EMT Practice Test

1. Question Content...

---

Question1: Aaron is a Cyber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R80.10. Company's Network Security Developer Team is having issue testing new API with newly deployed R80.10 Security Management Server and blames Check Point Security Management Server as root cause. The ticket has been created and issue is at Aaron's desk for an investigation. What do you recommend as the best suggestion for Aaron to make sure API testing works as expected?

Question2: You have successfully backed up your Check Point configurations without the OS information. What command would you use to restore this backup?

Question3: SandBlast has several functional components that work together to ensure that attacks are prevented in real-time. Which the following is NOT part of the SandBlast component?

Question4: In SPLAT the command to set the timeout was idle. In order to achieve this and increase the timeout for Gaia, what command do you use?

Question5: After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

Question6: What is the port used for SmartConsole to connect to the Security Management Server:

Question7: Which of the following is NOT an attribute of packet acceleration?

Question8: What is correct statement about Security Gateway and Security Management Server failover in Check Point R80.X in terms of Check Point Redundancy driven solutions?

Question9: What are the three components for Check Point Capsule?

Question10: Daisy need to review how the Security Gateway Cluster, Jonas, behaves when a cluster member comes back on line. Where would she review the behavior of cluster member recovery in the Dashboard?

Question11: You are investigating issues with two gateway cluster members that are not able to establish the first initial cluster synchronization. What service is used by the FWD daemon to do a Full Synchronization?

Question12: Which one of the following is true about Threat Emulation?

Question13: In a Client to Server scenario, which represents that the packet has already been checked against the tables and the Rule Base?

Question14: After successfully exporting a policy package, how would you import that package into another SMS database in R80.10?

Question15: What does the command vpn crl_zapdo?

Question16: What happen when IPS profile is set in Detect-Only Mode for troubleshooting?

Question17: What API command below creates a new host with the name "New Host" and IP address of
"192.168.0.10"?

Question18: What is the mechanism behind Threat Extraction?

Question19: What processes does CPM control?

Question20: To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection.
Which of these IS NOT a SecureXL template?

Question21: VPN Tunnel Sharing can be configured with any of the options below, EXCEPT One:

Question22: What are types of Check Point APIs available currently as part of R80.10 code?

Question23: Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

Question24: What is the command to see cluster status in cli expert mode?

Question25: SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

Question26: What is true of the API server on R80.10?

Question27: Automatic affinity means that is SecureXL is running, the affinity for each interface is automatically reset every.

Question28: You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores. How many cores can be used in a Cluster for Firewall-kernel on the new device?

Question29: The system administrator of a company is trying to find out why acceleration is not working for the traffic.
The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

Question30: What is the difference between an event and a log?

Question31: Where do you create and modify the Mobile Access policy in R80?

Question32: Check Point security components are divided into the following components:

Question33: In R80.10, how do you manage your Mobile Access Policy?

Question34: By default, the R80 web API uses which content-type in its response?

Question35: Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will be need if he does NOT include a SmartConsole machine in his calculations?

Question36: You plan to automate creating new objects using new R80 Management API. You decide to use GAIA CLI for this task. What is the first step to run management API commands on GAIA's shell?

Question37: The Correlation Unit performs all but which of the following actions:

Question38: Identify the API that is not supported by Check Point currently.

Question39: Which command will allow you to see the interface status?

Question40: What information is NOT collected from a Security Gateway in a Cpinfo?

Question41: In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with
___________ will not apply.

Question42: Which statement is most correct regarding about "CorrectXL Dynamic Dispatcher"?

Question43: Which of the following is NOT a type of Check Point API available in R80.10?

Question44: What are the main stages of a policy installation?

Question45: You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down. What command do you run to determine the case?

Question46: You have existing dbedit scripts from R77. Can you use them with R80.10?

Question47: If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsive, which of these steps should NOT be performed:

Question48: What is considered Hybrid Emulation Mode?

Question49: The "MAC magic" value must be modified under the following condition:

Question50: What is the command to show SecureXL status?

