAP) servers. What provision do you make to enable a Gateway to use all available resources?
Each SmartDirectory (LDAP) server must be:
Question103: Katie has enabled User Directory and applied the license to Security Management Server, Green. Her supervisor has asked her to configure the Password Strength options of the least one digit, one symbol, 8 characters long and include an uppercase character. How should she accomplish this?
Question104: VPN traffic control would fall under which VPN component?
Question105: What does the command vpn crl_zap do?
Question106: Can end users be forced to authenticate by using client certificates and username/password credentials?
Question107: Which of the following services will cause SecureXL templates to be disabled?
Question108: You have pushed a policy to your firewall and you are not able to access the firewall. What command will allow you to remove the current policy from the machine?
Question109: What is the meaning of the option Connect to the Internet?
Question110: What command will stop all (and only) Management Portal services?
Question111: What is a Sticky Connection?
Question112: What is the command to show OSPF adjacencies?
Question113: Which external user authentication protocols are supported in SSL VPN?
Question114: Fill in the blank.
Type the command and syntax to configure the Cluster Control Protocol (CCP) to use Broadcast.
Question115: When using Connector with Endpoint Security Policies, what option is not available when configuring DAT enforcement?
Question116: How can you completely tear down a specific VPN tunnel in an intranet IKE VPN deployment?
Question117: You are preparing to deploy a VPN-1 Pro Gateway for VPN-1 NGX.
You have five systems to choose from for the new Gateway, and you must conform to the following requirements:
Operating-system vendor's license agreement
Check Point's license agreement
Minimum operating-system hardware specification
Minimum Gateway hardware specification
Gateway installed on a supported operating system (OS)
Which machine meets ALL of the following requirements?
Question118: You have configured a site to site VPN but the tunnel in not coming up. Review the following screen shots.
What is a likely cause?
Question119: If Bob wanted to create a Management High Availability configuration, what is the minimum number of Security Management servers required in order to achieve his goal?
Question120: The "MAC Magic" value must be modified under the following condition:
Question121: Which of the following statements is FALSE regarding OSPF configuration on Secure Platform Pro?
Question122: The process _____ is responsible for Policy compilation.
Question123: If Jack was concerned about the number of log entries he would receive in the SmartReporter system, which policy would he need to modify?
Question124: Fill in the blank.
To verify that a VPN Tunnel is properly established, use the command _____.
Question125: Wayne configures an HTTP Security Server to work with the content vectoring protocol to screen forbidden sites. He has created a URI resource object using CVP with the following settings:
Use CVP
Allow CVP server to modify content
Return data after content is approved
He adds two rules to his Rule Base: one to inspect HTTP traffic going to known forbidden sites, the other to allow all other HTTP traffic.
Wayne sees HTTP traffic going to those problematic sites is not prohibited.
What could cause this behavior?
Question126: If Victor wanted to edit new Signature Protections, what tab would he need to access in SmartDashboard?
Question127: For a dedicated DLP Gateway that runs in inline bridge mode, why is it important to properly define the topology?
Question128: What port is used for Administrator access for your SSL VPN?
Question129: Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?
Question130: SmartReporter reports can be used to analyze data from a penetration-testing regimen in all of the following examples, EXCEPT:
Question131: All of the following are used by the DLP engine to match a message during a scan, EXCEPT:
Question132: You are responsible for the IPS configuration of your Check Point firewall. Inside the Denial of service section you need to set the protection parameters against the Teardrop attack tool with high severity. How would you characterize this attack tool? Give the BEST answer.
Question133: When an Endpoint user is able to authenticate but receives a message from the client that it is unable to enforce the desktop policy, what is the most likely scenario?
Question134: Which protocol is not supported for DLP?
Question135: You are establishing a ClusterXL environment, with the following topology:
VIP internal cluster IP = 172.16.10.3; VIP external cluster IP = 192.168.10.3 Cluster Member 1: 4 NICs, 3 enableD. hme0: 192.168.10.1/24, hme1: 10.10.10.1/24, qfe2: 172.16.10.1/24 Cluster Member 2: 5 NICs, 3 enabled; hme3: 192.168.10.2/24, hme1: 10.10.10.2/24, hme2:
172.16.10.2/24
External interfaces 192.168.10.1 and 192.168.10.2 connect to a VLAN switch. The upstream router connects to the same VLAN switch. Internal interfaces 172.16.10.1 and 172.16.10.2 connect to a hub.
10.10.10.0 is the synchronization network. The Security Management Server is located on the internal network with IP 172.16.10.3. What is the problem with this configuration?
Question136: The process _____ is responsible for the authentication for Remote Access clients.
Question137: You are a Security Administrator preparing to deploy a new HFA (Hot fix Accumulator) to ten Security Gateways at five geographically separated locations.
What is the BEST method to implement this HFA?
Question138: Which operating system(s) support(s) unnumbered VPN Tunnel Interfaces (VTIs) for route-based VPN's?
Question139: In ClusterXL, which of the following processes are defined by default as critical devices?
Question140: The Smart Provisioning management concept is based on:
Question141: Which of the following is NOT a valid way to view interface's IP address settings in GAiA?
Question142: Which of the following deployment scenarios CANNOT be managed by Check Point QoS?
Question143: For Management High Availability synchronization, what does the Advance status mean?
Question144: A user cannot authenticate to SSL VPN. You have verified the user is assigned a user group and reproduced the problem, confirming a failed-login session. You do not see an indication of this attempt in the traffic log. The user is not using a client certificate for login.
To debug this error, where in the authentication process could the solution be found?
Question145: Which command would you use to save the IP address and routing information before upgrading a GAiA Gateway?
Question146: Based on the following information, which of the statements below is FALSE?
A DLP Rule Base has the following conditions:
Data Type =Password Protected File
Source=My Organization
Destination=Outside My Organization
Protocol=Any
Action=Ask User
Exception: Data Type=Any,
Source=Research and Development (R&D)
Destination=Pratner1.com
Protocol=Any
All other rules are set to Detect. User Check is enabled and installed on all client machines.
Question147: Which is the BEST configuration option to protect internal users from malicious Java code, without stripping Java scripts?
Question148: There are times when you want to use Link Selection to manage high-traffic VPN connections.
With Link Selection you can:
Question149: You need to completely reboot the Operating System after making which of the following changes on the Security Gateway? (i.e. the command cprestart is not sufficient.)
1 . Adding a hot-swappable NIC to the Operating System for the first time.
2 . Uninstalling the R75 Power/UTM package.
3 . Installing the R75 Power/UTM package.
4 . Re-establishing SIC to the Security Management Server.
5 . Doubling the maximum number of connections accepted by the Security Gateway.
Question150: Which of the following log files contains only information about the negotiation process for encryption?
Question151: During a Security Management Server migrate export, the system:
Question152: Check Point recommends deploying SSL VPN:
Question153: Anytime a client initiates a connection to a server, the firewall kernel signals the FWD process using a trap.
FWD spawns the _____ child service, which runs the security server.
Question154: How can you verify that SecureXL is running?
Question155: How is change approved for implementation in SmartWorkflow?
Question156: How is the SmartWorkflow Session Information Pane enabled?
Question157: In R76, My Organization e-mail addresses or domains are used for:
Question158: What action can be run from SmartUpdate NGX R65?
Question159: Remote clients are using SSL VPN to authenticate via LDAP server to connect to the organization. Which gateway process is responsible for the authentication?
Question160: MegaCorp has two different types of hardware with Check Point GAiA installed and set up as gateways.
The Administrator wants to provide redundancy in case one of them fails. Choose the best approach.
Question161: Which graded parameters help determine the protections to activate for security and which can be safely deactivated? Select the most correct answer.
Question162: You want to block corporate internal-net and localnet from accessing Web sites containing inappropriate content. You are using WebTrends for URL filtering.
You have disabled VPN- 1 Control connections in the Global properties.
Review the diagram and the Security Policies for GW_A and GW_B in the exhibit provided.
Corporate users and localnet users receive message "Web cannot be displayed". In SmartView Tracker, you see the connections are dropped with message "content security is not reachable".
What is the problem, and how do you fix it?
Question163: __________ is a proprietary Check Point protocol. It is the basis for Check Point ClusterXL inter-module communication.
Question164: Provisioning Profiles can NOT be applied to:
Question165: Fill in the blank.
What is the correct command and syntax used to view a connection table summary on a Check Point Firewall?
Question166: The process _____ executes the authentication for logging in to SmartDashboard.
Question167: Fill in the blank.
In a zero downtime firewall cluster environment, what command syntax do you run to avoid switching problems around the cluster for command cphaconf?
Question168: To force clients to use Integrity Secure Workspace when accessing sensitive applications, the Administrator can configure Connectra:
Question169: Which of the following functions CANNOT be performed in Client Info on computer information collected?
Question170: Public keys and digital certificates provide which of the following? Select three.
Question171: What access level cannot be assigned to an Administrator in SmartEvent?
Question172: Which SmartConsole component can Administrators use to track changes to the Rule Base?
Question173: Fill in the blank.
To remove site-to-site IKE and IPSEC keys you would enter command _____ _____ and select the option to delete all IKE and IPSec SA's.
Question174: What is the lowest possible version a Security Gateway may be running in order to use it as an LSM enabled Gateway?
Question175: _____ manages Standard Reports and allows the administrator to specify automatic uploads of reports to a central FTP server.
Question176: To configure a Security Management Server for an SSL VPN Gateway, you can set up log forwarding from that Gateway. All of the following tasks must be performed to accomplish this, EXCEPT:
Question177: Which of the following is a valid Active Directory designation for user Jane Doe in the MIS department of AcmeCorp.com?
Question178: How many Events can be shown at one time in the Event preview pane?
