EMT Practice Test

1. Question Content...

---

Question1: Which of the following is NOT an option to calculate the traffic direction?

Question2: What are the different command sources that allow you to communicate with the API server?

Question3: Check Point ClusterXL Active/Active deployment is used when:

Question4: Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

Question5: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

Question6: You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.
How many cores can be used in a Cluster for Firewall-kernel on the new device?

Question7: Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .

Question8: John detected high load on sync interface. Which is most recommended solution?

Question9: Which file contains the host address to be published, the MAC address that needs to be associated with the IP Address, and the unique IP of the interface that responds to ARP request?

Question10: When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

Question11: The Correlation Unit performs all but the following actions:

Question12: NAT rules are prioritized in which order?
1. Automatic Static NAT
2. Automatic Hide NAT
3. Manual/Pre-Automatic NAT
4. Post-Automatic/Manual NAT rules

Question13: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question14: On the following picture an administrator configures Identity Awareness:

After clicking "Next" the above configuration is supported by:

Question15: How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

Question16: Which command is used to obtain the configuration lock in Gaia?

Question17: Please choose the path to monitor the compliance status of the Check Point R80.10 based management.

Question18: If SecureXL is disabled which path is used to process traffic?

Question19: CPM process stores objects, policies, users, administrators, licenses and management data in a database. The database is:

Question20: What are the two high availability modes?

Question21: What is true about the IPS-Blade?

Question22: View the rule below. What does the lock-symbol in the left column mean? (Choose the BEST answer.)

Question23: What CLI command compiles and installs a Security Policy on the target's Security Gateways?

Question24: What statement best describes the Proxy ARP feature for Manual NAT in R80.10?

Question25: How many interfaces can you configure to use the Multi-Queue feature?

Question26: UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users. Which action is not supported in UserCheck objects?

Question27: Fill in the blank: Identity Awareness AD-Query is using the Microsoft _______________ API to learn users from AD.

Question28: Which of the following will NOT affect acceleration?

Question29: Check Point security components are divided into the following components:

Question30: What is the most recommended way to install patches and hotfixes?

Question31: Where do you create and modify the Mobile Access policy in R80?

Question32: What is the purpose of Priority Delta in VRRP?

Question33: What component of R80 Management is used for indexing?

Question34: Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

Question35: What is the purpose of extended master key extension/session hash?

Question36: What Factor preclude Secure XL Templating?

Question37: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

Question38: Which is not a blade option when configuring SmartEvent?

Question39: Which is NOT a SmartEvent component?

Question40: When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

Question41: Which tool is used to enable ClusterXL?

Question42: In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with __________________ will not apply.

Question43: In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a response before the peer host is declared 'down', you would set the_________?

Question44: In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Question45: Which member of a high-availability cluster should be upgraded first in a Zero downtime upgrade?

Question46: You can access the ThreatCloud Repository from:

Question47: Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

Question48: Which Check Point feature enables application scanning and the detection?

Question49: Which blades and or features are not supported in R80?

Question50: Which command shows the current connections distributed by CoreXL FW instances?

Question51: Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or ______ .

Question52: What needs to be configured if the NAT property 'Translate destination or client side' is not enabled in Global Properties?

Question53: To add a file to the Threat Prevention Whitelist, what two items are needed?

Question54: What is the mechanism behind Threat Extraction?

Question55: Which firewall daemon is responsible for the FW CLI commands?

Question56: SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

Question57: In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

Question58: Which command is used to set the CCP protocol to Multicast?

Question59: How many policy layers do Access Control policy support?

Question60: John is using Management HA. Which Smartcenter should be connected to for making changes?

Question61: What does the Log "Views" tab show when SmartEvent is Correlating events?

Question62: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question63: For Management High Availability, which of the following is NOT a valid synchronization status?

Question64: John detected high load on sync interface. Which is most recommended solution?

Question65: Fill in the blank: The R80 feature _____ permits blocking specific IP addresses for a specified time period.

Question66: Which software blade does NOT accompany the Threat Prevention policy?

Question67: SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data. Which component is NOT part of the SandBlast Mobile solution?

Question68: Under which file is the proxy arp configuration stored?

Question69: Automation and Orchestration differ in that:

Question70: Which GUI client is supported in R80?

Question71: Which of the following links will take you to the SmartView web application?

Question72: What is the benefit of "tw monitor" over "tcpdump"?

Question73: You want to store the GAIA configuration in a file for later reference. What command should you use?

Question74: Which file gives you a list of all security servers in use, including port number?

Question75: Session unique identifiers are passed to the web api using which http header option?

Question76: How is communication between different Check Point components secured in R80? As with all questions, select the BEST answer.

Question77: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question78: What has to be taken into consideration when configuring Management HA?

Question79: What is the difference between SSL VPN and IPSec VPN?

Question80: If there are two administration logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available or other administrators? (Choose the BEST answer.)

Question81: What is the main difference between Threat Extraction and Threat Emulation?

