EMT Practice Test

1. Question Content...

---

Question1:
What can we infer about the recent changes made to the Rule Base?

Question2: What Factor preclude Secure XL Templating?

Question3: What processes does CPM control?

Question4: Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Question5: Which process handles connection from SmartConsole R81?

Question6: The "MAC magic" value must be modified under the following condition:

Question7: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question8: What are possible Automatic Reactions in SmartEvent?

Question9: Return oriented programming (ROP) exploits are detected by which security blade?

Question10: Which of the following statements is TRUE about R81 management plug-ins?

Question11: What is the default size of NAT table fwx_alloc?

Question12: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question13: SandBlast agent extends 0 day prevention to what part of the network?

Question14: Which 3 types of tracking are available for Threat Prevention Policy?

Question15: Fill in the blank: The R81 utility fw monitor is used to troubleshoot ______________________.

Question16: There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational.
When it re-joins the cluster, will it become active automatically?

Question17: What is the minimum number of CPU cores required to enable CoreXL?

Question18: On what port does the CPM process run?

Question19: What kind of information would you expect to see using the sim affinity command?

Question20: What traffic does the Anti-bot feature block?

Question21: When using CPSTAT, what is the default port used by the AMON server?

Question22: Main Mode in IKEv1 uses how many packages for negotiation?

Question23: What is not a component of Check Point SandBlast?

Question24: The essential means by which state synchronization works to provide failover in the event an active member goes down, ____________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.

Question25: Kofi, the administrator of the ALPHA Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port. Which CLISH commands are required to be able to change this TCP port?

Question26: If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsive, which if these steps should NOT be performed:

Question27: What is the main difference between Threat Extraction and Threat Emulation?

Question28: Pamela is Cyber Security Engineer working for Global Instance Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R81.10. Company's Developer Team is having random access issue to newly deployed Application Server in DMZ's Application Server Farm Tier and blames DMZ Security Gateway as root cause. The ticket has been created and issue is at Pamela's desk for an investigation. Pamela decides to use Check Point's Packet Analyzer Tool-fw monitor to iron out the issue during approved Maintenance window.
What do you recommend as the best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic?

Question29: The WebUI offers several methods for downloading hotfixes via CPUSE except:

Question30: When defining QoS global properties, which option below is not valid?

Question31: According to the policy installation flow the transfer state (CPTA) is responsible for the code generated by the FWM. On the Security Gateway side a process receives them and first stores them Into a temporary directory.
Which process is true for receiving these Tiles;

Question32: Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

Question33: Which blades and or features are not supported in R81?

Question34: Which method below is NOT one of the ways to communicate using the Management API's?

Question35: Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?

Question36: A user complains that some Internet resources are not available. The Administrator is having issues seeing it packets are being dropped at the firewall (not seeing drops in logs). What is the solution to troubleshoot the issue?

Question37: The Firewall kernel is replicated multiple times, therefore:

Question38: Which statement is correct about the Sticky Decision Function?

Question39: Which statement is true about ClusterXL?

Question40: You want to verify if your management server is ready to upgrade to R81.10. What tool could you use in this process?

Question41: Alice wants to upgrade the current security management machine from R80.40 to R81.10 and she wants to check the Deployment Agent status over the GAIA CLISH. Which of the following GAIACLISH command is true?

Question42: As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

Question43: Alice works for a big security outsourcing provider company and as she receives a lot of change requests per day she wants to use for scripting daily (asks the API services from Check Point fof the Management API.
Firstly she needs to be aware if the API services are running for the management. Which of the following Check Point Command is true:

Question44: Fill in the blank: A ________ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser.

Question45: Bob works for a big security outsourcing provider company and as he receives a lot of change requests per day he wants to use for scripting daily tasks the API services (torn Check Point for the GAIA API. Firstly he needs to be aware if the API services are running for the GAIA operating system. Which of the following Check Point Command is true:

Question46: Which command can you use to verify the number of active concurrent connections?

Question47: What is mandatory for ClusterXL to work properly?

Question48: You have enabled "Full Log" as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?

Question49: Please choose the path to monitor the compliance status of the Check Point R81.10 based management.

Question50: Which command would disable a Cluster Member permanently?

Question51: Check Pont Central Deployment Tool (CDT) communicates with the Security Gateway / Cluster Members over Check Point SIC _______ .

Question52: Which of the following technologies extracts detailed information from packets and stores that information in state tables?