Question179: Management Portal should be installed on:
(i) Management Server
(ii) Security Gateway
(iii) Dedicated Server
Question180: When synchronizing clusters, which of the following statements are true? Select all that apply.
Question181: Your company is planning on moving their server farm to a new datacenter which requires IP changes to important network services including DNS, DHCP, and TFTP. Rather than manually logging in to all your firewalls and modifying the settings individually, you decide to purchase and enable SmartProvisioning.
Assuming all your firewalls are on SPLAT, what is the minimum version required to update the firewalls' DNS and backup settings via SmartProvisioning?
Question182: Which command would you use to save the interface information before upgrading a GAiA Gateway?
Question183: Which of the following is the default port for Management Portal?
Question184: What SmartConsole application allows you to change the SmartReporter Policy?
Question185: In a R77 ClusterXL Load Sharing configuration, which type of ARP related problem can force the use of Unicast Mode (Pivot) configuration due to incompatibility on some adjacent routers and switches?
Question186: Your customer wishes to install SmartWorkflow on top of R70 Security Management Server (Windows system). What is the required disk space?
Question187: VPN access control would fall under which VPN component?
Question188: Which statement about LDAP and Active Directory (AD) with SSL VPN is TRUE?
Question189: Which of the following is NOT an internal/native Check Point command?
Question190: A Minimal Effort Upgrade of a cluster:
Question191: Which VPN Community object is used to configure VPN routing within the SmartDashboard?
Question192: Fill in the blank.
In a zero downtime scenario, which command do you run manually after all cluster members are upgraded?
Question193: Fill in the blank.
To verify SecureXL statistics, you would use the command _____.
Question194: Select the right answer to export IPS profiles to copy to another management server?
Question195: Fred is troubleshooting a NAT issue and wants to check to see if the inbound connection from this internal network is being translated across the interface in the firewall correctly. He decides to use the fw monitorto capture the traffic from the source 192.168.3.5 or the destination of 10.1.1.25 on his Security Gateway. Green that has an IP of 192.168.4.5. What command captures this traffic in a file that he can download and review with WireShark?
Question196: MultiCorp is running Smartcenter R71 on an IPSO platform and wants to upgrade to a new Appliance with R77. Which migration tool is recommended?
Question197: UserA is able to create a SmartLSM Security Cluster Profile , you must select the correct justification.
Question198: Fill in the blank.
MultiCorp is located in Atlanta. It has a branch office in Europe, Asia, and Africa. Each location has its own AD controller for local user login. How many ADqueries have to be configured?
Question199: In Management High Availability, what is an Active SMS?
Question200: Frank is concerned with performance and wants to configure the affinities settings. His gateway does not have the |Performance pack running. What would Frank need to perform in order configure those settings?
Question201: Fill in the blank.
Type the command and syntax you would use to verify that your Check Point cluster is functioning correctly.
Question202: Which is the lowest Gateway version manageable by SmartCenter R77?
Question203: How does Check Point recommend that you secure the sync interface between gateways?
Question204: Using the output below, what does the red flag indicate for the MS08-067 Protection?
Question205: What proprietary Check Point protocol is the basis of the functionality of Check Point ClusterXL inter- module communication?
Question206: Which technology would describe RDED for Qos?
Question207: You are preparing computers for a new ClusterXL deployment. For your cluster, you plan to use four machines with the following configurations:
Cluster Member 1: OS - GAiA; NICs - QuadCard; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 2: OS - GAiA; NICs - 4 Intel 3Com; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 3: OS - GAiA; NICs - 4 other manufacturers; Memory: 512 MB; Security Gateway only, version: R77 Security Management Server: MS Windows 2008; NIC - Intel NIC (1); Security Gateway and primary Security Management Server installed, version: R77 Are these machines correctly configured for a ClusterXL deployment?
Question208: What is the SmartEvent Correlation Unit's function?
Question209: A Fast Path Upgrade of a cluster:
Question210: Which procedure will create an Internal User?
Question211: When selecting a backup target using SmartProvisioning, which target is NOT available?
Question212: Damon enables an SMTP resource for content protection.
He notices that mail seems to slow down on occasion, sometimes being delivered late.
Which of the following might improve throughput performance?
Question213: You plan to migrate a VPN-1 NG with Application Intelligence (Al) R55 SmartCenter Server to VPN-1 NGX.
You also plan to upgrade four VPN-1 Pro Gateways at remote offices, and one local VPN-1 Pro Gateway at your company's headquarters. The SmartCenter Server configuration must be migrated. What is the correct procedure to migrate the configuration?
Question214: What is the behavior of ClusterXL in a High Availability environment?
Question215: If traffic requires preferential treatment by other routers on the network, in addition to the QoS module, which Check Point QoS feature should be used?
Question216: The process that performs the authentication for SSL VPN Users is:
Question217: Which file defines the fields for each object used in the file objects.C (color, num/string, default value...)?
Question218: How do you enable SecureXL (command line) on GAiA?
Question219: When you add a resource service to a rule, which ONE of the following actions occur?
Question220: When defining an Organizational Unit, which of the following are NOT valid object categories?
Question221: Why would an old Connecter Gateway IP be displayed to remote SSL Network Extender users, after changing it to a different IP? You must:
Question222: The process _____ provides service to access the GAIA configuration database.
Question223: By default, a standby Security Management Server is automatically synchronized by an active Security Management Server, when:
Question224: In ClusterXL, _____ is defined by default as a critical device.
Question225: When connecting to the SSL VPN portal, you receive a pop-up message indicating that the server hostname does not match the certificate hostname, and the certificate is not signed by a known Certificate Authority (CA). How would you solve this problem?
Question226: Which component receives events and assigns severity levels to the events; invokes any defined automatic reactions, and adds the events to the Events Data Base?
Question227: Which command would you use to save the routing information before upgrading a Secure Platform Gateway?
Question228: At what router prompt would you save your OSPF configuration?
Question229: What happens to the session information after they are approved and a policy installation is done?
Question230: Which command can be used to verify SecureXL statistics?
Question231: You receive an alert indicating a suspicious FTP connection is trying to connect to one of your internal hosts. How do you block the connection in real time and verify the connection is successfully blocked?
Question232: You logged in to your firewall and discovered that the scheduled backup has been modified.
Which of the below options is NOT a reason for the change?
Question233: Which of the following commands can be used to stop Management portal services?
Question234: Your R7x-series Enterprise Security Management Server is running abnormally on Windows Server 2008 R2. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings intact (i.e., all Security Policies, databases, SIC, licensing etc.) What is the BEST method to reinstall the Server and keep its critical configuration?
A:
B:
C:
D:
Question235: In R71, how would you define a rule to block all traffic sent to or from Germany?
Question236: Assume an intruder has compromised your current IKE Phase 1 and Phase 2 keys.
Which of the following options will end the intruder's access, after the next Phase 2 exchange occurs?
Question237: Which task will ThreatSpect Engine NOT do?
Question238: John is the MegaCorp Security Administrator, and is using Check Point R71. Malcolm is the Security Administrator of a partner company and is using a different vendor's product and both have to build a VPN tunnel between their companies. Both are using clusters with Load Sharing for their firewalls and John is using ClusterXL as a Check Point clustering solution.
While trying to establish the VPN, they are constantly noticing problems and the tunnel is not stable and then Malcolm notices that there seems to be 2 SPIs with the same IP from the Check Point site. How can they solve this problem and stabilize the tunnel?
Question239: When configuring an LDAP Group object, select the option _____ if you want the gateway to reference all groups defined on the LDAP server for authentication purposes.
Question240: Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
Which of the following is NOT a recommended use for this method?
Question241: You are running a R77 Security Gateway on GAiA. In case of a hardware failure, you have a server with the exact same hardware and firewall version installed. What backup method could be used to quickly put the secondary firewall into production?
Question242: The following rule contains an FTP resource object in the Service field:
Source: local_net
Destination: Any
Service: FTP-resource object
Action: Accept
How do you define the FTP Resource Properties > Match tab to prevent internal users from receiving corporate files from external FTP servers, while allowing users to send files?
Question243: What's true about Troubleshooting option in the IPS profile properties?
Question244: What is NOT a valid LDAP use in Check Point SmartDirectory?
Question245: Susan needs to change the DNS settings on her Secure Platform Gateway.
Using the output below,
Which Gateway could she edit directly from the Devices view using Edit Gateway, then selecting the DNS tab?
Question246: Choose the ClusterXL process that is defined be default as a critical device?
Question247: When synchronizing clusters, which of the following statements is NOT true?
Question248: Concerning these products: SecurePlatform, VPN-1 Pro Gateway, UserAuthority Server, Nokia OS, UTM-
1, Eventia Reporter, and Performance Pack, which statement is TRUE?
Question249: In cryptography, the Rivest, Shamir, Adelman (RSA) scheme has which of the following? Select all that apply.
Question250: You start the configuration of SmartWorkflow. SmartWorkflow is enabled, but you are not able to select Open New Session because it is greyed out.
What must be done to open a new session? Choose the BEST answer.
Question251: When upgrading a cluster in Full Connectivity Mode, the first thing you must do is see if all cluster members have the same products installed. Which command should you run?
Question252: After installing VPN-1 Pro NGQ R65, you discover that one port on your Intel Quad NIC on the Security Gateway is not fetched by a get topology request. What is the most likely cause and solution?
Question253: You configure a Check Point QoS Rule Base with two rules:
an H.323 rule with a weight of 10, and the Default Rule with a weight of 10.
The H.323 rule includes a per-connection guarantee of 384 Kbps. and a per-connection limit of 512 Kbps.
The per-connection guarantee is for four connections, and no additional connections are allowed in the Action properties. If traffic is passing through the QoS Module matches both rules, which of the following statements is TRUE?
Question254: A user attempts to initialize a network application using SSL Network Extender.
