EMT Practice Test

1. Question Content...

---

Question1: SandBlast agent extends 0 day prevention to what part of the network?

Question2: What is not a purpose of the deployment of Check Point API?

Question3: Which command gives us a perspective of the number of kernel tables?

Question4: Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

Question5: Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

Question6: In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

Question7: When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

Question8: Both ClusterXL and VRRP are fully supported by Gaia R80.10 and available to all Check Point appliances.
Which the following command is NOT related to redundancy and functions?

Question9: As an administrator, you may be required to add the company logo to reports. To do this, you would save the logo as a PNG file with the name 'cover-company-logo.png' and then copy that image file to which directory on the SmartEvent server?

Question10: What API command below creates a new host with the name "New Host" and IP address of "192.168.0.10"?

Question11: Which view is NOT a valid CPVIEW view?

Question12: What information is NOT collected from a Security Gateway in a Cpinfo?

Question13: Which command is used to set the CCP protocol to Multicast?

Question14: What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?

Question15: When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

Question16: Please choose the path to monitor the compliance status of the Check Point R80.10 based management.

Question17: John is using Management HA. Which Smartcenter should be connected to for making changes?

Question18: You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the PWO daemon to do a Full Synchronization?

Question19: From SecureXL perspective, what are the tree paths of traffic flow:

Question20: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question21: Which statement is most correct regarding about "CoreXL Dynamic Dispatcher"?

Question22: What is the command to show SecureXL status?

Question23: Automation and Orchestration differ in that:

Question24: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question25: What is true about the IPS-Blade?

Question26: Which command shows detailed information about VPN tunnels?

Question27: For Management High Availability, which of the following is NOT a valid synchronization status?

Question28: Which of the following is NOT an option to calculate the traffic direction?

Question29: Which features are only supported with R80.10 Gateways but not R77.x?

Question30: Where you can see and search records of action done by R80 SmartConsole administrators?

Question31: You need to change the number of firewall Instances used by CoreXL. How can you achieve this goal?

Question32: Which command would disable a Cluster Member permanently?

Question33: Which of the SecureXL templates are enabled by default on Security Gateway?

Question34: Which Check Point daemon monitors the other daemons?

Question35: Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. Which is NOT an option to adjust or configure?

Question36: What is the least amount of CPU cores required to enable CoreXL?

Question37: Which directory below contains log files?

Question38: To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following command in Expert mode then reboot:

Question39: In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with
__________________ will not apply.

Question40: Session unique identifiers are passed to the web api using which http header option?

Question41: How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

Question42: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?

Question43: When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

Question44: Both ClusterXL and VRRP are fully supported by Gaia R80.10 and available to all Check Point appliances.
Which the following command is NOT related to redundancy and functions?

Question45: In which formats can Threat Emulation forensics reports be viewed in?

Question46: What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

Question47: You are asked to check the status of several user-mode processes on the management server and gateway.
Which of the following processes can only be seen on a Management Server?

Question48: To fully enable Dynamic Dispatcher on a Security Gateway:

Question49: Which remote Access Solution is clientless?

Question50: What are the steps to configure the HTTPS Inspection Policy?

Question51: You want to store the GAIA configuration in a file for later reference. What command should you use?

Question52: Fill in the blank: The R80 utility fw monitor is used to troubleshoot ________.

Question53: What is the command to check the status of the SmartEvent Correlation Unit?

Question54: The essential means by which state synchronization works to provide failover in the event an active member goes down, ____________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.

Question55: What Factor preclude Secure XL Templating?

Question56: What is the port used for SmartConsole to connect to the Security Management Server?

Question57: Pamela is Cyber Security Engineer working for Global Instance Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R80.10. Company's Developer Team is having random access issue to newly deployed Application Server in DMZ's Application Server Farm Tier and blames DMZ Security Gateway as root cause. The ticket has been created and issue is at Pamela's desk for an investigation. Pamela decides to use Check Point's Packet Analyzer Tool-fw monitor to iron out the issue during approved Maintenance window. What do you recommend as the best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic?

Question58: Which command would you use to set the network interfaces' affinity in Manual mode?

