EMT Practice Test

1. Question Content...

---

Question1: Which one of the following is true about Capsule Connect?

Question2: To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Question3: SandBlast appliances can be deployed in the following modes:

Question4: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Question5: You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the PWO daemon to do a Full Synchronization?

Question6: In R80 spoofing is defined as a method of:

Question7: The Security Gateway is installed on GAIA R80. The default port for the Web User interface is ______.

Question8: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

Question9: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question10: In the Firewall chain mode FFF refers to:

Question11: How often does Threat Emulation download packages by default?

Question12: What is true of the API server on R80.10?

Question13: What cloud-based SandBlast Mobile application is used to register new devices and users?

Question14: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question15: Which of the following will NOT affect acceleration?

Question16: Which TCP-port does CPM process listen to?

Question17: CPM process stores objects, policies, users, administrators, licenses and management data in a database.
The database is:

Question18: What is the limitation of employing Sticky Decision Function?

Question19: Fill in the blank. The R80 feature ___________________ permits blocking specific IP addresses for a specified time period.

Question20: The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API command can he use in the script to achieve the requirement?

Question21: Which of the following process pulls application monitoring status?

Question22: When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?

Question23: During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

Question24: Security Checkup Summary can be easily conducted within:

Question25: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Question26: Which is NOT an example of a Check Point API?

Question27: The Firewall kernel is replicated multiple times, therefore:

Question28: What are the blades of Threat Prevention?

Question29: Which file gives you a list of all security servers in use, including port number?

Question30: With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments. What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?

Question31: Which directory below contains log files?

Question32: Using ClusterXL, what statement is true about the Sticky Decision Function?

Question33: SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Question34: Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

Question35: What is the correct command to observe the Sync traffic in a VRRP environment?

Question36: What is the difference between SSL VPN and IPSec VPN?

Question37: What is the responsibility of SOLR process on R80.10 management server?

Question38: Automation and Orchestration differ in that:

Question39: If you needed the Multicast MAC address of a cluster, what command would you run?

Question40: Which statement is most correct regarding about "CoreXL Dynamic Dispatcher"?

Question41: Connections to the Check Point R80 Web API use what protocol?

Question42: What is considered Hybrid Emulation Mode?

Question43: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question44: Where do you create and modify the Mobile Access policy in R80?

Question45: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question46: The Correlation Unit performs all but the following actions:

Question47: The SmartEvent R80 Web application for real-time event monitoring is called:

Question48: Which is not a blade option when configuring SmartEvent?

Question49: What API command below creates a new host with the name "New Host" and IP address of
"192.168.0.10"?

Question50: What is the mechanism behind Threat Extraction?

Question51: What is the main difference between Threat Extraction and Threat Emulation?

Question52: Which method below is NOT one of the ways to communicate using the Management API's?

Question53: What are the main stages of a policy installations?

Question54: You notice that your firewall is under a DDoS attack and would like to enable the Penalty Box feature, which command you use?

Question55: What is the purpose of Priority Delta in VRRP?

Question56: You have existing dbedit scripts from R77. Can you use them with R80.10?

Question57: SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's machine via the web browser. What are the two modes of SNX?

Question58: Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

Question59: For best practices, what is the recommended time for automatic unlocking of locked admin accounts?

Question60: What information is NOT collected from a Security Gateway in a Cpinfo?

Question61: What kind of information would you expect to see using the sim affinity command?

Question62: Which view is NOT a valid CPVIEW view?

Question63: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

Question64: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?

Question65: Which statement is true regarding redundancy?

Question66: What command can you use to have cpinfo display all installed hotfixes?

Question67: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question68: Which Check Point daemon monitors the other daemons?

Question69: Which encryption algorithm is the least secured?

Question70: With Mobile Access enabled, administrators select the web-based and native applications that can be accessed by remote users and define the actions that users can perform the applications. Mobile Access encrypts all traffic using:

Question71: What is the command to check the status of the SmartEvent Correlation Unit?

Question72: Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

Question73: Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?

Question74: What scenario indicates that SecureXL is enabled?

Question75: Which command would you use to set the network interfaces' affinity in Manual mode?

Question76: How many images are included with Check Point TE appliance in Recommended Mode?

Question77: On what port does the CPM process run?

Question78: What is correct statement about Security Gateway and Security Management Server failover in Check Point R80.X in terms of Check Point Redundancy driven solution?

Question79: To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?

Question80: SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

Question81: The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via which 2 processes?

Question82: In SmartEvent, what are different types of automatic reactions that the administrator can configure?

Question83: Which of the following is NOT a type of Check Point API available in R80.10?

Question84: When simulating a problem on ClusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?

Question85: Which command would disable a Cluster Member permanently?

Question86: Which remote Access Solution is clientless?

Question87: Which statements below are CORRECT regarding Threat Prevention profiles in SmartDashboard?

Question88: What are the different command sources that allow you to communicate with the API server?

Question89: NAT rules are prioritized in which order?
1. Automatic Static NAT
2. Automatic Hide NAT
3. Manual/Pre-Automatic NAT
4. Post-Automatic/Manual NAT rules

Question90: What are the steps to configure the HTTPS Inspection Policy?

Question91: When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

Question92: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Question93: Fill in the blank: The command ___________ provides the most complete restoration of a R80 configuration.

Question94: Which command can you use to verify the number of active concurrent connections?

Question95: Can multiple administrators connect to a Security Management Server at the same time?

Question96: When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

Question97: Fill in the blank: The tool ________ generates a R80 Security Gateway configuration report.

Question98: Which of the following describes how Threat Extraction functions?

Question99: How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

Question100: How do Capsule Connect and Capsule Workspace differ?

Question101: To add a file to the Threat Prevention Whitelist, what two items are needed?

Question102: When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

Question103: John is using Management HA. Which Smartcenter should be connected to for making changes?

Question104: What is the least amount of CPU cores required to enable CoreXL?

Question105: Which two of these Check Point Protocols are used by SmartEvent Processes?

Question106: John detected high load on sync interface. Which is most recommended solution?

Question107: Please choose the path to monitor the compliance status of the Check Point R80.10 based management.

Question108: What is the command to see cluster status in cli expert mode?

Question109: Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

Question110: Which command gives us a perspective of the number of kernel tables?

Question111: Which of the following statements is TRUE about R80 management plug-ins?

Question112: Both ClusterXL and VRRP are fully supported by Gaia R80.10 and available to all Check Point appliances.
Which the following command is NOT related to redundancy and functions?