The application fails to start. What is the MOST LIKELY solution?
Question255: Which of the following operating systems support numbered VTI's?
Question256: Mark the configuration options that are available for Data Loss Prevention in R71.
Question257: You want to upgrade a SecurePlatform NG with Application Intelligence (Al) R55 Gateway to SecurePlatform NGX R60 via SmartUpdate.
Which package is needed in the repository before upgrading?
Question258: When running DLP Wizard for the first time, which of the following is a mandatory configuration?
Question259: Which Remote Desktop protocols are supported natively in SSL VPN?
Question260: How is SmartWorkflow enabled?
Question261: The SmartEvent Correlation Unit:
Question262: Which changes are tracked by SmartWorkflow?
Question263: Your primary Security Management Server runs on GAiA. What is the fastest way to back up your Security Gateway R77 configuration, including routing and network configuration files?
Question264: Which version is the minimum requirement for SmartProvisioning?
Question265: How do you verify the Check Point kernel running on a firewall?
Question266: The relay mail server configured under Email Notifications is used by the DLP Gateway to: (Choose the BEST answer.)
Question267: Your customer wishes to install the SmartWorkflow Software Blade on a R70 Security Management server (Secure Platform).
Which is the correct method?
Question268: How many pre-defined exclusions are included by default in SmartEvent R77 as part of the product installation?
Question269: You want to upgrade a cluster with two members to VPN-1 NGX. The Smart CenterServer and both members are version VPN-1/Firewall-1 NG FP3, with the latest Hotfix.
What is the correct upgrade procedure?
1 . Change the version, in the General Properties of the gateway-cluster object.
2 . Upgrade the Smart CenterServer, and reboot after upgrade.
3 . Run cpstop on one member, while leaving the other member running. Upgrade one member at a time, and reboot after upgrade.
4 . Reinstall the Security Policy.
Question270: A Threat Prevention profile is a set of configurations based on the following. Select the right answer.
Question271: You need to determine if your company's Web servers are accessed an excessive number of times from the same host. How would you configure this in the IPS tab?
Question272: SSL termination takes place:
Question273: Jack needs to configure CoreXL on his Red Security Gateway. What are the correct steps to enable CoreXL?
Question274: MegaCorp is using SmartCenter Server with several gateways. Their requirements result in a heavy log load. Would it be feasible to add the SmartEvent Correlation Unit and SmartEvent Server to their SmartCenter Server?
Question275: What is the SmartEvent Client's function?
Question276: Steve tries to configure Directional VPN Rule Match in the Rule Base.
But the Match column does not have the option to see the Directional Match.
Steve sees the following screen.
What is the problem?
Question277: Smart Provisioning is an integral part of the Security Management or Provider-1 CMA.
To enable Smart Provisioning on the Security Management server:
Question278: Your current stands alone VPN-1 NG with Application Intelligence (Al) R55 installation is running on SecurePlatform. You plan to implement VPN-1 NGX in a distributed environment, where the existing machine will be the VPN-1 Pro Gateway. An additional machine will serve as the SmartCenter Server. The new machine runs on a Windows Server 2003.
You need to upgrade the NG with Al R55 SmartCenter Server configuration to VPN-1 NGX.
How do you upgrade to VPN-1 NGX?
Question279: When configuring a Web Application for SSL VPN remote access, you have given the following definition for the application along with its protection level.
Which of the following is the best match for the above application?
Question280: What is the maximum number of cores supported by CoreXL?
Question281: What is the supported ClusterXL configuration when configuring a cluster synchronization network on a VLAN interface?
Question282: Using SmartProvisioning Profiles, which of the following could be configured for both Secure Platform and UTM-1 Edge devices?
(i) Backup
(ii) Routing
(iii) Interfaces
(iv) Hosts
(v) NTP server
(vi) DNS
Question283: Fill in the blank with a numeric value. The default port number for Secure Sockets Layer (SSL) connections with the LDAP Server is
Question284: What process manages the dynamic routing protocols (OSPF, RIP, etc.) on GAiA?
Question285: When configuring site-to-site VPN High Availability (HA) with MEP, which of the following is correct?
Question286: The CoreXL SND (Secure Network Distributor) is responsible for:
Question287: Which of the following load-balancing methods is not valid?
Question288: You want to upgrade a cluster with two members to R77. The Security Management Server and both members are version NGX R65, with the latest Hotfix Accumulator. What is the correct upgrade procedure?
1) Change the version in the General Properties of the Gateway-cluster object.
2) Upgrade the Security Management Server, and reboot.
3) Run cpstop on one member, while leaving the other member running. Upgrade one member at a time and reboot after upgrade.
4) Install the Security Policy.
Question289: Which of the following are valid reasons for beginning with a fresh installation VPN-1 NGX R65, instead of upgrading a previous version to VPN-1 NGX R65? Select all that apply.
Question290: Which of the following statements is TRUE concerning MEP VPN's?
Question291: What is the benefit to running SmartEvent in Learning Mode?
Question292: Included in the customer's network are some firewall systems with the Performance Pack in use. The customer wishes to use these firewall systems in a cluster (Load Sharing mode). He is not sure if he can use the Sticky Decision Function in this cluster. Explain the situation to him.
Question293: When restoring R76 using the command upgrade_import, which of the following items are NOT restored?
Question294: Your users are defined in a Windows 2008 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R77?
Question295: What is the most typical type of configuration for VPNs with several externally managed Gateways?
Question296: What is a requirement for setting up R77 Management High Availability?
Question297: Where do Gateways managed by SmartProvisioning fetch their assigned profiles?
Question298: Check Point support has asked Tony for a firewall capture of accepted packets. What would be the correct syntax to create a capture file to a filename called monitor.out?
Question299: Security server configuration settings are stored in _____.
Question300: By default, what happens to the existing connections on a firewall when a new policy is installed?
Question301: Even after configuring central logging on Connecter, Connecterlogs are not displaying in Smart View Tracker. What could be the cause of this problem?
Question302: You have a High Availability ClusterXL configuration. Machines are not synchronized. What happens to connections on failover?
Question303: Your network traffic requires preferential treatment by other routers on the network, in addition to the QoS Module, which Check Point QoS feature should you use?
Question304: Fill in the blank.
The command that typically generates the firewall application, operating system, and hardware specific drivers is _____.
Question305: To clean the system of all SmartEvent events, you should delete the files in which folder(s)?
Question306: Which port is typically used by SSL Network Extender, if the Connecter Portal will also be used on the same IP address?
Question307: What is a task of the SmartEvent Server?
Question308: You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities should you do first?
Question309: Which command provides cluster upgrade status?
Question310: The TotallyCoolSecurity Company has a large security staff. Bob configured a new IPS Chicago_Profile for fw-chicago using Detect mode. After reviewing logs, Matt noticed that fw-Chicago is not detecting any of the IPS protections that Bob had previously setup.
Analyze the output below and determine how Matt can correct the problem.
Question311: A customer called to report one cluster member's status as Down. What command should you use to identify the possible cause?
Question312: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend anytime outside a maintenance window?
Question313: Which of the following is a valid Active Directory designation for user John Doe in the Sales department of AcmeCorp.com?
Question314: The customer wishes to install a cluster. In his network, there is a switch which is incapable of forwarding multicast. Is it possible to install a cluster in this situation?
Question315: What is the best method for scheduling backup's on multiple firewalls?
Question316: How do you run "CPSIZEME" on SPLAT?
Question317: Which of the following statements is TRUE concerning MEP VPN's?
Question318: The process _____ is responsible for GUIClient communication with the SmartCenter.
Question319: After Travis added new processing cores on his server, CoreXL did not use them.
What would be the most plausible reason why? Travis did not:
Question320: Which of the following statements about SSL VPN is TRUE?
Question321: What firewall kernel table stores information about port allocations for Hide NAT connections?
Question322: When deploying a dedicated DLP Gateway behind a perimeter firewall on an interface leading to the internal network (there is only one internal network):
Question323: Which of the following describes the default behavior of an R77 Security Gateway?
Question324: What are the SmartProvisioning Provisioning Profile indicators?
Question325: Which two processes are responsible on handling Identity Awareness?
Question326: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question327: Control connections between the Security Management Server and the Gateway are not encrypted by the VPN Community. How are these connections secured?
Question328: If a digital signature is used to achieve both data-integrity checking and verification of sender, digital signatures are only used when implementing:
Question329: Which of the following commands would you run to remove site-to-site IKE and IPSec Keys?
Question330: A SmartProvisioning Gateway could be a member of which VPN communities?
1) Center in Star Topology
2) Satellite in Star Topology
3) Center in Remote Access Community
4) Meshed Community
Question331: Fill in the blank.
To stop acceleration on a GAiA Security Gateway, enter command
Question332: Which statement is TRUE for route-based VPN's?
Question333: Where do you verify that SmartDirectory is enabled?
Question334: Which method of load balancing describes "Round Robin"?
Question335: What is the greatest benefit derived from VPNs compared to frame relay, leased lines any other types of dedicated networks?
Question336: Which of the following can NOT be modified by editing the cp_httpd_admin.conf file?
Question337: When upgrading Check Point products in a distributed environment, in which order should you upgrade these components?
1 GUI Client
2 Security Management Server
3 Security Gateway
Question338: You are using trace logger to debug SSL VPN's server side and obtain a textual traffic dump.
Which type of traffic will you NOT see in the output?
Question339: SmartProvisioning can provision the Operating System and network settings on which of the following?
Question340: CPD is a core Check Point process that does all of the following EXCEPT:
Question341: Which of the following SSL Network Extender server-side prerequisites are correct? Select all that apply.
Question342: True or false? After creating a snapshot of a Windows 2003 SP2 Security Management Server, you can restore it on a Secure Platform R76 Security Management Server, except you must load interface information manually.
