Question1: Which process is used mainly for backward compatibility of gateways in R80.X? It provides communication with GUI-client, database manipulation, policy compilation and Management HA synchronization.
Question2: Which statement is true regarding redundancy?
Question3: Which one of the following is true about Threat Emulation?
Question4: In the Firewall chain mode FFF refers to:
Question5: SmartEvent does NOT use which of the following procedures to identify events:
Question6: How would you deplue TE250x Check Point appliance h=just for email traffic and inline mode without a Check point Security Gateway?
Question7: On R80.10 the IPS Blade is managed by:
Question8: How do you enable virtual mac (VMAC) on-the-fly on a cluster member?
Question9: In R80 spoofing is defined as a method of :
Question10: Which is NOT an example of a Check Point API?
Question11: Your manager asked you to check the status of SecureXL, and its enabled templates and features. What command will you use to provide such information to manager?
Question12: Which command lists all tables in Gaia?
Question13: To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:
Question14: Advance Security Checkups can easily conducted with:
Question15: To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?
Question16: After trust has been established between the Check Point components, what is TRUE about name and IP- address changes?
Question17: On what port does the CPM process run?
Question18: Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?
Question19: Which view is NOT a valid CPVIEW view?
Question20: What is true of the API server on R80.10?
Question21: Check point recommends configuring Disk Management parameters to delete old log available disk space is less than or equal to?
Question22: What command is used to manually failover a cluster during a zero downtime upgrade?
Question23: To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?
Question24: Fill in the blank: The R80 utility fw monitor is used to troubleshoot ________.
Question25: What command is used to manually failover a Multi-Version Cluster during the upgrade?
Question26: Which statements below are CORRECT regarding Threat Prevention profiles in SmartDashboard?
Question27: The back end database for Check Point R80 Management uses:
Question28: Fill in the blank: Authentication rules are defined for ________ .
Question29: Which command is used to set the CCP protocol to Multicast?
Question30: In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of
traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with
__________________ will not apply.
Question31: In what way is Secure Distribute (SND) a relevant feature if the security gateway?
Question32: Which Check Point daemon monitors the other daemons?
Question33: What traffic does the Anti-bot feature block?
Question34: CoreXL is supported when one of the following features is enabled:
Question35: Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.
Question36: Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal
website, file share and emails?
Question37: Which statement is true regarding redundancy?
Question38: Which VPN routing option uses VPN routing for every connection a satellite gateway handles?
Question39: Using ClusterXL, what statement is true about the Sticky Decision Function?
Question40: At what point is the Internal Certificate Authority (ICA) created?
Question41: Packet acceleration (SecureXL) identifies connections by several attributes- Which of the attributes is NOT used for identifying connection?
Question42: You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the tight protections in place. Check Point has been selected for the security vendor.
Which Check Point product protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?
Question43: What is the purpose of the CPCA process?
Question44: Which command collects diagnostic data for analyzing customer setup remotely?
Question45: When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?
Question46: Which command is used to obtain the configuration lock in Gaia?
Question47: You have existing dbedit scripts from R77. Can you use them with R80.10?
Question48: What are the blades of Threat Prevention?
Question49: Which command lists all tables in Gaia?
Question50: When SecureXL is enabled, all packets should be accelerated, except packets that match the following
conditions:
Question51: R80.10 management server can manage gateways with which versions installed?
Question52: Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port. Which CLISH commands are required to be able to change this TCP port?
Question53: Automation and Orchestration differ in that:
Question54: If the Active Security Management Server fails or if it becomes necessary to change the active to
standby, the following steps must be taken to prevent data loss. Providing the active Security
management server is responsive, which if these steps should NOT be performed:
Question55: 
You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.
What does this mean?
Question56: What two ordered layers make up the Access Control Policy Layer?
Question57: In the Firewall chain mode FFF refers to:
Question58: Fill in the blank: A ________ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser.
Question59: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.
Question60: Check Point Management (cpm) is the main management process in that it provides the architecture for a
consolidates management console. CPM allows the GUI client and management server to communicate via
web services using ___________.
Question61: Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?
Question62: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when
the management server is not connected to the Internet?
Question63: Fill in the blank. The R80 feature ___________________ permits blocking specific IP addresses for a specified time period.
Question64: Which Check Point daemon monitors the other daemons?
