Question1: Provisioning Profiles can NOT be applied to:
Question2: The following diagram illustrates how a VPN-1 SecureClient user tries to establish a VPN with hosts in the external_net and internal_net from the Internet.
How is the Security Gateway VPN Domain created?
Question3: Assuming all connections that are allocated bandwidth in your Check Point QoS Rule Base are open, what would be the corresponding bandwidth percentage of the Kazaa Rule in the following example?
Question4: How are cached usernames and passwords cleared from the memory of a Security Gateway?
Question5: Where can a Security Administrator adjust the unit of measurement (bps, Kbps or Bps), for Check Point QoS bandwidth?
Question6: If ClusterXL Load Sharing is enabled with state synchronization enabled, what will happen if one member goes down?
Question7: Which of the following uses the same key to decrypt as it does to encrypt?
Question8: Which is NOT a method through which Identity Awareness receives its identities?
Question9: You want to upgrade an NG with Application Intelligence R55 Security Gateway running on SecurePlatform to VPN-1 NGX R65 via SmartUpdate.
Which package(s) is(are) needed in the Repository prior to upgrade?
Question10: When restoring a Security Management Server from a backup file, the restore package can be retrieved from which source?
Question11: The process _____ is responsible for GUIClient communication with the SmartCenter.
Question12: What is the benefit to running SmartEvent in Learning Mode?
Question13: Fill in the blank.
Type the full cphaprob command and syntax that will show full synchronization status.
Question14: Which of the following is a valid Active Directory designation for user John Doe in the Sales department of AcmeCorp.com?
Question15: SmartProvisioning uses different types of profiles to manage and provision the gateways.
These types are:
Question16: When, during policy installation, does the atomic load task run?
Question17: Which of the following statements accurately describes the migrate command?
Question18: MegaCorp has two different types of hardware with Check Point GAiA installed and set up as gateways.
The Administrator wants to provide redundancy in case one of them fails. Choose the best approach.
Question19: What action CANNOT be run from SmartUpdate NGX R65?
Question20: Fill in the blank with a numeric value. The default port number for Secure Sockets Layer (SSL) connections with the LDAP Server is
Question21: The We-Make-Widgets company has purchased twenty UTM-1 Edge appliances for their remote offices.
Kim decides the best way to manage those appliances is to use SmartProvisioning and create a profile they can all use. List the order of steps Kim would go through to add the Dallas Edge appliance to the Remote Office profile using the output below.
1 . Enter the name of the profile called "Remote Offices"
2 . Change the provisioning profile to "Remote Offices"
3 . Click File, then select New, then Provisioning Profile
4 . Click on the Devices Tab
5 . Highlight the Dallas Edge appliance, click Edit, then edit Gateway
6 . Click on the Profiles Tab
Question22: Your expanding network currently includes ClusterXL running Multicast mode on two members, as shown in this topology:
You need to add interfaces: 10.10.10.1/24 on Member A, and 10.10.10.2/24 on Member B The virtual IP address for these interfaces is 10.10.10.3/24. Both cluster gateways have a Quad card with an available eth3 interface. What is the correct procedure to add these interfaces?
Question23: Which command would you use to save the interface information before upgrading a GAiA Gateway?
Question24: Your organization maintains several IKE VPN's. Executives in your organization want to know which mechanism Security Gateway R77 uses to guarantee the authenticity and integrity of messages. Which technology should you explain to the executives?
Question25: Which application is used to create a File-Share Application?
Question26: Match the ClusterXL modes with their configurations.
Exhibit:
Question27: What physical machine must have access to the UserCenter public IP when checking for new packages with SmartUpdate?
Question28: Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?
Question29: In cryptography, the Rivest, Shamir, Adelman (RSA) scheme has which of the following? Select all that apply.
Question30: MegaCorps' disaster recovery plan is past due for an update to the backup and restore section to enjoy the benefits of the new distributed R77 installation. You must propose a plan that meets the following required and desired objectives:
Required: Security Policy repository must be backed up no less frequently than every 24 hours.
Desired: Back up R77 components enforcing the Security Policies at least once a week.
Desired: Back up R77 logs at least once a week.
You develop a disaster recovery plan proposing the following:
Use the utility cron to run the command upgrade_export each night on the Security Management
Servers.
Configure the organization's routine backup software to back up files created by the command
upgrade_export.
Configure GAiA back up utility to back up Security Gateways every Saturday night.
Use the utility cron to run the command upgrade_export each Saturday night on the log servers.
Configure an automatic, nightly logswitch.
Configure the organization's routine back up software to back up the switched logs every night.
The corporate IT change review committee decides your plan:
Question31: Which of the following would be a result of having more than one active Security Management Server in a Management High Availability (HA) configuration?
Question32: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question33: Where is it necessary to configure historical records in SmartView Monitor to generate Express reports in SmartReporter?
Question34: John is the MegaCorp Security Administrator, and is using Check Point R71. Malcolm is the Security Administrator of a partner company and is using a different vendor's product and both have to build a VPN tunnel between their companies. Both are using clusters with Load Sharing for their firewalls and John is using ClusterXL as a Check Point clustering solution.
While trying to establish the VPN, they are constantly noticing problems and the tunnel is not stable and then Malcolm notices that there seems to be 2 SPIs with the same IP from the Check Point site. How can they solve this problem and stabilize the tunnel?
Question35: A Security Administrator opens a new session, makes changes to the policy and submits the session for approval. The Security Manager may approve the session or request repair. If a manager opens a new session and submits it for approval, can he approve his session as a Security Manager?
Question36: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question37: Fill in the blank.
MultiCorp is located in Atlanta. It has a branch office in Europe, Asia, and Africa. Each location has its own AD controller for local user login. How many ADqueries have to be configured?
Question38: How do you check the version of "CPSIZEME" on GAiA?
Question39: You have to uninstall the Check Point SmartWorkflow Software Blade on a Secure Platform system. How can you perform this procedure?
Question40: Each entry in SmartDirectory has a unique _____.
Question41: The Management Portal Software Blade allows users to
Question42: You have selected the event Port Scan from Internal Network in SmartEvent, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?
Question43: Which process is responsible for delta synchronization in ClusterXL?
Question44: You are running the license_upgrade tool on your SecurePlatform Gateway.
Which of the following can you NOT do with the upgrade tool?
Question45: Your users are defined in a Windows 2008 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R77?
Question46: If Jack was concerned about the number of log entries he would receive in the SmartReporter system, which policy would he need to modify?
Question47: To help organize events, SmartReporter uses filtered queries. Which of the following is NOT an SmartEvent event property you can query?
Question48: What could the following regular expression be used for in a DLP rule?
\$([0-9]*,[0-9] [0-9] [0-9]. [0-9] [0-9]
Select the best answer.
Question49: When synchronizing clusters, which of the following statements are true? Select all that apply.
Question50: Which protocol can be used to provide logs to third-party reporting?
Question51: _____ is a proprietary Check Point protocol. It is the basis for Check Point ClusterXL inter-module communication.
Question52: You have just upgraded your Load Sharing gateway cluster (both members) from NGX R65 to R77.
cphaprob stat shows:
Cluster Mode: New High Availability (Active Up)
Member Unique Address Assigned Load State
1 (local) 172.16.185.21 100% Active
2 172.16.185.22 0% Ready
Which of the following is NOT a possible cause of this?
