EMT Practice Test

1. Question Content...

---

Question1: Which features are only supported with R81.10 Gateways but not R77.x?

Question2: What processes does CPM control?

Question3: What is the valid range for VRID value in VRRP configuration?

Question4: Choose the correct syntax to add a new host named "emailserver1" with IP address 10.50.23.90 using GAiA Management CLI?

Question5: What is the best method to upgrade a Security Management Server to R81.x when it is not connected to the Internet?

Question6: Which command shows the current connections distributed by CoreXL FW instances?

Question7: What will be the effect of running the following command on the Security Management Server?

Question8: The WebUI offers several methods for downloading hotfixes via CPUSE except:

Question9: John detected high load on sync interface. Which is most recommended solution?

Question10: Which of the following links will take you to the SmartView web application?

Question11: Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client communications, database manipulation, policy compilation and Management HA synchronization?

Question12: Tom has connected to the R81 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.
What will happen to the changes already made?

Question13: Which two of these Check Point Protocols are used by SmartEvent Processes?

Question14: Joey want to configure NTP on R81 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?

Question15: Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port. Which CLISH commands are required to be able to change this TCP port?

Question16: What is the purpose of Priority Delta in VRRP?

Question17: You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.
What is the first step to run management API commands on GAIA's shell?

Question18: What does it mean if Deyra sees the gateway status? (Choose the BEST answer.)

Question19: Which Check Point software blade provides Application Security and identity control?

Question20: What will SmartEvent automatically define as events?

Question21: Which statement is NOT TRUE about Delta synchronization?

Question22: You want to store the GAIA configuration in a file for later reference. What command should you use?

Question23: Which of the following Windows Security Events will not map a username to an IP address in Identity Awareness?

Question24: What is the command used to activated Multi-Version Cluster mode?

Question25: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question26: Which of the following is NOT a valid type of SecureXL template?

Question27: Fill in the blank: Authentication rules are defined for ________ .

Question28: What API command below creates a new host with the name "New Host" and IP address of "192.168.0.10"?

Question29: Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

Question30: The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

Question31: The "Hit count" feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits if the Track option is set to "None"?

Question32: To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Question33: What is true about VRRP implementations?

Question34: SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Question35: Which statement is true regarding redundancy?

Question36: When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?

Question37: What statement best describes the Proxy ARP feature for Manual NAT in R81.10?

Question38: Which Check Point software blade provides protection from zero-day and undiscovered threats?

Question39: View the rule below. What does the lock-symbol in the left column mean? (Choose the BEST answer.)

Question40: Where do you create and modify the Mobile Access policy in R81?

Question41: Which command will allow you to see the interface status?

Question42: You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down. What command do you run to determine the cause?

Question43: When synchronizing clusters, which of the following statements is FALSE?

Question44: When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.

Question45: Check Point APIs allow system engineers and developers to make changes to their organization's security policy with CLI tools and Web Services for all the following except:

Question46: How many policy layers do Access Control policy support?

Question47: Which component is NOT required to communicate with the Web Services API?

Question48: To fully enable Dynamic Dispatcher on a Security Gateway:

Question49: In a Client to Server scenario, which inspection point is the first point immediately following the tables and rule base check of a packet coming from outside of the network?

Question50: Which of the following is NOT an alert option?

Question51: Which GUI client is supported in R81?

Question52: The ____ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

Question53: Which is NOT an example of a Check Point API?

Question54: In R81, how do you manage your Mobile Access Policy?

Question55: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question56: Why would an administrator see the message below?

Question57: How is communication between different Check Point components secured in R81? As with all questions, select the BEST answer.

Question58: Fill in the blank: The R81 feature _____ permits blocking specific IP addresses for a specified time period.

Question59: SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

Question60: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question61: Which of the following is NOT a VPN routing option available in a star community?

Question62: Which one of the following is true about Capsule Connect?

Question63: Which statement is true about ClusterXL?

Question64: Fill in the blanks. There are ________ types of software containers: ___________.

Question65: As an administrator, you may be required to add the company logo to reports. To do this, you would save the logo as a PNG file with the name 'cover-company-logo.png' and then copy that image file to which directory on the SmartEvent server?

Question66: Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

Question67: What is the Implicit Clean-up Rule?

Question68: When an encrypted packet is decrypted, where does this happen?

Question69: GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

Question70: What is the difference between SSL VPN and IPSec VPN?

Question71: What Factor preclude Secure XL Templating?

Question72: The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via which 2 processes?

Question73: You are the administrator for ABC Corp. You have logged into your R81 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.

What does this mean?

Question74: Joey wants to upgrade from R75.40 to R81 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.
What is one of the requirements for his success?

Question75: What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

Question76: After verifying that API Server is not running, how can you start the API Server?

Question77: In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

Question78: John detected high load on sync interface. Which is most recommended solution?

Question79: By default how often updates are checked when the CPUSE Software Updates Policy is set to Automatic?

Question80: Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?

Question81: Which software blade does NOT accompany the Threat Prevention policy?

Question82: Which 3 types of tracking are available for Threat Prevention Policy?

Question83: Which command can you use to verify the number of active concurrent connections?

Question84: Pamela is Cyber Security Engineer working for Global Instance Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R81.10. Company's Developer Team is having random access issue to newly deployed Application Server in DMZ's Application Server Farm Tier and blames DMZ Security Gateway as root cause. The ticket has been created and issue is at Pamela's desk for an investigation. Pamela decides to use Check Point's Packet Analyzer Tool-fw monitor to iron out the issue during approved Maintenance window.
What do you recommend as the best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic?

Question85: Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic. However, in the Application Control policy layer, the default action is ______ all traffic.

