EMT Practice Test

1. Question Content...

---

Question1: On R80.10 the IPS Blade is managed by:

Question2: Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?

Question3: Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?

Question4: What is the SandBlast Agent designed to do?

Question5: What command all interface using Multi_queue?

Question6: There are 4 ways to use the Management API for creating host object with R80 Management API. Which one
is NOT correct?

Question7: When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?

Question8: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question9: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

Question10: Which statement is true regarding redundancy?

Question11: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

Question12: What happen when IPS profile is set in Detect Only Mode for troubleshooting?

Question13: You want to gather and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?

Question14: What happen when IPS profile is set in Detect Only Mode for troubleshooting?

Question15: What is the protocol and port used for Health Check and State Synchronization ClusterXL?

Question16: What are the blades of Threat Prevention?

Question17: What is the correct order of the default "fw monitor" inspection points?

Question18: What is the difference between an event and a log?

Question19: The Firewall kernel is replicated multiple times, therefore:

Question20: What component of R80 Management is used for indexing?

Question21: Using ClusterXL, what statement is true about the Sticky Decision Function?

Question22: In SmartEvent, what are different types of automatic reactions that the administrator can configure?

Question23: Which is NOT an example of a Check Point API?

Question24: What will be the effect of running the following command on the Security Management Server?

Question25: Which statement is NOT TRUE about Delta synchronization?

Question26: Which NAT rules are prioritized first?

Question27: You have existing dbedit scripts from R77. Can you use them with R80.10?

Question28: After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

Question29: Which of to the following is true about

Question30: You have successfully backed up Check Point configurations without the OS information. What command
would you use to restore this backup?

Question31: What are the blades of Threat Prevention?

Question32: Which software blade does NOT accompany the Threat Prevention policy?

Question33: You have a Geo-Protection policy blocking Australia and a number of other countries. Your network now requires a Check Point Firewall to be installed in Sydney, Australia.
What must you do to get SIC to work?

Question34: What are the main stages of a policy installation?

Question35: The Firewall kernel is replicated multiple times, therefore:

Question36: When installing a dedicated R80 SmartEvent server. What is the recommended size of the root partition?

Question37: Which features are only supported with R80.10 Gateways but not R77.x?

Question38: Which statement is most correct regarding about "CoreXL Dynamic Dispatcher"?

Question39: What state is the Management HA in when both members have different policies/databases?

Question40: Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

Question41: Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

Question42: Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows then as prioritized security events.

Question43: In the Firewall chain mode FFF refers to:

Question44: Which statement is correct about the sticky Decision function?

Question45: You have enabled "Full Log" as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?

Question46: What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

Question47: To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?

Question48: What is true about the IPS-Blade?

Question49: Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

Question50: What is the command to check the status of the SmartEvent Correlation Unit?

Question51: What kind of information would you expect to see using the sim affinity command?

Question52: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question53: Which of the following is NOT a type of Check Point API available in R80.x?

Question54: Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

Question55: Vanessa is firewall administrator in her company. Her company is using Check Point firewall on a central and several remote locations which are managed centrally by R77.30 Security Management Server. On central location is installed R77.30 Gateway on Open server. Remote locations are using Check Point UTM-1570 series appliances with R75.30 and some of them are using a UTM-1-Edge-X or Edge-W with latest available firmware. She is in process of migrating to R80.
What can cause Vanessa unnecessary problems, if she didn't check all requirements for migration to R80?

Question56: What processes does CPM control?

Question57: The Check Point history feature in R80 provides the following:

Question58: Which method below is NOT one of the ways to communicate using the Management API's?

Question59: Which statement is correct about the Sticky Decision Function?

Question60: You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down.
What command do you run to determine the cause?

Question61: Advanced Security Checkups can be easily conducted within:

Question62: What command verifies that the API server is responding?

Question63: Which tool is used to enable ClusterXL?

Question64: Fill in the blank: The R80 feature ________ permits blocking specific IP addresses for a specified time period.

Question65: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Question66: To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:

Question67: What is not a component of Check Point SandBlast?

Question68: Steve is a Cyber Security Engineer working for Global Bank with large scale deployment of Check point Enterprise Appliances. Steve's Manager-Diana asks him to provide ecommerce Firewall Connection Table details to Bank's SOC Team as well as Check Point Support Team. Which command will trigger heavy impact on the ecommerce Firewall performance and should be avoided by Steve?

Question69: Fill in the blank: The tool _____ generates a R80 Security Gateway configuration report.

Question70: After verifying that API Server is not running, how can you start the API Server?

Question71: What happen when IPS profile is set in Detect Only Mode for troubleshooting?

Question72: Which command can you use to verify the number of active concurrent connections?

Question73: Which command is used to set the CCP protocol to Multicast?

Question74: What is true of the API server on R80.10?

Question75: In the Firewall chain mode FFF refers to:

Question76: Which Check Point feature enables application scanning and the detection?

Question77: Which of the following Windows Security Events will not map a username to an IP address in Identity Awareness?

Question78: The security Gateway is installed on GAiA R80 The default port for the WEB User Interface is _______ .

Question79: Fill in the blank: The R80 feature ______ permits blocking specific IP addresses for a specific time period.

Question80: By default how often updates are checked when the CPUSE Software Updates Policy is set to Automatic?

Question81: Which command show the current connection distributed byCoreXL FW instances?

