Question1: Regarding QoS guarantees and limits, which of the following statements is FALSE?
Question2: The process_________executes the authentication for Remote Access clients.
Question3: You are running a VPN-1 NG with Application Intelligence R54 Secure Platform VPN-1 Pro Gateway. The Gateway also serves as a Policy Server. When you run patch add cd from the NGX CD, what does this command allow you to upgrade?
Question4: Your network is experiencing connectivity problems and you want to verify if routing problems are present.
You need to disable the firewall process but still allow routing to pass through the Gateway running on an IP Appliance running IPSO. What command do you need to run after stopping the firewall service?
Question5: SSL termination takes place:
Question6: You find that Gateway fw2 can NOT be added to the cluster object.
What are possible reasons for that?
Question7: Review the rules. Assume domain UDP is enabled in the impled rules.
What happens when a user from the internal network tries to browse to the internet using HTTP? The user:
Question8: When synchronizing clusters, which of the following statements are true?
Select all that apply.
Question9: Jacob is using a mesh VPN Community to create a sitE. to-site VPN. The VPN properties in this mesh Community display in this graphic: Which of the following statements is TRUE?
Question10: SIMULATION
Type the full fw command and syntax that allows you to disable only sync on a cluster firewall member.
Question11: When selecting a backup target using Smart Provisioning, which target is NOT available?
Question12: Which of the following is NOT a Cluster XL mode?
Question13: When upgrading Check Point products in a distributed environment, in which order should you upgrade these components?
1 GUI Client
2 Security Management Server
3 Security Gateway
Question14: Refer to Exhibit below:
Match the Cluster XL modes with their configurations.
Question15: The process ___________ is responsible for all other security server processes run on the Gateway.
Question16: You run cphaprob -a if. When you review the output, you find the word DOWN. What does DOWN mean?
Question17: What is the significance of the depicted icon in the Smart Workflow toolbar?
Question18: An administrator has installed the latest HFA on the system for fixing traffic problems after creating a backup file. A large number of routes were added or modified, causing network problems. The Check Point configuration has not been changed. What would be the most efficient way to revert to a working configuration?
Question19: When defining an Organizational Unit, which of the following are NOT valid object categories?
Question20: You are Mega Corp's Security Administrator. There are various network objects which must be NATed.
Some of them use the Automatic Hide NAT method, while others use the Automatic Static NAT method.
What is the rule order if both methods are used together? Give the best answer.
Question21: The Management Portal allows all of the following EXCEPT:
Question22: What is the purpose of the pre-defined exclusions included with Smart Event R76?
Question23: When using Connecter with Endpoint Security Policies, what option is not available when configuring DAT enforcement?
Question24: What is NOT a valid LDAP use in Check Point Smart Directory?
Question25: A Fast Path Upgrade of a cluster:
Question26: When you add a resource service to a rule, which ONE of the following actions occur?
Question27: Your primary Security Management Server runs on GAiA. What is the fastest way to back up your Security Gateway R76 configuration, including routing and network configuration files?
Question28: Which of the following is NOT a Smart Event Permission Profile type?
Question29: You are preparing computers for a new Cluster XL deployment. For your cluster, you plan to use three machines with the following configurations:
Are these machines correctly configured for a Cluster XL deployment?
Question30: How do you verify the Check Point kernel running on a firewall?
Question31: Included in the customer's network are some firewall systems with the Performance Pack in use. The customer wishes to use these firewall systems in a cluster (Load Sharing mode). He is not sure if he can use the Sticky Decision Function in this cluster. Explain the situation to him.
Question32: What command will allow you to disable sync on a cluster firewall member?
Question33: The challenges to IT involve deployment, security, management, and what else?
Question34: In a zero downtime firewall cluster environment what command do you run to avoid switching problems around the cluster.
Question35: When defining Smart Directory for High Availability (HA), which of the following should you do?
Question36: The process __________ is responsible for the authentication for Remote Access clients.
Question37: You plan to incorporate OPSEC servers, such as Web sense and Trend Micro, to do content filtering.
Which segment is the BEST location for these OPSEC servers, when you consider Security Server performance and data security?
Question38: What is the command to enter the router shell?
Question39: What is the Smart Event Analyzer's function?
Question40: VPN traffic control would fall under which VPN component?
Question41: _______________ manages Standard Reports and allows the administrator to specify automatic uploads of reports to a central FTP server.
Question42: What is a requirement for setting up Management High Availability?
Question43: What step should you take before running upgrade export?
Question44: In Cluster XL R76; when configuring a cluster synchronization network on a VLAN interface what is the supported configuration?
Question45: What firewall kernel table stores information about port allocations for Hide NAT connections?
Question46: When a failed cluster member recovers, which of the following actions is NOT taken by the recovering member?
Question47: The Core XL SND (Secure Network Distributor) is responsible for:
Question48: Which process is responsible for delta synchronization in Cluster XL?
Question49: Which process is responsible for full synchronization in Cluster XL?
Question50: A Full Connectivity Upgrade of a cluster:
Question51: What are the Smart Provisioning Provisioning Profile indicators?
Question52: ______________ is NOT an Smart Event event-triggered Automatic Reaction.
Question53: How do you recover communications between your Security Management Server and Security Gateway if you lock yourself out through a rule or policy mis-configuration?
Question54: What is the best method for scheduling backup's on multiple firewalls?
Question55: You are the Security Administrator for Mega Corp. A Check Point firewall is installed and in use on a platform using GAiA. You have trouble configuring the speed and duplex settings of your Ethernet interfaces. Which of the following commands can be used in Expert Mode to configure the speed and duplex settings of an Ethernet interface and will survive a reboot? Give the BEST answer.
Question56: Using IPS, how do you notify the Security Administrator that malware is scanning specific ports? By enabling:
Question57: When configuring an LDAP Group object, which option should you select if you want the gateway to reference the groups defined on the LDAP server for authentication purposes?
Question58: What process manages the dynamic routing protocols (OSPF, RIP, etc.) on SecurePlatform Pro?
Question59: The technical-support department has a requirement to access an intranet server. When configuring a User Authentication rule to achieve this, which of the following should you remember?
Question60: SIMULATION
Type the command and syntax that you would use to view the virtual cluster interfaces of a Cluster XL environment.
Question61: What is NOT true about Management Portal?
Question62: Which of the following is NOT accelerated by Secure XL?
Question63: Which of the following TCP port numbers is used to connect the VPN-1 Gateway to the Content Vector Protocol (CVP) server?
Question64: You need to publish GAiA routes using the OSPF routing protocol. What is the correct command structure, once entering the route command, to implement OSPF successfully?
A: Run cpconfig utility to enable ospf routing
B: ip route ospf
ospf network1
ospf network2
C: Enable
Configure terminal
Router ospf [id]
Network [network] [wildmask] area [id]
D: Use DBedit utility to either the objects_5_0.c file
Question65: In order to have full control, you decide to use Manual NAT entries instead of Automatic NAT rules. Which of the following is NOT true?
Question66: Your customer asks you about the Performance Pack. You explain to him that a Performance Pack is a software acceleration product which improves the performance of the Security Gateway. You may enable or disable this acceleration by either:
1) the command: cpconfig
2) the command .fwaccel on off
What is the difference between these two commands?
Question67: Which of the following items can be provisioned via a Profile through Smart Provisioning?
i) Backup Schedule
ii) DNS Entries
iii) Hosts Table
iv) Domain Name
v) Interface IP's
Question68: Which operating system is NOT supported by VPN-1 Secure Client?
Question69: VPN access control would fall under which VPN component?
Question70: If Smart Workflow is configured to work without Sessions or Role Segregation, how does the Smart Dashboard function?
Question71: To back up all events stored in the Smart Event Server, you should back up the contents of which folder (s)?
Question72: In a Cluster, some features such as VPN only function properly when:
Question73: Which of the following is NOT an advantage of Smart Log?
Question74: Suppose the Security Gateway hard drive fails and you are forced to rebuild it. You have a snapshot file stored to a TFTP server and backups of your Security Management Server. What is the correct procedure for rebuilding the Gateway quickly?
Question75: Which of the following is an example of the hash function?
Question76: You are responsible for the configuration of Mega Corp's Check Point Firewall. You need to allow two NAT rules to match a connection. Is it possible? Give the BEST answer.
Question77: Your primary Security Management Server runs on GAiA. What is the easiest way to back up your Security Gateway R76 configuration, including routing and network configuration files?
Question78: Given the following protection detailed and the enforcing gateways list, is the Tool many DNS queries with the RD flag set protection enabled on the Gateway R76?
Please choose the answer with the correct justification.
Question79: What is the benefit to running Smart Event in Learning Mode?
Question80: Which of the following uses the same key to decrypt as it does to encrypt?
Question81: Which command would you use to save the interface information before upgrading a Windows Gateway?
Question82: What is the behavior of Cluster XL in a High Availability environment?
Question83: Typically, when you upgrade the Security Management Server, you install and configure a fresh R76 installation on a new computer and then migrate the database from the original machine. Which of the following statements are TRUE?
Question84: You need to verify the effectiveness of your IPS configuration for your Web server farm. You have a colleague run penetration tests to confirm that the Web servers are secure against traffic hijacks. Of the following, which would be the best configuration to protect from a traffic hijack attempt?
Question85: A tracked Smart Event Candidate in a Candidate Pool becomes an Event. What does NOT happen in the Analyzer Server?
Question86: The Smart Provisioning management concept is based on:
Question87: You start the configuration of Smart Workflow. Smart Workflow is enabled, but you are not able to select Open New Session because it is greyed out.
What must be done to open a new session? Choose the BEST answer.
Question88: The User Directory Software Blade is used to integrate which of the following with a R76 Security Gateway?
Question89: Which component functions as the Internal Certificate Authority for R76?
Question90: When, during policy installation, does the atomic load task run?
Question91: Which of the following does IPSec use during IPSec key negotiation?
Question92: Which of the following is NOT TRUE regarding HTTPS traffic being passed through a DLP gateway?
Question93: The Smart Event Correlation Unit:
Question94: Match the Cluster XL modes with their configurations.
Exhibit:
Question95: Which of the listed load-balancing methods is NOT valid?
Question96: Smart Provisioning is an integral part of the Security Management or Provider-1 CMA. To enable Smart Provisioning on the Security Management server:
Question97: A Smart Provisioning Gateway could be a member of which VPN communities?
(i) Center In Star Topology
(ii) Satellite in Star Topology
(iii) Carter in Remote Access Community
(iv) Meshed Community
Question98: When running DLP Wizard for the first time, which of the following is a mandatory configuration?
Question99: What is the correct policy installation process order?
1. Verification
2. Code generation and compilation
3. Initiation
4. Commit
5. Conversion
6. CPTA
Question100: Jon is explaining how the inspection module works to a colleague. If a new connection passes through the inspection module and the packet matches the rule, what is the next step in the process?
Question101: In Load Sharing Unicast mode, the internal cluster IP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2. Internal host 10.4.8.108 Pings 10.4.8.3, and receives replies. The following is the ARP table from the internal Windows host 10.4.8.108.
Review the exhibit and identify the member serving as the pivot machine.
Question102: Your primary Smart Center Server is installed on a Secure Platform Pro machine, which is also a VPN-1 Pro Gateway. You want to implement Management High Availability (HA). You have a spare machine to configure as the secondary Smart Center Server. How do you configure the new machine to be the standby Smart Center Server, without making any changes to the existing primary Smart Center Server?
(Changes can include uninstalling and reinstalling.)
Question103: In Company XYZ, the DLP Administrator defined a new Keywords Data Type that contains a list of secret project names; i.e., Ayalon, Yarkon, Yarden. The threshold is set to At least 2 keywords or phrases.
Based on this information, which of the following scenarios will be a match to the Rule Base?
A: A PDF file that contains the following text
Yarkon1 can be the code name for the new product. Yardens list of protected sites
B: An MS Excel file that contains the following text
Mort resources for Yarkon project.. Are you certain this is about Yarden?
C: A word file that contains the following text will match:
Ayalon
ayalon
AYALON
D: A password protected MS Excel file that contains the following text
Ayalon
Yarkon
Yarden
Question104: The London office just upgraded their DNS servers so their Gateway needs to be updated with the new settings. What would be the BEST way for Henry to change the DNS settings for London's Gateway?
Question105: SIMULATION
To provide cluster upgrade status, use command
Question106: In an R76 Cluster, some features such as VPN only function properly when:
Question107: If you check the box "Use Aggressive Mode", in the IKE Properties dialog box:
Question108: When restoring R76 using the command upgrade import, which of the following items are NOT restored?
Question109: Which encryption scheme provides in-place encryption?