Question53: Automation and Orchestration differ in that:

Question54: What will SmartEvent automatically define as events?

Question55: What is the least amount of CPU cores required to enable CoreXL?

Question56: Which command shows the current Security Gateway Firewall chain?

Question57: When Configuring Endpoint Compliance Settings for Applications and Gateways within Mobile Access, which of the three approaches will allow you to configure individual policies for each application?

Question58: Which of the following commands shows the status of processes?

Question59: What are types of Check Point APIs available currently as part of R81.10 code?

Question60: There are multiple types of licenses for the various VPN components and types. License type related to management and functioning of Remote Access VPNs are - which of the following license requirement statement is NOT true:

Question61: Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

Question62: What is the benefit of "tw monitor" over "tcpdump"?

Question63: What happen when IPS profile is set in Detect Only Mode for troubleshooting?

Question64: Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

Question65: Which command is used to add users to or from existing roles?

Question66: If a "ping"-packet is dropped by FW1 Policy -on how many inspection Points do you see this packet in "fw monitor"?

Question67: To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?

Question68: What is the difference between an event and a log?

Question69: Which configuration file contains the structure of the Security Server showing the port numbers, corresponding protocol name, and status?

Question70: Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R81.10 SmartConsole application?

Question71: When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.

Question72: What are the minimum open server hardware requirements for a Security Management Server/Standalone in R81?

Question73: What are the available options for downloading Check Point hotfixes in Gala WebUI (CPUSE)?

Question74: Fill in the blanks: A _______ license requires an administrator to designate a gateway for attachment whereas a ________ license is automatically attached to a Security Gateway.

Question75: What mechanism can ensure that the Security Gateway can communicate with the Management Server with ease in situations with overwhelmed network resources?

Question76: What is the minimum amount of RAM needed for a Threat Prevention Appliance?

Question77: Check Point Support in many cases asks you for a configuration summary of your Check Point system. This is also called:

Question78: Connections to the Check Point R81 Web API use what protocol?

Question79: What are the three SecureXL Templates available in R81.10?

Question80: Ken wants to obtain a configuration lock from other administrator on R81 Security Management Server. He can do this via WebUI or via CLI.
Which command should he use in CLI? (Choose the correct answer.)

Question81: Can multiple administrators connect to a Security Management Server at the same time?

Question82: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Question83: Which of the following is NOT a type of Endpoint Identity Agent?

Question84: You notice that your firewall is under a DDoS attack and would like to enable the Penalty Box feature, which command you use?

Question85: After having saved the Cllsh Configuration with the "save configuration config.txt* command, where can you find the config.txt file?

Question86: Tom has been tasked to install Check Point R81 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?

Question87: Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

Question88: Which SmartEvent component is responsible to collect the logs from different Log Servers?

Question89: Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

Question90: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question91: Which command collects diagnostic data for analyzing customer setup remotely?

Question92: What API command below creates a new host object with the name "My Host" and IP address of "192 168 0
10"?

Question93: You have existing dbedit scripts from R77. Can you use them with R81.10?

Question94: Which statement is NOT TRUE about Delta synchronization?

Question95: After some changes in the firewall policy you run into some issues. You want to test if the policy from two weeks ago have the same issue. You don't want to lose the changes from the last weeks. What is the best way to do it?

Question96: Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. Which is NOT an option to adjust or configure?

Question97: How long may verification of one file take for Sandblast Threat Emulation?

Question98: Which command lists firewall chain?

Question99: From SecureXL perspective, what are the three paths of traffic flow:

Question100: In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

Question101: Choose the correct syntax to add a new host named "emailserver1" with IP address 10.50.23.90 using GAiA Management CLI?

Question102: What is false regarding a Management HA environment?

Question103: Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use which operating system?

Question104: With SecureXL enabled, accelerated packets will pass through the following:

Question105: Vanessa is a Firewall administrator. She wants to test a backup of her company's production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment.
Which details she need to fill in System Restore window before she can click OK button and test the backup?

Question106: Tom has connected to the R81 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.
What will happen to the changes already made?

Question107: Which of the following Central Deployment is NOT a limitation in R81.10 SmartConsole?

Question108: Which of the following is NOT an option to calculate the traffic direction?

Question109: To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?

Question110: Kurt is planning to upgrade his Security Management Server to R81.X. What is the lowest supported version of the Security Management he can upgrade from?

