EMT Practice Test

1. Question Content...

---

Question1: What is the minimum software version required for a Threat Emulation deployment?

Question2: What advantage does the Recommended_Profile provide over the Default_Protection profile?

Question3: Bots and viruses appear as __________ in the reporting blade.

Question4: If a bot is detected on your network, which of the following statements is correct regarding anti-bot blade.

Question5: A customer does not own Check Point Gateways, but he wants to use Threat Emulation Service to detect SMTP Zero-Day vulnerabilities. What is his option?

Question6: _______________ enforces or monitors traffic, based on the source or destination IP address of the country.

Question7: Joey is the MegaCorp Firewall administrator. Which options does he have for the configuration of the Threat Emulation Analysis Location on his gateway?

Question8: This graphic shows traffic being blocked from certain countries.

What is the deciding factor for this?

Question9: IPS is primarily a __________-based engine.

Question10: What is the most common way a computer can become infected with a bot?

Question11: In SmartViewTracker, you see a log record of type "control" and severity "critical" for the product "Threat Emulation" which says:
"cloud emulation failed. Reason: failed to authenticate gateway..."
What is likely to be the reason for this failure?

Question12: Order the steps to bypass the IPS for specific protection:
a. Open the SmartDashboard
b. Find the protection you want to bypass
c. Add the exception for this specific protection
d. Go to Network Exception tab
e. Click New.
f. Go to Protections view
g. Install Security policy
h. Go to IPS tab

Question13: Check Point Signature teams are constantly monitoring the threat space.

Question14: You just enabled the IPS blade, and have downloaded the latest signature updates. You created a custom profile but you are concerned that if you push a policy it might start dropping existing connections. What should you do?

Question15: What is the name of the Check Point cloud-driven Knowledgebase?

Question16: Looking at these logs, what happened at 10:55?

Question17: Damage from a bot attack can take place after the bot compromises a machine. Which of the following represents the order by which this process takes place? The bot:

Question18: Which of the following is a searchable database of all known threats detected by sensors around the world?

Question19: SmartEvent > Events > Predefined: in which section can the "All Threat Emulation" setting be found?

Question20: IPS can assist in the discovery of unknown buffer overflow attacks without any pre-defined signatures.

Question21: When pushing the Threat Prevention policy, which of the following blades will NOT get updated?

Question22: SmartEvent has several components that work together to help track down security threats. What is the function of the Correlation Unit as one of those components in the architecture? The Correlation Unit:

Question23: When the feature ______________ is ON, the Gateway does not block DNS requests that were identified as malicious. Instead it sends a false response with a bogus IP address to the client.

Question24: What filters can be used in Check Point ThreatWiki (either via ThreatWiki.checkpoint.com or via ThreatPrevention tab in Dashboard)?

Question25: John is troubleshooting a dropped traffic issue. Looking in SmartViewTracker, he cannot find anything related to it. What CLI command might help him in this situation where he suspects a possible problem with IPS?

Question26: An end-user calls the helpdesk, complaining that he cannot access a web site. You check the log and see that an IPS signature is dropping his connections. What can you do? Change the signature action to:

Question27: When adding IPS to a gateway, which profile will be set?

Question28: A customer does not own Check Point Gateways, but he wants to use Threat Emulation Service to detect SMTP Zero-Day vulnerabilities. What is his option?

Question29: How can SmartEvent be launched out of SmartDashboard?

Question30: Check Point's IPS blade provides two pre-defined profiles. Which of the following definitions are correct?