Question343: Which Check Point ClusterXL mode is used to synchronize the physical interface IP and MAC addresses on all clustered interfaces.
Question344: How can you view the virtual cluster interfaces of a Cluster XL environment?
Question345: Match the ClusterXL modes with their configurations.
Exhibit:
Question346: What is the command to upgrade an NG with Application Intelligence R55 Smart Center running on SecurePlatform to VPN-1 NGX R65?
Question347: How does a cluster member take over the VIP after a failover event?
Question348: UDP packets are delivered if they are ___________.
Question349: Which of the following platforms does NOT support SecureXL?
Question350: Which of the following items can be provisioned via a Profile through SmartProvisioning?
i) Backup Schedule
ii) DNS Entries
iii) Hosts Table
iv) Domain Name
v) Interface IP's
Question351: David wants to manage hundreds of gateways using a central management tool. What tool would David use to accomplish his goal?
Question352: Which Name Resolution protocols are supported in SSL VPN?
Question353: What is the best tool to produce a report which represents historical system information?
Question354: While using the SmartProvisioning Wizard to create a new profile, you cannot continue because there are no devices to select. What is a possible reason for this?
i) All devices already have a profile assigned to them
ii) Provisioning Blade is not enabled on the devices
iii) No UTM- 1/Power- 1/Secure Platform devices are defined in Smart Dashboard iv) SIC is not established on the devices.
Question355: To back up all events stored in the SmartEvent Server, you should back up the contents of which folder(s)?
Question356: What action CANNOT be run from SmartUpdate NGX R65?
Question357: What Smart Console application allows you to change the Log Consolidation Policy?
Question358: Network applications accessed using SSL Network Extender have been found to fail after one of their TCP connections has been left idle for more than one hour.
You determine that you must enable sending reset (RST) packets upon TCP time-out expiration.
Where is it necessary to change the setting?
Question359: While authorization for users managed by SmartDirectory is performed by the gateway, the authentication mostly occurs in _____.
Question360: What can be said about RSA algorithms? Select all that apply.
Question361: Which of the following is NOT a supported browser for Management Portal?
Question362: You are troubleshooting a HTTP connection problem. You've started fw monitor -o http.pcap. When you open http.pcap with Wireshark there is only one line. What is the most likely reason?
Question363: Which of the following statements is FALSE about the DLP Software Blade and Active Directory (AD) or LDAP?
Question364: After Travis added new processing cores on his server, CoreXL did not use them. What would be the most plausible reason why? Travis did not:
Question365: When synchronizing clusters, which of the following statements is NOT true?
Question366: _____ is a proprietary Check Point protocol. It is the basis for Check Point ClusterXL inter-module communication.
Question367: Using IPS, how do you notify the Security Administrator that malware is scanning specific ports? By enabling:
Question368: In a distributed VPN-1 Pro NGX environment, where is the Internal Certificate Authority (ICA) installed?
Question369: Which of the following is a supported deployment for Connectra?
Question370: Your R7x-series Enterprise Security Management Server is running abnormally on Windows Server 2008 R2. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings intact (i.e., all Security Policies, databases, SIC, licensing etc.) What is the BEST method to reinstall the Server and keep its critical configuration?
Question371: The following configuration is for VPN-1 NGX:1s this configuration correct for Management High Availability (HA)?
Question372: A Full Connectivity Upgrade of a cluster:
Question373: Which load-balancing method below is NOT valid?
Question374: Your primary Security Management Server runs on GAiA. What is the easiest way to back up your Security Gateway R76 configuration, including routing and network configuration files?
Question375: Fill in the blank.
The command useful for debugging by capturing packet information, including verifying LDAP authentication on all Check Point platforms is _______
Question376: Yoav is a Security Administrator preparing to implement a VPN solution for his multi-site organization.
To comply with industry regulations, Yoav's VPN solution must meet the following requirements:
Portability: Standard
Key management: Automatic, external PKI
Session keys: Changed at configured times during a connection's lifetime Key length: No less than 128-bit Data integrity: Secure against inversion and brute force attacks What is the most appropriate setting Yoav should choose?
Question377: What process is responsible for transferring the policy file from SmartCenter to the Gateway?
Question378: The SmartEvent Correlation Unit:
Question379: In Company XYZ, the DLP Administrator defined a new template Data Type that is based on an empty PDF form for an insurance claim.
Which of the following statements about this new data type are CORRECT?
Question380: Steve is troubleshooting a connection problem with an internal application. If he knows the source IP address is 192.168.4.125, how could he filter this traffic?
Question381: Your customer wishes to use SmartWorkflow Software Blade, but he also wishes to install a policy during an emergency without an approval. Is it possible?
Question382: Fill in the blanks.
To view the number of concurrent connections going through your firewall, you would use the command and syntax _____ _____ _____ _____ _____.
Question383: Typically, when you upgrade the Security Management Server, you install and configure a fresh R76 installation on a new computer and then migrate the database from the original machine.
Which of the following statements are TRUE?
Question384: Where is it necessary to configure historical records in SmartView Monitor to generate Express reports in SmartReporter?
Question385: When configuring numbered VPN Tunnel Interfaces (VTIs) in a clustered environment, what issues need to be considered?
1) Each member must have a unique source IP address.
2) Every interface on each member requires a unique IP address.
3) All VTI's going to the same remote peer must have the same name.
4) Cluster IP addresses are required.
Question386: In which case is a Sticky Decision Function relevant?
Question387: Check Point New Mode HA is a(n) _____ solution.
Question388: You set up a mesh VPN Community, so your internal networks can access your partner's network, and vice versa. Your Security Policy encrypts only FTP and HTTP traffic through a VPN tunnel. All other traffic among your internal and partner networks is sent in clear text.
How do you configure the VPN Community?
Question389: Your customer complains of the weak performance of his systems. He has heard that Connection Templates accelerate traffic. How do you explain to the customer about template restrictions and how to verify that they are enabled?
Question390: What is a task of the SmartEvent Client?
Question391: If the number of kernel instances for CoreXL shown is 6, how many cores are in the physical machine?
Question392: Which command will erase all CRL's?
Question393: MultiCorp has bought company OmniCorp and now has two active AD domains. How would you deploy Identity Awareness in this environment?
Question394: What are the Smart Provisioning Policy Status indicators?
Question395: To configure the Cluster Control Protocol (CCP) to use Broadcast, the following command is run:
Question396: What step should you take before running migrate_export?
Question397: In a Check Point gateway cluster, are VRRP and ClusterXL mutually exclusive?
Question398: The process _____ complies $FWDIR/CONF/*.W files into machine language.
Question399: Which internal user authentication protocols are supported in SSL VPN?
Question400: Your organization has many VPN-1 Edge gateways at various branch offices, to allow VPN-1 Secure Client users to access company resources. For security reasons, your organization's Security Policy requires all Internet traffic initiated behind the VPN-1 Edge gateways first be inspected by your headquarters' VPN-1 Pro Security Gateway.
How do you configure VPN routing in this star VPN Community?
Question401: Which of the following does IPSec use during IPSec key negotiation?
Question402: SmartWorkflow has been enabled with the following configuration:
If a security administrator opens a new session and after making changes to policy, submits the session for approval will be displayed as:
Question403: Which of these components does NOT require a VPN-1 NGX R65 license?
Question404: What type of object may be explicitly defined as a MEP VPN?
Question405: How would you set the debug buffer size to 1024?
Question406: Fill in the blank.
To enter the router shell, use command _____.
Question407: Jack is using SmartEvent and does not see the identities of the users on the events. As an administrator with full access, what does he need to do to fix his issue?
Question408: Your company has the requirement that SmartEvent reports should show a detailed and accurate view of network activity but also performance should be guaranteed. Which actions should be taken to achieve that?
1) Use same hard drive for database directory, log files, and temporary directory.
2) Use Consolidation Rules.
3) Limit logging to blocked traffic only.
4) Use Multiple Database Tables.
Question409: What configuration change must you make to change an existing ClusterXL cluster object from Multicast to Unicast mode?
Question410: Snapshot is available on which Security Management Server and Security Gateway platforms?
Question411: Which of the following is part of the PKI? Select all that apply.
Question412: Which statements about Management HA are correct?
1) Primary SmartCenter describes first installed SmartCenter
2) Active SmartCenter is always used to administrate with SmartConsole
3) Active SmartCenter describes first installed SmartCenter
4) Primary SmartCenter is always used to administrate with SmartConsole
Question413: What type of packet does a VPN-1 SecureClient send to its Policy Server, to report its Secure Configuration Verification status?
Question414: Before upgrading SecurePlatform, you should create a backup.
To save time, many administrators use the command backup.
This creates a backup of the Check Point configuration as well as the system configuration.
An administrator has installed the latest HFA on the system for fixing traffic problems after creating a backup file. There is a mistake in the very complex static routing configuration.
The Check Point configuration has not been changed.
Can the administrator use a restore to fix the errors in static routing?
Question415: Which of these four Check Point QoS technologies prevents the transmission of redundant packets when multiple copies of a packet are concurrently queued on the same flow?
Question416: Which three of the following components are required to get a SmartEvent up and running?
1) SmartEvent SIC
2) SmartEvent Correlation Unit
3) SmartEvent Server
4) SmartEvent Analyzer
5) SmartEvent Client
Question417: In the following cluster configuration; if you reboot sglondon_1 which device will be active when sglondon_1 is back up and running? Why?
Question418: Stephanie wants to reduce the encryption overhead and improve performance for her mesh VPN Community. The Advanced VPN Properties screen below displays adjusted page settings:
What can Stephanie do to achieve her goal?
Question419: Which of the following is the preferred method for adding static routes in GAiA?
Question420: Can the smallest appliance handle all Blades simultaneously?
Question421: What is the command to enter the router shell?
Question422: What is the primary benefit of using upgrade_export over either backup or snapshot?
Question423: Public-key cryptography is considered which of the following?
Question424: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question425: John is configuring a new R77 Gateway cluster but he can not configure the cluster as Third Party IP Clustering because this option is not available in Gateway Cluster Properties. What's happening?
Exhibit:
Question426: Domain name can NOT be changed in Smart Provisioning and Domain Name is grayed out.
What is a possible reason for this?
Question427: The _____ contains the Events Data Base.
Question428: You have selected the event Port Scan from Internal Network in SmartEvent, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?
Question429: To configure a client to properly log in to the user portal using a certificate, the Administrator MUST:
Question430: What is the router command to save your OSPF configuration?
Question431: If you are experiencing LDAP issues, which of the following should you check?
Question432: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question433: The process _____ is responsible for all other security server processes run on the Gateway.
Question434: When, during policy installation, does the atomic load task run?
Question435: You are running R71 and using the new IPS Software Blade.
To maintain the highest level of security, you are doing IPS updates regularly.
What kind of problems can be caused by the automatic updates?
Question436: You run cphaprob -a if. When you review the output, you find the word DOWN. What does DOWN mean?
Question437: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend every couple of months, depending on how frequently you make changes to the network or policy?
Question438: To help organize events, SmartReporter uses filtered queries. Which of the following is NOT an SmartEvent event property you can query?
Question439: Which of the following would be a result of having more than one active Security Management Server in a Management High Availability (HA) configuration?
Question440: Which network port does PPTP use for communication?
Question441: You are preparing to configure your VoIP Domain Gatekeeper object.
Which two other objects should you have created first?
Question442: Match the VPN-related terms with their definitions. Each correct term is only used once.
Exhibit:
Question443: VPN routing can also be configured by editing which file?
Question444: What port is used for communication to the UserCenter with SmartUpdate?
Question445: You need to back up the routing, interface, and DNS configuration information from your R77 GAiA Security Gateway. Which backup-and-restore solution do you use?
Question446: In ClusterXL, which of the following are defined by default as a critical device?
Question447: Why should the upgrade_export configuration file (.tgz) be deleted after you complete the import process?
Question448: What are you required to do before running upgrade_export?
Question449: Which process is responsible for full synchronization in ClusterXL?
Question450: In SmartDirectory, what is each LDAP server called?
Question451: You want to upgrade an NG with Application Intelligence R55 Security Gateway running on SecurePlatform to VPN-1 NGX R65 via SmartUpdate.
Which package(s) is(are) needed in the Repository prior to upgrade?
Question452: A snapshot delivers a complete backup of Secure Platform.
The resulting file can be stored on servers or as a local file in /var/CPsnapshot/snapshots.
How do you restore a local snapshot named MySnapshot.tgz?
Question453: Your current VPN-1 NG with Application Intelligence (AI) R55 stand-alone VPN-1 Pro Gateway and SmartCenter Server runs on SecurePlatform.
You plan to implement VPN-1 NGX R65 in a distributed environment, where the new machine will be the SmartCenter Server, and the existing machine will be the VPN-1 Pro Gateway only.
You need to migrate the NG with AI R55 SmartCenter Server configuration, including licensing.
How do you handle licensing for this NGX R65 upgrade?
Question454: You are using SmartUpdate to fetch data and perform a remote upgrade of an NGX Security Gateway.
Which of the following statements is FALSE?
Question455: If Jack was concerned about the number of log entries he would receive in the SmartReporter system, which policy would he need to modify?
Question456: Refer to Exhibit below:
Match the ClusterXL modes with their configurations.
Question457: Fill in the blank.
Complete this statement. To save interface information before upgrading a Windows Gateway, use command
Question458: Where can a Security Administrator adjust the unit of measurement (bps, Kbps or Bps), for Check Point QoS bandwidth?
Question459: When configuring an LDAP Group object, which option should you select if you want the gateway to reference the groups defined on the LDAP server for authentication purposes?
Question460: How do you block some seldom-used FTP commands, such as CWD, and FIND from passing through the Gateway?
Question461: How could you compare the Fingerprint shown to the Fingerprint on the server? Run cpconfig and select:
Exhibit:
Question462: You just upgraded to R71 and are using the IPS Software Blade.
You want to enable all critical protections while keeping the rate of false positive very low.
How can you achieve this?
Question463: Which service type does NOT invoke a Security Server?
Question464: Check Point Clustering protocol, works on:
Question465: How frequently does CPSIZEME run by default?
Question466: With the User Directory Software Blade, you can create R77 user definitions on a(n) _____ Server.
Question467: Restoring a snapshot-created file on one machine that was created on another requires which of the following to be the same on both machines?
Question468: How can you disable SecureXL via the command line (it does not need to survive a reboot)?
Question469: In a "zero downtime" firewall cluster environment, what command do you run to avoid switching problems around the cluster.
Question470: Which process should you debug if SmartDashboard login fails?
Question471: You have a production implementation of Management High Availability, at version VPN-1 NG with Application Intelligence R55.
You must upgrade your two SmartCenter Servers to VPN-1 NGX. What is the correct procedure?
Question472: When using Captive Portal to send unidentified users to a Web portal for authentication, which of the following is NOT a recommended use for this method?
Question473: Using the output below,why is the QoS rule not limiting the internal users to 2000 Bps of GNU tella traffic?
Question474: Fill in the blank.
To bind a NIC to a single processor when using CoreXL on GAiA, you would use the command
Question475: VPN-1 NGX supports VoIP traffic in all of the following environments, EXCEPT which environment?
Question476: You use the snapshot feature to store your Connector SSL VPN configuration.
What do you expect to find?
Question477: How do you verify a VPN Tunnel Interface (VTI) is configured properly?
Question478: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question479: Which DLP action would describe the following action:
The data transmission event is logged in SmartView Tracker.
Administrators with permission can view the data that was sent. The traffic is passed.
Question480: Included in the client's network are some switches, which rely on IGMP snooping. You must find a solution to work with these switches. Which of the following answers does NOT lead to a successful solution?
Question481: Does Check Point recommend generating an upgrade_export on standby SmartCenters?
Question482: A tracked SmartEvent Candidate in a Candidate Pool becomes an Event. What does NOT happen in the Analyzer Server?
Question483: When you use the Global Properties' default settings on R77, which type of traffic will be dropped if NO explicit rule allows the traffic?
Question484: What happens when an Administrator activates the DLP Portal for Self Incident Handling and enters its fully qualified domain name (DNS name)?
Question485: You need to verify the effectiveness of your IPS configuration for your Web server farm.
You have a colleague run penetration tests to confirm that the Web servers are secure against traffic hijacks.
Of the following, which would be the best configuration to protect from a traffic hijack attempt?
Question486: Which of the following is NOT part of the policy installation process?
Question487: The SmartEvent Server:
Question488: In a R75 Management High Availability (HA) configuration, you can configure synchronization to occur automatically, when:
1) The Security Policy is installed.
2) The Security Policy is saved.
3) The Security Administrator logs in to the seconday Security Management Server and changes its status to Active.
4) A scheduled event occurs.
5) The user data base is installed.
Select the BEST response for the synchronization trigger.
Question489: VPN-1 NGX includes a resource mechanism for working with the Common Internet File System (CIFS).
However, this service only provides a limited level of actions for CIFS security.
Which of the following services is NOT provided by a CIFS resource?
Question490: Which of the following is NOT supported by CoreXL?
Question491: What happens in relation to the CRL cache after a cpstop;spstart has been initiated?
Question492: When upgrading to NGX R65, which Check Point products do not require a license upgrade to be current?
Question493: Which of the following software blades can be used to provide centralized backup management?
Question494: You are running the license_upgrade tool on your SecurePlatform Gateway.
Which of the following can you NOT do with the upgrade tool?
Question495: Fill in the blank.
Type the full cphaprob command and syntax that will show full synchronization status.
Question496: You have installed Secure Platform R76 as Security Gateway operating system. As company requirements changed, you need the VTI features of R76. What should you do?
Question497: A VPN Tunnel Interface (VTI) is defined on GAiA as:
vpn shell interface add numbered 10.10.0.1 10.10.0.2 madrid.cp
What do you know about this VTI?
Question498: Which of the following commands can provide the most complete restore of an R76 configuration?
Question499: Which of the following can NOT approve a change in a SmartWorkflow session?
Question500: Which is NOT a method through which Identity Awareness receives its identities?
Question501: Review the cphaprob state command output from one New Mode High Availability ClusterXL member.
Which member will be active after member 192.168.1.2 fails over and is rebooted?
Question502: State Synchronization is enabled on both members in a cluster, and the Security Policy is successfully installed. No protocols or services have been unselected for selective sync.
Review the fw tab -t connections -soutput from both members. Is State Synchronization working properly between the two members?
Question503: You are preparing computers for a new ClusterXL deployment. For your cluster, you plan to use three machines with the following configurations:
Cluster Member 1: OS - GAiA; NICs - QuadCard; Memory - 1 GB; Security Gateway - version: R71 and primary Security Management Server installed, version: R77 Cluster Member 2: OS - GAiA; NICs - 4 Intel 3Com; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 3: OS - GAiA; NICs - 4 other manufacturers; Memory - 512 MB; Security Gateway only, version: R77 Are these machines correctly configured for a ClusterXL deployment?
Question504: The process that performs the authentication for legacy session authentication is:
Question505: Match the SmartDashboard session status icons with the appropriate SmartWorkflow session status:
Question506: Which of the following are supported with the office mode? Select all that apply.