Question65: Which of the following is NOT supported by CPUSE?
Question66: CoreXL is supported when one of the following features is enabled:
Question67: Identify the API that is not supported by Check Point currently.
Question68: Which VPN routing option uses VPN routing for every connection a satellite gateway handles?
Question69: To add a file to the Threat Prevention Whitelist, what two items are needed?
Question70: Which statement is true about ClusterXL?
Question71: What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?
Question72: What is the limitation of employing Sticky Decision Function?
Question73: When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?
Question74: What are the main stages of a policy installations?
Question75: When deploying Sandblast, how would a Threat Emulation appliance be benefits from the integration of threatCloud?
Question76: What is the valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration?
Question77: You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down. What command do you run to determine the cause?
Question78: You need to change the number of firewall Instances used by CoreXL. How can you achieve this goal?
Question79: To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following
command in Expert mode then reboot:
Question80: To fully enable Dynamic Dispatcher on a Security Gateway:
Question81: In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories. Which of the following is NOT an objects category?
Question82: In the Firewall chain mode FFF refers to:
Question83: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?
Question84: What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti- Virus, IPS, and Threat Emulation?
Question85: What is UserCheck?
Question86: Which CLI command will reset the IPS pattern matcher statistics?
Question87: During Inspection of your Threat Prevention logs you find four different computers having one event each with a critical Severity. Which of those host should you try to remediate first?
Question88: Which statement is correct about the Sticky Decision Function?
Question89: Which CLI command will reset the IPS pattern matcher statistics?
Question90: Why would an administrator see the message below?
Question91: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?
Question92: Which features are only supported with R80.10 Gateways but not R77.x?
Question93: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?
Question94: Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows then as prioritized security events.
Question95: Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal website, file share and emails?
Question96: The following command is used to verify the CPUSE version:
Question97: Joey want to configure NTP on R80 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?
Question98: Which command is used to add users to or from existing roles?
Question99: The Firewall kernel is replicated multiple times, therefore:
Question100: Which CLI command will reset the IPS pattern matcher statistics?
Question101: What are the main stages of a policy installation?
Question102: The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.
What is the most likely reason that the traffic is not accelerated?
Question103: Your manager asked you to check the status of SecureXL, and its enabled templates and features. What command will you use to provide such information to manager?
Question104: What is the difference between SSL VPN and IPSec VPN?
Question105: What is true about VRRP implementations?
Question106: Fill in the blank: The R80 utility fw monitoris used to troubleshoot ________.
Question107: Can multiple administrators connect to a Security Management Server at the same time?
Question108: When doing a Stand-Alone Installation, you would install the Security Management Server with which other
Check Point architecture component?
Question109: You are working with multiple Security enforcing an extensive number of rules. To simplify security administration, which action you chose?
Question110: What is true about VRRP implementations?
Question111: How is communication between different Check Point components secured in R80? As with all questions, select the BEST answer.
Question112: Fill in the blank: Authentication rules are defined for ________ .
Question113: With Mobile Access enabled, administrators select the web-based and native applications that can be
accessed by remote users and define the actions that users can perform within the applications. Mobile
Access encrypts all traffic using:
Question114: What is the mechanism behind Threat Extraction?
Question115: What are the different command sources that allow you to communicate with the API server?
Question116: What is the command to check the status of the SmartEvent Correlation Unit?
Question117: What is the mechanism behind Threat Extraction?
Question118: Fill in the blank: The R80 feature _____ permits blocking specific IP addresses for a specified time period.
Question119: What is the purpose of a SmartEvent Correlation Unit?
Question120: You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.
What must you do to get SIC to work?
Question121: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?
Question122: SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data. Which component is NOT part of the SandBlast Mobile solution?
Question123: In order to get about assignment (FW,SND) of all CPUSs in your SGW, what is the most accurate CLI command?
Question124: Which is not a blade option when configuring SmartEvent?
Question125: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?
Question126: Which statement is not TRUE about Default synchronization?
Question127: What are the attributes that secureXL will after the connection is allowed by Secure policy?
Question128: Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?
Question129: For Management High Availability, which of the following is NOT a valid synchronization status?
Question130: Which command is used to display status information for various components?
Question131: Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?
Question132: What has to be taken into consideration when configuring Management HA?
Question133: To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?
Question134: Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________ .
Question135: Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?