Question111: What does the Log "Views" tab show when SmartEvent is Correlating events?

Question112: Which NAT rules are prioritized first?

Question113: What is the default shell for the command line interface?

Question114: Which of the following is a task of the CPD process?

Question115: What are the steps to configure the HTTPS Inspection Policy?

Question116: To add a file to the Threat Prevention Whitelist, what two items are needed?

Question117: How many interfaces can you configure to use the Multi-Queue feature?

Question118: What is Dynamic Balancing?

Question119: What are the main stages of a policy installation?

Question120: Which statement is true regarding redundancy?

Question121: Which of the following is NOT an attribute of packet acceleration?

Question122: You need to change the MAC-address on eth2 interface of the gateway. What command and what mode will you use to achieve this goal?

Question123: Which of these statements describes the Check Point ThreatCloud?

Question124: SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in an event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

Question125: In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

Question126: What is required for a certificate-based VPN tunnel between two gateways with separate management systems?

Question127: The following command is used to verify the CPUSE version:

Question128: You need to change the MAC-address on eth2 interface of the gateway. What is the correct way to change MAC-address in Check Point Gaia?

Question129: How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

Question130: Which utility allows you to configure the DHCP service on Gaia from the command line?

Question131: You want to allow your Mobile Access Users to connect to an internal file share. Adding the Mobile Application 'File Share' to your Access Control Policy in the SmartConsole didn't work. You will be only allowed to select Services for the 'Service & Application' column How to fix it?

Question132: Secure Configuration Verification (SCV), makes sure that remote access client computers are configured in accordance with the enterprise Security Policy. Bob was asked by Alice to implement a specific SCV configuration but therefore Bob needs to edit and configure a specific Check Point file. Which location file and directory is true?

Question133: Which file contains the host address to be published, the MAC address that needs to be associated with the IP Address, and the unique IP of the interface that responds to ARP request?

Question134: Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ________
.

Question135: Native Applications require a thin client under which circumstances?

Question136: Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:

Question137: View the rule below. What does the lock-symbol in the left column mean? (Choose the BEST answer.)

Question138: Name the file that is an electronically signed file used by Check Point to translate the features in the license into a code?

Question139: Which command shows actual allowed connections in state table?

Question140: Fill in the blank: The IPS policy for pre-R81 gateways is installed during the _______ .

Question141: What is not a purpose of the deployment of Check Point API?

Question142: What is the command to see cluster status in cli expert mode?

Question143: The Check Point history feature in R81 provides the following:

Question144: What is the command switch to specify the Gaia API context?

Question145: What is the amount of Priority Queues by default?

Question146: After having saved the Clish Configuration with the "save configuration config.txt" command, where can you find the config.txt file?

Question147: Which feature is NOT provided by all Check Point Mobile Access solutions?

Question148: What is the purpose of extended master key extension/session hash?

Question149: In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. Which of the following options can you add to each Log, Detailed Log and Extended Log?

Question150: You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down. What command do you run to determine the cause?

Question151: You want to store the GAIA configuration in a file for later reference. What command should you use?

Question152: You pushed a policy to your gateway and you cannot access the gateway remotely any more. What command should you use to remove the policy from the gateway by logging in through console access?

Question153: You had setup the VPN Community VPN-Stores'with 3 gateways. There are some issues with one remote gateway(1.1.1.1) and an your local gateway. What will be the best log filter to see only the IKE Phase 2 agreed networks for both gateways

Question154: Session unique identifiers are passed to the web api using which http header option?

Question155: After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

Question156: Which Check Point software blade provides Application Security and identity control?

Question157: How many layers make up the TCP/IP model?

Question158: What is the SandBlast Agent designed to do?

Question159: In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with
__________________ will not apply.

Question160: When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events. What is this setting called and what are you defining?

Question161: In what way are SSL VPN and IPSec VPN different?

Question162: Which member of a high-availability cluster should be upgraded first in a Zero downtime upgrade?

Question163: When users connect to the Mobile Access portal they are unable to open File Shares.
Which log file would you want to examine?

Question164: Which one of the following is true about Capsule Connect?

Question165: What solution is multi-queue intended to provide?

Question166: SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data. Which component is NOT part of the SandBlast Mobile solution?

Question167: Which of the SecureXL templates are enabled by default on Security Gateway?

Question168: By default how often updates are checked when the CPUSE Software Updates Policy is set to Automatic?

