EMT Practice Test

1. Question Content...

---

Question1: What is the best sync method in the ClusterXL deployment?

Question2: Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?

Question3: What cloud-based SandBlast Mobile application is used to register new devices and users?

Question4: One of major features in R80 SmartConsole is concurrent administration.
Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?

Question5: What does the Log "Views" tab show when SmartEvent is Correlating events?

Question6: What is correct statement about Security Gateway and Security Management Server failover in Check Point R80.X in terms of Check Point Redundancy driven solution?

Question7: Automation and Orchestration differ in that:

Question8: Which feature is NOT provided by all Check Point Mobile Access solutions?

Question9: Which is NOT an example of a Check Point API?

Question10: What scenario indicates that SecureXL is enabled?

Question11: What is the command to show SecureXL status?

Question12: Under which file is the proxy arp configuration stored?

Question13: Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal website, file share and emails?

Question14: Which statement is NOT TRUE about Delta synchronization?

Question15: How many layers make up the TCP/IP model?

Question16: John is using Management HA. Which Security Management Server should he use for making changes?

Question17: What key is used to save the current CPView page in a filename format cpview_"cpview process ID".cap"number of captures"?

Question18: NAT rules are prioritized in which order?
1. Automatic Static NAT
2. Automatic Hide NAT
3. Manual/Pre-Automatic NAT
4. Post-Automatic/Manual NAT rules

Question19: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ________ .

Question20: You need to change the number of firewall Instances used by CoreXL. How can you achieve this goal?

Question21: Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R80.X The Network Security Developer Team is having an issue testing the API with a newly deployed R80.X Security Management Server Aaron wants to confirm API services are working properly. What should he do first?

Question22: Which application should you use to install a contract file?

Question23: Which command would disable a Cluster Member permanently?

Question24: By default how often updates are checked when the CPUSE Software Updates Policy is set to Automatic?

Question25: What is not a component of Check Point SandBlast?

Question26: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?

Question27: The SmartEvent R80 Web application for real-time event monitoring is called:

Question28: For Management High Availability, which of the following is NOT a valid synchronization status?

Question29: Fill in the blanks. There are ________ types of software containers: ___________.

Question30: Tom has connected to the R80 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.
What will happen to the changes already made?

Question31: What is UserCheck?

Question32: What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?

Question33: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

Question34: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question35: What is the minimum amount of RAM needed for a Threat Prevention Appliance?

Question36: Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?

Question37: What command is used to manually failover a cluster during a zero downtime upgrade?

Question38: What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

Question39: With SecureXL enabled, accelerated packets will pass through the following:

Question40: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

Question41: After the initial installation on Check Point appliance, you notice that the Management-interface and default gateway are incorrect.
Which commands could you use to set the IP to 192.168.80.200/24 and default gateway to 192.168.80.1.

Question42: When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

Question43: In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:

Question44: Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Question45: If you needed the Multicast MAC address of a cluster, what command would you run?

Question46: Which two of these Check Point Protocols are used by SmartEvent Processes?

Question47: If SecureXL is disabled which path is used to process traffic?

Question48: Sieve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances Steve's manager. Diana asks him to provide firewall connection table details from one of the firewalls for which he is responsible. Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?

Question49: What is the command to check the status of the SmartEvent Correlation Unit?

Question50: What is the purpose of Priority Delta in VRRP?

Question51: What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

Question52: As an administrator, you may be required to add the company logo to reports. To do this, you would save the logo as a PNG file with the name 'cover-company-logo.png' and then copy that image file to which directory on the SmartEvent server?

Question53: SmartEvent does NOT use which of the following procedures to identify events:

Question54: Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

Question55: Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

Question56: When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

Question57: At what point is the Internal Certificate Authority (ICA) created?

Question58: Which TCP port does the CPM process listen on?

Question59: Which command will allow you to see the interface status?

Question60: How can SmartView application accessed?

Question61: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question62: SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Question63: How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

Question64: Which command can you use to verify the number of active concurrent connections?

Question65: You have existing dbedit scripts from R77. Can you use them with R80.10?

Question66: SandBlast agent extends 0 day prevention to what part of the network?

Question67: Which one of the following is true about Capsule Connect?

Question68: Which of these is an implicit MEP option?

Question69: If an administrator wants to add manual NAT for addresses now owned by the Check Point firewall, what else is necessary to be completed for it to function properly?

Question70: SmartEvent Security Checkups can be run from the following Logs and Monitor activity:

Question71: What Factor preclude Secure XL Templating?

Question72: Joey wants to upgrade from R75.40 to R80 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.
What is one of the requirements for his success?

Question73: Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. Which is NOT an option to adjust or configure?

Question74: The back end database for Check Point R80 Management uses:

Question75: Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

Question76: R80.10 management server can manage gateways with which versions installed?

Question77: Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

Question78: How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

Question79: Can multiple administrators connect to a Security Management Server at the same time?

Question80: How do Capsule Connect and Capsule Workspace differ?

Question81: What are types of Check Point APIs available currently as part of R80.10 code?

Question82: Kurt is planning to upgrade his Security Management Server to R80.X. What is the lowest supported version of the Security Management he can upgrade from?

Question83: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question84: Which two of these Check Point Protocols are used by SmartEvent Processes?

Question85: True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway.

Question86: Capsule Connect and Capsule Workspace both offer secured connection for remote users who are using their mobile devices. However, there are differences between the two.
Which of the following statements correctly identify each product's capabilities?