Question86: What information is NOT collected from a Security Gateway in a Cpinfo?

Question87: What component of R81 Management is used for indexing?

Question88: Which is NOT a SmartEvent component?

Question89: What is the valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration?

Question90: The Event List within the Event tab contains:

Question91: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question92: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ________ .

Question93: What is the command to check the status of the SmartEvent Correlation Unit?

Question94: In ClusterXL Load Sharing Multicast Mode:

Question95: What is the difference between an event and a log?

Question96: To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?

Question97: Using ClusterXL, what statement is true about the Sticky Decision Function?

Question98: Which is NOT an example of a Check Point API?

Question99: What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

Question100: Can multiple administrators connect to a Security Management Server at the same time?

Question101: Fill in the blank: The tool _____ generates a R81 Security Gateway configuration report.

Question102: In the Firewall chain mode FFF refers to:

Question103: Which of the SecureXL templates are enabled by default on Security Gateway?

Question104: What is the command to check the status of Check Point processes?

Question105: What is true of the API server on R81.10?

Question106: Matt wants to upgrade his old Security Management server to R81.x using the Advanced Upgrade with Database Migration. What is one of the requirements for a successful upgrade?

Question107: Which command shows actual allowed connections in state table?

Question108: Which command shows only the table names of all kernel tables?

Question109: Which command can you use to enable or disable multi-queue per interface?

Question110: The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule based and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

Question111: How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Question112: Which Remote Access Client does not provide an Office-Mode Address?

Question113: According to out of the box SmartEvent policy, which blade will automatically be correlated into events?

Question114: How many versions, besides the destination version, are supported in a Multi-Version Cluster Upgrade?

Question115: What are the blades of Threat Prevention?

Question116: You need to change the MAC-address on eth2 interface of the gateway. What is the correct way to change MAC-address in Check Point Gaia?

Question117: Identify the API that is not supported by Check Point currently.

Question118: Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________ .

Question119: What state is the Management HA in when both members have different policies/databases?

Question120: With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments. What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?

Question121: Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

Question122: In what way are SSL VPN and IPSec VPN different?

Question123: What traffic does the Anti-bot feature block?

Question124: Office mode means that:

Question125: Which process is used mainly for backward compatibility of gateways in R81.X? It provides communication with GUI-client, database manipulation, policy compilation and Management HA synchronization.

Question126: Which view is NOT a valid CPVIEW view?

Question127: Which packet info is ignored with Session Rate Acceleration?

Question128: What is the main difference between Threat Extraction and Threat Emulation?

Question129: Which of the following is a task of the CPD process?

Question130: What is the default shell of Gaia CLI?

Question131: In Advanced Permanent Tunnel Configuration, to set the amount of time the tunnel test runs without a response before the peer host is declared 'down', you would set the_________?

Question132: What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?

Question133: Firewall polices must be configured to accept VRRP packets on the GAiA platform if it Firewall software. The Multicast destination assigned by the internet Assigned Number Authority (IANA) for VRRP is:

Question134: When installing a dedicated R81 SmartEvent server. What is the recommended size of the root partition?

Question135: After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

Question136: Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process:

Question137: What is the port used for SmartConsole to connect to the Security Management Server?

Question138: With Mobile Access enabled, administrators select the web-based and native applications that can be accessed by remote users and define the actions that users can perform the applications. Mobile Access encrypts all traffic using:

Question139: At what point is the Internal Certificate Authority (ICA) created?

Question140: From SecureXL perspective, what are the tree paths of traffic flow:

Question141: What command would show the API server status?

Question142: Which file contains the host address to be published, the MAC address that needs to be associated with the IP Address, and the unique IP of the interface that responds to ARP request?

Question143: Which of the following technologies extracts detailed information from packets and stores that information in state tables?

Question144: How many users can have read/write access in Gaia at one time?

Question145: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question146: Which command will reset the kernel debug options to default settings?

Question147: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?

Question148: Which one of the following is true about Threat Emulation?

Question149: What are the three components for Check Point Capsule?

Question150: Which file gives you a list of all security servers in use, including port number?

Question151: What needs to be configured if the NAT property 'Translate destination or client side' is not enabled in Global Properties?

Question152: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Question153: If you needed the Multicast MAC address of a cluster, what command would you run?

Question154: When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

Question155: What does the Log "Views" tab show when SmartEvent is Correlating events?

Question156: The SmartEvent R81 Web application for real-time event monitoring is called:

Question157: What solution is Multi-queue intended to provide?

Question158: Which one of the following is true about Threat Extraction?

Question159: Which statements below are CORRECT regarding Threat Prevention profiles in SmartDashboard?

Question160: Which of the following is NOT a component of Check Point Capsule?

Question161: By default, which port does the WebUI listen on?

Question162: You need to change the number of firewall Instances used by CoreXL. How can you achieve this goal?

Question163: How many interfaces can you configure to use the Multi-Queue feature?

Question164: fwssd is a child process of which of the following Check Point daemons?

Question165: Which NAT rules are prioritized first?

Question166: To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab. How many options are available to calculate the traffic direction?

Question167: Which method below is NOT one of the ways to communicate using the Management API's?

Question168: What command can you use to have cpinfo display all installed hotfixes?

Question169: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

Question170: Which options are given on features, when editing a Role on Gaia Platform?

Question171: The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?

Question172: What is not a component of Check Point SandBlast?

Question173: What scenario indicates that SecureXL is enabled?

Question174: Which of these statements describes the Check Point ThreatCloud?

Question175: Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______ .

Question176: Session unique identifiers are passed to the web api using which http header option?

Question177: What is the minimum amount of RAM needed for a Threat Prevention Appliance?