Question507: Your R76 enterprise Security Management Server is running abnormally on Windows 2008 Server. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings intact (i.e., all Security Policies, databases, SIC, licensing etc.) What is the BEST method to reinstall the Server and keep its critical configuration?
Question508: When configuring a Permanent Tunnel between two gateways in a Meshed VPN community, in what object is the tunnel managed?
Question509: Organizations are sometimes faced with the need to locate cluster members in different geographic locations that are distant from each other. A typical example is replicated data centers whose location is widely separated for disaster recovery purposes. What are the restrictions of this solution?
Question510: Where is the encryption domain for a SmartLSM Security Gateway configured in R71?
Question511: SmartProvisioning uses different types of profiles to manage and provision the gateways.
These types are:
Question512: When using IPS, what does Geo protection do?
Question513: Which of the following statements accurately describes the migrate command?
Question514: Regarding QoS guarantees and limits, which of the following statements is FALSE?
Question515: If both domain-based and route-based VPN's are configured, which will take precedence?
Question516: In a UNIX environment, SmartReporter Data Base settings could be modified in:
Question517: Which operating system is NOT supported by VPN-1 Secure Client?
Question518: You are running a VPN-1 NG with Application Intelligence R54 SecurePlatform VPN-1 Pro Gateway. The Gateway also serves as a Policy Server.
When you run patch add cd from the NGX CD, what does this command allow you to upgrade?
Question519: What is the most common cause for a Quick mode packet 1 failing with the error "No Proposal Chosen" error?
Question520: When restoring a Security Management Server from a backup file, the restore package can be retrieved from which source?
Question521: If no flags are defined during a back up on the Security Management Server, where does the system store the *.tgz file?
Question522: You plan to install a VPN-1 Pro Gateway for VPN-1 NGX at your company's headquarters.
You have a single Sun SPARC Solaris 9 machine for VPN-1 Pro enterprise implementation.
You need this machine to inspect traffic and keep configuration files.
Which Check Point software package do you install?
Question523: In Gaia, the operating system can be changed to 32-bit or 64-bit, provided the processor supports 64-bit.
What command toggles to 64-bit.
Question524: For Management High Availability, if an Active SMS goes down, does the Standby SMS automatically take over?
Question525: When migrating the SmartEvent data base from one server to another, the last step is to save the files on the new server. Which of the following commands should you run to save the SmartEvent data base files on the new server?
Question526: Which of the following can NOT be done on the Management Portal?
Question527: When troubleshooting user authentication, you may see the following entries in a debug of the user authentication process. In which order are these messages likely to appear?
Question528: If a SmartUpdate upgrade or distribution operation fails on SecurePlatform, how is the system recovered?
Question529: You find that Gateway fw2 can NOT be added to the cluster object.
What are possible reasons for that?
Question530: Among the authentication schemes SSL VPN employs for users, which scheme does Check Point recommend so all servers are replicated?
Question531: When does the SmartWorkflow Policy Installation window appear?
Question532: How can you view the critical devices on a cluster member in a Cluster XL environment?
Question533: Which of the following statements is TRUE concerning MEP VPN's?
Question534: How do you control the maximum mail messages in a spool directory?
Question535: Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?
Question536: Which of the following statements accurately describes the upgrade_export command?
Question537: When restoring R77 using the command upgrade_import, which of the following items are NOT restored?
Question538: What physical machine must have access to the UserCenter public IP when checking for new packages with SmartUpdate?
Question539: Which of the following is a TRUE statement concerning contract verification?
Question540: In a Windows environment, SmartReporter Data Base settings could be modified in:
Question541: What is the proper command for importing users into the R77 User Database?
Question542: Select the command set best used to verify proper failover function of a new ClusterXL configuration.
Question543: Which Check Point QoS feature is used to dynamically allocate relative portions of available bandwidth?
Question544: Which of the following is NOT a feature of ClusterXL?
Question545: Remote clients are using IPSec VPN to authenticate via LDAP server to connect to the organization.
Which gateway process is responsible for the authentication?
Question546: Each entry in SmartDirectory has a unique _____.
Question547: Please review the following QoS policy:
Assume you have 200 Kbps bandwidth available at all times.
Which statement would describe this policy?
Question548: Given the following protection detailed and the enforcing gateways list, is the Tool many DNS queries with the RD flag set protection enabled on the Gateway R76?
Please choose the answer with the correct justification.
Question549: What is the default port number for Secure Sockets Layer connections with the LDAP Server?
Question550: What is the default port number for standard TCP connections with the LDAP server?
Question551: You are concerned that the processor for your firewall running NGX R71 Secure Platform may be overloaded. What file would you view to determine the speed of your processor(s)?
Question552: When configuring an LDAP Group object, select option _____ if you want the gateway to reference a specific group defined on the LDAP server for authentication purposes.
Question553: Review the R77 configuration. Is it correct for Management High Availability?
Exhibit:
Question554: Fill in the blank.
In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2 Internal host 10.4.8.108 pings 10.4.8.3, and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. According to the output, which member is the standby machine?
Question555: You are the MegaCorp Security Administrator. This company uses a firewall cluster, consisting of two cluster members. The cluster generally works well but one day you find that the cluster is behaving strangely. You assume that there is a connectivity problem with the cluster synchronization link (cross-over cable). Which of the following commands is the BEST for testing the connectivity of the crossover cable?
Question556: Can you implement a complete R77 IPv6 deployment without IPv4 addresses?
Question557: To run GAiA in 64bit mode, which of the following is true?
1) Run set edition default 64-bit.
2) Install more than 4 GB RAM.
3) Install more than 4 TB of Hard Disk.
Question558: When a security administrator logs in to SmartDashboard and selects Continue without session from the following window,what kind of access will be granted to him in SmartDashboard?
Question559: The following graphic illustrates which command being issued on GaiA?
Exhibit:
Question560: You configure a Check Point QoS Rule Base with two rules: an HTTP rule with a weight of 40, and the Default Rule with a weight of 10. If the only traffic passing through your QoS Module is HTTP traffic, what percent of bandwidth will be allocated to the HTTP traffic?
Question561: Which command will only show the number of entries in the connection table?
Question562: Fill in the blank.
Type the full fw command and syntax that will show full synchronization status.
Question563: When Converting Gateways to Smart LSM Security Gateways, you can:
Question564: David is the MultiCorp Security Manager and approves the proposals submitted by the Security Administrator Peter. One day, David believes he has detected a vulnerability in the Security Policy. He submits a change proposal and tries to approve his own submission. The system does not allow him to perform this procedure.
What is the reason for this behavior?
Question565: Which SmartReporter report type is generated from the SmartView Monitor history file?
Question566: Which Check Point tool allows you to open a debug file and see the VPN packet exchange details.
Question567: The process _____ is responsible for Management High Availability synchronization.
Question568: What command will allow you to disable sync on a cluster firewall member?
Question569: John is the MultiCorp Security Administrator. If he suggests a change in the firewall configuration, he must submit his proposal to David, a security manager. One day David is out of the office and john submits his proposal to peter. Surprisingly, Peter is not able to approve the proposal because the system does not permit him to do so?
Both David and Peter have accounts as administrators in the Security Management server and both have the Read/Write ALL permission. What is the reason for this difference?
Question570: You intend to upgrade a Check Point Gateway from R65 to R76.
To avoid problems, you decide to back up the Gateway.
Which approach allows the Gateway configuration to be completely backed up into a manageable size in the least amount of time?
Question571: Which protocol can be used to provide logs to third-party reporting?
Question572: You are a SSL VPN Administrator. Your users complain that their Outlook Web Access is running extremely slowly, and their overall browsing experience continues to worsen.
You suspect it could be a logging problem.
Which of the following log files does Check Point recommend you purge?
Question573: What could the following regular expression be used for in a DLP rule?
\$([0-9]*,[0-9] [0-9] [0-9]. [0-9] [0-9]
Select the best answer.
Question574: Assuming all connections that are allocated bandwidth in your Check Point QoS Rule Base are open, what would be the corresponding bandwidth percentage of the Kazaa Rule in the following example?
Question575: Which of the following is NOT a SmartEvent Permission Profile type?
Question576: Which of the following explains Role Segregation?
Question577: After you add new interfaces to a cluster, how can you check if the new interfaces and the associated virtual IP address are recognized by ClusterXL?
Exhibit:
Question578: What could be a reason why synchronization between primary and secondary Security Management Servers does not occur?
Question579: In a Cluster, some features such as VPN only function properly when:
Question580: Where do you verify that SmartDirectory is enabled?
Question581: Fill in the blank.
To save your OSPF configuration in GAiA, enter the command _____.
Question582: Which command line interface utility allows the administrator to verify the Security Policy name and timestamp currently installed on a firewall module?
Question583: By default Check Point High Availability components send updates about their state every:
Question584: In GAiA, if one is unsure about a possible command, what command lists all possible commands.
Question585: For an initial installation of Connecter, which of the following statements is TRUE?
Question586: How does ClusterXL Unicast mode handle new traffic?
Question587: DShield is a Check Point feature used to block which of the following threats?
Question588: In a particular IPS protection in R76 in the Logging Settings, what does the Capture Packets option do?
Question589: What does it mean when a Security Gateway is labeled Untrusted in the SmartProvisioning Status view?
Question590: You want only RAS signals to pass through H.323 Gatekeeper and other H.323 protocols, passing directly between end points.
Which routing mode in the VoIP Domain Gatekeeper do you select?
Question591: Your expanding network currently includes ClusterXL running Multicast mode on two members, as shown in this topology:
You need to add interfaces: 10.10.10.1/24 on Member A, and 10.10.10.2/24 on Member B.
The virtual IP address for these interfaces is 10.10.10.3/24. Both cluster gateways have a Quad card with an available eth3 interface. What is the correct procedure to add these interfaces?