Question110: How do you block some seldom-used FTP commands, such as CWD, and FIND from passing through the Gateway?
Question111: Multi Corp is located in Atlanta. It has a branch office in Europe, Asia, and Africa. Each location has its own AD controller for local user login. How many AD queries have to be configured?
Question112: SIMULATION
To bind a NIC to a single processor when using Core XL on GAiA, you would use the command
Question113: Which component functions as the Internal Certificate Authority for VPN-1 NGX?
Question114: SIMULATION
Fill in the blanks. To view the number of concurrent connections going through core 0 on the firewall, you would use the command and syntax __ __ _ ___ __ ___________ __ .
Question115: The Smart Event Server:
Question116: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop with a static IP (10.0.0.19). He wants to move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources installs the policy.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.
What should John do when he cannot access the web server from a different personal computer?
Question117: What is the purpose of the pre-defined exclusions included with Smart Event R71?
Question118: How does a cluster member take over the VIP after a failover event?
Question119: In a Management High Availability (HA) configuration, you can configure synchronization to occur automatically, when:
1. The Security Policy is installed.
2. The Security Policy is saved.
3. The Security Administrator logs in to the secondary Smart Center Server, and changes its status to active.
4. A scheduled event occurs.
5. The user database is installed.
Select the BEST response for the synchronization sequence. Choose one.
Question120: How can you disable Secure XL via the command line (it does not need to survive a reboot)?
Question121: Can you upgrade R71 directly to R76?
Question122: What is the advantage for deploying SSL VPN in a DMZ, versus a LAN?
Question123: You are concerned that the processor for your firewall running NGX R71 Secure Platform may be overloaded. What file would you view to determine the speed of your processor(s)?
Question124: John is upgrading a cluster from NGX R65 to R76. John knows that you can verify the upgrade process using the pre-upgrade verifier tool. When John is running Pre-Upgrade Verification, he sees the warning message:
Title: Incompatible pattern.
What is happening?
Question125: What is the benefit to running Smart Event in Learning Mode?
Question126: Which Name Resolution protocols are supported in SSL VPN?
Question127: How does Check Point recommend that you secure the sync interface between gateways?
Question128: Which specific R76 GUI would you use to view the length of time a TCP connection was open?
Question129: The We-Make-Widgets company has purchased twenty UTM-1 Edge appliances for their remote offices.
Kim decides the best way to manage those appliances is to use Smart Provisioning and create a profile they can all use. List the order of steps Kim would go through to add the Dallas Edge appliance to the Remote Office profile using the output below.
1. Enter the name of the profile called "Remote Offices"
2. Change the provisioning profile to "Remote Offices"
3. Click File, then select New, then Provisioning Profile
4. Click on the Devices Tab
5. Highlight the Dallas Edge appliance, click Edit, then edit Gateway
6. Click on the Profiles Tab
Question130: What happens if the identity of a user is known?
Question131: SIMULATION
Complete this statement. To save interface information before upgrading a Windows Gateway, use command
Question132: Match the VPN-related terms with their definitions. Each correct term is only used once.
Exhibit:
Question133: For object-based VPN routing to succeed, what must be configured?
Question134: A customer calls saying that a Load Sharing cluster shows drops with the error First packet is not SYN.
Complete the following sentence. I will recommend:
Question135: SIMULATION
Fill in the blank. To remove site-to-site IKE and IPSEC keys you would enter command ____ ___ and select the option to delete all IKE and IPSec SA's.
Question136: Can end users be forced to authenticate by using client certificates and username/password credentials?
Question137: You have an internal FTP server, and you allow downloading, but not uploading. Assume Network Address Translation is set up correctly, and you want to add an inbound rule with:
Source: Any
Destination: FTP server
Service: FTP resources object.
How do you configure the FTP resource object and the action column in the rule to achieve this goal?
Question138: You have pushed a policy to your firewall and you are not able to access the firewall. What command will allow you to remove the current policy from the machine?
Question139: What action CANNOT be run from Smart Update NGX R65?
Question140: Your company is running Security Management Server R76 on GAiA, which has been migrated through each version starting from Check Point 4.1. How do you add a new administrator account?
Question141: Where does the security administrator activate Identity Awareness within Smart Dashboard?
Question142: Security Gateway R76 supports User Authentication for which of the following services? Select the response below that contains the MOST correct list of supported services.
Question143: John is configuring a new R76 Gateway cluster but he can not configure the cluster as Third Party IP Clustering because this option is not available in Gateway Cluster Properties.
What's happening?
Question144: In cryptography, the Rivest, Shamir, Adelman (RSA) scheme has which of the following? Select all that apply.
Question145: By default, what happens to the existing connections on a firewall when a new policy is installed?
Question146: Which of the following manages Standard Reports and allows the administrator to specify automatic uploads of reports to a central FTP server?
Question147: Which of the following is a valid Active Directory designation for user Jane Doe in the MIS department of AcmeCorp.com?
Question148: A Security Administrator opens a new session, makes changes to the policy and submits the session for approval. The Security Manager may approve the session or request repair. If a manager opens a new session and submits it for approval, can he approve his session as a Security Manager?
Question149: A host on the Internet initiates traffic to the Static NAT IP of your Web server behind the Security Gateway.
With the default settings in place for NAT, the initiating packet will translate the _________.
Question150: How should Check Point packages be uninstalled?
Question151: You are reviewing computer information collected in Client Info. You can NOT:
Question152: At what router prompt would you save your OSPF configuration?
Question153: Complete this statement from the options provided. Using Captive Portal, unidentified users may be either; blocked, allowed to enter required credentials, or required to download the _____________.
Question154: Which of the following can NOT be done on the Management Portal?
Question155: You are using trace logger to debug SSL VPN's server side and obtain a textual traffic dump. Which type of traffic will you NOT see in the output?
Question156: You are using Smart Update to fetch data and perform a remote upgrade of an NGX Security Gateway.
Which of the following statements is FALSE?
Question157: Which specific R76 GUI would you use to view the length of time a TCP connection was open?
Question158: You configure a Check Point QoS Rule Base with two rules: an H.323 rule with a weight of 10, and the Default Rule with a weight of 10. The H.323 rule includes a per-connection guarantee of 384 Kbps. and a per-connection limit of 512 Kbps. The per-connection guarantee is for four connections, and no additional connections are allowed in the Action properties. If traffic is passing through the QoS Module matches both rules, which of the following statements is TRUE?
Question159: You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities should you do first?
Question160: What is the command to upgrade a Secure Platform NG with Application Intelligence (Al) R55 Smart Center Server to VPN-1 NGX using a CD?
Question161: Where is the ideal place to deploy your SSL VPN?
Question162: You enable Automatic Static NAT on an internal host node object with a private IP address of 10.10.10.5, which is NATed into 216.216.216.5. (You use the default settings in Global Properties / NAT.) When you run fw monitor on the R76 Security Gateway and then start a new HTTP connection from host
10.10.10.5 to browse the Internet, at what point in the monitor output will you observe the HTTP SYN-ACK packet translated from 216.216.216.5 back into 10.10.10.5?
Question163: Which statement defines Public Key Infrastructure? Security is provided:
Question164: A customer is calling saying one member's status is Down. What will you check?
Question165: Public-key cryptography is considered which of the following?
Question166: Assume an intruder has compromised your current IKE Phase 1 and Phase 2 keys. Which of the following options will end the intruder's access, after the next Phase 2 exchange occurs?
Question167: Which file defines the fields for each object used in the file objects. C (color, num/string, default value...)?
Question168: You want to generate a cpinfo file via CLI on a system running GAiA. This will take about 40 minutes since the log files are also needed. What action do you need to take regarding timeout?
Question169: The relay mail server configured under Email Notifications is used by the DLP Gateway to: (Choose the BEST answer.)
Question170: Which of the following platforms does NOT support Secure XL?
Question171: Where do you define NAT properties so that NAT is performed either client side or server side?
Question172: Your customer, Mr. Smith needs access to other networks and should be able to use all services. Session authentication is not suitable. You select Client Authentication with HTTP. The standard authentication port for client HTTP authentication (Port 900) is already in use.
You want to use Port 9001 but are having connectivity problems. Why are you having problems?
Question173: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question174: Your R76 primary Security Management Server is installed on GAiA. You plan to schedule the Security Management Server to run fw log switch automatically every 48 hours. How do you create this schedule?
Question175: Which technology would describe RDED for Qos?
Question176: Math the Smart Dashboard session status icons with the appropriate Smart Workflow session status:
Question177: You want to create an IKE VPN between two VPN-1 NGX Security Gateways, to protect two networks. The network behind one Gateway is 10.15.0.0/16, and network 192.168.9.0/24 is behind the peer's Gateway.
Which type of address translation should you use, to ensure the two networks access each other through the VPN tunnel?
Question178: Which of the following is NOT a supported browser for Management Portal?
Question179: When troubleshooting user authentication, you may see the following entries in a debug of the user authentication process. In which order are these messages likely to appear?
Question180: What Smart Console application allows you to change the Smart Reporter Policy?
Question181: What happens in relation to the CRL cache after a cpstop;spstart has been initiated?
Question182: In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2. Internal host 10.4.8.108 Pings 10.4.8.3, and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. According to the output, which member is the standby machine?
Question183: From the following output of cphaprob state, which Cluster XL mode is this?
Question184: You configure a Check Point QoS Rule Base with two rules: an HTTP rule with a weight of 40, and the Default Rule with a weight of 10. If the only traffic passing through your QoS Module is HTTP traffic, what percent of bandwidth will be allocated to the HTTP traffic?
Question185: Match the Best Management High Availability synchronization-status descriptions for your Security Management Server (SMS):
Question186: The Smart Event Correlation Unit:
Question187: When configuring a Permanent Tunnel between two gateways in a Meshed VPN community, in what object is the tunnel managed?
Question188: You have selected the event Port Scan from Internal Network in Smart Event, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?
Question189: With the User Directory Software Blade, you can create R76 user definitions on a(n) _________ Server.
Question190: When upgrading to NGX R65, which Check Point products do not require a license upgrade to be current?
Question191: Smart Reporter reports can be used to analyze data from a penetration-testing regimen in all of the following examples, EXCEPT:
Question192: In Cluster XL, which of the following processes are defined by default as critical devices?
Question193: Multi Corp has bought company Omni Corp and now has two active AD domains. How would you deploy Identity Awareness in this environment?
Question194: Which of the following statements about the Port Scanning feature of IPS is TRUE?
Question195: When configuring site-to-site VPN High Availability (HA) with MEP, which of the following is correct?
Question196: What can be said about RSA algorithms? Select all that apply.
Question197: You need to determine if your company's Web servers are accessed an excessive number of times from the same host. How would you configure this in the IPS tab?
Question198: Which of the following is a CLI command for Security Gateway R76?
Question199: Which of the following QoS rule action properties is an Advanced action type, only available in Traditional mode?
Question200: You are responsible for the IPS configuration of your Check Point firewall. Inside the Denial of service section you need to set the protection parameters against the Teardrop attack tool with high severity. How would you characterize this attack tool? Give the BEST answer.
Question201: Where is the encryption domain for a Smart LSM Security Gateway configured in R71?
Question202: For Management High Availability synchronization, what does the Advance status mean?
Question203: You are the Security Administrator for ABC-Corp. A Check Point Firewall is installed and in use on Secure Platform. You are concerned that the system might not be retaining your entries for the interfaces and routing configuration. You would like to verify your entries in the corresponding file(s) on Secure Platform.
Where can you view them? Give the BEST answer.
Question204: SIMULATION
Fill in the blanks. To view the number of concurrent connections going through your firewall, you would use the command and syntax __ ___ __ __________ __ .
Question205: Your company is planning on moving their server farm to a new datacenter which requires IP changes to important network services including DNS, DHCP, and TFTP. Rather than manually logging in to all your firewalls and modifying the settings individually, you decide to purchase and enable Smart Provisioning.
Assuming all your firewalls are on SPLAT, what is the minimum version required to update the firewalls' DNS and backup settings via Smart Provisioning?
Question206: What is a requirement for setting up R77 Management High Availability?
Question207: When using Smart Dashboard to manage existing users in Smart Directory, when are the changes applied?
Question208: While authorization for users managed by Smart Directory is performed by the gateway, the authentication is mostly performed by the infrastructure in which of the following?
Question209: Paul has just joined the Mega Corp security administration team. Natalie, the administrator, creates a new administrator account for Paul in Smart Dashboard and installs the policy. When Paul tries to login it fails.
How can Natalie verify whether Paul's IP address is predefined on the security management server?
Question210: You need to back up the routing, interface, and DNS configuration information from your R76 Secure Platform Security Gateway. Which backup-and-restore solution do you use?
