EMT Practice Test

1. Question Content...

---

Question1: Connections to the Check Point R80 Web API use what protocol?

Question2: Which command would you use to set the network interfaces' affinity in Manual mode?

Question3: Security Checkup Summary can be easily conducted within:

Question4: Which 3 types of tracking are available for Threat Prevention Policy?

Question5: On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

Question6: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question7: When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?

Question8: Which command will allow you to see the interface status?

Question9: Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

Question10: In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a response before the peer host is declared 'down', you would set the_________?

Question11: You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or _____ action for the file types.

Question12: Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

Question13: Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

Question14: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Question15: What is the valid range for VRID value in VRRP configuration?

Question16: Which Check Point feature enables application scanning and the detection?

Question17: Identify the API that is not supported by Check Point currently.

Question18: What is the SOLR database for?

Question19: The Check Point history feature in R80 provides the following:

Question20: Which of the following is NOT a valid type of SecureXL template?

Question21: The essential means by which state synchronization works to provide failover in the event an active member goes down, ____________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.

Question22: By default, which port does the WebUI listen on?

Question23: An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server.
While configuring the VPN community to specify the pre-shared secret the administrator found that the check box to enable pre-shared secret and cannot be enabled.
Why does it not allow him to specify the pre-shared secret?

Question24: What are the three components for Check Point Capsule?

Question25: Which one of the following is true about Capsule Connect?

Question26: One of major features in R80 SmartConsole is concurrent administration.
Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?

Question27: Which NAT rules are prioritized first?

Question28: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?

Question29: Which Check Point software blade provides Application Security and identity control?

Question30: When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

Question31: What is the difference between an event and a log?

Question32: With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments. What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?

Question33: What is the minimum amount of RAM needed for a Threat Prevention Appliance?

Question34: What is true about VRRP implementations?

Question35: SmartConsole R80 x requires the following ports to be open for SmartEvent.

Question36:
You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.
What does this mean?

Question37: The WebUI offers several methods for downloading hotfixes via CPUSE except:

Question38: Tom has connected to the R80 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.
What will happen to the changes already made?

Question39: Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Question40: Fill in the blank: The tool _____ generates a R80 Security Gateway configuration report.

Question41: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Question42: Which command would disable a Cluster Member permanently?

Question43: Which statement is true regarding redundancy?

Question44: What is not a purpose of the deployment of Check Point API?

Question45: How is communication between different Check Point components secured in R80? As with all questions, select the BEST answer.

Question46: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ________
.

Question47: What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

Question48: Which command shows the current connections distributed by CoreXL FW instances?

Question49: In R80.10, how do you manage your Mobile Access Policy?

Question50: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question51: What command would show the API server status?

Question52: Fill in the blank: An identity server uses a __________ for user authentication.

Question53: Which path below is available only when CoreXL is enabled?

Question54: SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Question55: Can multiple administrators connect to a Security Management Server at the same time?

Question56: Which of the following is NOT a component of Check Point Capsule?

Question57: You want to store the GAIA configuration in a file for later reference. What command should you use?

Question58: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question59: Which GUI client is supported in R80?

Question60: John is using Management HA. Which Smartcenter should be connected to for making changes?

Question61: What are types of Check Point APIs available currently as part of R80.10 code?

Question62: What API command below creates a new host with the name "New Host" and IP address of "192.168.0.10"?

Question63: What does the Log "Views" tab show when SmartEvent is Correlating events?

Question64: Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

Question65: What will SmartEvent automatically define as events?

Question66: What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

Question67: What CLI command compiles and installs a Security Policy on the target's Security Gateways?

Question68: Which is the correct order of a log flow processed by SmartEvent components?

Question69: What is the difference between SSL VPN and IPSec VPN?

Question70: During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

Question71: What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?

Question72: R80.10 management server can manage gateways with which versions installed?

Question73: Automation and Orchestration differ in that:

Question74: What statement best describes the Proxy ARP feature for Manual NAT in R80.10?

Question75: Both ClusterXL and VRRP are fully supported by Gaia R80.10 and available to all Check Point appliances.
Which the following command is NOT related to redundancy and functions?

Question76: Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?

Question77: Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

Question78: What is the correct order of the default "fw monitor" inspection points?

Question79: With SecureXL enabled, accelerated packets will pass through the following:

Question80: Which statement is most correct regarding about "CoreXL Dynamic Dispatcher"?