Question82: GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

Question83: When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?

Question84: What key is used to save the current CPView page in a filename format cpview_"cpview process ID".cap"number of captures"?

Question85: You are asked to check the status of several user-mode processes on the management server and gateway. Which of the following processes can only be seen on a Management Server?

Question86: SandBlast appliances can be deployed in the following modes:

Question87: Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible. Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

Question88: Which statement is NOT TRUE about Delta synchronization?

Question89: Which command can you use to verify the number of active concurrent connections?

Question90: Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?

Question91: Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

Question92: What is the default shell for the command line interface?

Question93: What is the SOLR database for?

Question94: If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsive, which if these steps should NOT be performed:

Question95: When setting up an externally managed log server, what is one item that will not be configured on the R80 Security Management Server?

Question96: Choose the correct syntax to add a new host named "emailserver1" with IP address 10.50.23.90 using GAiA Management CLI?

Question97: What is the valid range for VRID value in VRRP configuration?

Question98: Which is NOT an example of a Check Point API?

Question99: On what port does the CPM process run?

Question100: Which options are given on features, when editing a Role on Gaia Platform?

Question101: What are the steps to configure the HTTPS Inspection Policy?

Question102: You want to gather and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?

Question103: What command verifies that the API server is responding?

Question104: You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the FWD daemon to do a Full Synchronization?

Question105: Which path below is available only when CoreXL is enabled?

Question106: What is the purpose of a SmartEvent Correlation Unit?

Question107: Which of the following technologies extracts detailed information from packets and stores that information in state tables?

Question108: An administrator would like to troubleshoot why templating is not working for some traffic. How can he determine at which rule templating is disabled?

Question109: What destination versions are supported for a Multi-Version Cluster Upgrade?

Question110: SmartEvent does NOT use which of the following procedures to identify events:

Question111: After the initial installation on Check Point appliance, you notice that the Management-interface and default gateway are incorrect.
Which commands could you use to set the IP to 192.168.80.200/24 and default gateway to 192.168.80.1.

Question112: To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Question113: Which of the following statements is TRUE about R80 management plug-ins?

Question114: The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.
What is the most likely reason that the traffic is not accelerated?

Question115: You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the tight protections in place. Check Point has been selected for the security vendor.
Which Check Point product protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?

Question116: What will SmartEvent automatically define as events?

Question117: R80.10 management server can manage gateways with which versions installed?

Question118: What are the available options for downloading Check Point hotfixes in Gala WebUI (CPUSE)?

Question119: Which command lists all tables in Gaia?

Question120: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question121: What is the benefit of Manual NAT over Automatic NAT?

Question122: In the Check Point Security Management Architecture, which component(s) can store logs?

Question123: Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R80.X The Network Security Developer Team is having an issue testing the API with a newly deployed R80.X Security Management Server Aaron wants to confirm API services are working properly. What should he do first?

Question124: You have pushed policy to GW-3 and now cannot pass traffic through the gateway. As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?

Question125: Which Check Point software blade provides Application Security and identity control?

Question126: In terms of Order Rule Enforcement, when a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom Which of the following statements is correct?

Question127: For best practices, what is the recommended time for automatic unlocking of locked admin accounts?

Question128: You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.
What must you do to get SIC to work?

Question129: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?

Question130: What kind of information would you expect to see using the sim affinity command?

Question131: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Question132: In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories. Which of the following is NOT an objects category?

Question133: You have successfully backed up Check Point configurations without the OS information. What command would you use to restore this backup?

Question134: At what point is the Internal Certificate Authority (ICA) created?

Question135: What is the base level encryption key used by Capsule Docs?

Question136: What command lists all interfaces using Multi-Queue?

Question137: You want to verify if your management server is ready to upgrade to R80.10. What tool could you use in this process?

Question138: In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

Question139: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question140: In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

Question141: How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

Question142: Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.
Which component of SandBlast protection is her company using on a Gateway?

Question143: Identify the API that is not supported by Check Point currently.

Question144: Which utility allows you to configure the DHCP service on Gaia from the command line?

Question145: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question146: Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called:

Question147: What is true of the API server on R80.10?

Question148: Which of the following commands shows the status of processes?

Question149: Fill in the blank: Authentication rules are defined for ________ .

Question150: Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Question151: SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's machine via the web browser. What are the two modes of SNX?

Question152: D18912E1457D5D1DDCBD40AB3BF70D5D
The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule based and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

Question153: You plan to automate creating new objects using new R80 Management API. You decide to use GAIA CLI for this task.
What is the first step to run management API commands on GAIA's shell?

Question154: You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or _____ action for the file types.

Question155: What is a best practice before starting to troubleshoot using the "fw monitor" tool?

Question156: Joey wants to upgrade from R75.40 to R80 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.
What is one of the requirements for his success?

Question157: What is considered Hybrid Emulation Mode?

Question158: Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

Question159: What is UserCheck?