Question136: What two ordered layers make up the Access Control Policy Layer?
Question137: What makes Anti-Bot unique compared to gather Threate Prevention mechanisms, Such as URL Filtering Anti-Virus, IPS and Threat Emulation?
Question138: Fill in the blank: Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or ______ .
Question139: How would you enable VMAC Mode in ClusterXL?
Question140: What CLI command compiles and installs a Security Policy on the target's Security Gateways?
Question141: How many images are included with Check Point TE appliance in Recommended Mode?
Question142: With Mobile Access enabled, administrators select the web-based and native applications that can be accessed
by remote users and define the actions that users can perform the applications. Mobile Access encrypts all
traffic using:
Question143: What destination versions are supported for a Multi-Version Cluster Upgrade?
Question144: Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?
Question145: Which files below are NOT core dump files when debugging the security Acceleration Module card?
Question146: Which Check Point daemon monitors the other daemons?
Question147: You are working with multiple Security Gateways enforcing an extensive number of rules.
To simplify security administration, which action would you choose?
Question148: When a packet arrives at the gateway, the gateway checks it against the rules in the hop Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?
Question149: On R80.10 when configuring Third-Party devices o read the logs using the LEA (Log Export API) the default Log Server uses port:
Question150: The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic method. How many times per day will cpuse agent check for hotfixes and automatically download them?
Question151: What is the valid range for VRID value in VRRP configuration?
Question152: How can SmartView application accessed?
Question153: How many interfaces can you configure to use the Multi-Queue feature?
Question154: To verify enable Dynamic Dispatcher on a Security Gateway:
Question155: Which is not a blade option when configuring SmartEvent?
Question156: When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or _______.
Question157: What command verifies that the API server is responding?
Question158: The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API commands can use in the script to achieve the requirement?
Question159: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?
Question160: To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab. How many options are available to calculate the traffic direction?
Question161: Under which file is the proxy arp configuration stored?
Question162: Which Check Point feature enables application scanning and the detection?
Question163: What command lists all interfaces using Multi-Queue?
Question164: What is the command to check the status of the SmartEvent Correlation Unit?
Question165: What CLI utility runs connectivity tests from a Security Gateway to an AD domain controller?
Question166: What are types of Check Point APIs available currently as part of R80.10 code?
Question167: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priorities Queues and fully enable Dynamic Dispatcher. How can you enable them?
Question168: In terms of Order Rule Enforcement, when a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom Which of the following statements is correct?
Question169: What is not a purpose of the deployment of Check Point API?
Question170: What is mandatory for ClusterXL to work properly?
Question171: What is the command used to activated Multi-Version Cluster mode?
Question172: View the rule below. What does the lock-symbol in the left column mean? (Choose the BEST answer.)
Question173: How do Capsule Connect and Capsule Workspace differ?
Question174: Capsule Connect and Capsule Workspace both offer secured connection for remote users who are using their mobile devices. However, there are differences between the two.
Which of the following statements correctly identify each product's capabilities?
Question175: Which GUI client is supported in R80?
Question176: When installing a dedicated R80 SmartEvent server. What is the recommended size of the root partition?
Question177: The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic
method. How many times per day will cpuse agent check for hotfixes and automatically download
them?
Question178: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one
is NOT correct?
Question179: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ________
.
Question180: To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab. How many options are available to calculate the traffic direction?
Question181: The Firewall kernel is replicated multiple times, therefore:
Question182: When gathering information about a gateway using CPINFO, what information is included or excluded when
using the "-x" parameter?
Question183: What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?
Question184: Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every
Question185: What is considered Hybrid Emulation Mode?
Question186: When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?
Question187: Which of the following is a task of the CPD process?
Question188: Which of the following technologies extracts detailed information from packets and stores that information in state tables?
Question189: What happen when IPS profile is set in Detect Only Mode for troubleshooting?
Question190: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?
Question191: What are the two high availability modes?
Question192: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .
Question193: NAT rules are prioritized in which order?
1. Automatic Static NAT
2. Automatic Hide NAT
3. Manual/Pre-Automatic NAT
4. Post-Automatic/Manual NAT rules
Question194: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?
Question195: You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile
defines a(n) _____ or ______ action for the file types.
Question196: Which of the following technologies extracts detailed information from packets and stores that information in state tables?
Question197: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .
Question198: Which of the following is NOT a type of Check Point API available in R80.10?
Question199: SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?
Question200: What is true about VRRP implementations?
Question201: Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?
Question202: Which command collects diagnostic data for analyzing customer setup remotely?
Question203: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ________
.
Question204: What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)
Question205: What is the valid range for VRID value in VRRP configuration?
Question206: Which statement is NOT TRUE about Delta synchronization?
Question207: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session
without employing Stateful Inspection?
Question208: What is true about the IPS-Blade?
Question209: Which CLI allows you to run connectivity tests from the Security to an AD domain controller?
Question210: Installations and upgrades with CPUSE require that the CPUSE agent is up-to-date. Usually the latest build is downloaded automatically. How can you verify the CPUSE agent build?
Question211: What level of CPU load on a Secure Network Distributor would indicate that another may be necessary?
Question212: Please choose the path to monitor the compliance status of the Check Point R80.10 based management.
Question213: You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down.
What command do you run to determine the cause?
Question214: What is the default shell of Gaia CLI?
Question215: Fill in the blank: The tool _____ generates a R80 Security Gateway configuration report.
Question216: Which command lists all tables in Gaia?
Question217: Which Check Point software blades could be enforced under Threat Prevention profile using Check Point
R80.10 SmartConsole application?
Question218: An administrator would like to troubleshoot why templating is not working for some traffic. How can he determine at which rule templating is disabled?
Question219: What Factors preclude Secure XL Templating?
Question220: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?
Question221: : 146
To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?
Question222: Which one of the following is true about Capsule Connect?
Question223: Steve is a Cyber Security Engineer working for Global Bank with large scale deployment of Check point Enterprise Appliances. Steve's Manager-Diana asks him to provide ecommerce Firewall Connection Table details to Bank's SOC Team as well as Check Point Support Team. Which command will trigger heavy impact on the ecommerce Firewall performance and should be avoided by Steve?
Question224: The following command is used to verify the CPUSE version:
Question225: What SmartEvent component creates events?
Question226: In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a response before the peer host is declared 'down', you would set the_________?
Question227: What has to be taken into consideration when configuring Management HA?
Question228: Which statement is true about ClusterXL?
Question229: if a ''ping-packet is dropped by FW1 policy-on how many inspection points do you see this packet in ''fw monitor''?
Question230: What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?
Question231: Check Point Management (cpm) is the main management process in that it provides the architecture for a
consolidated management console. It empowers the migration from legacy Client-side logic to Server-side
logic. The cpm process:
Question232: Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic. However, in the Application Control policy layer, the default action is ______ all traffic.
Question233: View the rule below. What does the lock-symbol in the left column mean? (Choose the BEST answer.)
Question234: Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?
Question235: To fully enable Dynamic Dispatcher on a Security Gateway:
Question236: After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?
Question237: Office mode means that:
Question238: In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with
__________________ will not apply.
Question239: When simulating a problem on ClusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a
failover on an active cluster member, what command allows you remove the problematic state?
Question240: Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?
Question241: What does the Log "Views" tab show when SmartEvent is Correlating events?
Question242: CPM process stores objects, policies, users, administrators, licenses and management data in a database. The database is:
Question243: Which of the following is NOT an attribute of packet acceleration?
Question244: What is true VRRP implementation?
Question245: When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?
Question246: Which command collects diagnostic data for analyzing customer setup remotely?
Question247: What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?
Question248: Fill in the blank: The tool ________ generates a R80 Security Gateway configuration report.
Question249: One of major features in R80 SmartConsole is concurrent administration.
Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?
Question250: Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?
Question251: Which features are only supported with R80.10 Gateways but not R77.x?
Question252: The following command is used to verify the CPUSE version:
Question253: How is communication between different Check Point components secured in R80? As with all questions, select the BEST answer.
Question254: Which command is used to display status information for various components?
Question255: Packet acceleration (SecureXL) identifies connections by several attributes- Which of the attributes is NOT used for identifying connection?
Question256: When performing a minimal effort upgrade, what will happen to the network traffic?
Question257: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:
Question258: Which one of the following is true about Threat Emulation?
Question259: In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with ____________ will not apply.
Question260: Steve is a Cyber Security Engineer working for Global Bank with a large scale deployment of Check Point Enterprise Appliances. Steve's manager, Diana, asks him to provide firewall connection table details from one of the firewalls for which he is responsible. Which of these commands may impact performance briefly and should not be used during heavy traffic times of day?