Question53: In Management High Availability, what is an Active SMS?
Question54: Your customer wishes to install the SmartWorkflow Software Blade on a R70 Security Management server (Secure Platform).
Which is the correct method?
Question55: Using SmartProvisioning Profiles, which of the following could be configured for both Secure Platform and UTM-1 Edge devices?
(i) Backup
(ii) Routing
(iii) Interfaces
(iv) Hosts
(v) NTP server
(vi) DNS
Question56: If using AD Query for seamless identity data reception from Microsoft Active Directory (AD), which of the following methods is NOT Check Point recommended?
Question57: Damon enables an SMTP resource for content protection.
He notices that mail seems to slow down on occasion, sometimes being delivered late.
Which of the following might improve throughput performance?
Question58: Wayne configures an HTTP Security Server to work with the content vectoring protocol to screen forbidden sites. He has created a URI resource object using CVP with the following settings:
Use CVP
Allow CVP server to modify content
Return data after content is approved
He adds two rules to his Rule Base: one to inspect HTTP traffic going to known forbidden sites, the other to allow all other HTTP traffic.
Wayne sees HTTP traffic going to those problematic sites is not prohibited.
What could cause this behavior?
Question59: A snapshot delivers a complete backup of GAiA. How do you restore a local snapshot named MySnapshot.tgz?
Question60: Fill in the blank.
In a zero downtime scenario, which command do you run manually after all cluster members are upgraded?
Question61: What is the best method for scheduling backup's on multiple firewalls?
Question62: Jerry is concerned that a denial-of-service (DoS) attack may affect his VPN Communities. He decides to implement IKE DoS protection. Jerry needs to minimize the performance impact of implementing this new protection.
Which of the following configurations is MOST appropriate for Jerry?
Question63: Laura notices the Microsoft Visual Basic Bits Protection is set to inactive. She wants to set the Microsoft Visual Basic Kill Bits Protection and all other Low Performance Impact Protections to Prevent. She asks her manager for approval and stated she can turn theses on.
But he wants Laura to make sure no high Performance Impacted Protections are turned on while changing this setting.
Using the out below, how would Laura change the Default_Protection on Performance Impact Protections classified as low from inactive to prevent until meeting her other criteria?
Question64: To change the default port of the Management Portal:
Question65: Your current stands alone VPN-1 NG with Application Intelligence (Al) R55 installation is running on SecurePlatform. You plan to implement VPN-1 NGX in a distributed environment, where the existing machine will be the VPN-1 Pro Gateway. An additional machine will serve as the SmartCenter Server. The new machine runs on a Windows Server 2003.
You need to upgrade the NG with Al R55 SmartCenter Server configuration to VPN-1 NGX.
How do you upgrade to VPN-1 NGX?
Question66: Which network port does PPTP use for communication?
Question67: What tools CANNOT be launched from SmartUpdate NGX R65?
Question68: Which VPN Community object is used to configure VPN routing within the SmartDashboard?
Question69: What is the command to upgrade an NG with Application Intelligence R55 Smart Center running on SecurePlatform to VPN-1 NGX R65?
Question70: By default, what happens to the existing connections on a firewall when a new policy is installed?
Question71: What happens when an Administrator activates the DLP Portal for Self Incident Handling and enters its fully qualified domain name (DNS name)?
Question72: Where multiple SmartDirectory servers exist in an organization, a query from one of the clients for user information is made to the servers based on a priority. By what category can this priority be defined?
Question73: What type of object may be explicitly defined as a MEP VPN?
Question74: What is the supported ClusterXL configuration when configuring a cluster synchronization network on a VLAN interface?
Question75: VPN access control would fall under which VPN component?
Question76: How would you configure a rule in a Security Policy to allow SIP traffic from end point Net_Ato end point Net_B, through an NGX Security Gateway?
Question77: The Management Portal allows all of the following EXCEPT:
Question78: The process _____ is responsible for all other security server processes run on the Gateway.
Question79: Fill in the blank.
Write the full fw command and syntax that you would use to troubleshoot ClusterXL sync issues.
Question80: The following rule contains an FTP resource object in the Service field:
Source: local_net
Destination: Any
Service: FTP-resource object
Action: Accept
How do you define the FTP Resource Properties > Match tab to prevent internal users from receiving corporate files from external FTP servers, while allowing users to send files?
Question81: Which Name Resolution protocols are supported in SSL VPN?
Question82: Which command will only show the number of entries in the connection table?
Question83: Security server configuration settings are stored in _____.
Question84: Which of the following methods will provide the most complete backup of an R77 configuration?
Question85: The file snapshot generates is very large, and can only be restored to:
Question86: You want to upgrade a SecurePlatform NG with Application Intelligence (Al) R55 Gateway to SecurePlatform NGX R60 via SmartUpdate.
Which package is needed in the repository before upgrading?
Question87: Which three of the following are ClusterXL member requirements?
1) same operating systems
2) same Check Point version
3) same appliance model
4) same policy
Question88: Fill in the blank.
In a zero downtime firewall cluster environment, what command syntax do you run to avoid switching problems around the cluster for command cphaconf?
Question89: In the following cluster configuration; if you reboot sglondon_1 which device will be active when sglondon_1 is back up and running? Why?
Question90: Typically, when you upgrade the Security Management Server, you install and configure a fresh R77 installation on a new computer and then migrate the database from the original machine.
What is the correct order of the steps below to successfully complete this procedure?
1) Export databases from source.
2) Connect target to network.
3) Prepare the source machine for export.
4) Import databases to target.
5) Install new version on target.
6) Test target deployment.
Question91: Which of the following is part of the PKI? Select all that apply.
Question92: Your company has two headquarters, one in London, one in New York. Each headquarters includes several branch offices. The branch offices only need to communicate with the headquarters in their country, not with each other, and only the headquarters need to communicate directly. What is the BEST configuration for VPN Communities among the branch offices and their headquarters, and between the two headquarters?
VPN Communities comprised of:
Question93: What access level cannot be assigned to an Administrator in SmartEvent?
Question94: You plan to install a VPN-1 Pro Gateway for VPN-1 NGX at your company's headquarters.
You have a single Sun SPARC Solaris 9 machine for VPN-1 Pro enterprise implementation.
You need this machine to inspect traffic and keep configuration files.
Which Check Point software package do you install?
Question95: MegaCorp plans to upgrade all of its firewalls. Currently the corporation is a mixture of SecurePlatform and IPSO machines running R71, to the latest code level of GAiA. Many of the firewalls are using VTIs to allow advanced routing configuration to propagate through all the networks. What will the Acme company need to do to make sure VTIs will work once moved to GAiA?
Question96: When distributing IPSec packets to gateways in a Load Sharing Multicast mode cluster, which valid Load Sharing method will consider VPN information?
Question97: How is change approved for implementation in SmartWorkflow?
Question98: MegaCorp is using SmartCenter Server with several gateways. Their requirements result in a heavy log load. Would it be feasible to add the SmartEvent Correlation Unit and SmartEvent Server to their SmartCenter Server?
Question99: In ClusterXL, _____ is defined by default as a critical device.
Question100: What proprietary Check Point protocol is the basis of the functionality of Check Point ClusterXL inter- module communication?