Question592: The SmartEvent Client:
Question593: You are trying to configure Directional VPN Rule Match in the Rule Base. But the Match column does not have the option to see the Directional Match. You see the following window. What must you enable to see the Directional Match?
Exhibit:
Question594: How do you upload the results of "CPSIZEME" to Check Point when using a PROXY server with authentication?
Question595: Greg is creating rules and objects to control VoIP traffic in his organization, through a VPN- 1 NGX Security Gateway. Greg creates VoIP Domain SIP objects to represent each of his organization's three SIP gateways. Greg then creates a simple group to contain the VoIP Domain SIP objects. When Greg attempts to add the VoIP Domain SIP objects to the group, they are not listed. What is the problem?
Question596: If you need strong protection for the encryption of user data, what option would be the BEST choice?
Question597: What is not available for Express Reports compared to Standard Reports?
Question598: What is used to validate a digital certificate?
Question599: Exhibit:
From the following output of cphaprob state, which ClusterXL mode is this?
Question600: For proper system operation, the Administrator has to configure the DLP Portal and define its DNS name for which of the following conditions?
Question601: Fill in the blank.
Type the command and syntax that you would use to view the virtual cluster interfaces of a ClusterXL environment.
Question602: What is the significance of the depicted icon in the SmartWorkflow toolbar?
Question603: What is Check Point's CoreXL?
Question604: Based on the following information, which of the statements below is TRUE?
A DLP Rule Base has the following conditions:
Data Type = Large file (> 500KB)
Source = My Organization
Destination = Free Web Mails
Protocol = Any
Action = Ask User
All other rules are set to Detect. User Check is enabled and installed on all client machines.
Question605: Typically, when you upgrade the Security Management Server, you install and configure a fresh R77 installation on a new computer and then migrate the database from the original machine.
What is the correct order of the steps below to successfully complete this procedure?
1) Export databases from source.
2) Connect target to network.
3) Prepare the source machine for export.
4) Import databases to target.
5) Install new version on target.
6) Test target deployment.
Question606: Exhibit:
What cluster mode is represented in this case?
Question607: What are the 3 main components of the SmartEvent Software Blade?
1) Correlation Unit
2) Correlation Client
3) Correlation Server
4) Analyzer Server
5) Analyzer Client
6) Analyzer Unit
Question608: Fill in the blank.
In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. An internal host 10.4.8.108 successfully pings its Cluster and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. Based on this information, what is the active cluster member's IP address?
Question609: What is a possible reason for the grayed out Restore Version button in the screenshot of the Database Revision Control while trying to restore Old Structure?
Question610: After repairing a SmartWorkflow session:
Question611: Which of the following CLISH commands would you use to set the admin user's shell to bash?
Question612: What is the proper CLISH syntax to configure a default route via 192.168.255.1 in GAiA?
Question613: The connection to the ClusterXL member 'A' breaks. The ClusterXL member 'A' status is now 'down'.
Afterwards the switch admin set a port to ClusterXL member 'B' to 'down'. What will happen?
Question614: What tools CANNOT be launched from SmartUpdate NGX R65?
Question615: How many events are shown by default in the Event preview pane?
Question616: How does a standby SmartCenter Server receive logs from all Security Gateways, when an active SmartCenter Server fails over?
Question617: Which Protection Mode does not exist in IPS?
Question618: Your VPN Community includes three Security Gateways. Each Gateway has its own internal network defined as a VPN Domain. You must test the VPN-1 NGX route-based VPN feature, without stopping the VPN. What is the correct order of steps?
Question619: Which of the following files is used to allow only specific IPs or networks to access the Management Portal?
Question620: When migrating the SmartEvent data base from one server to another, the first step is to back up the files on the original server. Which of the following commands should you run to back up the SmartEvent data base?
Question621: You have three Gateways in a mesh community. Each gateway's VPN Domain is their internal network as defined on the Topology tab setting All IP Addresses behind Gateway based on Topology information.
You want to test the route-based VPN, so you created VTIs among the Gateways and created static route entries for the VTIs. However, when you test the VPN, you find out the VPN still go through the regular domain IPsec tunnels instead of the routed VTI tunnels.
What is the problem and how do you make the VPN use the VTI tunnels?
Question622: In ClusterXL, _______ is defined by default as a critical device.
Question623: Which Check Point QoS feature allows a Security Administrator to define special classes of service for delay-sensitive applications?
Question624: You have configured an LDAP account unit and confirmed the Apply & Fetch Branches option works in SSL VPN, but end users still cannot be authenticated.
What is the MOST LIKELY cause?
Question625: If your firewall is performing a lot of IPS inspection and the CPUs assigned to fw_worker_thread are at or near 100%, which of the following could you do to improve performance?
Question626: From the following output of cphaprob state,
Which ClusterXL mode is this?
Question627: Which of the following is NOT a LDAP server option in SmartDirectory?
Question628: What can you do to see the current number of kernel instances in a system with CoreXL enabled?
Question629: If you check the box "Use Aggressive Mode", in the IKE Properties dialog box:
Question630: When you check Web Server in a host-node object, what happens to the host?
Question631: Which of the following is NOT TRUE regarding HTTPS traffic being passed through a DLP gateway?
Question632: Which Security Server can perform authentication tasks, but CANNOT perform content security tasks?
Question633: When two or more DLP rules are matched, the action taken is the most restrictive action.
Rank the following items from the lowest restriction level (1) to the highest (4).
1 . Ask User
2 . Prevent
3 . Detect
4 . Inform User
Question634: Barak is a Security Administrator for an organization that has two sites using pershared secrets in its VPN.
The two sites are Oslo and London. Barak has just been informed that a new office is opening in Madrid, and he must enable all three sites to connect via the VPN to each other. Three Security Gateways are managed by the same SmartCenter Server, behind the Oslo Security Gateway. Barak decides to switch from pershared secrets to Certificates issued by the Internal Certificate Authority (ICA).
After creating the Madrid gateway object with the proper VPN Domain, what are Barak's remaining steps?
1. Disable "PreShared Secret" on the London and Oslo gateway objects
2. Add the Madrid gateway object into the Oslo and London's mesh VPN Community
3. Manually generate ICA Certificates for all three Security Gateways.
4. Configure "Traditional mode VPN configuration" in the Madrid gateway object's VPN screen
5. Reinstall the Security Policy on all three Security Gateways.
Question635: The We-Make-Widgets company has purchased twenty UTM-1 Edge appliances for their remote offices.
Kim decides the best way to manage those appliances is to use SmartProvisioning and create a profile they can all use. List the order of steps Kim would go through to add the Dallas Edge appliance to the Remote Office profile using the output below.
1 . Enter the name of the profile called "Remote Offices"
2 . Change the provisioning profile to "Remote Offices"
3 . Click File, then select New, then Provisioning Profile
4 . Click on the Devices Tab
5 . Highlight the Dallas Edge appliance, click Edit, then edit Gateway
6 . Click on the Profiles Tab
Question636: You are preparing computers for a new ClusterXL deployment.
For your cluster, you plan to use four machines with the following configurations:
Cluster Member 1: OS:Secure Platform, NICs: QuadCard, memory: 1 GB, Security Gateway only, version:
R76
Cluster Member 2: OS:Secure Platform, NICs: 4 Intel 3Com, memory: 1 GB, Security Gateway only, version: R76 Cluster Member 3: OS:Secure Platform, NICs: 4 other manufacturers, memory: 512 MB, Security Gateway only, version: R76 Security Management Server: MS Windows 2003, NIC. Intel NIC (1), Security Gateway and primary Security Management Server installed, version: R76 Are these machines correctly configured for a ClusterXL deployment?
Question637: With is the SmartEvent Correlation Unit's function?
Question638: Which Check Point product implements a Consolidation Policy?
Question639: Which of the following is a supported Sticky Decision Function of Sticky Connections for Load Sharing?
Question640: Cody is notified by blacklist.org that his site has been reported as a spam relay, due to his SMTP Server being unprotected. Cody decides to implement an SMTP Security Server, to prevent the server from being a spam relay.
Which of the following is the most efficient configuration method?
Question641: What tool exports the Management Configuration into a single file?
Question642: The Security Gateway is installed on SecurePlatform R77. The default port for the Web User Interface is
____________.
Question643: Due to some recent performance issues, you are asked to add additional processors to your firewall. If you already have CoreXL enabled, how are you able to increase Kernel instances?
Question644: Fill in the blank.
Type the command and syntax to view critical devices on a cluster member in a ClusterXL environment.
Question645: Which of the following commands can be used to troubleshoot ClusterXL sync issues?
Question646: Which of the following commands will stop acceleration on a Security Gateway running on Secure Platform?
Question647: A Smart ProvisioningGateway could be a member of which VPN communities?
(i) Center In Star Topology
(ii) Satellite in Star Topology
(iii) Carter in Remote Access Community
(iv) Meshed Community
Question648: When a packet is flowing through the security gateway, which one of the following is a valid inspection path?
Question649: Your company has two headquarters, one in London, one in New York. Each headquarters includes several branch offices. The branch offices only need to communicate with the headquarters in their country, not with each other, and only the headquarters need to communicate directly. What is the BEST configuration for VPN Communities among the branch offices and their headquarters, and between the two headquarters?
VPN Communities comprised of:
Question650: Choose the BEST sequence for configuring user management in SmartDashboard, using an LDAP server.
Question651: Jacob is using a mesh VPN Community to create a site-to-site VPN. The VPN properties in this mesh Community display in this graphic:
Which of the following statements is TRUE?
Question652: Which three of the following are ClusterXL member requirements?