Question211: You are establishing a Cluster XL environment, with the following topology:
External interfaces 192.168.10.1 and 192.168.10.2 connect to a VLAN switch. The upstream router connects to the same VLAN switch. Internal interfaces 172.16.10.1 and 172.16.10.2 connect to a hub.
10.10.10.0 is the synchronization network. The Security Management Server is located on the internal network with IP 172.16.10.3. What is the problem with this configuration?
Question212: How could you compare the Fingerprint shown to the Fingerprint on the server?
Question213: Which of these four Check Point QoS technologies prevents the transmission of redundant packets when multiple copies of a packet are concurrently queued on the same flow?
Question214: Which of the following commands can be used to bind a NIC to a single processor when using a Performance Pack on Secure Platform?
Question215: Where is it necessary to configure historical records in Smart View Monitor to generate Express reports in Smart Reporter?
Question216: In R71, how would you define a rule to block all traffic sent to or from Germany?
Question217: Which is NOT a valid option when upgrading Cluster Deployments?
Question218: Which two processes are responsible on handling Identity Awareness?
Question219: Which of the following is a supported Sticky Decision Function of Sticky Connections for Load Sharing?
Question220: Which of the following log files contains verbose information regarding the negotiation process and other encryption failures?
Question221: Why should the upgrade export configuration file (.tgz) be deleted after you complete the import process?
Question222: Check Point recommends deploying SSL VPN:
Question223: What happens when an Administrator activates the DLP Portal for Self Incident Handling and enters its fully qualified domain name (DNS name)?
Question224: To configure the Cluster Control Protocol (CCP) to use Broadcast, the following command is run:
Question225: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question226: In Company XYZ, the DLP Administrator defined a new template Data Type that is based on an empty PDF form for an insurance claim. Which of the following statements about this new data type are CORRECT?
Question227: __________ is NOT a Cluster XL mode.
Question228: You plan to install a VPN-1 Pro Gateway for VPN-1 NGX at your company's headquarters. You have a single Sun SPARC Solaris 9 machine for VPN-1 Pro enterprise implementation. You need this machine to inspect traffic and keep configuration files. Which Check Point software package do you install?
Question229: When a packet is flowing through the security gateway, which one of the following is a valid inspection path?
Question230: Match the following commands to their correct function. Each command has one function only listed.
Question231: Users with Identity Awareness Agent installed on their machines login with __________, so that when the user logs into the domain, that information is also used to meet Identity Awareness credential requests.
Question232: Which of the following statements is TRUE concerning MEP VPN's?
Question233: SIMULATION
Fill in the blank with a numeric value. The default port number for standard TCP connections with the LDAP server is
Question234: What are you required to do before running the command upgrade export?
Question235: In Cluster XL, _______ is defined by default as a critical device.
Question236: How can you verify that Secure XL is running?
Question237: How do you run "CPSIZEME" on SPLAT?
Question238: Typically, when you upgrade the Security Management Server, you install and configure a fresh R76 installation on a new computer and then migrate the database from the original machine. What is the correct order of the steps below to successfully complete this procedure?
1) Export databases from source.
2) Connect target to network.
3) Prepare the source machine for export.
4) Import databases to target.
5) Install new version on target.
6) Test target deployment.
Question239: Which Check Point QoS feature allows a Security Administrator to define special classes of service for delay-sensitive applications?
Question240: When a security administrator logs in to Smart Dashboard and selects Continue without session from the following window, what kind of access will be granted to him in Smart Dashboard?
Question241: SIMULATION
In a zero downtime firewall cluster environment, what command syntax do you run to avoid switching problems around the cluster for command cphaconf?
Question242: If Cluster XL Load Sharing is enabled with state synchronization enabled, what will happen if one member goes down?
Question243: Yoav is a Security Administrator preparing to implement a VPN solution for his multi-site organization. To comply with industry regulations, Yoav's VPN solution must meet the following requirements:
Portability: Standard
Key management: Automatic, external PKI
Session keys: Changed at configured times during a connection's lifetime
Key length: No less than 128-bit
Data integrity: Secure against inversion and brute force attacks
What is the most appropriate setting Yoav should choose?
Question244: The third-shift Administrator was updating Security Management Server access settings in Global Properties and testing. He managed to lock himself out of his account. How can you unlock this account?
Question245: You have three Gateways in a mesh community. Each gateway's VPN Domain is their internal network as defined on the Topology tab setting All IP Addresses behind Gateway based on Topology information.
You want to test the route-based VPN, so you created VTIs among the Gateways and created static route entries for the VTIs. However, when you test the VPN, you find out the VPN still go through the regular domain IPsec tunnels instead of the routed VTI tunnels.
What is the problem and how do you make the VPN use the VTI tunnels?
Question246: When restoring a Security Management Server from a backup file, the restore package can be retrieved from which source?
Question247: Using the Backup Target functionality in Smart Provisioning, what targets are available?
i) FTP
ii) TFTP
iii) SFTP
iv) SCP
v) Locally
Question248: There are several Smart Directory (LDAP) features that can be applied to further enhance Smart Directory (LDAP) functionality, which of the following is NOT one of those features?
Question249: John is the Mega Corp Security Administrator, and is using Check Point R71. Malcolm is the Security Administrator of a partner company and is using a different vendor's product and both have to build a VPN tunnel between their companies. Both are using clusters with Load Sharing for their firewalls and John is using Cluster XL as a Check Point clustering solution. While trying to establish the VPN, they are constantly noticing problems and the tunnel is not stable and then Malcolm notices that there seems to be
2 SPIs with the same IP from the Check Point site. How can they solve this problem and stabilize the tunnel?
Question250: SIMULATION
Type the command and syntax to view critical devices on a cluster member in a Cluster XL environment.
Question251: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question252: Captive Portal is a __________ that allows the gateway to request login information from the user.
Question253: What is Check Point's Core XL?
Question254: Which of the following is NOT a feature of Cluster XL?
Question255: What are the Smart Provisioning Policy Status indicators?
Question256: Which method of load balancing describes "Round Robin"?
Question257: How many pre-defined exclusions are included by default in Smart Event R71 as part of the product installation?
Question258: You are preparing to deploy a VPN-1 Pro Gateway for VPN-1 NGX. You have five systems to choose from for the new Gateway, and you must conform to the following requirements:
Operating-system vendor's license agreement
Check Point's license agreement
Minimum operating-system hardware specification
Minimum Gateway hardware specification
Gateway installed on a supported operating system (OS)
Which machine meets ALL of the following requirements?
Question259: The process _______ provides service to access the GAIA configuration database.
Question260: Which of the following is NOT a restriction for connection template generation?
Question261: SIMULATION
Fill in the blank. To verify the Secure XL status, you would enter command _____________ .
Question262: Where can you find the Check Point's SNMP MIB file?
Question263: What is the primary benefit of using upgrade export over either backup or snapshot?
Question264: After you add new interfaces to a cluster, how can you check if the new interfaces and the associated virtual IP address are recognized by Cluster XL?
Question265: Damon enables an SMTP resource for content protection. He notices that mail seems to slow down on occasion, sometimes being delivered late. Which of the following might improve throughput performance?
Question266: Which of the following statements accurately describes the upgrade export command?
Question267: Which Check Point QoS feature marks the ToS byte in the IP header?
Question268: Match the Cluster XL modes with their configurations.
Exhibit:
Question269: The customer wishes to install a cluster. In his network, there is a switch which is incapable of forwarding multicast. Is it possible to install a cluster in this situation?
Question270: What mechanism does a gateway configured with Identity Awareness and LDAP initially use to communicate with a Windows 2003 or 2008 server?
Question271: How is change approved for implementation in Smart Workflow?
Question272: What configuration change must you make to change an existing Cluster XL cluster object from Multicast to Unicast mode?
Question273: Concerning these products: Secure Platform, VPN-1 Pro Gateway, User Authority Server, Nokia OS, UTM-
1, Eventia Reporter, and Performance Pack, which statement is TRUE?
Question274: Your current VPN-1 NG with Application Intelligence (AI) R55 stand-alone VPN-1 Pro Gateway and Smart Center Server runs on Secure Platform. You plan to implement VPN-1 NGX R65 in a distributed environment, where the new machine will be the Smart Center Server, and the existing machine will be the VPN-1 Pro Gateway only. You need to migrate the NG with AI R55 Smart Center Server configuration, including licensing.
How do you handle licensing for this NGX R65 upgrade?
Question275: Check Point support has asked Tony for a firewall capture of accepted packets. What would be the correct syntax to create a capture file to a filename called monitor. out?
Question276: Jerry is concerned that a denial-oF. service (DoS) attack may affect his VPN Communities. He decides to implement IKE DoS protection. Jerry needs to minimize the performance impact of implementing this new protection. Which of the following configurations is MOST appropriate for Jerry?
Question277: Your network includes Cluster XL running Multicast mode on two members, as shown in this topology:
Your network is expanding, and you need to add new interfaces: 10.10.10.1/24 on Member A, and
10.10.10.2/24 on Member B.
The virtual IP address for interface 10.10.10.0/24 is 10.10.10.3. What is the correct procedure to add these interfaces?
Question278: SIMULATION
Fill in the blank. In Load Sharing Unicast mode, the internal cluster IP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2. Internal host 10.4.8.108 Pings 10.4.8.3, and receives replies. The following is the ARP table from the internal Windows host 10.4.8.108.
Review the exhibit and type the IP address of the member serving as the pivot machine in the space below.
Question279: A user cannot authenticate to SSL VPN. You have verified the user is assigned a user group and reproduced the problem, confirming a failed-login session. You do not see an indication of this attempt in the traffic log. The user is not using a client certificate for login. To debug this error, where in the authentication process could the solution be found?
Question280: The following configuration is for VPN-1 NGX:1s this configuration correct for Management High Availability (HA)?
Question281: If your firewall is performing a lot of IPS inspection and the CPUs assigned to fw_worker_thread are at or near 100%, which of the following could you do to improve performance?
Question282: You are a SSL VPN administrator. Your users complain that their Outlook Web Access is running extremely slowly, and their overall browsing experience continues to worsen. You suspect it could be a logging problem. Which of the following logs does Check Point recommend you turn off?
Question283: Security server configuration settings are stored in _______________ .
Question284: When an Endpoint user is able to authenticate but receives a message from the client that it is unable to enforce the desktop policy, what is the most likely scenario?
Question285: When configuring numbered VPN Tunnel Interfaces (VTIs) in a clustered environment, what issues need to be considered?
Question286: SIMULATION
Type the command and syntax to configure the Cluster Control Protocol (CCP) to use Broadcast.
Question287: By default, a standby Security Management Server is automatically synchronized by an active Security Management Server, when:
Question288: How does Cluster XL Unicast mode handle new traffic?
Question289: What is the officially accepted diagnostic tool for IP Appliance Support?
Question290: When Converting Gateways to Smart LSM Security Gateways, you can:
Question291: What port is used for Administrator access for your SSL VPN?
Question292: SIMULATION
Fill in the blank. The user wants to replace a failed Windows-based firewall with a new server running GAiA. For the most complete restore of an GAiA configuration, he or she will use the command
Question293: What is the offline CPSIZEME upload procedure?
Question294: You want to verify that your Check Point cluster is working correctly. Which command line tool can you use?
Question295: Which of the following commands will stop acceleration on a Security Gateway running on Secure Platform?
Question296: Which of the following commands would you run to remove site-to-site IKE and IPSec Keys?
Question297: To configure a client to properly log in to the user portal using a certificate, the Administrator MUST:
Question298: When migrating the Smart Event data base from one server to another, the last step is to save the files on the new server. Which of the following commands should you run to save the Smart Event data base files on the new server?
Question299: In Smart Dashboard, Translate destination on client side is checked in Global Properties. When Network Address Translation is used:
Question300: To backup all events stored in the Smart Event Server, you should back up the contents of which folder(s)?
Question301: Which is the BEST configuration option to protect internal users from malicious Java code, without stripping Java scripts?
Question302: Which of the following services will cause Secure XL templates to be disabled?
Question303: Which of the following commands shows full synchronization status?
Question304: Which of the following explains Role Segregation?
Question305: Your expanding network currently includes Cluster XL running Multicast mode on two members, as shown in this topology:
You need to add interfaces: 10.10.10.1/24 on Member A, and 10.10.10.2/24 on Member B.
The virtual IP address for these interfaces is 10.10.10.3/24. Both cluster gateways have a Quad card with an available eth3 interface. What is the correct procedure to add these interfaces?
Question306: When migrating the Smart Event data base from one server to another, the first step is to back up the files on the original server. Which of the following commands should you run to back up the Smart Event data base?