Question81: How many images are included with Check Point TE appliance in Recommended Mode?

Question82: Fill in the blank: The R80 utility fw monitor is used to troubleshoot ______________________.

Question83: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

Question84: Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible. Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

Question85: In ClusterXL Load Sharing Multicast Mode:

Question86: What are the available options for downloading Check Point hotfixes in Gala WebUI (CPUSE)?

Question87: When a packet arrives at the gateway, the gateway checks it against the rules in the hop Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?

Question88: What is the purpose of a SmartEvent Correlation Unit?

Question89: How many layers make up the TCP/IP model?

Question90: What state is the Management HA in when both members have different policies/databases?

Question91: Which application should you use to install a contract file?

Question92: You need to change the number of firewall Instances used by CoreXL. How can you achieve this goal?

Question93: Your manager asked you to check the status of SecureXL, and its enabled templates and features. What command will you use to provide such information to manager?

Question94: What command verifies that the API server is responding?

Question95: Which file contains the host address to be published, the MAC address that needs to be associated with the IP Address, and the unique IP of the interface that responds to ARP request?

Question96: What is the purpose of Priority Delta in VRRP?

Question97: What is the command to check the status of the SmartEvent Correlation Unit?

Question98: Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal website, file share and emails?

Question99: John detected high load on sync interface. Which is most recommended solution?

Question100: You have pushed policy to GW-3 and now cannot pass traffic through the gateway. As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?

Question101: During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

Question102: How many policy layers do Access Control policy support?

Question103: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?

Question104: Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?

Question105: Which of the following links will take you to the SmartView web application?

Question106: Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

Question107: Which command gives us a perspective of the number of kernel tables?

Question108: When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?

Question109: When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

Question110: Hit Count is a feature to track the number of connections that each rule matches, which one is not benefit of Hit Count.

Question111: True or False: In R80, more than one administrator can login to the Security Management Server with write permission at the same time.

Question112: Which method below is NOT one of the ways to communicate using the Management API's?

Question113: Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

Question114: In R80 spoofing is defined as a method of:

Question115: To fully enable Dynamic Dispatcher on a Security Gateway:

Question116: There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational.
When it re-joins the cluster, will it become active automatically?

Question117: In the Check Point Security Management Architecture, which component(s) can store logs?

Question118: Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

Question119: What is the command to check the status of Check Point processes?

Question120: SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data. Which component is NOT part of the SandBlast Mobile solution?

Question121: Which tool is used to enable ClusterXL?

Question122: If there are two administration logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available or other administrators? (Choose the BEST answer.)

Question123: An administrator would like to troubleshoot why templating is not working for some traffic. How can he determine at which rule templating is disabled?

Question124: What is the default shell of Gaia CLI?

Question125: The back end database for Check Point R80 Management uses:

Question126: Which of the following will NOT affect acceleration?

Question127: From SecureXL perspective, what are the tree paths of traffic flow:

Question128: Fill in the blank: The R80 feature _____ permits blocking specific IP addresses for a specified time period.

Question129: What key is used to save the current CPView page in a filename format cpview_"cpview process ID".cap"number of captures"?

Question130: At what point is the Internal Certificate Authority (ICA) created?

Question131: Fill in the blank: Authentication rules are defined for ________ .

Question132: If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsive, which if these steps should NOT be performed:

Question133: Joey wants to upgrade from R75.40 to R80 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.
What is one of the requirements for his success?

Question134: What SmartEvent component creates events?

Question135: Which command shows detailed information about VPN tunnels?

Question136: Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

Question137: When using the Mail Transfer Agent, where are the debug logs stored?

Question138: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question139: Which of the following is NOT an alert option?

Question140: You need to change the MAC-address on eth2 interface of the gateway. What command and what mode will you use to achieve this goal?

Question141: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question142: Which firewall daemon is responsible for the FW CLI commands?

Question143: Which SmartConsole tab is used to monitor network and security performance?

Question144: Which of the following statements is TRUE about R80 management plug-ins?

Question145: Which blades and or features are not supported in R80?

Question146: In what way are SSL VPN and IPSec VPN different?

Question147: How can SmartView application accessed?

Question148: In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

Question149: Which of these statements describes the Check Point ThreatCloud?

Question150: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .