EMT Practice Test

1. Question Content...

---

Question1: Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

Question2: What is the port used for SmartConsole to connect to the Security Management Server?

Question3: Which command shows the current connections distributed by CoreXL FW instances?

Question4: Fill in the blank: The R80 feature ______ permits blocking specific IP addresses for a specific time period.

Question5: When using the Mail Transfer Agent, where are the debug logs stored?

Question6: Which of the following commands shows the status of processes?

Question7: How many images are included with Check Point TE appliance in Recommended Mode?

Question8: Which command is used to set the CCP protocol to Multicast?

Question9: Which command shows actual allowed connections in state table?

Question10: Which statement is true regarding redundancy?

Question11: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question12: Which path below is available only when CoreXL is enabled?

Question13: Which file gives you a list of all security servers in use, including port number?

Question14: Which of the following will NOT affect acceleration?

Question15: What Factor preclude Secure XL Templating?

Question16: To add a file to the Threat Prevention Whitelist, what two items are needed?

Question17: When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events. What is this setting called and what are you defining?

Question18: What is the mechanism behind Threat Extraction?

Question19: Which command would disable a Cluster Member permanently?

Question20: After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

Question21: What is the minimum amount of RAM needed for a Threat Prevention Appliance?

Question22: Which is NOT a SmartEvent component?

Question23: What kind of information would you expect to see using the sim affinity command?

Question24: Connections to the Check Point R80 Web API use what protocol?

Question25: Which command collects diagnostic data for analyzing customer setup remotely?

Question26: What happen when IPS profile is set in Detect Only Mode for troubleshooting?

Question27: What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

Question28: What is the difference between SSL VPN and IPSec VPN?

Question29: The Security Gateway is installed on GAIA R80. The default port for the Web User interface is ______.

Question30: SandBlast agent extends 0 day prevention to what part of the network?

Question31: What is the name of the secure application for Mail/Calendar for mobile devices?

Question32: Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible. Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

Question33: How do Capsule Connect and Capsule Workspace differ?

Question34: The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via which
2 processes?

Question35: To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?

Question36: Which blades and or features are not supported in R80?

Question37: Which of the following is NOT a component of Check Point Capsule?

Question38: To fully enable Dynamic Dispatcher on a Security Gateway:

Question39: When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

Question40: The Event List within the Event tab contains:

Question41: What is the difference between an event and a log?

Question42: The Firewall kernel is replicated multiple times, therefore:

Question43: What is true about the IPS-Blade?

Question44: Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

Question45: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Question46: Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic. Assuming acceleration is enabled which path is handling the traffic?

Question47: In ClusterXL Load Sharing Multicast Mode:

Question48: ION NO: 254
You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.
How many cores can be used in a Cluster for Firewall-kernel on the new device?

Question49: What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

Question50: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priorities Queues and fully enable Dynamic Dispatcher. How can you enable them?

Question51: Which one of the following is true about Threat Extraction?

Question52: fwssd is a child process of which of the following Check Point daemons?

Question53: When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?

Question54: What is the correct command to observe the Sync traffic in a VRRP environment?

Question55: R80.10 management server can manage gateways with which versions installed?

Question56: In R80.10, how do you manage your Mobile Access Policy?

Question57: You notice that your firewall is under a DDoS attack and would like to enable the Penalty Box feature, which command you use?

Question58: Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?

Question59: When using CPSTAT, what is the default port used by the AMON server?

Question60: From SecureXL perspective, what are the tree paths of traffic flow:

Question61: How can SmartView application accessed?

Question62: In R80 spoofing is defined as a method of:

Question63: What scenario indicates that SecureXL is enabled?

Question64: For Management High Availability, which of the following is NOT a valid synchronization status?

Question65: What is the benefit of "tw monitor" over "tcpdump"?

Question66: What CLI command compiles and installs a Security Policy on the target's Security Gateways?

Question67: Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?

Question68: What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?

Question69: Fill in the blank: The R80 utility fw monitor is used to troubleshoot ________.

Question70: Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal website, file share and emails?

Question71: Which statement is correct about the Sticky Decision Function?

Question72: Vanessa is firewall administrator in her company. Her company is using Check Point firewall on a central and several remote locations which are managed centrally by R77.30 Security Management Server. On central location is installed R77.30 Gateway on Open server. Remote locations are using Check Point UTM-1570 series appliances with R75.30 and some of them are using a UTM-1-Edge-X or Edge-W with latest available firmware. She is in process of migrating to R80.
What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R80?

Question73: Fill in the blank: The tool ________ generates a R80 Security Gateway configuration report.

Question74: What is not a component of Check Point SandBlast?

Question75: SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's machine via the web browser. What are the two modes of SNX?