Question307: Based on the following information, which of the statements below is FALSE?
A DLP Rule Base has the following conditions:
Data Type =Password Protected File
Source=My Organization
Destination=Outside My Organization
Protocol=Any
Action=Ask User
Exception: Data Type=Any,
Source=Research and Development (R&D)
Destination=Pratner1.com
Protocol=Any
All other rules are set to Detect. User Check is enabled and installed on all client machines.
Question308: Your VPN Community includes three Security Gateways. Each Gateway has its own internal network defined as a VPN Domain. You must test the VPN-1 NGX route-based VPN feature, without stopping the VPN. What is the correct order of steps?
Question309: Your internal network is configured to be 10.1.1.0/24. This network is behind your perimeter R76 Gateway, which connects to your ISP provider. How do you configure the Gateway to allow this network to go out to the Internet?
Question310: What is the Smart Event Analyzer's function?
Question311: When connecting to the SSL VPN portal, you receive a pop-up message indicating that the server hostname does not match the certificate hostname, and the certificate is not signed by a known Certificate Authority (CA). How would you solve this problem?
Question312: When upgrading a cluster in Full Connectivity Mode, the first thing you must do is see if all cluster members have the same products installed. Which command should you run?
Question313: What could the following regular expression be used for in a DLP rule?
\$([0-9]*,[0-9] [0-9] [0-9]. [0-9] [0-9]
Select the best answer
Question314: What is the meaning of the option Connect to the Internet?
Question315: A Web server behind the Security Gateway is set to Automatic Static NAT. Client side NAT is not checked in the Global Properties. A client on the Internet initiates a session to the Web Server. Assuming there is a rule allowing this traffic, what other configuration must be done to allow the traffic to reach the Web server?
Question316: Which of the following statements is TRUE concerning MEP VPN's?
Question317: To qualify as an Identity Awareness enabled rule, which column MAY include an Access Role?
Question318: You can NOT use Smart Dashboard's Smart Directory features to connect to the LDAP server. What should you investigate?
1. Verify you have read-only permissions as administrator for the operating system.
2. Verify there are no restrictions blocking Smart Dashboard's User Manager from connecting to the LDAP server.
3. Check that the Login Distinguished Name configured has root (Administrator) permission (or at least write permission) in the access control configuration of the LDAP server.
Question319: After installing VPN-1 Pro NGQ R65, you discover that one port on your Intel Quad NIC on the Security Gateway is not fetched by a get topology request. What is the most likely cause and solution?
Question320: When using Cluster XL in Load Sharing, what is the default method?
Question321: The process that performs the authentication for Remote Access is:
Question322: In Smart Directory, what is each LDAP server called?
Question323: John is the Multi Corp Security Administrator. If he suggests a change in the firewall configuration, he must submit his proposal to David, a security manager. One day David is out of the office and john submits his proposal to peter. Surprisingly, Peter is not able to approve the proposal because the system does not permit him to do so?
Both David and Peter have accounts as administrators in the Security Management server and both have the Read/Write ALL permission. What is the reason for this difference?
Question324: Which of the following CLISH commands would you use to set the admin user's shell to bash?
Question325: If a Smart Update upgrade or distribution operation fails on Secure Platform, how is the system recovered?
Question326: Which external user authentication protocols are supported in SSL VPN?
Question327: How do you upload the results of "CPSIZEME" to Check Point when using a PROXY server with authentication?
Question328: In Management High Availability, what is an Active SMS?
Question329: You find that Users are not prompted for authentication when they access their Web servers, even though you have created an HTTP rule via User Authentication. Choose the BEST reason why.
Question330: Because of pre-existing design constraints, you set up manual NAT rules for your HTTP server. However, your FTP server and SMTP server are both using automatic NAT rules. All traffic from your FTP and SMTP servers are passing through the Security Gateway without a problem, but traffic from the Web server is dropped on rule 0 because of anti-spoofing settings. What is causing this?
Question331: For an initial installation of Connecter, which of the following statements is TRUE?
Question332: Which of the following generates a Smart Event Report from its SQL database?
Question333: What is the primary benefit of using upgrade export over either backup or snapshot?
Question334: You have created a Rule Base for firewall, websydney. Now you are going to create a new policy package with security and address translation rules for a second Gateway.
What is TRUE about the new package's NAT rules?
Question335: How frequently does CPSIZEME run by default?
Question336: How can you view the critical devices on a cluster member in a Cluster XL environment?
Question337: _____________ generates a Smart Event Report from its SQL database.
Question338: A snapshot delivers a complete backup of GAiA. How do you restore a local snapshot named MySnapshot.tgz?
Question339: You are configuring the VoIP Domain object for a Skinny Client Control Protocol (SCCP) environment protected by VPN-1 NGX. Which VoIP Domain object type can you use?
Question340: Which procedure will create an Internal User?
Question341: In which Cluster XL Load Sharing mode, does the pivot machine get chosen automatically by Cluster XL?
Question342: After repairing a Smart Workflow session:
Question343: The Smart Event Client:
Question344: Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?
Question345: Your network traffic requires preferential treatment by other routers on the network, in addition to the QoS Module, which Check Point QoS feature should you use?
Question346: After filtering a fw monitor trace by port and IP, a packet is displayed three times; in the i, I, and o inspection points, but not in the O inspection point. Which is the likely source of the issue?
Question347: Which three of the following components are required to get a Smart Event up and running?
1) Smart Event SIC
2) Smart Event Correlation Unit
3) Smart Event Server
4) Smart Event Analyzer
5) Smart Event Client
Question348: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop with a static IP (10.0.0.19). He wants to move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources installs the policy.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.
John plugged in his laptop to the network on a different network segment and he is not able to connect.
How does he solve this problem?
Question349: Using the output below, what does the red flag indicate for the MS08-067 Protection?
Question350: Which Check Point product is used to create and save changes to a Log Consolidation Policy?
Question351: The following rule contains an FTP resource object in the Service field:
Source: local_net
Destination: Any
Service: FTP-resource object
Action: Accept
How do you define the FTP Resource Properties > Match tab to prevent internal users from receiving corporate files from external FTP servers, while allowing users to send files?
Question352: Which Security Gateway R76 configuration setting forces the Client Authentication authorization time-out to refresh, each time a new user is authenticated? The:
Question353: When do modifications to the Event Policy take effect?
Question354: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend before major changes, such as upgrades?
Question355: What is the default port number for standard TCP connections with the LDAP server?
Question356: A VPN Tunnel Interface (VTI) is defined on Secure Platform Pro as:
vpn shell interface add numbered 10.10.0.1 10.10.0.2 madrid.cp
What do you know about this VTI?
Question357: Even after configuring central logging on Connecter, Connecter logs are not displaying in Smart View Tracker. What could be the cause of this problem?
Question358: Multi Corp is running Smart center R71 on an IPSO platform and wants to upgrade to a new Appliance with R77. Which migration tool is recommended?
Question359: With the User Directory Software Blade, you can create R77 user definitions on a(n) _________ Server.
Question360: Please review the following QoS policy:
Assume you have 200 Kbps bandwidth available at all times. Which statement would describe this policy?
Question361: Which technology is responsible for assembling packet streams and passing ordered data to the protocol parsers in IPS?
Question362: Which of the following provides a unique user ID for a digital Certificate?
Question363: SIMULATION
Fill in the blank. To verify Secure XL statistics, you would use the command ________ .
Question364: The ________ Check Point Cluster XL mode must synchronize the physical interface IP and MAC addresses on all clustered interfaces.
Question365: Which of the following commands do you run on the AD server to identify the DN name before configuring LDAP integration with the Security Gateway?
Question366: Provisioning Profiles can NOT be applied to:
Question367: Assuming all connections that are allocated bandwidth in your Check Point QoS Rule Base are open, what would be the corresponding bandwidth percentage of the Kazaa Rule in the following example?
Question368: From the following output of cphaprob state,
which Cluster XL mode is this?
Question369: You just installed a new Web server in the DMZ that must be reachable from the Internet. You create a manual Static NAT rule as follows:
Source: Any || Destination: web_public_IP || Service: Any || Translated Source: original || Translated Destination: web_private_IP || Service: Original
"web_public_IP" is the node object that represents the new Web server's public IP address.
"web_private_IP" is the node object that represents the new Web site's private IP address. You enable all settings from Global Properties > NAT.
When you try to browse the Web server from the Internet you see the error "page cannot be displayed".
Which of the following is NOT a possible reason?
Question370: Which of the following files is used to allow only specific IPs or networks to access the Management Portal?
Question371: By default Check Point High Availability components send updates about their state every:
Question372: An organization may be distributed across several Smart Directory (LDAP) servers. What provision do you make to enable a Gateway to use all available resources? Each Smart Directory (LDAP) server must be:
Question373: What is used to validate a digital certificate?
Question374: Which process is responsible for kernel table information sharing across all cluster members?
Question375: You plan to migrate a VPN-1 NG with Application Intelligence (Al) R55 Smart Center Server to VPN-1 NGX. You also plan to upgrade four VPN-1 Pro Gateways at remote offices, and one local VPN-1 Pro Gateway at your company's headquarters. The Smart Center Server configuration must be migrated. What is the correct procedure to migrate the configuration?
Question376: Which version is the minimum requirement for Smart Provisioning?
Question377: Which Security Server can perform authentication tasks, but CANNOT perform content security tasks?
Question378: Your customer wishes to install Smart Workflow on top of R70 Security Management Server (Windows system). What is the required disk space?
Question379: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question380: Which of the following is a valid Active Directory designation for user John Doe in the Sales department of AcmeCorp.com?
Question381: Your organization maintains several IKE VPN's. Executives in your organization want to know which mechanism Security Gateway R76 uses to guarantee the authenticity and integrity of messages. Which technology should you explain to the executives?
Question382: You must set up SIP with a proxy for your network. IP phones are in the 172.16.100.0 network. The Registrar and proxy are installed on host 172.16.100.100. To allow handover enforcement for outbound calls from SIP-net to network Net_B on the Internet, you have defined the following objects:
Network object: SIP-net: 172.16.100.0/24
SIP-gateway: 172.16.100.100
VoIP Domain object: VolP_domain_A
1. End point domain: SIP-net
2.VoIP gateway installed at: SIP-gateway host object
How would you configure the rule?
Question383: You intend to upgrade a Check Point Gateway from R65 to R76. To avoid problems, you decide to back up the Gateway. Which approach allows the Gateway configuration to be completely backed up into a manageable size in the least amount of time?
Question384: Which of these components does NOT require a VPN-1 NGX R65 license?
Question385: The process that performs the authentication for SSL VPN Users is:
Question386: Why would an old Connecter Gateway IP be displayed to remote SSL Network Extender users, after changing it to a different IP? You must:
Question387: In a "zero downtime" scenario, which command do you run manually after all cluster members are upgraded?
Question388: Which of the following does NOT happen when using Pivot Mode in Cluster XL?
Question389: Your organization's disaster recovery plan needs an update to the backup and restore section to reap the benefits of the new distributed R76 installation. Your plan must meet the following required and desired objectives:
Upon evaluation, your plan:
Question390: You use the snapshot feature to store your Connecter SSL VPN configuration. What do you expect to find?
Question391: You have pushed a policy to your firewall and you are not able to access the firewall. What command will allow you to remove the current policy from the machine?
Question392: Which of the following statements accurately describes the migrate command?
Question393: Restoring a snapshot-created file on one machine that was created on another requires which of the following to be the same on both machines?
Question394: Which of the following statements about SSL VPN is TRUE?
Question395: Frank is concerned with performance and wants to configure the affinities settings. His gateway does not have the Performance Pack running. What would Frank need to perform in order configure those settings?
Question396: Snapshot is available on which Security Management Server and Security Gateway platforms?
Question397: Mega Corps' disaster recovery plan is past due for an update to the backup and restore section to enjoy the benefits of the new distributed R77 installation. You must propose a plan that meets the following required and desired objectives:
Required. Security Policy repository must be backed up no less frequently than every 24 hours.
Desired. Back up R77 components enforcing the Security Policies at least once a week.
Desired. Back up R77 logs at least once a week.
You develop a disaster recovery plan proposing the following:
Use the utility cron to run the command upgrade_export each night on the Security Management
Servers.
Configure the organization's routine backup software to back up files created by the command
upgrade_export.
Configure GAiA back up utility to back up Security Gateways every Saturday night.
Use the utility cron to run the command upgrade_export each Saturday night on the log servers.
Configure an automatic, nightly log switch.
Configure the organization's routine back up software to back up the switched logs every night.
The corporate IT change review committee decides your plan:
Question398: When using Smart Workflow, how many sessions can be in progress at the same time?
Question399: Which statement is TRUE for route-based VPN's?
Question400: A Zero Downtime Upgrade of a cluster:
Question401: Which of the following commands shows full synchronization status?
Question402: Select the correct statement about Secure Internal Communications (SIC) Certificates. SIC Certificates:
Question403: The process that performs the authentication for legacy session authentication is:
Question404: SIMULATION
Type the full fw command and syntax that will show full synchronization status.
Question405: What is a task of the Smart Event Client?
Question406: How can you prevent delay-sensitive applications, such as video and voice traffic, from being dropped due to long queue using Check Point QoS solution?
Question407: When distributing IPSec packets to gateways in a Load Sharing Multicast mode cluster, which valid Load Sharing method will consider VPN information?
Question408: Smart Provisioning uses different types of profiles to manage and provision the gateways. These types are:
Question409: Which three of the following are Cluster XL member requirements?
1) same operating systems
2) same Check Point version
3) same appliance model
4) same policy
Question410: David wants to manage hundreds of gateways using a central management tool.
What tool would David use to accomplish his goal?
Question411: You configure a Check Point QoS Rule Base with two rules: an HTTP rule with a weight of 40, and the Default Rule with a weight of 10. If the only traffic passing through your QoS Module is HTTP traffic, what percent of bandwidth will be allocated to the HTTP traffic?
Question412: The process that performs the authentication for Smart Dashboard is:
Question413: How do you configure the Security Policy to provide user access to the Captive Portal through an external (Internet) interface?
Question414: Steve is troubleshooting a connection problem with an internal application. If he knows the source IP address is 192.168.4.125, how could he filter this traffic?
Question415: You have a production implementation of Management High Availability, at version VPN-1 NG with Application Intelligence R55. You must upgrade your two Smart Center Servers to VPN-1 NGX. What is the correct procedure?
Question416: Choose the BEST sequence for configuring user management in Smart Dashboard, using an LDAP server.
Question417: When configuring an LDAP Group object, which option should you select if you want the gateway to reference the groups defined on the LDAP server for authentication purposes?
Question418: What are you required to do before running upgrade export?
Question419: You are a Security Administrator who has installed Security Gateway R76 on your network. You need to allow a specific IP address range for a partner site to access your intranet Web server. To limit the partner's access for HTTP and FTP only, you did the following:
1) Created manual Static NAT rules for the Web server.
2) Cleared the following settings in the Global Properties > Network Address Translation screen:
- Allow bi-directional NAT
- Translate destination on client side
Do the above settings limit the partner's access?
Question420: What is the most typical type of configuration for VPNs with several externally managed Gateways?
Question421: Can you implement a complete IPv6 deployment without IPv4 addresses?
Question422: What is the supported Cluster XL configuration when configuring a cluster synchronization network on a VLAN interface?
Question423: What is the most common cause for a Quick mode packet 1 failing with the error "No Proposal Chosen" error?
Question424: When does the Smart Workflow Policy Installation window appear?
Question425: What command syntax would you use to turn on PDP logging in a distributed environment?
Question426: What is the syntax for uninstalling a package using newpkg?
Question427: During a Security Management Server migrate export, the system:
Question428: Your company has the requirement that Smart Event reports should show a detailed and accurate view of network activity but also performance should be guaranteed.
Which actions should be taken to achieve that?
(i) Use same hard driver for database directory, log files and temporary directory (ii) Use Consolidation Rules (iii) Limit logging to blocked traffic only
(iv) Using Multiple Database Tables
Question429: Which command would you use to save the IP address and routing information before upgrading a GAiA Gateway?
Question430: You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate destination on client site from Global Properties > NAT. Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?
Question431: What is a "sticky" connection?
Question432: Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?
Question433: Which describes the function of the account unit?
Question434: What are the 3 main components of the Smart Event Software Blade?
Question435: Which of the following tools is used to generate a Security Gateway R76 configuration report?
Question436: Which of the following software blades can be used to provide centralized backup management?
Question437: How do you verify a VPN Tunnel Interface (VTI) is configured properly?
Question438: A Cluster XL configuration is limited to ___ members.
Question439: One profile in Smart Provisioning can update:
Question440: You want to upgrade an NG with Application Intelligence R55 Security Gateway running on Secure Platform to VPN-1 NGX R65 via Smart Update. Which package(s) is(are) needed in the Repository prior to upgrade?
Question441: Where do you verify that Smart Directory is enabled?
Question442: What could be a reason why synchronization between primary and secondary Security Management Servers does not occur?
Question443: Laura notices the Microsoft Visual Basic Bits Protection is set to inactive. She wants to set the Microsoft Visual Basic Kill Bits Protection and all other Low Performance Impact Protections to Prevent. She asks her manager for approval and stated she can turn theses on. But he wants Laura to make sure no high Performance Impacted Protections are turned on while changing this setting.
Using the out below, how would Laura change the Default Protection on Performance Impact Protections classified as low from inactive to prevent until meeting her other criteria?
Question444: How is the Smart Workflow Session Information Pane enabled?
Question445: In a Windows environment, Smart Reporter Data Base settings could be modified in:
Question446: The following graphic illustrates which command being issued on Secure Platform?
Question447: What is the command to show OSPF adjacencies?
Question448: You have three servers located in a DMZ, using private IP addresses. You want internal users from
10.10.10.x to access the DMZ servers by public IP addresses. Internal_net 10.10.10.x is configured for Hide NAT behind the Security Gateway's external interface.
What is the best configuration for 10.10.10.x users to access the DMZ servers, using the DMZ servers' public IP addresses?
Question449: Which of the following are valid reasons for beginning with a fresh installation VPN-1 NGX R65, instead of upgrading a previous version to VPN-1 NGX R65? Select all that apply.
Question450: Which service type does NOT invoke a Security Server?
Question451: In Core XL, what process is responsible for processing incoming traffic from the network interfaces, securely accelerating authorized packets, and distributing non-accelerated packets among kernel instances?
Question452: Remote clients are using SSL VPN to authenticate via LDAP server to connect to the organization. Which gateway process is responsible for the authentication?
Question453: While authorization for users managed by Smart Directory is performed by the gateway, the authentication mostly occurs in __________.
Question454: What happens to the session information after they are approved and a policy installation is done?
Question455: Which type of service should a Security Administrator use in a Rule Base to control access to specific shared partitions on target machines?
Question456: What is the Smart Event Client's function?
Question457: Your current VPN-1 NG with Application Intelligence (Al) R55 stand alone VPN-1 Pro Gateway and Smart Center Server run on Secure Platform. You plan to implement VPN-1 NGX in a distributed environment, where the existing machine will be the Smart Center Server, and a new machine will be the VPN-1 Pro Gateway only. You need to migrate the NG with Al R55 Smart Center Server configuration, including such items as Internal Certificate Authority files, databases, and Security Policies.
How do you request a new license for this VPN-1 NGX upgrade?
Question458: If no flags are defined during a back up on the Security Management Server, where does the system store the *.tgz file?
Question459: Peter is your new Security Administrator. On his first working day, he is very nervous and enters the wrong password three times. His account is locked. What can be done to unlock Peter's account? Give the BEST answer.
Question460: The ______________ contains the Events Data Base.
Question461: MEP VPN's use the Proprietary Probing Protocol to send special UDP RDP packets to port ____ to discover if an IP is accessible.
Question462: When configuring an LDAP Group object, which option should you select if you do NOT want the gateway to reference the groups defined on the LDAP server for authentication purposes?
Question463: What cluster mode is represented in this case?
Question464: For best performance in Event Correlation, you should use:
Question465: SIMULATION
To provide full connectivity upgrade status, use command
Question466: How do you enable Secure XL (command line) on GAiA?
Question467: Which utility or command is useful for debugging by capturing packet information, including verifying LDAP authentication?
Question468: Organizations are sometimes faced with the need to locate cluster members in different geographic locations that are distant from each other. A typical example is replicated data centers whose location is widely separated for disaster recovery purposes. What are the restrictions of this solution?
Question469: Anytime a client initiates a connection to a server, the firewall kernel signals the FWD process using a trap.
FWD spawns the ________ child service, which runs the security server.
Question470: When migrating the Smart Event data base from one server to another, the last step is to save the files on the new server. Which of the following commands should you run to save the Smart Event data base files on the new server?
Question471: Among the authentication schemes SSL VPN employs for users, which scheme does Check Point recommend so all servers are replicated?
Question472: When synchronizing clusters, which of the following statements is NOT true?
Question473: Which command will erase all CRL's?
Question474: When deploying a dedicated DLP Gateway behind a perimeter firewall on an interface leading to the internal network (there is only one internal network):
Question475: In a UNIX environment, Smart Reporter Data Base settings could be modified in:
Question476: David is the Multi Corp Security Manager and approves the proposals submitted by the Security Administrator Peter. One day, David believes he has detected a vulnerability in the Security Policy. He submits a change proposal and tries to approve his own submission. The system does not allow him to perform this procedure.
What is the reason for this behavior?
Question477: How many events are shown by default in the Event preview pane?
Question478: Which statement about LDAP and Active Directory (AD) with SSL VPN is TRUE?
Question479: The following graphic illustrates which command being issued on Secure Platform?
Question480: SIMULATION
Type the full cphaprob command and syntax that will show full synchronization status.
Question481: Which of the following statements is TRUE concerning MEP VPN's?
Question482: Which application is used to create a File-Share Application?
Question483: How is Smart Workflow enabled?
Question484: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question485: Which Check Point QoS feature is used to dynamically allocate relative portions of available bandwidth?
Question486: When using migrate to upgrade a Secure Management Server, which of the following is included in the migration?
Question487: You are preparing to configure your VoIP Domain Gatekeeper object. Which two other objects should you have created first?
Question488: Using the output below, why is the QoS rule not limiting the internal users to 2000 Bps of GNUtella traffic?
Question489: After Travis added new processing cores on his server, Core XL did not use them. What would be the most plausible reason why? Travis did not:
Question490: You want to implement Static Destination NAT in order to provide external, Internet users access to an internal Web Server that has a reserved (RFC 1918) IP address. You have an unused valid IP address on the network between your Security Gateway and ISP router. You control the router that sits between the firewall external interface and the Internet.
What is an alternative configuration if proxy ARP cannot be used on your Security Gateway?
Question491: SIMULATION
Fill in the blank. In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. An internal host
10.4.8.108 successfully pings its Cluster and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. Based on this information, what is the active cluster member's IP address?
Question492: In a R76 Management High Availability (HA) configuration, you can configure synchronization to occur automatically, when:
1. The Security Policy is installed.
2. The Security Policy is saved.
3. The Security Administrator logs in to the secondary Smart Center Server, and changes its status to active.
4. A scheduled event occurs.
5. The user database is installed.
Select the BEST response for the synchronization trigger.
Question493: Which Check Point product implements a Consolidation Policy?
Question494: Which of the following functions CANNOT be performed in Client Info on computer information collected?
Question495: How can you completely tear down a specific VPN tunnel in an intranet IKE VPN deployment?
Question496: VPN-1 NGX includes a resource mechanism for working with the Common Internet File System (CIFS).
However, this service only provides a limited level of actions for CIFS security. Which of the following services is NOT provided by a CIFS resource?
Question497: A Minimal Effort Upgrade of a cluster:
Question498: Which statements about Management HA are correct?
1) Primary Smart Center describes first installed Smart Center
2) Active Smart Center is always used to administrate with Smart Console
3) Active Smart Center describes first installed Smart Center
4) Primary Smart Center is always used to administrate with Smart Console
Question499: Check Point New Mode HA is a(n) _________ solution.
Question500: Which of the following operating systems support numbered VTI's?
Question501: Which of the following is the default port for Management Portal?
Question502: Which of the following methods will provide the most complete backup of an R76 configuration?
Question503: Several Security Policies can be used for different installation targets. The Firewall protecting Human Resources' servers should have its own Policy Package. These rules must be installed on this machine and not on the Internet Firewall. How can this be accomplished?
Question504: Which of the following are valid PKI architectures?
Question505: Which command line interface utility allows the administrator to verify the Security Policy name and timestamp currently installed on a firewall module?
Question506: You have to uninstall the Check Point Smart Workflow Software Blade on a Secure Platform system. How can you perform this procedure?
Question507: Which of the following commands shows full synchronization status?
Question508: An internal host initiates a session to www.google.com and is set for Hide NAT behind the Security Gateway. The initiating traffic is an example of __________.
Question509: What type of traffic can be re-directed to the Captive Portal?
Question510: How can you view the virtual cluster interfaces of a Cluster XL environment?
Question511: Which of the following are supported with the office mode? Select all that apply.
Question512: You have just upgraded your Load Sharing gateway cluster (both members) from NGX R65 to R76.
cphaprob stat shows:
Which of the following is not a possible cause of this?
Question513: The User Directory Software Blade is used to integrate which of the following with a R77 Security Gateway?
Question514: How can you check whether IP forwarding is enabled on an IP Security Appliance?
Question515: The set of rules that governs the types of objects in the directory and their associated attributes is called the:
Question516: You enable Hide NAT on the network object, 10.1.1.0 behind the Security Gateway's external interface.
You browse to www.google.com from host, 10.1.1.10 successfully. You enable a log on the rule that allows
10.1.1.0 to exit the network. How many log entries do you see for that connection in Smart View Tracker?
Question517: After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by anti-spoofing protections. Which of the following is the MOST LIKELY cause?
Question518: SIMULATION
Fill in the blank. The command that typically generates the firewall application, operating system, and hardware specific drivers is _________ .
Question519: Which operating system(s) support(s) unnumbered VPN Tunnel Interfaces (VTIs) for route-based VPNs?
Question520: What action can be run from Smart Update NGX R65?
Question521: What tools CANNOT be launched from Smart Update NGX R65?
Question522: When configuring a Web Application for SSL VPN remote access, you have given the following definition for the application along with its protection level.
Which of the following is the best match for the above application?
Question523: DShield is a Check Point feature used to block which of the following threats?
Question524: What is the proper command for importing users into the R76 User Database?
Question525: Which operating system(s) support(s) unnumbered VPN Tunnel Interfaces (VTIs) for route-based VPN's?
Question526: When using Secure Platform, it might be necessary to temporarily change the MAC address of the interface eth 0 to 00:0C:29:12:34:56. After restarting the network the old MAC address should be active.
How do you configure this change?
Question527: Which of the following statements is TRUE concerning MEP VPN's?
Question528: What command will stop all (and only) Management Portal services?
Question529: Which of the following is NOT supported by Core XL?
Question530: How does a standby Smart Center Server receive logs from all Security Gateways, when an active Smart Center Server fails over?
Question531: Select the command set best used to verify proper failover function of a new Cluster XL configuration.
Question532: Which load-balancing method below is NOT valid?
Question533: What physical machine must have access to the User Center public IP when checking for new packages with Smart Update?
Question534: Your company has two headquarters, one in London, one in New York. Each headquarters includes several branch offices. The branch offices only need to communicate with the headquarters in their country, not with each other, and only the headquarters need to communicate directly. What is the BEST configuration for VPN Communities among the branch offices and their headquarters, and between the two headquarters? VPN Communities comprised of:
Question535: Review the Rule Base displayed.
For which rules will the connection templates be generated in Secure XL?
Question536: In the following command,
LSMcli [-d] <server><user><pswd><action> "server"
should be replaced with:
Question537: When two or more DLP rules are matched, the action taken is the most restrictive action. Rank the following items from the lowest restriction level (1) to the highest (4).
1. Ask User
2. Prevent
3. Detect
4. Inform User
Question538: In a R76 Cluster XL Load Sharing configuration, which type of ARP related problem can force the use of Unicast Mode (Pivot) configuration due to incompatibility on some adjacent routers and switches?
Question539: Which Check Point address translation method allows an administrator to use fewer ISP-assigned IP addresses than the number of internal hosts requiring Internet connectivity?
Question540: Where do Gateways managed by Smart Provisioning fetch their assigned profiles?
Question541: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend every couple of months, depending on how frequently you make changes to the network or policy?
Question542: What is the lowest possible version a Security Gateway may be running in order to use it as an LSM enabled Gateway?
Question543: The Totally Cool Security Company has a large security staff. Bob configured a new IPS Chicago Profile for fw-chicago using Detect mode. After reviewing logs, Matt noticed that fw-Chicago is not detecting any of the IPS protections that Bob had previously setup. Analyze the output below and determine how Matt can correct the problem.
Question544: Which of these is a type of acceleration in Secure XL?
Question545: In the following cluster configuration; if you reboot sglondon_1 which device will be active when sglondon_1 is back up and running? Why?
Question546: The Smart Event Server:
Question547: When Load Sharing Multicast mode is defined in a Cluster XL cluster object, how are packets being handled by cluster members?
Question548: Typically, when you upgrade the Security Management Server, you install and configure a fresh R76 installation on a new computer and then migrate the database from the original machine. When doing this, what is required of the two machines? They must both have the same:
Question549: Your users are defined in a Windows 2008 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R77?
Question550: In R76, My Organization e-mail addresses or domains are used for:
Question551: Which statement is TRUE for route-based VPN's?
Question552: In Cluster XL, which of the following are defined by default as a critical device?
Question553: Greg is creating rules and objects to control VoIP traffic in his organization, through a VPN-1 NGX Security Gateway. Greg creates VoIP Domain SIP objects to represent each of his organization's three SIP gateways. Greg then creates a simple group to contain the VoIP Domain SIP objects. When Greg attempts to add the VoIP Domain SIP objects to the group, they are not listed. What is the problem?
Question554: A user attempts to initialize a network application using SSL Network Extender. The application fails to start. What is the MOST LIKELY solution?
Question555: State Synchronization is enabled on both members in a cluster, and the Security Policy is successfully installed. No protocols or services have been unselected for selective sync. Review the fw tab -t connections -s output from both members.
Is State Synchronization working properly between the two members?
Question556: Each entry in Smart Directory has a unique _______________ ?
Question557: Which changes are tracked by Smart Workflow?
Question558: Which of the following commands can provide the most complete restore of an R76 configuration?
Question559: Your online bookstore has customers connecting to a variety of Web servers to place or change orders and check order status. You ran penetration tests through the Security Gateway to determine if the Web servers were protected from a recent series of cross-site scripting attacks. The penetration testing indicated the Web servers were still vulnerable. You have checked every box in the Web Intelligence tab, and installed the Security Policy. What else might you do to reduce the vulnerability?
Question560: Identify the correct step performed by Smart Update to upgrade a remote Security Gateway.
Question561: The connection to the first Cluster XL member breaks. The first Cluster XL member leaves the cluster.
Afterwards the switch admin set on port to second Cluster XL member to down. What will happen?
Question562: In Smart Workflow, what is NOT a valid possibility?
Question563: All R76 Security Servers can perform authentication with the exception of one. Which of the Security Servers can NOT perform authentication?
Question564: Control connections between the Security Management Server and the Gateway are not encrypted by the VPN Community. How are these connections secured?
Question565: Can the smallest appliance handle all Blades simultaneously?
Question566: Your customer asks you about Check Point Smart Workflow. His company must comply with various laws and regulations and therefore it is important for him to be able to see the changes made to a specific object0 How can the customer receive the required information?
Question567: To force clients to use Integrity Secure Workspace when accessing sensitive applications, the Administrator can configure Connector:
Question568: Which of the following would be a result of having more than one active Security Management Server in a Management High Availability (HA) configuration?
Question569: What is a requirement for setting up R76 Management High Availability?
Question570: Your customer wishes to use Smart Workflow Software Blade, but he also wishes to install a policy during an emergency without an approval. Is it possible?
Question571: For a dedicated DLP Gateway that runs in inline bridge mode, why is it important to properly define the topology?
Question572: Does Check Point recommend generating an upgrade export on standby Smart Centers?
Question573: Refer to the to the network topology below.
You have IPS software Blades active on security Gateways sglondon, sgla, and sgny, but still experience attacks on the Web server in the New York DMZ. How is this possible?
Question574: Network applications accessed using SSL Network Extender have been found to fail after one of their TCP connections has been left idle for more than one hour. You determine that you must enable sending reset (RST) packets upon TCP time-out expiration. Where is it necessary to change the setting?
Question575: How many pre-defined exclusions are included by default in Smart Event R76 as part of the product installation?
Question576: Rachel is the Security Administrator for a university. The university's FTP servers have old hardware and software. Certain FTP commands cause the FTP servers to malfunction. Upgrading the FTP servers is not an option at this time. Which of the following options will allow Rachel to control which FTP commands pass through the Security Gateway protecting the FTP servers?
Question577: Which command displays the installed Security Gateway version?
Question578: Which of the following is a valid Active Directory designation for user Jane Doe in the MIS department of AcmeCorp.com?
Question579: You are running a R76 Security Gateway on Secure Platform. In case of a hardware failure, you have a server with the exact same hardware and firewall version installed. What backup method could be used to quickly put the secondary firewall into production?
Question580: Which Check Point tool allows you to open a debug file and see the VPN packet exchange details?
Question581: __________ is a proprietary Check Point protocol. It is the basis for Check Point Cluster XL inter-module communication.
Question582: Your company's Security Policy forces users to authenticate to the Gateway explicitly, before they can use any services. The Gateway does not allow the Telnet service to itself from any location. How would you configure authentication on the Gateway? With a:
Question583: What is not available for Express Reports compared to Standard Reports?
Question584: In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. An internal host 10.4.8.108 successfully pings its Cluster and receives replies. Review the ARP table from the internal Windows host 10.4.8.108.
Based on this information, what is the active cluster member's IP address?
Question585: Which is the lowest Gateway version manageable by Smart Center R77?
Question586: Which port is typically used by SSL Network Extender, if the Connecter Portal will also be used on the same IP address?
Question587: Your users are defined in a Windows 2008 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R76?
Question588: When using IPS, what does Geo protection do?
Question589: While using the Smart Provisioning Wizard to create a new profile, you cannot continue because there are no devices to select. What is a possible reason for this?
i) All devices already have a profile assigned to them
ii) Provisioning Blade is not enabled on the devices
iii) No UTM- 1/Power- 1/Secure Platform devices are defined in Smart Dashboard iv) SIC is not established on the devices.
Question590: Which command would you use to save the routing information before upgrading a Windows Gateway?
Question591: What is the proper command for importing users into the R77 User Database?
Question592: Which of the following items should be configured for the Security Management Server to authenticate via LDAP?
Question593: If the number of kernel instances for Core XL shown is 6, how many cores are in the physical machine?
Question594: Problems sometimes occur when distributing IPSec packets to a few machines in a Load Sharing Multicast mode cluster, even though the machines have the same source and destination IP addresses. What is the best Load Sharing method for preventing this type of problem?
Question595: Which command would you use to save the interface information before upgrading a GAiA Gateway?
Question596: You logged in to your firewall and discovered that the scheduled backup has been modified. Which of the below options is NOT a reason for the change?
Question597: SIMULATION
In a zero downtime scenario, which command do you run manually after all cluster members are upgraded?
Question598: The process ________ is responsible for Policy compilation.
Question599: What type of object may be explicitly defined as a MEP VPN?
Question600: The Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
What is not a recommended usage of this method?
Question601: Where multiple Smart Directory servers exist in an organization, a query from one of the clients for user information is made to the servers based on a priority. By what category can this priority be defined?
Question602: What port is used for communication to the User Center with Smart Update?
Question603: Which Protection Mode does not exist in IPS?
Question604: Which three of the following components are required to ge a Smart Event up and running?
1) Smart Event SIC
2) Smart Event Correlation Unit
3) Smart Event Server
4) Smart Event Analyzer
5) Smart Event Client
Question605: Review the cphaprob state command output from a New Mode High Availability cluster member.
Which machine has the highest priority?
Question606: VPN routing can also be configured by editing which file?
Question607: For proper system operation, the Administrator has to configure the DLP Portal and define its DNS name for which of the following conditions?
Question608: Remote clients are using IPSec VPN to authenticate via LDAP server to connect to the organization.
Which gateway process is responsible for the authentication?
Question609: Which of the following is NOT defined by an Access Role object?
Question610: Your R7x-series Enterprise Security Management Server is running abnormally on Windows Server 2003 R2. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings intact (i.e., all Security Policies, databases, SIC, licensing etc.) What is the BEST method to reinstall the Server and keep its critical configuration?
A)
B)
C)
D)
Question611: Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
Which of the following is NOT a recommended use for this method?
Question612: SIMULATION
Fill in the blank. To save your OSPF configuration in GAiA, enter the command ___________ .
Question613: You want only RAS signals to pass through H.323 Gatekeeper and other H.323 protocols, passing directly between end points. Which routing mode in the VoIP Domain Gatekeeper do you select?
Question614: Robert has configured a Common Internet File System (CIFS) resource to allow access to the public partition of his company's file server, on \\erisco\goldenapple\files\public. Robert receives reports that users are unable to access the shared partition, unless they use the file server's IP address.
Which of the following is a possible cause?
Question615: True or false? After creating a snapshot of a Windows 2003 SP2 Security Management Server, you can restore it on a Secure Platform R76 Security Management Server, except you must load interface information manually.
Question616: Which OPSEC server is used to prevent users from accessing certain Web sites?