Question101: You are preparing to configure your VoIP Domain Gatekeeper object.
Which two other objects should you have created first?
Question102: Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?
Question103: Which is NOT a valid option when upgrading Cluster Deployments?
Question104: Which protocol is not supported for DLP?
Question105: Check Point New Mode HA is a(n) _____ solution.
Question106: Which of the following are valid reasons for beginning with a fresh installation VPN-1 NGX R65, instead of upgrading a previous version to VPN-1 NGX R65? Select all that apply.
Question107: Anytime a client initiates a connection to a server, the firewall kernel signals the FWD process using a trap.
FWD spawns the _____ child service, which runs the security server.
Question108: Fill in the blank.
To verify the SecureXL status, you would enter command _____.
Question109: In a Check Point gateway cluster, are VRRP and ClusterXL mutually exclusive?
Question110: What is the lowest possible version a Security Gateway may be running in order to use it as an LSM enabled Gateway?
Question111: Which three of the following components are required to get a SmartEvent up and running?
1) SmartEvent SIC
2) SmartEvent Correlation Unit
3) SmartEvent Server
4) SmartEvent Analyzer
5) SmartEvent Client
Question112: John is upgrading a cluster from NGX R65 to R77. John knows that you can verify the upgrade process using the pre-upgrade verifier tool. When John is running Pre-Upgrade Verification, he sees the warning message:
Title: Incompatible pattern.
What is happening?
Question113: What can be said about RSA algorithms? Select all that apply.
Question114: If you need strong protection for the encryption of user data, what option would be the BEST choice?
Question115: Mark the configuration options that are available for Data Loss Prevention in R71.
Question116: In a Windows environment, SmartReporter Data Base settings could be modified in:
Question117: Fill in the blank.
Complete this statement. To save interface information before upgrading a Windows Gateway, use command
Question118: You set up a mesh VPN Community, so your internal networks can access your partner's network, and vice versa. Your Security Policy encrypts only FTP and HTTP traffic through a VPN tunnel. All other traffic among your internal and partner networks is sent in clear text.
How do you configure the VPN Community?
Question119: What is used to validate a digital certificate?
Question120: Which of the following does IPSec use during IPSec key negotiation?
Question121: By default Check Point High Availability components send updates about their state every:
Question122: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question123: Public-key cryptography is considered which of the following?
Question124: Which of the following commands do you run on the AD server to identify the DN name before configuring LDAP integration with the Security Gateway?
Question125: For object-based VPN routing to succeed, what must be configured?
Question126: Which of the following files is used to allow only specific IPs or networks to access the Management Portal?
Question127: Fred is troubleshooting a NAT issue and wants to check to see if the inbound connection from this internal network is being translated across the interface in the firewall correctly. He decides to use the fw monitorto capture the traffic from the source 192.168.3.5 or the destination of 10.1.1.25 on his Security Gateway. Green that has an IP of 192.168.4.5. What command captures this traffic in a file that he can download and review with WireShark?
Question128: Which file defines the fields for each object used in the file objects.C (color, num/string, default value...)?
Question129: You have an internal FTP server, and you allow downloading, but not uploading.
Assume Network Address Translation is set up correctly, and you want to add an inbound rule with:
Source: Any
Destination: FTP server
Service: FTP resources object.
How do you configure the FTP resource object and the action column in the rule to achieve this goal?
Question130: What is the significance of the depicted icon in the SmartWorkflow toolbar?
Question131: Your organization has many VPN-1 Edge gateways at various branch offices, to allow VPN-1 Secure Client users to access company resources. For security reasons, your organization's Security Policy requires all Internet traffic initiated behind the VPN-1 Edge gateways first be inspected by your headquarters' VPN-1 Pro Security Gateway.
How do you configure VPN routing in this star VPN Community?
Question132: Which Check Point product implements a Consolidation Policy?
Question133: Which encryption scheme provides in-place encryption?
Question134: Which of the following is an example of the hash function?
Question135: You are responsible for the IPS configuration of your Check Point firewall. Inside the Denial of service section you need to set the protection parameters against the Teardrop attack tool with high severity. How would you characterize this attack tool? Give the BEST answer.
Question136: Which process is responsible for full synchronization in ClusterXL?
Question137: How does a standby SmartCenter Server receive logs from all Security Gateways, when an active SmartCenter Server fails over?
Question138: When configuring an LDAP Group object, select the option _____ if you want the gateway to reference all groups defined on the LDAP server for authentication purposes.
Question139: Fill in the blank.
In Load Sharing Unicast mode, the internal cluster IP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2. Internal host 10.4.8.108 Pings 10.4.8.3, and receives replies. The following is the ARP table from the internal Windows host 10.4.8.108.
Review the exhibit and type the IP address of the member serving as the pivot machine in the space below.
Question140: Fill in the blank.
To provide full connectivity upgrade status, use command _____
Question141: Which of the following access options would you NOT use when configuring Captive Portal?
Question142: Your customer wishes to use SmartWorkflow Software Blade, but he also wishes to install a policy during an emergency without an approval. Is it possible?
Question143: Where do you verify that SmartDirectory is enabled?
Question144: Which of the following CLISH commands would you use to set the admin user's shell to bash?
Question145: What port is used for communication to the UserCenter with SmartUpdate?
Question146: The "MAC Magic" value must be modified under the following condition:
Question147: MEP VPN's use the Proprietary Probing Protocol to send special UDP RDP packets to port ____ to discover if an IP is accessible.
Question148: David wants to manage hundreds of gateways using a central management tool. What tool would David use to accomplish his goal?
Question149: What is a possible reason for the grayed out Restore Version button in the screenshot of the Database Revision Control while trying to restore Old Structure?
Question150: Fill in the blank.
The command useful for debugging by capturing packet information, including verifying LDAP authentication on all Check Point platforms is _______
Question151: MultiCorp has bought company OmniCorp and now has two active AD domains. How would you deploy Identity Awareness in this environment?
Question152: A Minimal Effort Upgrade of a cluster:
Question153: When you add a resource service to a rule, which ONE of the following actions occur?
Question154: How do you control the maximum mail messages in a spool directory?
Question155: You are using SmartUpdate to fetch data and perform a remote upgrade of an NGX Security Gateway.
Which of the following statements is FALSE?
Question156: You are preparing computers for a new ClusterXL deployment. For your cluster, you plan to use three machines with the following configurations:
Cluster Member 1: OS - GAiA; NICs - QuadCard; Memory - 1 GB; Security Gateway - version: R71 and primary Security Management Server installed, version: R77 Cluster Member 2: OS - GAiA; NICs - 4 Intel 3Com; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 3: OS - GAiA; NICs - 4 other manufacturers; Memory - 512 MB; Security Gateway only, version: R77 Are these machines correctly configured for a ClusterXL deployment?
Question157: What's true about Troubleshooting option in the IPS profile properties?
Question158: You start the configuration of SmartWorkflow. SmartWorkflow is enabled, but you are not able to select Open New Session because it is greyed out.
What must be done to open a new session? Choose the BEST answer.
Question159: Why should the upgrade_export configuration file (.tgz) be deleted after you complete the import process?
Question160: Jon is explaining how the inspection module works to a colleague. If a new connection passes through the inspection module and the packet matches the rule, what is the next step in the process?
Question161: How many events are shown by default in the Event preview pane?