Question51: In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:

Question52: When simulating a problem on CLusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?

Question53: Which statement is true regarding redundancy?

Question54: What is the responsibility of SOLR process on R80.10 management server?

Question55: Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Question56: Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

Question57: You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don't have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

Question58: What Factors preclude Secure XL Templating?

Question59: Which packet info is ignored with Session Rate Acceleration?

Question60: Which one of these is NOT a firewall chain?

Question61: Advanced Security Checkups can be easily conducted within:

Question62: Which is the correct order of a log flow processed by SmartEvents components:

Question63: Both ClusterXL and VRRP are fully supported by Gaia R80.10 and available to all Check Point appliances.
Which of the following command is NOT related to redundancy and functions?

Question64: Jack has finished building his new SMS server, Red, on new hardware. He used SCP to move over the Red-old.tgzexport of his old SMS server. What is the command he will use to import this into the new server?

Question65: What are the available options for downloading Check Point hotfixes in Gaia WebUI (CPUSE)?

Question66: The Regulatory Compliance pane shows compliance statistics for selected regulatory standards, based on the Security Best Practice scan. Which of the following does NOT show in this pane?

Question67: Fred is troubleshooting a NAT issue and wants to check to see if the inbound connection from his internal network is being translated across the interface in the firewall correctly. He decides to use the fw monitor to capture the traffic from the source 192.168.3.5 or the destination of 10.1.1.25 on his Security Gateway, Green that has an IP of 192.168.4.5. What command captures this traffic in a file that he can download and review with WireShark?
Expert@Green# fwmonitor -e "accept src=192.168.3.5 and dst=10.1.1.25;" -o

Question68: Joey and Vanessa are firewall administrators in their company. Joey wants to run Management API server on his Security Management server. He is logging in to a Smart Console and goes to the Manage & Settings > Blade. In Management API section, he proceeds to Advanced Settings. He likes to set up the Management API server to automatic run at startup. He is surprised, because this functionality is already selected by default.
What is the reason, that functionality is already enabled?

Question69: Which one of the following processes below would not start if there was a licensing issue.

Question70: What are the different command sources that allow you to communicate with the API server?

Question71: What is the purpose of Priority Delta in VRRP?

Question72: Which components allow you to reset a VPN tunnel?

Question73: Firewall policies must be configured to accept VRRP packets on the GAiA platform if it runs Firewall software. The Multicast destination assigned by the Internet Assigned Numbers Authority (IANA) for VRRP is:

Question74: What's true about Troubleshooting option in the IPS profile properties?

Question75: Return oriented programming (ROP) exploits are detected by which security blade?

Question76: You want to store the GAiA configuration in a file for later reference. What command should you use?

Question77: SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Question78: You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

Question79: What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

Question80: If an administrator wants to add manual NAT for addresses not owned by the Check Point firewall, what else is necessary to be completed for it to function properly?

Question81: What is true about the IPS-Blade?

Question82: During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

Question83: Fill in the blank: The tool ___________ generates a R80 Security Gateway configuration report.

Question84: Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

Question85: Which Check Point ClusterXL mode is used to synchronize the physical interface IP and MAC addresses on all clustered interfaces?

Question86: What is the SOLR database for?

Question87: What is the least ideal Synchronization Status for Security Management Server High Availability deployment?

Question88: What command verifies that the API server is responding?

Question89: What is mandatory for ClusterXL to work properly?

Question90: Which method below is NOT one of the ways to communicate using the Management API's?

Question91: The Event List within the Events tab contains:

Question92: To ensure that VMAC mode is enabled, which CLI command you should run on all cluster members?

Question93: Session unique identifiers are passed to the web api using which http header option?

Question94: What is the command to check the status of the SmartEvent Correlation Unit?

Question95: What is the main difference between Threat Extraction and Threat Emulation?

Question96: CPM process stores objects, policies, users, administrators, licenses and management data in a database.
This database is:

Question97: When an encrypted packet is decrypted, where does this happen?