Question82: What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti- Virus, IPS, and Threat Emulation?

Question83: Advance Security Checkups can easily conducted with:

Question84: You need to change the number of firewall Instances used by CoreXL. How can you achieve this goal?

Question85:
You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.
What does this mean?

Question86: Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R80.10 SmartConsole application?

Question87: Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______ .

Question88: What component of R80 Management is used for indexing?

Question89: You can access the ThreatCloud Repository from:

Question90: What is a best practice before starting to troubleshooting using the ''fw monitor'' tool?

Question91: Which command is used to obtain the configuration lock in Gaia?

Question92: In ClusterXL Load Sharing Multicast Mode:

Question93: Advanced Security Checkups can be easily conducted within:

Question94: When simulating a problem on ClusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?

Question95: Which of the SecureXL templates are enabled by default on Security Gateway?

Question96: ESTION NO: 255
Which NAT rules are prioritized first?

Question97: When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

Question98: What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

Question99: What is mandatory for ClusterXL to work properly?

Question100: CPM process stores objects, policies, users, administrators, licenses and management data in a database.
The database is:

Question101: To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?

Question102: Which of the following authentication methods ARE NOT used for Mobile Access?

Question103: How many interfaces can you configure to use the Multi-Queue feature?

Question104: Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

Question105: On the following picture an administrator configures Identity Awareness:

After clicking "Next" the above configuration is supported by:

Question106: Which Check point software blades cloud be enforced under Threat Prevention profile using
Point1R80.10 SmartConsole application?

Question107: GAiA Software update packages can be imported and installed offline in situation where:

Question108: Which command will allow you to see the interface status?

Question109: Which is not a blade option when configuring SmartEvent?

Question110: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question111: What is the SandBlast Agent designed to do?

Question112: Which component is NOT required to communicate with the Web Services API?

Question113: What is considered Hybrid Emulation Mode?

Question114: Where you can see and search records of action done by R80 SmartConsole administrators?

Question115: Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal
website, file share and emails?

Question116: To verify enable Dynamic Dispatcher on a Security Gateway:

Question117: What is the purpose of Priority Delta in VRRP?

Question118: Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?

Question119: The Correlation Unit performs all but the following actions:

Question120: Which of the following links will take you to the SmartView web application?

Question121: Check Point APIs allow system engineers and developers to make changes to their organization's security policy with CLI tools and Web Services for all the following except:

Question122: Which is the correct order of a log flow processed by SmartEvent components?

Question123: Which Check point software blades cloud be enforced under Threat Prevention profile using Point1R80.10 SmartConsole application?

Question124: Automation and Orchestration differ in that:

Question125: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question126: By default how often updates are checked when the CPUSE Software Updates Policy is set to Automatic?

Question127: Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

Question128: When deploying Sandblast, how would a Threat Emulation appliance be benefits from the integration of
threatCloud?

Question129: The "Hit count" feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits if the Track option is set to "None"?

Question130: John is using Management HA. Which Security Management Server should he use for making changes?

Question131: Which is NOT an example of a Check Point API?

Question132: What is the valid range for VRID value in VRRP configuration?

Question133: Which process is available on any management product and on products that require direct GUI access, such
as SmartEvent and provides GUI client communications, database manipulation, policy compilation and
Management HA synchronization?

Question134: Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic.
However, in the Application Control policy layer, the default action is ______ all traffic.

Question135: Which blades and or features are not supported in R80?

Question136: As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

Question137: Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?

Question138: What is the limitation of Employing Stickly Function?

Question139: You plan to automate creating new objects using new R80 Management API. You decide to use GAIA CLI for this task.
What is the first step to run management API commands on GAIA's shell?

Question140: NAT rules are prioritized in which order?
1. Automatic Static NAT
2. Automatic Hide NAT
3. Manual/Pre-Automatic NAT
4. Post-Automatic/Manual NAT rules

Question141: SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's
machine via the web browser. What are the two modes of SNX?

Question142: What two ordered layers make up the Access Control Policy Layer?

Question143: Which Check Point feature enables application scanning and the detection?

Question144: SmartConsole R80 x requires the following ports to be open for SmartEvent.

Question145: SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data.
Which component is NOT part of the SandBlast Mobile solution?

Question146: Which command collects diagnostic data for analyzing customer setup remotely?

Question147: What has to be taken into consideration when configuring Management HA?

Question148: Which statement is correct about the Sticky Decision Function?

Question149: What are the blades of Threat Prevention?

Question150: Which command can you use to verify the number of active concurrent connections?

Question151: Which command will allow you to see the interface status?

Question152: Which command lists all tables in Gaia?

Question153: The Firewall kernel is replicated multiple times, therefore:

Question154: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

Question155: When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

Question156: Office mode means that:

Question157: SmartEvent does NOT use which of the following procedures to identify events:

Question158: When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?

Question159: Which of the following is NOT supported by CPUSE?

Question160: What is the SandBlast Agent designed to do?

Question161: To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following
command in Expert mode then reboot:

Question162: What is the benefit of Manual NAT over Automatic NAT?

Question163: You have successfully backed up Check Point configurations without the OS information.
What command
would you use to restore this backup?

Question164: In R80 spoofing is defined as a method of:

Question165: You are asked to check the status of several user-mode processes on the management server and gateway.
Which of the following processes can only be seen on a Management Server?