Question162: When two or more DLP rules are matched, the action taken is the most restrictive action.
Rank the following items from the lowest restriction level (1) to the highest (4).
1 . Ask User
2 . Prevent
3 . Detect
4 . Inform User
Question163: In ClusterXL, which of the following processes are defined by default as critical devices?
Question164: To back up all events stored in the SmartEvent Server, you should back up the contents of which folder(s)?
Question165: By default, the Cluster Control Protocol (CCP) uses this to send delta sync messages to other cluster members.
Question166: Included in the customer's network are some firewall systems with the Performance Pack in use. The customer wishes to use these firewall systems in a cluster (Load Sharing mode). He is not sure if he can use the Sticky Decision Function in this cluster. Explain the situation to him.
Question167: When configuring site-to-site VPN High Availability (HA) with MEP, which of the following is correct?
Question168: Which type of service should a Security Administrator use in a Rule Base to control access to specific shared partitions on target machines?
Question169: When upgrading a cluster in Full Connectivity Mode, the first thing you must do is see if all cluster members have the same products installed. Which command should you run?
Question170: You are running a R77 Security Gateway on GAiA. In case of a hardware failure, you have a server with the exact same hardware and firewall version installed. What backup method could be used to quickly put the secondary firewall into production?
Question171: SmartReporter reports can be used to analyze data from a penetration-testing regimen in all of the following examples, EXCEPT:
Question172: Which Security Servers can perform Content Security tasks, but CANNOT perform authentication tasks?
Question173: Which of the following can NOT be modified by editing the cp_httpd_admin.conf file?
Question174: Which process is responsible for kernel table information sharing across all cluster members?
Question175: Which of the following is the preferred method for adding static routes in GAiA?
Question176: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend anytime outside a maintenance window?
Question177: VPN routing can also be configured by editing which file?
Question178: VPN-1 NGX supports VoIP traffic in all of the following environments, EXCEPT which environment?
Question179: Fill in the blank.
To view the number of concurrent connections going through core 0 on the firewall, you would use the command and syntax _____ _____ _____ _____ _____ _____ _____.
Question180: You want to create an IKE VPN between two VPN-1 NGX Security Gateways, to protect two networks. The network behind one Gateway is 10.15.0.0/16, and network 192.168.9.0/24 is behind the peer's Gateway.
Which type of address translation should you use, to ensure the two networks access each other through the VPN tunnel?
Question181: Which of these components does NOT require a VPN-1 NGX R65 license?
Question182: SmartProvisioning can provision the Operating System and network settings on which of the following?
Question183: An organization may be distributed across several SmartDirectory (LDAP) servers. What provision do you make to enable a Gateway to use all available resources?
Each SmartDirectory (LDAP) server must be:
Question184: Which of the following are valid PKI architectures?
Question185: Check Point recommends deploying SSL VPN:
Question186: Check Point Clustering protocol, works on:
Question187: What is the maximum number of cores supported by CoreXL?
Question188: You want VPN traffic to match packets from internal interfaces. You also want the traffic to exit the Security Gateway bound for all site-to-site VPN Communities, including Remote Access Communities. How should you configure the VPN match rule?
Question189: Jacob is using a mesh VPN Community to create a site-to-site VPN. The VPN properties in this mesh Community display in this graphic:
Which of the following statements is TRUE?
Question190: Control connections between the Security Management Server and the Gateway are not encrypted by the VPN Community. How are these connections secured?
Question191: Fill in the blanks.
To view the number of concurrent connections going through your firewall, you would use the command and syntax _____ _____ _____ _____ _____.
Question192: Fill in the blank.
To verify SecureXL statistics, you would use the command _____.
Question193: Which of the following is NOT a supported browser for Management Portal?
Question194: You are running a VPN-1 NG with Application Intelligence R54 SecurePlatform VPN-1 Pro Gateway. The Gateway also serves as a Policy Server.
When you run patch add cd from the NGX CD, what does this command allow you to upgrade?
Question195: When configuring numbered VPN Tunnel Interfaces (VTIs) in a clustered environment, what issues need to be considered?
1) Each member must have a unique source IP address.
2) Every interface on each member requires a unique IP address.
3) All VTI's going to the same remote peer must have the same name.
4) Cluster IP addresses are required.
Question196: Can you implement a complete R77 IPv6 deployment without IPv4 addresses?
Question197: In a Cluster, some features such as VPN only function properly when:
Question198: Regarding QoS guarantees and limits, which of the following statements is FALSE?
Question199: Steve is troubleshooting a connection problem with an internal application. If he knows the source IP address is 192.168.4.125, how could he filter this traffic?
Question200: You need to verify the effectiveness of your IPS configuration for your Web server farm.
You have a colleague run penetration tests to confirm that the Web servers are secure against traffic hijacks.
Of the following, which would be the best configuration to protect from a traffic hijack attempt?
Question201: Using the Backup Target functionality in SmartProvisioning, what targets are available?
i) FTP
ii) TFTP
iii) SFTP
iv) SCP
Question202: What is the consequence of clearing the "Log VoIP Connection" box in Global Properties?
Question203: You enable Sweep Scan Protection and Host port scan in IPS to determine if a large amount of traffic from a specific internal IP address is a network attack, or a user's system is infected with a worm. Will you get all the information you need from these actions?
Question204: Which two processes are responsible on handling Identity Awareness?
Question205: You are reviewing SmartView Tracker entries, and see a Connection Rejection on a Check Point QoS rule.
What causes the Connection Rejection?
Question206: A Threat Prevention profile is a set of configurations based on the following. Select the right answer.
Question207: You want only RAS signals to pass through H.323 Gatekeeper and other H.323 protocols, passing directly between end points.
Which routing mode in the VoIP Domain Gatekeeper do you select?
Question208: Which of the following does NOT happen when using Pivot Mode in ClusterXL?
Question209: Which of the following load-balancing methods is not valid?
Question210: When configuring a Web Application for SSL VPN remote access, you have given the following definition for the application along with its protection level.
Which of the following is the best match for the above application?
Question211: You are preparing computers for a new ClusterXL deployment. For your cluster, you plan to use four machines with the following configurations:
Cluster Member 1: OS - GAiA; NICs - QuadCard; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 2: OS - GAiA; NICs - 4 Intel 3Com; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 3: OS - GAiA; NICs - 4 other manufacturers; Memory: 512 MB; Security Gateway only, version: R77 Security Management Server: MS Windows 2008; NIC - Intel NIC (1); Security Gateway and primary Security Management Server installed, version: R77 Are these machines correctly configured for a ClusterXL deployment?
Question212: Which of the following TCP port numbers is used to connect the VPN-1 Gateway to the Content Vector Protocol (CVP) server?
Question213: _____ manages Standard Reports and allows the administrator to specify automatic uploads of reports to a central FTP server.
Question214: What is the behavior of ClusterXL in a High Availability environment?
Question215: Which of the following items can be provisioned via a Profile through SmartProvisioning?
i) Backup Schedule
ii) DNS Entries
iii) Hosts Table
iv) Domain Name
v) Interface IP's
Question216: The process that performs the authentication for SSL VPN Users is:
Question217: Which Check Point product is used to create and save changes to a Log Consolidation Policy?