Question59: What command verifies that the API server is responding?

Question60: SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Question61: You have existing dbedit scripts from R77. Can you use them with R80.10?

Question62: What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

Question63: The Firewall kernel is replicated multiple times, therefore:

Question64: How often does Threat Emulation download packages by default?

Question65: Which process handles connection from SmartConsole R80?

Question66: Which command collects diagnostic data for analyzing customer setup remotely?

Question67: What are the attributes that SecureXL will check after the connection is allowed by Security Policy?

Question68: When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

Question69: NAT rules are prioritized in which order?
1. Automatic Static NAT
2. Automatic Hide NAT
3. Manual/Pre-Automatic NAT
4. Post-Automatic/Manual NAT rules

Question70: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

Question71: What is the command to see cluster status in cli expert mode?

Question72: You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.
What must you do to get SIC to work?

Question73: You can access the ThreatCloud Repository from:

Question74: GAiA Software update packages can be imported and installed offline in situation where:

Question75: John detected high load on sync interface. Which is most recommended solution?

Question76: If you needed the Multicast MAC address of a cluster, what command would you run?

Question77: You need to see which hotfixes are installed on your gateway, which command would you use?

Question78: What will SmartEvent automatically define as events?

Question79: Which encryption algorithm is the least secured?

Question80: As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

Question81: Which GUI client is supported in R80?

Question82: What has to be taken into consideration when configuring Management HA?

Question83: Which one of the following is true about Threat Extraction?

Question84: You notice that your firewall is under a DDoS attack and would like to enable the Penalty Box feature, which command you use?

Question85: R80.10 management server can manage gateways with which versions installed?

Question86: Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

Question87: Which file contains the host address to be published, the MAC address that needs to be associated with the IP Address, and the unique IP of the interface that responds to ARP request?

Question88: With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments. What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?

Question89: What kind of information would you expect to see using the sim affinity command?

Question90: In a Client to Server scenario, which represents that the packet has already checked against the tables and the Rule Base?

Question91: You want to verify if your management server is ready to upgrade to R80.10. What tool could you use in this process?

Question92: What are the three components for Check Point Capsule?

Question93: Which of the following authentication methods ARE NOT used for Mobile Access?

Question94: What is the SandBlast Agent designed to do?

Question95: Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?

Question96: Which CLI command will reset the IPS pattern matcher statistics?

Question97: In the Firewall chain mode FFF refers to:

Question98: Which of the following statements is TRUE about R80 management plug-ins?

Question99: Which is NOT a SmartEvent component?

Question100: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question101: In what way are SSL VPN and IPSec VPN different?

Question102: What is the purpose of a SmartEvent Correlation Unit?

Question103: Which statements below are CORRECT regarding Threat Prevention profiles in SmartDashboard?

Question104: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question105: An administrator would like to troubleshoot why templating is not working for some traffic. How can he determine at which rule templating is disabled?

Question106: SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

Question107: What command would show the API server status?

Question108: Which is NOT an example of a Check Point API?

Question109: Using ClusterXL, what statement is true about the Sticky Decision Function?

Question110: Vanessa is firewall administrator in her company. Her company is using Check Point firewall on a central and several remote locations which are managed centrally by R77.30 Security Management Server. On central location is installed R77.30 Gateway on Open server. Remote locations are using Check Point UTM-1570 series appliances with R75.30 and some of them are using a UTM-1-Edge-X or Edge-W with latest available firmware. She is in process of migrating to R80.
What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R80?

Question111: To help SmartEvent determine whether events originated internally you must define using the Initial Settings under General Settings in the Policy Tab. How many options are available to calculate the traffic direction?

Question112: Fill in the blank: The command ___________ provides the most complete restoration of a R80 configuration.

Question113: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question114: You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or ______ action for the file types.

Question115: Which is NOT an example of a Check Point API?

Question116: Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

Question117: Which command shows the current connections distributed by CoreXL FW instances?

Question118: What is the name of the secure application for Mail/Calendar for mobile devices?

Question119: Which of the following will NOT affect acceleration?

Question120: What component of R80 Management is used for indexing?