Question617: You are reviewing Smart View Tracker entries, and see a Connection Rejection on a Check Point QoS rule. What causes the Connection Rejection?
Question618: SIMULATION
Multi Corp is located in Atlanta. It has a branch office in Europe, Asia, and Africa. Each location has its own AD controller for local user login. How many AD queries have to be configured?
Question619: What is a task of the Smart Event Correlation Unit?
Question620: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question621: Match the VPN-related terms with their definitions:
Question622: What is a possible reason for the grayed out Restore Version button in the screenshot of the Database Revision Control while trying to restore Old Structure?
Question623: What cluster mode is represented in this case?
Question624: Barak is a Security Administrator for an organization that has two sites using per shared secrets in its VPN.
The two sites are Oslo and London. Barak has just been informed that a new office is opening in Madrid, and he must enable all three sites to connect via the VPN to each other. Three Security Gateways are managed by the same Smart Center Server, behind the Oslo Security Gateway. Barak decides to switch from per shared secrets to Certificates issued by the Internal Certificate Authority (ICA). After creating the Madrid gateway object with the proper VPN Domain, what are Barak's remaining steps?
1. Disable "PrE. Shared Secret" on the London and Oslo gateway objects
2. Add the Madrid gateway object into the Oslo and London's mesh VPN Community
3. Manually generate ICA Certificates for all three Security Gateways.
4. Configure "Traditional mode VPN configuration" in the Madrid gateway object's VPN screen
5. Reinstall the Security Policy on all three Security Gateways.
Question625: Which of the following authentication methods can be configured in the Identity Awareness setup wizard?
Question626: You are a Security Administrator preparing to deploy a new HFA (Hot fix Accumulator) to ten Security Gateways at five geographically separated locations. What is the BEST method to implement this HFA?
Question627: As a Security Administrator, you must refresh the Client Authentication authorization time-out every time a new user connection is authorized. How do you do this? Enable the Refreshable Timeout setting:
Question628: What is the command to upgrade an NG with Application Intelligence R55 Smart Center running on Secure Platform to VPN-1 NGX R65?
Question629: Your perimeter Security Gateway's external IP is 200.200.200.3. Your network diagram shows:
Required. Allow only network 192.168.10.0 and 192.168.20.0 to go out to the Internet, using
200.200.200.5.
The local network 192.168.1.0/24 needs to use 200.200.200.3 to go out to the Internet.
Assuming you enable all the settings in the NAT page of Global Properties, how could you achieve these requirements?
Question630: You set up a mesh VPN Community, so your internal networks can access your partner's network, and vice versa. Your Security Policy encrypts only FTP and HTTP traffic through a VPN tunnel. All other traffic among your internal and partner networks is sent in clear text. How do you configure the VPN Community?
Question631: SIMULATION
Fill in the blank. To verify that a VPN Tunnel is properly established, use the command _________
Question632: You have a High Availability Cluster XL configuration. Machines are not synchronized. What happens to connections on failover?
Question633: When using a template to define a Smart Directory, where should the user's password be defined? In the:
Question634: What is the default port number for Secure Sockets Layer connections with the LDAP Server?
Question635: What happens if the identity of a user is known?
Question636: An Account Unit is the interface between the __________ and the __________.
Question637: What is the router command to save your OSPF configuration?
Question638: Which of the following is NOT a LDAP server option in Smart Directory?
Question639: Which command allows you to view the contents of an R76 table?
Question640: You are the Mega Corp Security Administrator. This company uses a firewall cluster, consisting of two cluster members. The cluster generally works well but one day you find that the cluster is behaving strangely. You assume that there is a connectivity problem with the cluster synchronization cluster link (cross-over cable). Which of the following commands is the best for testing the connectivity of the crossover cable?
Question641: Smart Provisioning can provision the Operating System and network settings on which of the following?
Question642: What is the best tool to produce a report which represents historical system information?
Question643: Charles requests a Website while using a computer not in the net_singapore network. What is TRUE about his location restriction?
Exhibit:
Question644: _________ is the called process that starts when opening Smart View Tracker application.
Question645: Management Portal should be installed on:
(i) Management Server
(ii) Security Gateway
(iii) Dedicated Server
Question646: What command with appropriate switches would you use to test Identity Awareness connectivity?
Question647: Review the following list of actions that Security Gateway R76 can take when it controls packets. The Policy Package has been configured for Simplified Mode VPN. Select the response below that includes the available actions:
Question648: Which network port does PPTP use for communication?
Question649: You are preparing computers for a new Cluster XL deployment. For your cluster, you plan to use four machines with the following configurations:
Cluster Member 1: OS: Secure Platform, NICs: Quad Card, memory: 1 GB, Security Gateway only, version: R76 Cluster Member 2: OS: Secure Platform, NICs: 4 Intel 3Com, memory: 1 GB, Security Gateway only, version: R76 Cluster Member 3: OS: Secure Platform, NICs: 4 other manufacturers, memory: 512 MB, Security Gateway only, version: R76 Security Management Server: MS Windows 2003, NIC. Intel NIC (1), Security Gateway and primary Security Management Server installed, version: R76 Are these machines correctly configured for a Cluster XL deployment?
Question650: Before upgrading Secure Platform, you should create a backup. To save time, many administrators use the command backup. This creates a backup of the Check Point configuration as well as the system configuration.
An administrator has installed the latest HFA on the system for fixing traffic problems after creating a backup file. There is a mistake in the very complex static routing configuration. The Check Point configuration has not been changed. Can the administrator use a restore to fix the errors in static routing?
Question651: Which of the following methods will provide the most complete backup of an R77 configuration?
Question652: The connection to the Cluster XL member 'A' breaks. The Cluster XL member 'A' status is now 'down'.
Afterwards the switch admin set a port to Cluster XL member 'B' to 'down'. What will happen?
Question653: How would you set the debug buffer size to 1024?
Question654: You are a SSL VPN Administrator. Your users complain that their Outlook Web Access is running extremely slowly, and their overall browsing experience continues to worsen. You suspect it could be a logging problem. Which of the following log files does Check Point recommend you purge?
Question655: Which of the following statements accurately describes the command upgrade export?
Question656: To help organize events, Smart Reporter uses filtered queries. Which of the following is NOT an Smart Event event property you can query?
Question657: For Management High Availability, if an Active SMS goes down, does the Standby SMS automatically take over?
Question658: You are running the license upgrade tool on your Secure Platform Gateway. Which of the following can you NOT do with the upgrade tool?
Question659: You are running R71 and using the new IPS Software Blade. To maintain the highest level of security, you are doing IPS updates regularly. What kind of problems can be caused by the automatic updates?
Question660: Mega Corp is using Smart Center Server with several gateways. Their requirements result in a heavy log load. Would it be feasible to add the Smart Event Correlation Unit and Smart Event Server to their Smart Center Server?
Question661: Which is NOT a method through which Identity Awareness receives its identities?
Question662: Where do you verify that Smart Directory is enabled?
Question663: What is a task of the Smart Event Server?
Question664: How granular may an administrator filter an Access Role with identity awareness?
Question665: You want to block corporate internal-net and local net from accessing Web sites containing inappropriate content. You are using Web Trends for URL filtering. You have disabled VPN-1 Control connections in the Global properties. Review the diagram and the Security Policies for GW_A and GW_B in the exhibit provided.
Corporate users and localnet users receive message "Web cannot be displayed". In Smart View Tracker, you see the connections are dropped with message "content security is not reachable". What is the problem, and how do you fix it?
Question666: Wayne configures an HTTP Security Server to work with the content vectoring protocol to screen forbidden sites. He has created a URI resource object using CVP with the following settings:
Use CVP
Allow CVP server to modify content
Return data after content is approved
He adds two rules to his Rule Base: one to inspect HTTP traffic going to known forbidden sites, the other to allow all other HTTP traffic.
Wayne sees HTTP traffic going to those problematic sites is not prohibited.
What could cause this behavior?
Question667: In a particular IPS protection in R76 in the Logging Settings, what does the Capture Packets option do?
Question668: How do you control the maximum mail messages in a spool directory?
Question669: What is a requirement for setting up R76 Management High Availability?
Question670: John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to a set of designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19.
He has received a new laptop and wants to access the HR Web Server from anywhere in the organization.
The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk.
The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop with a static IP (10.0.0.19).
He wants to move around the organization and continue to have access to the HR Web Server. To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources, and installs the policy.
2) Adds an access role object to the Firewall Rule Base that lets John Adams access the HR Web Server from any machine and from any location and installs policy.
John plugged in his laptop to the network on a different network segment and was not able to connect to the HR Web server. What is the next BEST troubleshooting step?
Question671: User definitions are stored in ________________ .
Question672: You have two IP Appliances: one IP565 and one IP395. Both appliances have IPSO 6.2 and R76 installed in a distributed deployment. Can they be members of a Gateway Cluster?
Question673: Where can a Security Administrator adjust the unit of measurement (bps, Kbps or Bps), for Check Point QoS bandwidth?
Question674: Which type of routing relies on a VPN Tunnel Interface (VTI) to route traffic?
Question675: Which command will only show the number of entries in the connection table?
Question676: Your R76 enterprise Security Management Server is running abnormally on Windows 2008 Server. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings intact (i.e., all Security Policies, databases, SIC, licensing etc.) What is the BEST method to reinstall the Server and keep its critical configuration?
Question677: When you check Web Server in a host-node object, what happens to the host?
Question678: When using Captive Portal to send unidentified users to a Web portal for authentication, which of the following is NOT a recommended use for this method?
Question679: You want to upgrade a cluster with two members to VPN-1 NGX. The Smart Center Server and both members are version VPN-1/Firewall-1 NG FP3, with the latest Hotfix. What is the correct upgrade procedure?
1. Change the version, in the General Properties of the gateway-cluster object.
2. Upgrade the Smart Center Server, and reboot after upgrade.
3. Run cpstop on one member, while leaving the other member running. Upgrade one member at a time, and reboot after upgrade.
4. Reinstall the Security Policy.
Question680: The process _______ executes the authentication for logging in to Smart Dashboard.
Question681: If traffic requires preferential treatment by other routers on the network, in addition to the QoS module, which Check Point QoS feature should be used?
Question682: When synchronizing clusters, which of the following statements is NOT true?
Question683: What type of packet does a VPN-1 Secure Client send to its Policy Server, to report its Secure Configuration Verification status?
Question684: Which of the following statements is FALSE regarding OSPF configuration on Secure Platform Pro?
Question685: A customer called to report one cluster member's status as Down. What command should you use to identify the possible cause?
Question686: Which CLI tool helps on verifying proper Cluster XL sync?
Question687: Which of the following commands can be used to stop Management portal services?
Question688: What is the Smart Event Correlation Unit's function?
Question689: Mega Corp is using Smart Center Server with several gateways. Their requirements result in a heavy log load. Would it be feasible to add the Smart Event Correlation Unit and Smart Event Server to their Smart Center Server?
Question690: You are troubleshooting a HTTP connection problem. You've started fw monitor -o http.pcap. When you open http. cap with Wire shark there is only one line. What is the most likely reason?
Question691: SIMULATION
To stop acceleration on a GAiA Security Gateway, enter command
Question692: Included in the client's network are some switches, which rely on IGMP snooping. You must find a solution to work with these switches. Which of the following answers does NOT lead to a successful solution?
Question693: If you need strong protection for the encryption of user data, what option would be the BEST choice?
Question694: If Bob wanted to create a Management High Availability configuration, what is the minimum number of Security Management servers required in order to achieve his goal?
Question695: Steve tries to configure Directional VPN Rule Match in the Rule Base. But the Match column does not have the option to see the Directional Match. Steve sees the following screen. What is the problem?
Question696: You have selected the event Port Scan from Internal Network in Smart Event, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?
Question697: SIMULATION
Fill in the blank. To enter the router shell, use command __________ .
Question698: Review the R76 configuration.
Is it correct for Management High Availability?
Question699: What command syntax would you use to see accounts the gateway suspects are service accounts?
Question700: Your customer wishes to install the Smart Workflow Software Blade on a R70 Security Management server (Secure Platform). Which is the correct method?
Question701: If both domain-based and route-based VPN's are configured, which will take precedence?
Question702: SIMULATION
The command useful for debugging by capturing packet information, including verifying LDAP authentication on all Check Point platforms is
Question703: Which protocol is not supported for DLP?
Question704: Mega Corp is running Smart center R70, some Gateways at R65 and some other Gateways with R60.
Management wants to upgrade to the most comprehensive IPv6 support. What should the administrator do first?
Question705: Which answers are TRUE? Automatic Static NAT CANNOT be used when:
1) NAT decision is based on the destination port.