Question218: When migrating the SmartEvent data base from one server to another, the first step is to back up the files on the original server. Which of the following commands should you run to back up the SmartEvent data base?
Question219: Where is the encryption domain for a SmartLSM Security Gateway configured in R71?
Question220: During a Security Management Server migrate export, the system:
Question221: If you are experiencing LDAP issues, which of the following should you check?
Question222: If traffic requires preferential treatment by other routers on the network, in addition to the QoS module, which Check Point QoS feature should be used?
Question223: When migrating the SmartEvent data base from one server to another, the last step is to save the files on the new server. Which of the following commands should you run to save the SmartEvent data base files on the new server?
Question224: Yoav is a Security Administrator preparing to implement a VPN solution for his multi-site organization.
To comply with industry regulations, Yoav's VPN solution must meet the following requirements:
Portability: Standard
Key management: Automatic, external PKI
Session keys: Changed at configured times during a connection's lifetime Key length: No less than 128-bit Data integrity: Secure against inversion and brute force attacks What is the most appropriate setting Yoav should choose?
Question225: If Bob wanted to create a Management High Availability configuration, what is the minimum number of Security Management servers required in order to achieve his goal?
Question226: The connection to the ClusterXL member 'A' breaks. The ClusterXL member 'A' status is now 'down'.
Afterwards the switch admin set a port to ClusterXL member 'B' to 'down'. What will happen?
Question227: You run cphaprob -a if. When you review the output, you find the word DOWN. What does DOWN mean?
Question228: After you add new interfaces to a cluster, how can you check if the new interfaces and the associated virtual IP address are recognized by ClusterXL?
Exhibit:
Question229: Fill in the blank.
In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. An internal host 10.4.8.108 successfully pings its Cluster and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. Based on this information, what is the active cluster member's IP address?
Question230: What SmartConsole application allows you to change the SmartReporter Policy?
Question231: You are configuring the VoIP Domain object for a Skinny Client Control Protocol (SCCP) environment protected by VPN-1 NGX. Which VoIP Domain object type can you use?
Question232: When does the SmartWorkflow Policy Installation window appear?
Question233: Barak is a Security Administrator for an organization that has two sites using pershared secrets in its VPN.
The two sites are Oslo and London. Barak has just been informed that a new office is opening in Madrid, and he must enable all three sites to connect via the VPN to each other. Three Security Gateways are managed by the same SmartCenter Server, behind the Oslo Security Gateway. Barak decides to switch from pershared secrets to Certificates issued by the Internal Certificate Authority (ICA).
After creating the Madrid gateway object with the proper VPN Domain, what are Barak's remaining steps?
1. Disable "PreShared Secret" on the London and Oslo gateway objects
2. Add the Madrid gateway object into the Oslo and London's mesh VPN Community
3. Manually generate ICA Certificates for all three Security Gateways.
4. Configure "Traditional mode VPN configuration" in the Madrid gateway object's VPN screen
5. Reinstall the Security Policy on all three Security Gateways.
Question234: Which Check Point QoS feature marks the ToS byte in the IP header?
Question235: The set of rules that governs the types of objects in the directory and their associated attributes is called the:
Question236: A tracked SmartEvent Candidate in a Candidate Pool becomes an Event. What does NOT happen in the Analyzer Server?
Question237: Typically, when you upgrade the Security Management Server, you install and configure a fresh R77 installation on a new computer and then migrate the database from the original machine. When doing this, what is required of the two machines? They must both have the same:
Question238: Assume an intruder has compromised your current IKE Phase 1 and Phase 2 keys.
Which of the following options will end the intruder's access, after the next Phase 2 exchange occurs?
Question239: What step should you take before running migrate_export?
Question240: MegaCorp is running Smartcenter R70, some Gateways at R65 and some other Gateways with R60.
Management wants to upgrade to the most comprehensive IPv6 support. What should the administrator do first?
Question241: What is the purpose of the pre-defined exclusions included with SmartEvent R77?
Question242: Which component functions as the Internal Certificate Authority for VPN-1 NGX?
Question243: Your network traffic requires preferential treatment by other routers on the network, in addition to the QoS Module, which Check Point QoS feature should you use?
Question244: The User Directory Software Blade is used to integrate which of the following with a R77 Security Gateway?
Question245: What is a requirement for setting up Management High Availability?
Question246: Review the following list of actions that Security Gateway R75 can take when it controls packets. The Policy Package has been configured for Simplified Mode VPN. Select the response below that includes the available actions:
Question247: _____ is NOT a ClusterXL mode.
Question248: MultiCorp is running Smartcenter R71 on an IPSO platform and wants to upgrade to a new Appliance with R77. Which migration tool is recommended?
Question249: Fill in the blank.
Type the full fw command and syntax that allows you to disable only sync on a cluster firewall member.
Question250: By default, a standby Security Management Server is automatically synchronized by an active Security Management Server, when:
Question251: How should Check Point packages be uninstalled?
Question252: In a UNIX environment, SmartReporter Data Base settings could be modified in:
Question253: Which command would you use to save the routing information before upgrading a Windows Gateway?
Question254: While authorization for users managed by SmartDirectory is performed by the gateway, the authentication mostly occurs in _____.
Question255: If both domain-based and route-based VPN's are configured, which will take precedence?
Question256: When a security administrator logs in to SmartDashboard and selects Continue without session from the following window,what kind of access will be granted to him in SmartDashboard?
Question257: The process _____ is responsible for the authentication for Remote Access clients.
Question258: When restoring R77 using the command upgrade_import, which of the following items are NOT restored?
Question259: User definitions are stored in _____.
Question260: Which version is the minimum requirement for SmartProvisioning?
Question261: In SmartDirectory, what is each LDAP server called?
Question262: What is the greatest benefit derived from VPNs compared to frame relay, leased lines any other types of dedicated networks?
Question263: Which Check Point QoS feature is used to dynamically allocate relative portions of available bandwidth?
Question264: VPN-1 NGX includes a resource mechanism for working with the Common Internet File System (CIFS).
However, this service only provides a limited level of actions for CIFS security.
Which of the following services is NOT provided by a CIFS resource?
Question265: Greg is creating rules and objects to control VoIP traffic in his organization, through a VPN- 1 NGX Security Gateway. Greg creates VoIP Domain SIP objects to represent each of his organization's three SIP gateways. Greg then creates a simple group to contain the VoIP Domain SIP objects. When Greg attempts to add the VoIP Domain SIP objects to the group, they are not listed. What is the problem?
Question266: If no flags are defined during a back up on the Security Management Server, where does the system store the *.tgz file?
Question267: Your current VPN-1 NG with Application Intelligence (AI) R55 stand-alone VPN-1 Pro Gateway and SmartCenter Server runs on SecurePlatform.
You plan to implement VPN-1 NGX R65 in a distributed environment, where the new machine will be the SmartCenter Server, and the existing machine will be the VPN-1 Pro Gateway only.
You need to migrate the NG with AI R55 SmartCenter Server configuration, including licensing.
How do you handle licensing for this NGX R65 upgrade?
Question268: To clean the system of all SmartEvent events, you should delete the files in which folder(s)?
Question269: How could you compare the Fingerprint shown to the Fingerprint on the server? Run cpconfig and select:
Exhibit:
Question270: John is configuring a new R77 Gateway cluster but he can not configure the cluster as Third Party IP Clustering because this option is not available in Gateway Cluster Properties. What's happening?