1) same operating systems
2) same Check Point version
3) same appliance model
4) same policy
Question653: A cluster contains two members, with external interfaces 172.28.108.1 and 172.28.108.2. The internal interfaces are 10.4.8.1 and 10.4.8.2. The external cluster's IP address is 172.28.108.3, and the internal cluster's IP address is 10.4.8.3. The synchronization interfaces are 192.168.1.1 and 192.168.1.2. The Security Administrator discovers State Synchronization is not working properly, cphaprob if command output displays as follows:
What is causing the State Synchronization problem?
Question654: A snapshot delivers a complete backup of GAiA. How do you restore a local snapshot named MySnapshot.tgz?
Question655: Which command would you use to save the routing information before upgrading a Windows Gateway?
Question656: Which of the following log files contains verbose information regarding the negotiation process and other encryption failures?
Question657: When a failed cluster member recovers, which of the following actions is NOT taken by the recovering member?
Question658: The _____ Check Point ClusterXL mode must synchronize the virtual IP and MAC addresses on all clustered interfaces.
Question659: What Shell is required in Gaia to use WinSCP?
Question660: You are reviewing SmartView Tracker entries, and see a Connection Rejection on a Check Point QoS rule.
What causes the Connection Rejection?
Question661: An administrator has installed the latest HFA on the system for fixing traffic problems after creating a backup file. A large number of routes were added or modified, causing network problems. The Check Point configuration has not been changed. What would be the most efficient way to revert to a working configuration?
Question662: When distributing IPSec packets to gateways in a Load Sharing Multicast mode cluster, which valid Load Sharing method will consider VPN information?
Question663: How do new connections get established through a Security Gateway with SecureXL enabled?
Question664: Which of the following does NOT happen when using Pivot Mode in ClusterXL?
Question665: What is the SmartEvent Analyzer's function?
Question666: Which of the following commands do you run on the AD server to identify the DN name before configuring LDAP integration with the Security Gateway?
Question667: Which is NOT a valid option when upgrading Cluster Deployments?
Question668: Which technology is responsible for assembling packet streams and passing ordered data to the protocol parsers in IPS?
Question669: Refer to the to the network topology below.
You have IPS software Blades active on security Gateways sglondon, sgla, and sgny, but still experience attacks on the Web server in the New York DMZ. How is this possible?
Question670: What is a requirement for setting up Management High Availability?
Question671: You want to verify that your Check Point cluster is working correctly.
Which command line tool can you use?
Question672: A Zero Downtime Upgrade of a cluster:
Question673: Match the Best Management High Availability synchronization-status descriptions for your Security Management Server (SMS):
Question674: The following diagram illustrates how a VPN-1 SecureClient user tries to establish a VPN with hosts in the external_net and internal_net from the Internet.
How is the Security Gateway VPN Domain created?
Question675: In a "zero downtime" scenario, which command do you run manually after all cluster members are upgraded?
Question676: Which of the following is an example of the hash function?
Question677: In the following command,
LSMcli [-d] <server><user><pswd><action> "server"
should be replaced with:
Question678: An Account Unit is the interface between the _____ and the _____.
Question679: Fill in the blank.
To verify the SecureXL status, you would enter command _____.
Question680: Which encryption scheme provides in-place encryption?
Question681: Your network includes ClusterXL running Multicast mode on two members, as shown in this topology: Your network is expanding, and you need to add new interfaces:
1 0.10.10.1/24 on Member A, and 10.10.10.2/24 on Member B.
The virtual IP address for interface 10.10.10.0/24 is 10.10.10.3.
What is the correct procedure to add these interfaces?
Question682: Fill in the blank.
To view the number of concurrent connections going through core 0 on the firewall, you would use the command and syntax _____ _____ _____ _____ _____ _____ _____.
Question683: Which Security Servers can perform Content Security tasks, but CANNOT perform authentication tasks?
Question684: You must set up SIP with a proxy for your network. IP phones are in the 172.16.100.0 network.
The Registrar and proxy are installed on host 172.16.100.100.
To allow handover enforcement for outbound calls from SIP-net to network Net_B on the Internet, you have defined the following objects:
Network object: SIP-net: 172.16.100.0/24
SIP-gateway: 172.16.100.100
VoIP Domain object: VolP_domain_A
1 .Endpoint domain: SIP-net
2 .VoIP gateway installed at: SIP-gateway host object
How would you configure the rule?
Question685: Fill in the blank.
Write the full fw command and syntax that you would use to troubleshoot ClusterXL sync issues.
Question686: Rachel is the Security Administrator for a university. The university's FTP servers have old hardware and software. Certain FTP commands cause the FTP servers to malfunction.
Upgrading the FTP servers is not an option at this time.
Which of the following options will allow Rachel to control which FTP commands pass through the Security Gateway protecting the FTP servers?
Question687: The SmartEvent Server:
Question688: What is the purpose of the pre-defined exclusions included with SmartEvent R77?
Question689: Which of the following methods will provide the most complete backup of an R77 configuration?
Question690: Which process is responsible for kernel table information sharing across all cluster members?
Question691: What is the reason for the following error?
Exhibit:
Question692: When defining SmartDirectory for High Availability (HA), which of the following should you do?
Question693: You find that Gateway fw2 can NOT be added to the cluster object.
What are possible reasons for that?
1) fw2 is a member in a VPN community.
2) ClusterXL software blade is not enabled on fw2.
3) fw2 is a DAIP Gateway.
Question694: Your current VPN-1 NG with Application Intelligence (Al) R55standalone VPN-1 Pro Gateway and SmartCenter Server run on SecurePlatform.
You plan to implement VPN-1 NGX in a distributed environment, where the existing machine will be the SmartCenter Server, and a new machine will be the VPN-1 Pro Gateway only.
You need to migrate the NG with Al R55 SmartCenter Server configuration, including such items as Internal Certificate Authority files, databases, and Security Policies.
How do you request a new license for this VPN-1 NGX upgrade?
Question695: You have installed a R77 Security Gateway on GAiA. To manage the Gateway from the enterprise Security Management Server, you create a new Gateway object and Security Policy.
When you install the new Policy from the Policy menu, the Gateway object does not appear in the Install Policy window as a target. What is the problem?
Question696: When using ClusterXL in Load Sharing, what is the default sharing method based on?
Question697: When using SmartDashboard to manage existing users in SmartDirectory, when are the changes applied?
Question698: The process that performs the authentication for Smart Dashboard is:
Question699: You need to back up the routing, interface, and DNS configuration information from your R76 Secure Platform Security Gateway. Which backup-and-restore solution do you use?
Question700: Which type of service should a Security Administrator use in a Rule Base to control access to specific shared partitions on target machines?
Question701: Your organization maintains several IKE VPN's. Executives in your organization want to know which mechanism Security Gateway R77 uses to guarantee the authenticity and integrity of messages. Which technology should you explain to the executives?
Question702: The process that performs the authentication for Remote Access is:
Question703: Your customer asks you about Check Point SmartWorkflow. His company must comply with various laws and regulations and therefore it is important for him to be able to see the changes made to a specific object.
How can the customer receive the required information?
Question704: Which of the following is supported with Office Mode?
Question705: Where is the ideal place to deploy your SSL VPN?
Question706: There are several SmartDirectory (LDAP) features that can be applied to further enhance SmartDirectory (LDAP) functionality, which of the following is NOT one of those features?
Question707: Which components allow you to reset a VPN tunnel?
Question708: When do modifications to the Event Policy take effect?
Question709: _____ is the called process that starts when opening SmartView Tracker application.
Question710: Which command would you use to save the interface information before upgrading a GAiA Gateway?
Question711: Jon is explaining how the inspection module works to a colleague. If a new connection passes through the inspection module and the packet matches the rule, what is the next step in the process?
Question712: Fill in the blank.
In Load Sharing Unicast mode, the internal cluster IP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2. Internal host 10.4.8.108 Pings 10.4.8.3, and receives replies. The following is the ARP table from the internal Windows host 10.4.8.108.
Review the exhibit and type the IP address of the member serving as the pivot machine in the space below.
Question713: One profile in SmartProvisioning can update:
Question714: Which CLI tool helps on verifying proper ClusterXL sync?
Question715: By default, the Cluster Control Protocol (CCP) uses this to send delta sync messages to other cluster members.
Question716: You are configuring the VoIP Domain object for a Skinny Client Control Protocol (SCCP) environment protected by VPN-1 NGX. Which VoIP Domain object type can you use?
Question717: You are a SSL VPN administrator. Your users complain that their Outlook Web Access is running extremely slowly, and their overall browsing experience continues to worsen.
You suspect it could be a logging problem.
Which of the following logs does Check Point recommend you turn off?
Question718: A Security Administrator opens a new session, makes changes to the policy and submits the session for approval. The Security Manager may approve the session or request repair. If a manager opens a new session and submits it for approval, can he approve his session as a Security Manager?
Question719: Which process is responsible for delta synchronization in ClusterXL?
Question720: How do you check the version of "CPSIZEME" on GAiA?
Question721: Review the Rule Base displayed.
For which rules will the connection templates be generated in SecureXL?
Question722: For object-based VPN routing to succeed, what must be configured?
Question723: MicroCorp experienced a security appliance failure. (LEDs of all NICs are off.) The age of the unit required that the RMA-unit be a different model. Will a revert to an existing snapshot bring the new unit up and running?
Question724: Problems sometimes occur when distributing IPSec packets to a few machines in a Load Sharing Multicast mode cluster, even though the machines have the same source and destination IP addresses. What is the best Load Sharing method for preventing this type of problem?
Question725: A Threat Prevention profile is a set of configurations based on the following. Select the right answer.
Question726: _____ is NOT an SmartEvent event-triggered Automatic Reaction.
Question727: You want VPN traffic to match packets from internal interfaces. You also want the traffic to exit the Security Gateway bound for all site-to-site VPN Communities, including Remote Access Communities. How should you configure the VPN match rule?