EMT Practice Test

1. Question Content...

---

Question1: Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

Question2: When using CPSTAT, what is the default port used by the AMON server?

Question3: Which of the following commands shows the status of processes?

Question4: Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______ .

Question5: On what port does the CPM process run?

Question6: What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

Question7: When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

Question8: Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R80.X The Network Security Developer Team is having an issue testing the API with a newly deployed R80.X Security Management Server Aaron wants to confirm API services are working properly. What should he do first?

Question9: Capsule Connect and Capsule Workspace both offer secured connection for remote users who are using their mobile devices. However, there are differences between the two.
Which of the following statements correctly identify each product's capabilities?

Question10: Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or via CLI.
Which command should he use in CLI? (Choose the correct answer.)

Question11: The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via which 2 processes?

Question12: Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client communications, database manipulation, policy compilation and Management HA synchronization?

Question13: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question14: Which NAT rules are prioritized first?

Question15: Which command shows detailed information about VPN tunnels?

Question16: Which remote Access Solution is clientless?

Question17: Fill in the blanks: A _______ license requires an administrator to designate a gateway for attachment whereas a ________ license is automatically attached to a Security Gateway.

Question18: In ClusterXL Load Sharing Multicast Mode:

Question19: You need to change the number of firewall Instances used by CoreXL. How can you achieve this goal?

Question20: When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

Question21: SmartEvent Security Checkups can be run from the following Logs and Monitor activity:

Question22: SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Question23: SmartConsole R80 x requires the following ports to be open for SmartEvent.

Question24: What is not a component of Check Point SandBlast?

Question25: Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

Question26: John detected high load on sync interface. Which is most recommended solution?

Question27: What is considered Hybrid Emulation Mode?

Question28: According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

Question29: Which of the following is NOT an attribute of packet acceleration?

Question30: What needs to be configured if the NAT property 'Translate destination or client side' is not enabled in Global Properties?

Question31: Which is not a blade option when configuring SmartEvent?

Question32: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question33: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question34: What is the name of the secure application for Mail/Calendar for mobile devices?

Question35: View the rule below. What does the lock-symbol in the left column mean? (Choose the BEST answer.)

Question36: With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments. What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?

Question37: You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet. However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet. How can you fix this?

Question38: Fill in the blank: The R80 feature _____ permits blocking specific IP addresses for a specified time period.

Question39: What is the order of NAT priorities?

Question40: What is the valid range for VRID value in VRRP configuration?

Question41: After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?

Question42: Packet acceleration (SecureXL) identifies connections by several attributes- Which of the attributes is NOT used for identifying connection?

Question43: Under which file is the proxy arp configuration stored?

Question44: Which blades and or features are not supported in R80?

Question45: Which command lists all tables in Gaia?

Question46: Which statements below are CORRECT regarding Threat Prevention profiles in SmartDashboard?

Question47: You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down. What command do you run to determine the cause?

Question48: What does the Log "Views" tab show when SmartEvent is Correlating events?

Question49: To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:

Question50: What is the difference between an event and a log?

Question51: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

Question52: Which of these statements describes the Check Point ThreatCloud?

Question53: The back end database for Check Point R80 Management uses:

Question54: After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

Question55: Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

Question56: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question57: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question58: Why would an administrator see the message below?

Question59: Can multiple administrators connect to a Security Management Server at the same time?

Question60: In R80 spoofing is defined as a method of:

Question61: From SecureXL perspective, what are the tree paths of traffic flow:

Question62: Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________ .

Question63: IF the first packet of an UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), what message is sent back through the kernel?

Question64: Which firewall daemon is responsible for the FW CLI commands?

Question65: Which encryption algorithm is the least secured?

Question66: Joey want to configure NTP on R80 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?

Question67: If you needed the Multicast MAC address of a cluster, what command would you run?

Question68: When setting up an externally managed log server, what is one item that will not be configured on the R80 Security Management Server?

Question69: What is true of the API server on R80.10?

Question70: One of major features in R80 SmartConsole is concurrent administration.
Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?

Question71: You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.
How many cores can be used in a Cluster for Firewall-kernel on the new device?

Question72: CoreXL is NOT supported when one of the following features is enabled: (Choose three)

Question73: Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called:

Question74: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

Question75: Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or ______ .

Question76: What are the methods of SandBlast Threat Emulation deployment?

Question77: Which is NOT a SmartEvent component?

Question78: During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

Question79: What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?

Question80: The WebUI offers several methods for downloading hotfixes via CPUSE except:

Question81: R80.10 management server can manage gateways with which versions installed?

Question82: What is the benefit of "tw monitor" over "tcpdump"?

Question83: Which statement is NOT TRUE about Delta synchronization?

Question84: The log server sends what to the Correlation Unit?