Exhibit:
Question271: Paul has just joined the MegaCorp security administration team. Natalie, the administrator, creates a new administrator account for Paul in SmartDashboard and installs the policy. When Paul tries to login it fails.
How can Natalie verify whether Paul's IP address is predefined on the security management server?
Question272: You are troubleshooting a HTTP connection problem. You've started fw monitor -o http.pcap. When you open http.pcap with Wireshark there is only one line. What is the most likely reason?
Question273: If SmartWorkflow is configured to work without Sessions or Role Segregation, how does the SmartDashboard function?
Question274: Concerning these products: SecurePlatform, VPN-1 Pro Gateway, UserAuthority Server, Nokia OS, UTM-
1, Eventia Reporter, and Performance Pack, which statement is TRUE?
Question275: Fill in the blank.
To save your OSPF configuration in GAiA, enter the command _____.
Question276: One profile in SmartProvisioning can update:
Question277: Which is the BEST configuration option to protect internal users from malicious Java code, without stripping Java scripts?
Question278: Where do you verify that SmartDirectory is enabled?
Question279: Which statement defines Public Key Infrastructure? Security is provided:
Question280: What is the proper command for importing users into the R77 User Database?
Question281: Fill in the blank.
To bind a NIC to a single processor when using CoreXL on GAiA, you would use the command
Question282: The process _____ is responsible for Policy compilation.
Question283: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question284: What firewall kernel table stores information about port allocations for Hide NAT connections?
Question285: _____ is NOT an SmartEvent event-triggered Automatic Reaction.
Question286: There are several SmartDirectory (LDAP) features that can be applied to further enhance SmartDirectory (LDAP) functionality, which of the following is NOT one of those features?
Question287: Review the R77 configuration. Is it correct for Management High Availability?
Exhibit:
Question288: How do you enable SecureXL (command line) on GAiA?
Question289: Management Portal should be installed on:
(i) Management Server
(ii) Security Gateway
(iii) Dedicated Server
Question290: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question291: For Management High Availability synchronization, what does the Advance status mean?
Question292: Where is the ideal place to deploy your SSL VPN?
Question293: When using IPS, what does Geo protection do?
Question294: Review the cphaprob state command output from a New Mode High Availability cluster member. Which machine has the highest priority?
Exhibit:
Question295: Which of the following can NOT approve a change in a SmartWorkflow session?
Question296: What is a Sticky Connection?
Question297: After installing VPN-1 Pro NGQ R65, you discover that one port on your Intel Quad NIC on the Security Gateway is not fetched by a get topology request. What is the most likely cause and solution?
Question298: Stephanie wants to reduce the encryption overhead and improve performance for her mesh VPN Community. The Advanced VPN Properties screen below displays adjusted page settings:
What can Stephanie do to achieve her goal?
Question299: David is the MultiCorp Security Manager and approves the proposals submitted by the Security Administrator Peter. One day, David believes he has detected a vulnerability in the Security Policy. He submits a change proposal and tries to approve his own submission. The system does not allow him to perform this procedure.
What is the reason for this behavior?
Question300: You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities should you do first?
Question301: You have a production implementation of Management High Availability, at version VPN-1 NG with Application Intelligence R55.
You must upgrade your two SmartCenter Servers to VPN-1 NGX. What is the correct procedure?
Question302: A Full Connectivity Upgrade of a cluster:
Question303: You are a Security Administrator preparing to deploy a new HFA (Hot fix Accumulator) to ten Security Gateways at five geographically separated locations.
What is the BEST method to implement this HFA?
Question304: How does a cluster member take over the VIP after a failover event?
Question305: Which statement about LDAP and Active Directory (AD) with SSL VPN is TRUE?
Question306: A connection is said to be Sticky when:
Question307: When configuring an LDAP Group object, select option _____ if you want the gateway to reference a specific group defined on the LDAP server for authentication purposes.
Question308: When Load Sharing Multicast mode is defined in a ClusterXL cluster object, how are packets being handled by cluster members?
Question309: Identify the correct step performed by SmartUpdate to upgrade a remote Security Gateway.
Question310: Problems sometimes occur when distributing IPSec packets to a few machines in a Load Sharing Multicast mode cluster, even though the machines have the same source and destination IP addresses. What is the best Load Sharing method for preventing this type of problem?
Question311: What happens to the session information after they are approved and a policy installation is done?
Question312: If a SmartUpdate upgrade or distribution operation fails on SecurePlatform, how is the system recovered?
Question313: Fill in the blank.
Type the command and syntax to configure the Cluster Control Protocol (CCP) to use Broadcast.
Question314: What is the correct policy installation process order?
1) Verification
2) Code generation and compilation
3) Initiation
4) Commit
5) Conversion
6) CPTA
Question315: VPN traffic control would fall under which VPN component?
Question316: Select the command set best used to verify proper failover function of a new ClusterXL configuration.
Question317: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend every couple of months, depending on how frequently you make changes to the network or policy?
Question318: Which of the following is a valid Active Directory designation for user Jane Doe in the MIS department of AcmeCorp.com?
Question319: When selecting a backup target using SmartProvisioning, which target is NOT available?
Question320: How would you set the debug buffer size to 1024?
Question321: SmartWorkflow has been enabled with the following configuration:
If a security administrator opens a new session and after making changes to policy, submits the session for approval will be displayed as:
Question322: To run GAiA in 64bit mode, which of the following is true?
1) Run set edition default 64-bit.
2) Install more than 4 GB RAM.
3) Install more than 4 TB of Hard Disk.
Question323: Your customer asks you about Check Point SmartWorkflow. His company must comply with various laws and regulations and therefore it is important for him to be able to see the changes made to a specific object.
How can the customer receive the required information?
Question324: What type of packet does a VPN-1 SecureClient send to its Policy Server, to report its Secure Configuration Verification status?
Question325: The process _____ is responsible for Management High Availability synchronization.
Question326: Which of the following are supported with the office mode? Select all that apply.
Question327: Rachel is the Security Administrator for a university. The university's FTP servers have old hardware and software. Certain FTP commands cause the FTP servers to malfunction.
Upgrading the FTP servers is not an option at this time.
Which of the following options will allow Rachel to control which FTP commands pass through the Security Gateway protecting the FTP servers?
Question328: You are preparing to deploy a VPN-1 Pro Gateway for VPN-1 NGX.
You have five systems to choose from for the new Gateway, and you must conform to the following requirements:
Operating-system vendor's license agreement
Check Point's license agreement
Minimum operating-system hardware specification
Minimum Gateway hardware specification
Gateway installed on a supported operating system (OS)
Which machine meets ALL of the following requirements?
Question329: You just upgraded to R71 and are using the IPS Software Blade.
You want to enable all critical protections while keeping the rate of false positive very low.
How can you achieve this?
Question330: Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
Which of the following is NOT a recommended use for this method?
Question331: When an Endpoint user is able to authenticate but receives a message from the client that it is unable to enforce the desktop policy, what is the most likely scenario?
Question332: Refer to the to the network topology below.
You have IPS software Blades active on security Gateways sglondon, sgla, and sgny, but still experience attacks on the Web server in the New York DMZ. How is this possible?
Question333: With is the SmartEvent Correlation Unit's function?
