EMT Practice Test

1. Question Content...

---

Question1: Which of the following is NOT an alert option?

Question2: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question3: Why would an administrator see the message below?

Question4: O: 110
What is the purpose of Priority Delta in VRRP?

Question5: How is communication between different Check Point components secured in R80? As with all questions, select the BEST answer.

Question6: Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Question7: When an encrypted packet is decrypted, where does this happen?

Question8: Which Check Point daemon monitors the other daemons?

Question9: What must you do first if "fwm sic_reset" could not be completed?

Question10: Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

Question11: Which command shows detailed information about VPN tunnels?

Question12: Fill in the blank: The command ___________________ provides the most complete restoration of a R80 configuration.

Question13: Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called:

Question14: At what point is the Internal Certificate Authority (ICA) created?

Question15: In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

Question16: What is the most recommended way to install patches and hotfixes?

Question17: After the initial installation on Check Point appliance, you notice that the Management-interface and default gateway are incorrect.
Which commands could you use to set the IP to 192.168.80.200/24 and default gateway to 192.168.80.1.

Question18: What is the benefit of "tw monitor" over "tcpdump"?

Question19: What are types of Check Point APIs available currently as part of R80.10 code?

Question20: Fill in the blanks: Gaia can be configured using the ______ or _____ .

Question21: R80.10 management server can manage gateways with which versions installed?

Question22: Which process handles connection from SmartConsole R80?

Question23: In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Question24: What is the main difference between Threat Extraction and Threat Emulation?

Question25: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

Question26: Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

Question27: Vanessa is firewall administrator in her company. Her company is using Check Point firewall on a central and several remote locations which are managed centrally by R77.30 Security Management Server. On central location is installed R77.30 Gateway on Open server. Remote locations are using Check Point UTM-1570 series appliances with R75.30 and some of them are using a UTM-1-Edge-X or Edge-W with latest available firmware. She is in process of migrating to R80.
What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R80?

Question28: Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible. Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

Question29: You have existing dbedit scripts from R77. Can you use them with R80.10?

Question30: Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or ______ .

Question31: You have enabled "Full Log" as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?

Question32: You have successfully backed up Check Point configurations without the OS information. What command would you use to restore this backup?

Question33: You can access the ThreatCloud Repository from:

Question34: Which path below is available only when CoreXL is enabled?

Question35: Which Check Point feature enables application scanning and the detection?

Question36: The ____ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

Question37: The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API command can he use in the script to achieve the requirement?

Question38: SmartEvent does NOT use which of the following procedures to identify events:

Question39: What are the main stages of a policy installations?

Question40: You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.
What must you do to get SIC to work?

Question41: What are the two high availability modes?

Question42: Pamela is Cyber Security Engineer working for Global Instance Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R80.10. Company's Developer Team is having random access issue to newly deployed Application Server in DMZ's Application Server Farm Tier and blames DMZ Security Gateway as root cause. The ticket has been created and issue is at Pamela's desk for an investigation. Pamela decides to use Check Point's Packet Analyzer Tool-fw monitor to iron out the issue during approved Maintenance window.
What do you recommend as the best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic?

Question43: What is the purpose of a SmartEvent Correlation Unit?

Question44: Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client communications, database manipulation, policy compilation and Management HA synchronization?

Question45: Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows then as prioritized security events.

Question46: To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab. How many options are available to calculate the traffic direction?

Question47: In R80 spoofing is defined as a method of:

Question48: In the Check Point Security Management Architecture, which component(s) can store logs?

Question49: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

Question50: What two ordered layers make up the Access Control Policy Layer?

Question51: Which GUI client is supported in R80?

Question52: Which method below is NOT one of the ways to communicate using the Management API's?

Question53: What CLI command compiles and installs a Security Policy on the target's Security Gateways?

Question54: Which of the following commands shows the status of processes?

Question55: You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or _____ action for the file types.

Question56: Which application should you use to install a contract file?

Question57: Check Point ClusterXL Active/Active deployment is used when:

Question58: Office mode means that:

Question59: Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.
Which component of SandBlast protection is her company using on a Gateway?

Question60: If there are two administration logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available or other administrators? (Choose the BEST answer.)

Question61: Which features are only supported with R80.10 Gateways but not R77.x?

Question62: GAiA Software update packages can be imported and installed offline in situation where:

Question63: What is the correct order of the default "fw monitor" inspection points?

Question64: What will be the effect of running the following command on the Security Management Server?

Question65: Which software blade does NOT accompany the Threat Prevention policy?

Question66: Which of these statements describes the Check Point ThreatCloud?

Question67: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

Question68: Which CLI command will reset the IPS pattern matcher statistics?

Question69: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Question70: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question71: Where you can see and search records of action done by R80 SmartConsole administrators?

Question72: What is the default size of NAT table fwx_alloc?

Question73: You need to see which hotfixes are installed on your gateway, which command would you use?

Question74: SandBlast agent extends 0 day prevention to what part of the network?

Question75: Which one of the following is true about Threat Extraction?

Question76: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question77: CPM process stores objects, policies, users, administrators, licenses and management data in a database. The database is:

Question78: Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

Question79: Session unique identifiers are passed to the web api using which http header option?

Question80: Which of the following will NOT affect acceleration?