Question261: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?
Question262: From SecureXL perspective, what are the tree paths of traffic flow:
Question263: To fully enable Dynamic Dispatcher on a Security Gateway:
Question264: As an administrator, you may be required to add the company logo to reports. To do this, you would save the
logo as a PNG file with the name 'cover-company-logo.png' and then copy that image file to which directory
on the SmartEvent server?
Question265: Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?
Question266: Which of the following is NOT a component of Check Point Capsule?
Question267: You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.
How many cores can be used in a Cluster for Firewall-kernel on the new device?
Question268: Which two of these Check Point Protocols are used by SmartEvent Processes?
Question269: Which blades and or features are not supported in R80?
Question270: After verifying that API Server is not running, how can you start the API Server?
Question271: Which of the following authentication methods ARE NOT used for Mobile Access?
Question272: When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.
Question273: What is the command to check the status of Check Point processes?
Question274: What is the valid range for VRID value in VRRP configuration?
Question275: Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?
Question276: SmartEvent uses it's event policy to identify events. How can this be customized?
Question277: Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows then as prioritized security events.
Question278: You have a Geo-Protection policy blocking Australia and a number of the countries. You network now requires a Check point Firewall to be installed in Sydney, Australia. What must you do to get SIC to work?
Question279: SmartEvent uses it's event policy to identify events. How can this be customized?
Question280: Which TCP-port does CPM process listen to?
Question281: Which remote Access Solution is clientless?
Question282: Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?
Question283: What is the mechanism behind Threat Extraction?
Question284: How many policy layers do Access Control policy support?
Question285: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?
Question286: Which of the following is a task of the CPD process?
Question287: Which commands can you use to verify the member of active concurrent connections?
Question288: The Correlation Unit performs all but the following actions:
Question289: Which TCP port does the CPM process listen on?
Question290: What is the order of NAT priorities?
Question291: Which feature is NOT provided by all Check Point Mobile Access solutions?
Question292: Steve is a Cyber Security Engineer working for Global Bank with large scale deployment of Check point
Enterprise Appliances. Steve's Manager-Diana asks him to provide ecommerce Firewall Connection
Table details to Bank's SOC Team as well as Check Point Support Team. Which command will trigger
heavy impact on the ecommerce Firewall performance and should be avoided by Steve?
Question293: Which Check Point software blade provides Application Security and identity control?
Question294: Fill in the blank: Identity Awareness AD-Query is using the Microsoft _______________ API to learn users from AD.
Question295: What are the blades of Threat Prevention?
Question296: Which command can you use to enable or disable multi-queue per interface?
Question297: Ken wants to obtain a configuration lock from other administrator on R80 Security Management Server. He can do this via WebUI or via CLI.
Which command should he use in CLI? (Choose the correct answer.)
Question298: SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's machine via the web browser. What are the two modes of SNX?
Question299: Which of these is an implicit MEP option?
Question300: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?
Question301: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.
Question302: What is the valid range for VRID value in VRRP configuration?
Question303: What is the command to show SecureXL status?
Question304: Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.
Question305: Which application should you use to install a contract file?
Question306: Which Remote Access Client does not provide an Office-Mode Address?
Question307: Joey want to configure NTP on R80 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?
Question308: What is the Implicit Clean-up Rule?
Question309: 
What can we infer about the recent changes made to the Rule Base?
Question310: What solution is Multi-queue intended to provide?
Question311: Which command would you use to set the network interfaces' affinity in Manual mode?
Question312: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?
Question313: Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?
Question314: Which is NOT example of a check point API?
Question315: SmartEvent has several components that function together to track security threats. What is the function of the
Correlation Unit as a component of this architecture?
Question316: Which of the following is a task of the CPD process?
Question317: Which statement is most correct regarding about "CoreXL Dynamic Dispatcher"?
Question318: On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:
Question319: To help SmartEvent determine whether events originated internally you must define using the Initial Settings under General Settings in the Policy Tab. How many options are available to calculate the traffic direction?
Question320: Kurt is planning to upgrade his Security Management Server to R80.X. What is the lowest supported version of the Security Management he can upgrade from?
Question321: When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events. What is this setting called and what are you defining?