Question334: The process that performs the authentication for legacy session authentication is:
Question335: For Management High Availability, if an Active SMS goes down, does the Standby SMS automatically take over?
Question336: Which command would you use to save the IP address and routing information before upgrading a GAiA Gateway?
Question337: Which of the following QoS rule action properties is an Advanced action type, only available in Traditional mode?
Question338: How do you verify a VPN Tunnel Interface (VTI) is configured properly?
Question339: Which of the following SSL Network Extender server-side prerequisites are correct? Select all that apply.
Question340: In Company XYZ, the DLP Administrator defined a new Keywords Data Type that contains a list of secret project names; i.e., Ayalon, Yarkon, Yarden. The threshold is set to At least 2 keywords or phrases. Based on this information, which of the following scenarios will be a match to the Rule Base?
Question341: In a distributed VPN-1 Pro NGX environment, where is the Internal Certificate Authority (ICA) installed?
Question342: When using ClusterXL in Load Sharing, what is the default sharing method based on?
Question343: Which process should you debug if SmartDashboard login fails?
Question344: Which operating system is NOT supported by VPN-1 Secure Client?
Question345: When synchronizing clusters, which of the following statements is NOT true?
Question346: The _____ Check Point ClusterXL mode must synchronize the virtual IP and MAC addresses on all clustered interfaces.
Question347: When do modifications to the Event Policy take effect?
Question348: Which procedure will create an Internal User?
Question349: Which CLI tool helps on verifying proper ClusterXL sync?
Question350: What happens in relation to the CRL cache after a cpstop;spstart has been initiated?
Question351: Which of the following is supported with Office Mode?
Question352: Which SmartReporter report type is generated from the SmartView Monitor history file?
Question353: Does Check Point recommend generating an upgrade_export on standby SmartCenters?
Question354: Which Check Point tool allows you to open a debug file and see the VPN packet exchange details.
Question355: The following configuration is for VPN-1 NGX:1s this configuration correct for Management High Availability (HA)?
Question356: The process _____ executes the authentication for logging in to SmartDashboard.
Question357: For a dedicated DLP Gateway that runs in inline bridge mode, why is it important to properly define the topology?
Question358: Which file can you modify to change settings of the Management Portal?
For example: changing the webserver port or to use HTTP instead of HTTPS.
Question359: What process manages the dynamic routing protocols (OSPF, RIP, etc.) on GAiA?
Question360: Which Security Server can perform authentication tasks, but CANNOT perform content security tasks?
Question361: UserA is able to create a SmartLSM Security Cluster Profile , you must select the correct justification.
Question362: Fill in the blank.
To stop acceleration on a GAiA Security Gateway, enter command
Question363: What is the proper CLISH syntax to configure a default route via 192.168.255.1 in GAiA?
Question364: Review the cphaprob state command output from one New Mode High Availability ClusterXL member.
Which member will be active after member 192.168.1.2 fails over and is rebooted?
Question365: A cluster contains two members, with external interfaces 172.28.108.1 and 172.28.108.2. The internal interfaces are 10.4.8.1 and 10.4.8.2. The external cluster's IP address is 172.28.108.3, and the internal cluster's IP address is 10.4.8.3. The synchronization interfaces are 192.168.1.1 and 192.168.1.2. The Security Administrator discovers State Synchronization is not working properly, cphaprob if command output displays as follows:
What is causing the State Synchronization problem?
Question366: Your primary Security Management Server runs on GAiA. What is the fastest way to back up your Security Gateway R77 configuration, including routing and network configuration files?
Question367: Match the SmartDashboard session status icons with the appropriate SmartWorkflow session status:
Question368: How many pre-defined exclusions are included by default in SmartEvent R77 as part of the product installation?
Question369: When defining SmartDirectory for High Availability (HA), which of the following should you do?
Question370: An Account Unit is the interface between the _____ and the _____.
Question371: When a failed cluster member recovers, which of the following actions is NOT taken by the recovering member?
Question372: When using migrate to upgrade a Secure Management Server, which of the following is included in the migration?
Question373: You receive an alert indicating a suspicious FTP connection is trying to connect to one of your internal hosts. How do you block the connection in real time and verify the connection is successfully blocked?
Question374: The relay mail server configured under Email Notifications is used by the DLP Gateway to: (Choose the BEST answer.)
Question375: Which of the following can NOT be done on the Management Portal?
Question376: Your customer wishes to install SmartWorkflow on top of R70 Security Management Server (Windows system). What is the required disk space?
Question377: How can you prevent delay-sensitive applications, such as video and voice traffic, from being dropped due to long queue using Check Point QoS solution?
Question378: If a digital signature is used to achieve both data-integrity checking and verification of sender, digital signatures are only used when implementing:
Question379: Cody is notified by blacklist.org that his site has been reported as a spam relay, due to his SMTP Server being unprotected. Cody decides to implement an SMTP Security Server, to prevent the server from being a spam relay.
Which of the following is the most efficient configuration method?
Question380: Which service type does NOT invoke a Security Server?
Question381: Use the table to match the BEST Management High Availability synchronication-status descriptions for your Security Management Server (SMS).
Question382: If you check the box "Use Aggressive Mode", in the IKE Properties dialog box:
Question383: What is the most typical type of configuration for VPNs with several externally managed Gateways?
Question384: Restoring a snapshot-created file on one machine that was created on another requires which of the following to be the same on both machines?
Question385: Where do you define NAT properties so that NAT is performed either client side or server side? In SmartDashboard under:
Question386: What is the command to upgrade a SecurePlatform NG with Application Intelligence (Al) R55 SmartCenter Server to VPN-1 NGX using a CD?
Question387: When using Captive Portal to send unidentified users to a Web portal for authentication, which of the following is NOT a recommended use for this method?
Question388: Identify the correct step performed by SmartUpdate to upgrade a remote Security Gateway.
Question389: What is the primary benefit of using upgrade_export over either backup or snapshot?
Question390: What tool exports the Management Configuration into a single file?
Question391: Fill in the blank.
What is the correct command and syntax used to view a connection table summary on a Check Point Firewall?
Question392: A user cannot authenticate to SSL VPN. You have verified the user is assigned a user group and reproduced the problem, confirming a failed-login session. You do not see an indication of this attempt in the traffic log. The user is not using a client certificate for login.
To debug this error, where in the authentication process could the solution be found?
Question393: Review the Rule Base displayed.
For which rules will the connection templates be generated in SecureXL?
Question394: _____ generates a SmartEvent Report from its SQL database.
Question395: Which of the following statements is TRUE concerning MEP VPN's?
Question396: In SmartWorkflow, what is NOT a valid possibility?
Question397: When using SmartDashboard to manage existing users in SmartDirectory, when are the changes applied?
Question398: You want to block corporate internal-net and localnet from accessing Web sites containing inappropriate content. You are using WebTrends for URL filtering.
You have disabled VPN- 1 Control connections in the Global properties.
Review the diagram and the Security Policies for GW_A and GW_B in the exhibit provided.
Corporate users and localnet users receive message "Web cannot be displayed". In SmartView Tracker, you see the connections are dropped with message "content security is not reachable".
What is the problem, and how do you fix it?