Question169: What are the types of Software Containers?

Question170: To fully enable Dynamic Dispatcher on a Security Gateway:

Question171: Which Check Point process provides logging services, such as forwarding logs from Gateway to Log Server, providing Log Export API (LEA) & Event Logging API (EL-A) services.

Question172: Which is NOT a SmartEvent component?

Question173: When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

Question174: What is the benefit of Manual NAT over Automatic NAT?

Question175: UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users. Which action is not supported in UserCheck objects?

Question176: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question177: What are valid authentication methods for mutual authenticating the VPN gateways?

Question178: Joey want to configure NTP on R81 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?

Question179: Which of the following process pulls application monitoring status?

Question180: Which is not a blade option when configuring SmartEvent?

Question181: How can you switch the active log file?

Question182: Fill in the blank: The tool _____ generates a R81 Security Gateway configuration report.

Question183: Fill in the blank: Identity Awareness AD-Query is using the Microsoft _______________ API to learn users from AD.

Question184: Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic. Assuming acceleration is enabled which path is handling the traffic?

Question185: Which command can you use to enable or disable multi-queue per interface?

Question186: Packet acceleration (SecureXL) identities connections by several attributes. Which of the attributes is NOT used for identifying connection?

Question187: When a packet arrives at the gateway, the gateway checks it against the rules in the hop Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?

Question188: Which firewall daemon is responsible for the FW CLI commands?

Question189: What level of CPU load on a Secure Network Distributor would indicate that another may be necessary?

Question190: Where do you create and modify the Mobile Access policy in R81?

Question191: You want to gather and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?

Question192: Which command shows detailed information about VPN tunnels?

Question193:
You are the administrator for ABC Corp. You have logged into your R81 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.
What does this mean?

Question194: Which GUI client is supported in R81?

Question195: Which command lists all tables in Gaia?

Question196: Your manager asked you to check the status of SecureXL, and its enabled templates and features. What command will you use to provide such information to manager?

Question197: You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the FWD daemon to do a Full Synchronization?

Question198: What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?

Question199: Advanced Security Checkups can be easily conducted within:

Question200: When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?

Question201: In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

Question202: What is the command to check the status of Check Point processes?

Question203: The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API command can he use in the script to achieve the requirement?

Question204: Joey wants to upgrade from R75.40 to R81 version of Security management. He will use Advanced Upgrade with Database Migration method to achieve this.
What is one of the requirements for his success?

Question205: What are the three components for Check Point Capsule?

Question206: How many users can have read/write access in Gaia at one time?

Question207: When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

Question208: You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.
How many cores can be used in a Cluster for Firewall-kernel on the new device?

Question209: When installing a dedicated R81 SmartEvent server. What is the recommended size of the root partition?

Question210: There are 4 ways to use the Management API for creating host object with R81 Management API. Which one is NOT correct?

Question211: Fill in the blank: Authentication rules are defined for ________ .

Question212: When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?

Question213: When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?

Question214: In the Check Point Security Management Architecture, which component(s) can store logs?

Question215: If SecureXL is disabled which path is used to process traffic?

Question216: What is the main objective when using Application Control?

Question217: Which Check Point daemon monitors the other daemons?

Question218: Which of the following will NOT affect acceleration?

Question219: Which of the following is NOT an alert option?

Question220: What is a possible command to delete all of the SSH connections of a gateway?

Question221: What should the admin do in case the Primary Management Server is temporary down?

Question222: Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

Question223: You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet. However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet. How can you fix this?

Question224: In ClusterXL Load Sharing Multicast Mode:

Question225: Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process:

Question226: The admin lost access to the Gaia Web Management Interface but he was able to connect via ssh. How can you check if the web service is enabled, running and which port is used?

Question227: When simulating a problem on ClusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?

Question228: Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

Question229: The "Hit count" feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits if the Track option is set to "None"?

Question230: What is the purpose of a SmartEvent Correlation Unit?

Question231: What command is used to manually failover a cluster during a zero-downtime upgrade?

Question232: How many policy layers do Access Control policy support?

Question233: Which tool is used to enable ClusterXL?

Question234: What is true about the IPS-Blade?

Question235: Gaia has two default user accounts that cannot be deleted. What are those user accounts?

Question236: Security Checkup Summary can be easily conducted within:

Question237: What is NOT a Cluster Mode?