Question322: Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R80.X The Network Security Developer Team is having an issue testing the API with a newly deployed R80.X Security Management Server Aaron wants to confirm API services are working properly. What should he do first?
Question323: What will SmartEvent automatically define as events?
Question324: What is the protocol and port used for Health Check and State Synchronization ClusterXL?
Question325: You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or ______ action for the file types.
Question326: SandBlast offers busineses flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?
Question327: Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?
Question328: What is the difference between an event and a log?
Question329: Which command shows detailed information about VPN tunnels?
Question330: Aaron is a Cyber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GaiA R80.X. The Network Security Developer Team is having an issue testing the API with a newly deployed R80.X Security Management Server. Aaron wants to confirm API services are working properly. What should he do first?
Question331: Which of the following links will take you to the SmartView web application?
Question332: What is the difference between SSL VPN and IPSec VPN?
Question333: You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.
What must you do to get SIC to work?
Question334: What component of R80 Management is used for indexing?
Question335: Your manager asked you to check the status of SecureXL, and its enabled templates and features. What command will you use to provide such information to manager?
Question336: Which command shows detailed information about VPN tunnels?
Question337: What is the name of the secure application for Mail/Calendar for mobile devices?
Question338: What happen when IPS profile is set in Detect Only Mode for troubleshooting?
Question339: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?
Question340: Which command is used to obtain the configuration lock in Gaia?
Question341: Which of the SecureXL templates are enabled by default on Security Gateway?
Question342: To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following command in Expert mode then reboot:
Question343: You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the FWD deamon to do a Full synchronization?
Question344: On what port does the CPM process run?
Question345: Where you can see and search records of action done by R80 SmartConsole administrators?
Question346: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?
Question347: What is the port used for SmartConsole to connect to the Security Management Server?
Question348: Which command is used to set the CCP protocol to Multicast?
Question349: Check Point APIs allow system engineers and developers to make changes to their organization's security policy with CLI tools and Web Services for all the following except:
Question350: What is the limitation of employing Sticky Decision Function?
Question351: With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments. What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?
Question352: Which is not a blade option when configuring SmartEvent?
Question353: SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's machine via the web browser. What are the two modes of SNX?
Question354: Fill in the blank: The R80 feature _____ permits blocking specific IP addresses for a specified time period.
Question355: You have successfully backed up Check Point configurations without the OS information. What command
would you use to restore this backup?
Question356: What is the amount CPU cores required to enable CoreXL?
Question357: R80.10 management server can manage gateways with which versions installed?
Question358: Fill in the blank: The R80 utility fw monitor is used to troubleshoot ________.
Question359: You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the PWO daemon to do a Full Synchronization?
Question360: Which command collects diagnostic data for analyzing customer setup remotely?
Question361: Hit Count is a feature to track the number of connections that each rule matches, which one is not benefit of Hit Count.
Question362: When simulating a problem on ClusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?
Question363: TION NO: 249
Check Point security components are divided into the following components:
Question364: IF the first packet of an UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), what message is sent back through the kernel?
Question365: You want to gather and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?
Question366: SanBlast Mobile threats in mobile devices by using on-device, network and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data. Which components is not part of the SandBlast Mobile solution?
Question367: SmartConsole R80 x requires the following ports to be open for SmartEvent.
Question368: Which view is NOT a valid CPVIEW view?
Question369: Which command shows actual allowed connections in state table?
Question370: Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R80.10 SmartConsole application?
Question371: Check Point APIs allow system engineers and developers to make changes to their organization's security policy with CLI tools and Web Services for all the following except:
Question372: Hit Count is a feature to track the number of connections that each rule matches, which one is not benefit of Hit Count.
Question373: What is required for a certificate-based VPN tunnel between two gateways with separate management systems?
Question374: Which process handles connection from SmartConsole R80?
Question375: Which command can you use to enable or disable multi-queue per interface?
Question376: What happen when IPS profile is set in Detect Only Mode for troubleshooting?
Question377: Which of these statements describes the Check Point ThreatCloud?
Question378: When simulating a problem on ClusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?
Question379: Which method below is NOT one of the ways to communicate using the Management API's?
Question380: In R80 spoofing is defined as a method of:
Question381: What is true of the API server on R80.10?
Question382: You need to see which hotfixes are installed on your gateway, which command would you use?
Question383: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?