Question399: Your VPN Community includes three Security Gateways. Each Gateway has its own internal network defined as a VPN Domain. You must test the VPN-1 NGX route-based VPN feature, without stopping the VPN. What is the correct order of steps?
Question400: The process _____ provides service to access the GAIA configuration database.
Question401: What action can be run from SmartUpdate NGX R65?
Question402: Select the right answer to export IPS profiles to copy to another management server?
Question403: What process manages the dynamic routing protocols (OSPF, RIP, etc.) on GAiA?
Question404: You need to back up the routing, interface, and DNS configuration information from your R77 GAiA Security Gateway. Which backup-and-restore solution do you use?
Question405: Choose the BEST sequence for configuring user management in SmartDashboard, using an LDAP server.
Question406: The following graphic illustrates which command being issued on GaiA?
Exhibit:
Question407: You have a High Availability ClusterXL configuration. Machines are not synchronized. What happens to connections on failover?
Question408: What is NOT true about Management Portal?
Question409: What GUI client would you use to view an IPS packet capture?
Question410: When troubleshooting user authentication, you may see the following entries in a debug of the user authentication process. In which order are these messages likely to appear?
Question411: Check Point New Mode HA is a(n) _____ solution.
Question412: Which of the following is NOT part of the policy installation process?
Question413: Which of the following is a supported Sticky Decision Function of Sticky Connections for Load Sharing?
Question414: Which describes the function of the account unit?
Question415: Which of the following is NOT a valid way to view interface's IP address settings in GAiA?
Question416: Fill in the blank.
Type the command and syntax that you would use to view the virtual cluster interfaces of a ClusterXL environment.
Question417: A Zero Downtime Upgrade of a cluster:
Question418: Organizations are sometimes faced with the need to locate cluster members in different geographic locations that are distant from each other. A typical example is replicated data centers whose location is widely separated for disaster recovery purposes. What are the restrictions of this solution?
Question419: Which statement is TRUE for route-based VPN's?
Question420: Robert has configured a Common Internet File System (CIFS) resource to allow access to the public partition of his company's file server, on \\erisco\goldenapple\files\public.
Robert receives reports that users are unable to access the shared partition, unless they use the file server's IP address.
Which of the following is a possible cause?
Question421: John is the MultiCorp Security Administrator. If he suggests a change in the firewall configuration, he must submit his proposal to David, a security manager. One day David is out of the office and john submits his proposal to peter. Surprisingly, Peter is not able to approve the proposal because the system does not permit him to do so?
Both David and Peter have accounts as administrators in the Security Management server and both have the Read/Write ALL permission. What is the reason for this difference?
Question422: When upgrading to NGX R65, which Check Point products do not require a license upgrade to be current?
Question423: DShield is a Check Point feature used to block which of the following threats?
Question424: You are the MegaCorp Security Administrator. This company uses a firewall cluster, consisting of two cluster members. The cluster generally works well but one day you find that the cluster is behaving strangely. You assume that there is a connectivity problem with the cluster synchronization link (cross-over cable). Which of the following commands is the BEST for testing the connectivity of the crossover cable?
Question425: From the following output of cphaprob state,
Which ClusterXL mode is this?
Question426: What can you do to see the current number of kernel instances in a system with CoreXL enabled?
Question427: A customer called to report one cluster member's status as Down. What command should you use to identify the possible cause?
Question428: Fill in the blank.
In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2 Internal host 10.4.8.108 pings 10.4.8.3, and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. According to the output, which member is the standby machine?
Question429: _____ is the called process that starts when opening SmartView Tracker application.
Question430: What is the advantage for deploying SSL VPN in a DMZ, versus a LAN?
Question431: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend before major changes, such as upgrades?
Question432: What is the best tool to produce a report which represents historical system information?
Question433: Which command would you use to save the interface information before upgrading a GAiA Gateway?
Question434: When using a template to define a user in SmartDirectory, the user's password should be defined in the
_____ object.
Question435: What process is responsible for transferring the policy file from SmartCenter to the Gateway?
Question436: Which of the following is a TRUE statement concerning contract verification?
Question437: How can you completely tear down a specific VPN tunnel in an intranet IKE VPN deployment?
Question438: With the User Directory Software Blade, you can create R77 user definitions on a(n) _____ Server.
Question439: Which specific R77 GUI would you use to view the length of time a TCP connection was open?
Question440: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question441: The process _____ complies $FWDIR/CONF/*.W files into machine language.
Question442: Which of the following statements is TRUE concerning MEP VPN's?
Question443: You need to determine if your company's Web servers are accessed an excessive number of times from the same host. How would you configure this in the IPS tab?
Question444: Your current VPN-1 NG with Application Intelligence (Al) R55standalone VPN-1 Pro Gateway and SmartCenter Server run on SecurePlatform.
You plan to implement VPN-1 NGX in a distributed environment, where the existing machine will be the SmartCenter Server, and a new machine will be the VPN-1 Pro Gateway only.
You need to migrate the NG with Al R55 SmartCenter Server configuration, including such items as Internal Certificate Authority files, databases, and Security Policies.
How do you request a new license for this VPN-1 NGX upgrade?
Question445: Which Protection Mode does not exist in IPS?
Question446: An administrator has installed the latest HFA on the system for fixing traffic problems after creating a backup file. A large number of routes were added or modified, causing network problems. The Check Point configuration has not been changed. What would be the most efficient way to revert to a working configuration?
Question447: If Jack was concerned about the number of log entries he would receive in the SmartReporter system, which policy would he need to modify?
Question448: Fill in the blank.
Type the command and syntax to view critical devices on a cluster member in a ClusterXL environment.
Question449: How does ClusterXL Unicast mode handle new traffic?
Question450: Which OPSEC server is used to prevent users from accessing certain Web sites?
Question451: Fill in the blank.
Type the command and syntax you would use to verify that your Check Point cluster is functioning correctly.
Question452: Which of the following is NOT a LDAP server option in SmartDirectory?
Question453: A customer calls saying that a Load Sharing cluster shows drops with the error First packet is not SYN.
Complete the following sentence. You will recommend:
Question454: When synchronizing clusters, which of the following statements is NOT true?
Question455: Which of the following explains Role Segregation?
Question456: Fill in the blank.
To enter the router shell, use command _____.
Question457: Check Point support has asked Tony for a firewall capture of accepted packets. What would be the correct syntax to create a capture file to a filename called monitor.out?
Question458: What command will stop all (and only) Management Portal services?
Question459: What port is used for Administrator access for your SSL VPN?
Question460: What does it mean when a Security Gateway is labeled Untrusted in the SmartProvisioning Status view?
Question461: Your R7x-series Enterprise Security Management Server is running abnormally on Windows Server 2008 R2. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings intact (i.e., all Security Policies, databases, SIC, licensing etc.) What is the BEST method to reinstall the Server and keep its critical configuration?
Question462: Fill in the blank.
Type the full fw command and syntax that will show full synchronization status.
Question463: Public keys and digital certificates provide which of the following? Select three.
Question464: You can NOT use SmartDashboard's SmartDirectory features to connect to the LDAP server.
What should you investigate?
1) Verify you have read-only permissions as administrator for the operating system.
2) Verify there are no restrictions blocking SmartDashboard's User Manager from connecting to the LDAP server.
3) Check that the login Distinguished Name configured has at least write permission in the access control configuration of the LDAP server.