2) Both Source and Destination IP's have to be translated.
3) The NAT rule should only be installed on a dedicated Gateway.
4) NAT should be performed on the server side.
Question706: The process ________________ compiles $FWDIR/conf/*.W files into machine language.
Question707: All of the following are used by the DLP engine to match a message during a scan, EXCEPT:
Question708: If using AD Query for seamless identity data reception from Microsoft Active Directory (AD), which of the following methods is NOT Check Point recommended?
Question709: Which of the following are authentication methods that Security Gateway R76 uses to validate connection attempts? Select the response below that includes the MOST complete list of valid authentication methods.
Question710: When using AD Query to authenticate users for Identity Awareness, identity data is received seamlessly from the Microsoft Active Directory (AD). What is NOT a recommended usage of this method?
Question711: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend anytime outside a maintenance window?
Question712: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question713: Which protocol can be used to provide logs to third-party reporting?
Question714: Which process should you debug if Smart Dashboard login fails?
Question715: Review the cphaprob state command output from one New Mode High Availability Cluster XL cluster member.
Which member will be active after member 192.168.1.2 fails over and is rebooted?
Question716: Choose all correct statements. Smart Update, located on a VPN-1 NGX Smart Center Server, allows you to:
(1) Remotely perform a first time installation of VPN-1 NGX on a new machine (2) Determine OS patch levels on remote machines (3) Update installed Check Point and any OPSEC certified software remotely (4) Update installed Check Point software remotely (5) Track installed versions of Check Point and OPSEC products
(6) Centrally manage licenses
Question717: You enable Sweep Scan Protection and Host port scan in IPS to determine if a large amount of traffic from a specific internal IP address is a network attack, or a user's system is infected with a worm. Will you get all the information you need from these actions?
Question718: With is the Smart Event Correlation Unit's function?
Question719: Which of the following SSL Network Extender server-side prerequisites are correct? Select all that apply.
Question720: Which procedure creates a new administrator in Smart Workflow?
Question721: A snapshot delivers a complete backup of Secure Platform. The resulting file can be stored on servers or as a local file in /var/CP snapshot/snapshots. How do you restore a local snapshot named MySnapshot.tgz?
Question722: Mark the configuration options that are available for Data Loss Prevention in R71.
Question723: The following diagram illustrates how a VPN-1 Secure Client user tries to establish a VPN with hosts in the external_net and internal_net from the Internet. How is the Security Gateway VPN Domain created?
Question724: Your current stands alone VPN-1 NG with Application Intelligence (Al) R55 installation is running on Secure Platform. You plan to implement VPN-1 NGX in a distributed environment, where the existing machine will be the VPN-1 Pro Gateway. An additional machine will serve as the Smart Center Server. The new machine runs on a Windows Server 2003. You need to upgrade the NG with Al R55 Smart Center Server configuration to VPN-1 NGX.
How do you upgrade to VPN-1 NGX?
Question725: How would you configure a rule in a Security Policy to allow SIP traffic from end point Net_Ato end point Net_B, through an NGX Security Gateway?
Question726: Due to some recent performance issues, you are asked to add additional processors to your firewall. If you already have Core XL enabled, how are you able to increase Kernel instances?
Question727: Which procedure enables the SSL VPN blade on the gateway?
Question728: How do new connections get established through a Security Gateway with Secure XL enabled?
Question729: Which of the following commands can be used to troubleshoot Cluster XL sync issues?
Question730: To verify Secure XL statistics you would use the command ________?
Question731: To change the default port of the Management Portal:
Question732: What does it mean when a Security Gateway is labeled Untrusted in the Smart Provisioning Status view?
Question733: Which of the following is the preferred method for adding static routes in GAiA?
Question734: You are trying to configure Directional VPN Rule Match in the Rule Base. But the Match column does not have the option to see the Directional Match. You see the following window.
What must you enable to see the Directional Match?
Question735: You receive an alert indicating a suspicious FTP connection is trying to connect to one of your internal hosts. How do you block the connection in real time and verify the connection is successfully blocked?
Question736: Which of the following allows administrators to allow or deny traffic to or from a specific network based on the user's credentials?
Question737: By default, the Cluster Control Protocol (CCP) uses this to send delta sync messages to other cluster members.
Question738: What is Check Point's Secure XL?
Question739: To configure a Security Management Server for an SSL VPN Gateway, you can set up log forwarding from that Gateway. All of the following tasks must be performed to accomplish this, EXCEPT:
Question740: Which of the following components contains the Events Data Base?
Question741: If Jack was concerned about the number of log entries he would receive in the SmartReporter system, which policy would he need to modify?
Question742: Which of the following is NOT part of the policy installation process?
Question743: What is the reason for the following error?
Question744: Which of the following load-balancing methods is not valid?
Question745: Looking at the SYN packets in the Wire shark output, select the statement that is true about NAT.
Exhibit:
Question746: What gives administrators more flexibility when configuring Captive Portal instead of LDAP query for Identity Awareness authentication?
Question747: The file snapshot generates is very large, and can only be restored to:
Question748: You have installed Secure Platform R76 as Security Gateway operating system. As company requirements changed, you need the VTI features of R76. What should you do?
Question749: The process ________ is responsible for Management High Availability synchronization.
Question750: You want VPN traffic to match packets from internal interfaces. You also want the traffic to exit the Security Gateway bound for all site-to-site VPN Communities, including Remote Access Communities. How should you configure the VPN match rule?
Question751: Susan needs to change the DNS settings on her Secure Platform Gateway. Using the output below,
Which Gateway could she edit directly from the Devices view using Edit Gateway, then selecting the DNS tab?
Question752: Your main internal network 10.10.10.0/24 allows all traffic to the Internet using Hide NAT. You also have a small network 10.10.20.0/24 behind the internal router. You want to configure the kernel to translate the source address only when network 10.10.20.0 tries to access the Internet for HTTP, SMTP, and FTP services. Which of the following configurations will allow this network to access the Internet?
Question753: Which internal user authentication protocols are supported in SSL VPN?
Question754: What is the maximum number of cores supported by Core XL?
Question755: Access Role objects define users, machines, and network locations as:
Question756: Which of the following actions is most likely to improve the performance of Check Point QoS?
Question757: If a digital signature is used to achieve both data-integrity checking and verification of sender, digital signatures are only used when implementing:
Question758: To run Gaia in 64bit mode, which of the following is true?
1) Run set edition default 64-bit.
2) Install more than 4 GB RAM.
3) Install more than 4 TB of Hard Disk.
Question759: Which command provides cluster upgrade status?
Question760: Which Security Servers can perform Content Security tasks, but CANNOT perform authentication tasks?
Question761: Which process should you debug if Smart Dashboard login fails?
Question762: Your customer complains of the weak performance of his systems. He has heard that Connection Templates accelerate traffic. How do you explain to the customer about template restrictions and how to verify that they are enabled?
Question763: Assume you are a Security Administrator for ABCTech. You have allowed authenticated access to users from Mkting_net to Finance net. But in the user's properties, connections are only permitted within Mkting_net. What is the BEST way to resolve this conflict?
Question764: You want to upgrade a cluster with two members to R76. The Security Management Server and both members are version NGX R65, with the latest Hot fix Accumulator. What is the correct upgrade procedure?
1. Change the version in the General Properties of the Gateway-cluster object.
2. Upgrade the Security Management Server, and reboot.
3. Run cpstop on one member, while leaving the other member running. Upgrade one member at a time and reboot after upgrade.
4. Reinstall the Security Policy.
Question765: The process ________ is responsible for GUI Client communication with the Smart Center.
Question766: Which statement is TRUE for route-based VPN's?
Question767: Your expanding network currently includes Cluster XL running Multicast mode on two members, as shown in this topology:
You need to add interfaces: 10.10.10.1/24 on Member A, and 10.10.10.2/24 on Member B.
The virtual IP address for these interfaces is 10.10.10.3/24. Both cluster gateways have a Quad card with an available eth3 interface. What is the correct procedure to add these interfaces?
Question768: Refer to the network topology below.
You have IPS Software Blades active on the Security Gateways sglondon, sgla, and sgny, but still experience attacks on the Web server in the New York DMZ. How is this possible?
Question769: In Cluster XL, _______ is defined by default as a critical device.
Question770: Which of the following statements is FALSE about the DLP Software Blade and Active Directory (AD) or LDAP?
Question771: Which of the following is a TRUE statement concerning contract verification?
Question772: When configuring an LDAP Group object, select option _______________ if you want the gateway to reference a specific group defined on the LDAP server for authentication purposes.
Question773: Which of the following deployment scenarios CANNOT be managed by Check Point QoS?
Question774: How are cached usernames and passwords cleared from the memory of a R76 Security Gateway?
Question775: Exhibit:
UserA is able to create a Smart LSM Security Cluster Profile , you must select the correct justification.
Question776: Which Check Point address translation method is necessary if you want to connect from a host on the Internet via HTTP to a server with a reserved (RFC 1918) IP address on your DMZ?
Question777: How is Smart Workflow disabled?
Question778: Which method of load balancing describes "Round Robin"?
Question779: What Smart Console application allows you to change the Log Consolidation Policy?
Question780: Which of the following can NOT be modified by editing the cp_httpd_admin.conf file?
Question781: Public keys and digital certificates provide which of the following? Select three.
Question782: SIMULATION
Fill in the blank. You can set Acceleration to ON or OFF using command syntax ___________ .
Question783: Which component receives events and assigns severity levels to the events; invokes any defined automatic reactions, and adds the events to the Events Data Base?
Question784: What is the behavior of Cluster XL in a High Availability environment?
Question785: Check Point Clustering protocol, works on:
Question786: Which of the following is part of the PKI? Select all that apply.
Question787: To clean the system of all events, you should delete the files in which folder(s)?
Question788: Use the table to match the BEST Management High Availability synchronization-status descriptions for your Security Management Server (SMS).
Question789: Stephanie wants to reduce the encryption overhead and improve performance for her mesh VPN Community. The Advanced VPN Properties screen below displays adjusted page settings: What can Stephanie do to achieve her goal?
Question790: You have configured an LDAP account unit and confirmed the Apply & Fetch Branches option works in SSL VPN, but end users still cannot be authenticated. What is the MOST LIKELY cause?
Question791: How do you check the version of "CPSIZEME" on GAiA?
Question792: The Management Portal Software Blade allows users to
Question793: Which of the following log files contains information about the negotiation process for encryption?
Question794: Identify the correct step performed by Smart Update to upgrade a remote Security Gateway.
Question795: SIMULATION
Fill in the blank. In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2 Internal host 10.4.8.108 pings 10.4.8.3, and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. According to the output, which member is the standby machine?
Question796: Which of the following can NOT approve a change in a Smart Workflow session?
Question797: Which operating systems are supported by a Check Point Security Gateway on an open server? Select MOST complete list.
Question798: Using Smart Provisioning Profiles, which of the following could be configured for both Secure Platform AND UTM-1 Edge devices?
(i) Backup
(ii) Routing
(iii) Interfaces
(iv) Hosts
(v) NTP server
(vi) DNS
Question799: Which of the following items should be configured for the Security Management Server to authenticate using LDAP?
Question800: Micro Corp experienced a security appliance failure. (LEDs of all NICs are off.) The age of the unit required that the RMA-unit be a different model. Will a revert to an existing snapshot bring the new unit up and running?
Question801: Many companies have defined more than one administrator. To increase security, only one administrator should be able to install a Rule Base on a specific Firewall. How do you configure this?
Question802: What step should you take before running migrate_export?
Question803: Which VPN Community object is used to configure VPN routing within the Smart Dashboard?
Question804: Which Remote Desktop protocols are supported natively in SSL VPN?
Question805: In a distributed VPN-1 Pro NGX environment, where is the Internal Certificate Authority (ICA) installed?
Question806: Jennifer McHanry is CEO of ACME. She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory domain, she cannot identify seamlessly with AD Query. However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R76 Firewall Rule Base.
To make this scenario work, the IT administrator must:
1) Enable Identity Awareness on a gateway and select Captive Portal as one of the Identity Sources.
2) In the Portal Settings window in the User Access section, make sure that Name and password login is selected.
3) Create a new rule in the Firewall Rule Base to let Jennifer McHanry access network destinations.
Select accept as the Action.
Ms. McHanry tries to access the resource but is unable. What should she do?
Question807: What process is responsible for transferring the policy file from Smart Center to the Gateway?
Question808: What is the greatest benefit derived from VPNs compared to frame relay, leased lines any other types of dedicated networks?
Question809: SIMULATION
Fill in the blank. What is the correct command and syntax used to view a connection table summary on a Check Point Firewall?