Question85: In the Check Point Security Management Architecture, which component(s) can store logs?

Question86: What is true about VRRP implementations?

Question87: Which of the SecureXL templates are enabled by default on Security Gateway?

Question88: What is the most recommended way to install patches and hotfixes?

Question89: Which path below is available only when CoreXL is enabled?

Question90: What is the valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration?

Question91: To add a file to the Threat Prevention Whitelist, what two items are needed?

Question92: GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

Question93: Which command would disable a Cluster Member permanently?

Question94: The Security Gateway is installed on GAIA R80. The default port for the Web User interface is ______.

Question95: Vanessa is firewall administrator in her company. Her company is using Check Point firewall on a central and several remote locations which are managed centrally by R77.30 Security Management Server. On central location is installed R77.30 Gateway on Open server. Remote locations are using Check Point UTM-1570 series appliances with R75.30 and some of them are using a UTM-1-Edge-X or Edge-W with latest available firmware. She is in process of migrating to R80.
What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R80?

Question96: What is true about the IPS-Blade?

Question97: Check Point security components are divided into the following components:

Question98: What processes does CPM control?

Question99: Which view is NOT a valid CPVIEW view?

Question100: What Factor preclude Secure XL Templating?

Question101: For Management High Availability, which of the following is NOT a valid synchronization status?

Question102: By default, the R80 web API uses which content-type in its response?

Question103: With SecureXL enabled, accelerated packets will pass through the following:

Question104: Which of the following is NOT supported by CPUSE?

Question105: Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. Which is NOT an option to adjust or configure?

Question106: What are the steps to configure the HTTPS Inspection Policy?

Question107: The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.
What is the most likely reason that the traffic is not accelerated?

Question108: SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

Question109: Which one of the following is true about Capsule Connect?

Question110: Which of the following is a task of the CPD process?

Question111: NAT rules are prioritized in which order?
1. Automatic Static NAT
2. Automatic Hide NAT
3. Manual/Pre-Automatic NAT
4. Post-Automatic/Manual NAT rules

Question112: Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

Question113: You have successfully backed up Check Point configurations without the OS information. What command would you use to restore this backup?

Question114: Which command shows actual allowed connections in state table?

Question115: What is the purpose of extended master key extension/session hash?

Question116: What is the correct order of the default "fw monitor" inspection points?

Question117: Which command is used to display status information for various components?

Question118: To fully enable Dynamic Dispatcher on a Security Gateway:

Question119: What is the least amount of CPU cores required to enable CoreXL?

Question120: If an administrator wants to add manual NAT for addresses now owned by the Check Point firewall, what else is necessary to be completed for it to function properly?

Question121: What is a best practice before starting to troubleshoot using the "fw monitor" tool?

Question122: What key is used to save the current CPView page in a filename format cpview_"cpview process ID".cap"number of captures"?

Question123: What is the purpose of a SmartEvent Correlation Unit?

Question124: While using the Gaia CLI. what is the correct command to publish changes to the management server?

Question125: Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic. Assuming acceleration is enabled which path is handling the traffic?

Question126: What is the correct command to observe the Sync traffic in a VRRP environment?

Question127: What is the default size of NAT table fwx_alloc?

Question128: Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

Question129: Please choose correct command to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI?

Question130: Which command is used to obtain the configuration lock in Gaia?

Question131: You have enabled "Full Log" as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?

Question132: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Question133: Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R80.10 SmartConsole application?

Question134: John is using Management HA.
Which Smartcenter should be connected to for making changes?

Question135: To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Question136: How do Capsule Connect and Capsule Workspace differ?

Question137: Which statement is true about ClusterXL?

Question138: You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or _____ action for the file types.

Question139: Which command can you use to verify the number of active concurrent connections?

Question140: Kurt is planning to upgrade his Security Management Server to R80.X. What is the lowest supported version of the Security Management he can upgrade from?

Question141: What is the minimum amount of RAM needed for a Threat Prevention Appliance?

Question142: Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?

Question143: The ____ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

Question144: You need to change the MAC-address on eth2 interface of the gateway. What is the correct way to change MAC-address in Check Point Gaia?

Question145: Which packet info is ignored with Session Rate Acceleration?

Question146: You can access the ThreatCloud Repository from:

Question147: The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API command can he use in the script to achieve the requirement?

Question148: On the following picture an administrator configures Identity Awareness:

After clicking "Next" the above configuration is supported by:

Question149: Fill in the blank: The R80 utility fw monitor is used to troubleshoot ______________________.

Question150: When users connect to the Mobile Access portal they are unable to open File Shares.
Which log file would you want to examine?

Question151: In the Firewall chain mode FFF refers to:

Question152: How long may verification of one file take for Sandblast Threat Emulation?