Question87: Which statement is most correct regarding about "CoreXL Dynamic Dispatcher"?

Question88: To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?

Question89: What is the correct command to observe the Sync traffic in a VRRP environment?

Question90: In the Check Point Security Management Architecture, which component(s) can store logs?

Question91: The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API command can he use in the script to achieve the requirement?

Question92: D18912E1457D5D1DDCBD40AB3BF70D5D
The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule based and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

Question93: What are the blades of Threat Prevention?

Question94: During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

Question95: Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic. However, in the Application Control policy layer, the default action is ______ all traffic.

Question96: While using the Gaia CLI. what is the correct command to publish changes to the management server?

Question97: Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

Question98: Where you can see and search records of action done by R80 SmartConsole administrators?

Question99: Which process handles connection from SmartConsole R80?

Question100: To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following command in Expert mode then reboot:

Question101: What solution is Multi-queue intended to provide?

Question102: Fill in the blank: The tool _____ generates a R80 Security Gateway configuration report.

Question103: What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?

Question104: Which of the following is a task of the CPD process?

Question105: Fill in the blank: The R80 feature _____ permits blocking specific IP addresses for a specified time period.

Question106: Fill in the blank: __________ information is included in "Full Log" tracking option, but is not included in "Log" tracking option?

Question107: Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______ .

Question108: Fill in the blanks: Gaia can be configured using the ______ or _____ .

Question109: What command can you use to have cpinfo display all installed hotfixes?

Question110: Which command is used to set the CCP protocol to Multicast?

Question111: Which member of a high-availability cluster should be upgraded first in a Zero downtime upgrade?

Question112: You pushed a policy to your gateway and you cannot access the gateway remotely any more. What command should you use to remove the policy from the gateway by logging in through console access?

Question113: When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events. What is this setting called and what are you defining?

Question114: Which of the following links will take you to the SmartView web application?

Question115: You have pushed policy to GW-3 and now cannot pass traffic through the gateway. As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?

Question116: What is the valid range for VRID value in VRRP configuration?

Question117: Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .

Question118: When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?

Question119: Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

Question120: GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

Question121: What API command below creates a new host with the name "New Host" and IP address of "192.168.0.10"?

Question122: Which 3 types of tracking are available for Threat Prevention Policy?

Question123: What is the base level encryption key used by Capsule Docs?

Question124: Which file gives you a list of all security servers in use, including port number?

Question125: Which of the following is NOT a type of Endpoint Identity Agent?

Question126: Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called:

Question127: What is the Implicit Clean-up Rule?

Question128: What SmartEvent component creates events?

Question129: Which command can you use to enable or disable multi-queue per interface?

Question130: To add a file to the Threat Prevention Whitelist, what two items are needed?

Question131: What are the steps to configure the HTTPS Inspection Policy?

Question132: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

Question133: What command verifies that the API server is responding?

Question134: You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.
How many cores can be used in a Cluster for Firewall-kernel on the new device?

Question135: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question136: In ClusterXL Load Sharing Multicast Mode:

Question137: Which is NOT a SmartEvent component?

Question138: The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?

Question139: You can access the ThreatCloud Repository from:

Question140: In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories. Which of the following is NOT an objects category?

Question141: When setting up an externally managed log server, what is one item that will not be configured on the R80 Security Management Server?

Question142: Which one of the following is true about Threat Emulation?

Question143: Pamela is Cyber Security Engineer working for Global Instance Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R80.10. Company's Developer Team is having random access issue to newly deployed Application Server in DMZ's Application Server Farm Tier and blames DMZ Security Gateway as root cause. The ticket has been created and issue is at Pamela's desk for an investigation. Pamela decides to use Check Point's Packet Analyzer Tool-fw monitor to iron out the issue during approved Maintenance window.
What do you recommend as the best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic?

Question144: You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the tight protections in place. Check Point has been selected for the security vendor.
Which Check Point product protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?

Question145: When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

Question146: What CLI command compiles and installs a Security Policy on the target's Security Gateways?

Question147: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

Question148: You notice that your firewall is under a DDoS attack and would like to enable the Penalty Box feature, which command you use?

Question149: How many interfaces can you configure to use the Multi-Queue feature?

Question150: Which view is NOT a valid CPVIEW view?

Question151: Which file contains the host address to be published, the MAC address that needs to be associated with the IP Address, and the unique IP of the interface that responds to ARP request?

Question152: Which of the following is NOT a type of Check Point API available in R80.x?

Question153: Which Check Point software blade provides Application Security and identity control?

Question154: What is required for a certificate-based VPN tunnel between two gateways with separate management systems?

Question155: What information is NOT collected from a Security Gateway in a Cpinfo?

Question156: When performing a minimal effort upgrade, what will happen to the network traffic?

Question157: Which software blade does NOT accompany the Threat Prevention policy?

Question158: When using CPSTAT, what is the default port used by the AMON server?

Question159: Connections to the Check Point R80 Web API use what protocol?

Question160: Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?

Question161: Please choose correct command to add an "emailserver1" host with IP address 10.50.23.90 using GAiA management CLI?

Question162: When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

Question163: The Security Gateway is installed on GAIA R80. The default port for the Web User interface is ______.

Question164: On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

Question165: Your manager asked you to check the status of SecureXL, and its enabled templates and features. What command will you use to provide such information to manager?

Question166: Which method below is NOT one of the ways to communicate using the Management API's?

Question167: To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot: