EMT Practice Test

1. Question Content...

---

Question1: Click the Exhibit button.

What is shown in the exhibit?

Question2: Which two statements are true about redundant interfaces? (Choose two.)

Question3: You want to enable IPv6 on your ScreenOS device.
Which command should you use to accomplish this goal?

Question4: Policy-based routing (PBR) policies can be bound to which three ScreenOS objects? (Choose three.)

Question5: Which two actions are performed by a read/write vsys administrator? (Choose two.)

Question6: You want to set up a last resort route and prevent route lookups in either the source-based routing table or the destination-based routing table.
What should you do?

Question7: You want to ensure that the ScreenOS device sends alert data to notify the security operation center.
Which three log destinations would you set to accomplish your objective? (Choose three.)

Question8: Click the Exhibit button.

The exhibit displays output from the event log of a ScreenOS device.
Given the information shown in the exhibit, which two statements are correct? (Choose two.)

Question9: Click the Exhibit button.

You configure NAT on your ScreenOS device to route the services shown in the exhibit to the internal addresses. Which commands will you use to configure this scenario?

Question10: You have configured deep-packet inspection on a ScreenOS device. You have not modified the default threshold values. The device detects a single session that matches an attack.
Which two actions can you configure the device to take? (Choose two.)

Question11: What are three policy types? (Choose three.)

Question12: -- Exhibit --
NSPROD1(M)-> get nsrp ha-link
total_ha_port = 2
probe on ha-link is disabled
unused channel: ethernet8 (ifnum: 11) maC. 0010db1d1e8b statE. down
unused channel: ethernet7 (ifnum: 10) maC. 0010db1d1e8a statE. down
ha control link not available
ha data link not available
ha secondary path link not available
-- Exhibit --
Referring to the exhibit, both clustered devices are in a master state.
What is the cause of this situation?

Question13: Policy-based routing consists of which three ScreenOS objects? (Choose three.)

Question14: What are two advantages for using the count parameter on a security policy? (Choose two.)

Question15: What is an aggregate interface?

Question16: Click the Exhibit button.

Referring to the exhibit, what does this output show?

Question17: -- Exhibit --
Date Time Module Level Type Description
2012-11-30 12:49:41 system warn 00528 SSH: Password authentication failed for admin user 'firewall-user' at host
10.210.62.67.
2012-11-30 12:49:41 system warn 00518 ADM: Local admin authentication failed for login name firewall-user: invalid
login name
2012-11-30 12:49:28 system info 00536 IKE 66.129.232.26 Phase 1:
Retransmission limit has been reached.
2012-11-30 12:42:23 system notif 00531 The system clock was updated from primary NTP server type 209.244.0.5
with an adjustment of 234 ms.
Authentication was None. Update mode
was Automatic
-- Exhibit --
Based on the output shown in the exhibit, in which log were these events displayed?

Question18: Which two authentication algorithms does AutoKey IKE use during Phase 1 negotiations? (Choose two.)

Question19: Click the Exhibit button.

In the exhibit, you have configured the MIP address 1.1.8.64 on a ScreenOS device.
Which statement is correct?

Question20: You are using debug to determine which policy is used for Web traffic from host 10.20.1.5 to server
10.240.1.100. Which flow filter will only capture traffic related to this scenario?

Question21: Which two statements are true about policy-based VPNs as compared to route-based IPsec VPNs when using ScreenOS devices? (Choose two.)

Question22: An SSG5 has a default configuration loaded on it.
Which two statements are correct? (Choose two.)

Question23: You have just installed a new ScreenOS device in your network and you want only a select range of IP addresses to have administrative access to the device.
Which choice will allow you to accomplish this?

Question24: Click the Exhibit button.

Network traffic with a source IP of 192.168.100.60, destination IP of 8.8.8.8, and a destination port of 80 is sent through the ScreenOS device. The inbound zone is Trust, the outbound zone is Untrust.
Based on the policy configuration shown in the exhibit, what happens to this traffic?

Question25: What is the purpose of a virtual system profile?

Question26: You have the following BGP configuration in place to establish a session with a remote peer over your ethernet4 interface.
set vrouter trust-vr protocol bgp 65000
set vrouter trust-vr protocol bgp enable
set vrouter trust-vr protocol bgp neighbor remote-as 65500
set vrouter trust-vr protocol bgp neighbor enable
Which additional statement is necessary to establish the session?

Question27: Your ScreenOS device is using NAT.
Which NAT function allows you to use a single IP address from an untrust zone to communicate to multiple IP addresses in a trust zone?

Question28: Click the Exhibit button.

Which two statements are true about the exhibit? (Choose two.)

Question29: You must translate a range of public IP addresses to a range of internal IP addresses.
Which two mechanisms would you use to accomplish your objective? (Choose two.)

Question30: What are two routing tables contained in a virtual router? (Choose two.)

Question31: What is required to route traffic from one virtual system to another virtual system?

Question32: You want to copy an external configuration file to your ScreenOS device and have it become active only after the device reboots. How would you accomplish this goal?

Question33: Which two protocols are used for NSRP IP tracking? (Choose two.)

Question34: Click the Exhibit button.

Users on the 10.10.10.0/24 subnet are reporting connectivity problems. While troubleshooting, you see the output shown in the exhibit. What is the cause of the route flapping?

Question35: -- Exhibit --
SSH V2 is active
ns5gt-> get int et1
Interface ethernet1:
description ethernet1
number 2, if_info 176, if_index 0, mode nat
link up, phy-link up/full-duplex
status change:1, last change:02/06/1997 18:02:32
vsys Root, zone Trust, vr trust-vr
dhcp client disabled
PPPoE disabled
admin mtu 0, operating mtu 1500, default mtu 1500
*ip 192.168.1.1/24
*manage ip 192.168.1.1,
route-deny disable
pmtu-v4 disabled
ping enabled, telnet enabled, SSH enabled, SNMP enabled
web enabled, ident-reset disabled, SSL enabled
SSH is enabled
SSH is ready for connections
Maximum sessions: 3
Active sessions: 3
-- Exhibit --
You are the administrator of a NetScreen 5GT. The system administrator cannot use SSH to log in to the NetScreen 5GT. Referring to the exhibit, what is the problem?

Question36: Which two statements are true about NAT? (Choose two.)

Question37: A routing table contains an IBGP route, a RIP route, an OSPF external Type 2 route, and an EBGP route for 192.168.0.0/16. When the router receives traffic destined for, which route will the router use by default?

Question38: How is the maximum bandwidth pool allocated when all policies share the same priority?

Question39: What are three valid states for an NSRP member? (Choose three.)

Question40: Click the Exhibit button.

Referring to the exhibit, what is the appropriate VPN monitor status?

Question41: Which NAT has bidirectional translation by default?

Question42: Your ScreenOS device is configured with multiple NAT types.
What is the order of precedence in this situation?

Question43: You have two interfaces in ZoneA and traffic is passing without any policy configured. You want to control the traffic between the two interfaces.
Which two actions will allow this to happen? (Choose two.)

Question44: You have configured integrated Web filtering in the ScreenOS software. A URL appears in the blacklist, the whitelist, and a user-defined category. Additionally, the device can obtain categorization information from the SurfControl server.
Which configuration will the device use to determine the action to take for Web requests for the URL?

Question45: While troubleshooting performance issues on your NetScreen cluster, you decide to failover the master device to its redundant peer. Which two methods will accomplish this task? (Choose two.)

Question46: Click the Exhibit button.

Which two statements are true about the default route configuration based on the output shown in the exhibit? (Choose two.)

Question47: Click the Exhibit button.

In the exhibit, eth3/1 is in the client-vr virtual router and eth3/2 is in the server-vr virtual router. Your policies permit all traffic between all zones. You want to ensure Client1 can contact Server1.
In this scenario, which two statements are true? (Choose two.)

Question48: You want to centralize the logging for all your ScreenOS devices and you must be able to synchronize the log. Which two actions would you perform to accomplish this? (Choose two.)

Question49: Your ScreenOS device does not have a static IP address. You want to be able to access it using its FQDN.
How would you implement this task?

Question50: Click the Exhibit button.

Given the policy and address information for the three hosts shown in the exhibit, which two statements are correct? (Choose two.)

Question51: A routing table contains an IBGP route for 192.168.0.0/24, a RIP route for 192.168.0.0/23, an OSPF route for 192.168.0.0/22, and a static route for 192.168.0.0/16.
When the router receives traffic destined for 192.168.0.1, which route will the router use?

Question52: A monitored interface on a clustered pair of ScreenOS devices goes down and both devices became ineligible to be master of the cluster. As a result, neither device is passing traffic.
Which step would have prevented this situation?

Question53: A ScreenOS device evaluates five primary elements when performing a security policy check on a new session. Which five elements are evaluated?

Question54: The ScreenOS software performs virus scanning for which three protocols? (Choose three.)

Question55: You want to know the username and IP address of users who logged in to the WebUI.
In which log would you find this information?

Question56: You are configuring a VPN with IKE between headquarters and a branch office that uses a dynamic public IP address. Which IKE mode should you use?

Question57: -- Exhibit --
ssg20-> set address "Trust" "192.168.1.0/32" 10.20.1.0 255.255.255.0
ssg20-> set address "Untrust" "10.204.1.0/24" 10.204.1.0 255.255.255.0
ssg20-> set address "Untrust" "192.168.1.0/24" 192.168.1.0 255.255.255.255 ssg20-> get policy id 1
name:"none" (id 1), zone Trust -> Untrust,action Permit, status "enabled" src "192.168.1.0/32", dst "192.168.1.0/24", serv "FTP"
Rules on this VPN policy: 0
nat off, Web filtering : disabled
vpn unknown vpn, policy flag 00000000, session backup: on, idle reset: on traffic shaping off, scheduler n/a, serv flag 00
log no, log count 0, alert no, counter no(0) byte rate(sec/min) 0/0
total octets 0, counter(session/packet/octet) 0/0/0
priority 7, diffserv marking Off
tadapter: state off, gbw/mbw 0/0 policing (no)
No Authentication
No User, User Group or Group expression set
-- Exhibit --
FTP connections from host 10.20.1.10 to server 192.168.1.100 are not working. You produce the output shown in the exhibit. What is causing the traffic problem?

Question58: -- Exhibit --
NS5200(M)-> get nsrp
nsrp version: 2.0
cluster info:
cluster iD. 1, namE. 5200
local unit iD. 8000208
active units discovereD.
index: 0, unit iD. 8014208, ctrl maC. 0010db000085, data maC. 0010db000086 index: 1, unit iD. 8337344, ctrl maC. 0010db0000c5, data maC. 0010db0000c6 total number of units: 2
VSD group info:
init hold timE. 5
heartbeat lost thresholD. 3
heartbeat interval: 200(ms)
master always exist: enabled
group priority preempt holddown inelig master PB other members
0 50 yes 45 no myself 8330044
total number of vsd groups: 1
Total iteration= ,time=878546093,max=4900,min=170,average=18
RTO mirror info:
run time object synC. enabled
ping session synC. enabled
coldstart sync done
nsrp data packet forwarding is enabled
nsrp link info:
control channel: ha1 (ifnum: 5) maC. 0010db000085 statE. up
data channel: ha2 (ifnum: 6) maC. 0010db000086 statE. up
ha secondary path link not available
NSRP encryption: disabled
NSRP authentication: disabled
device based nsrp monitoring thresholD. 255, weighted sum: 0, not failed device based nsrp monitor interfacE. ethernet2/1(weight 255, UP) ethernet2/3(weight 255, UP) ethernet2/4 (weight 255, UP) ethernet2/5(weight 255, UP) ethernet2/2(weight 255, UP) device based nsrp monitor zonE.
device based nsrp track ip: (weight: 255, disabled)
number of gratuitous arps: 4 (default)
config synC. enabled
track ip: disabled
-- Exhibit --
Referring to the exhibit, which three statements are true? (Choose three.)

Question59: What is the function of NAT?

Question60: You are troubleshooting telnet traffic destined to IP address 10.10.10.1. You decide to run debug and want to set the flow filter. Which command will show only the telnet traffic going to the 10.10.10.1 address?

Question61: You have created a site-to-site IPsec VPN between two devices. You want to keep the tunnel up at all times, even when no user traffic is using it. Which two configuration additions will accomplish this goal?
(Choose two.)

Question62: What is a zone?

Question63: You are using interface-based NAT for traffic passing from the trust zone to the untrust zone.
What will occur?

Question64: You are receiving 3000 SYN packets per second from multiple outside sources to the same destination IP address in your network. You want the SYN proxy Screen option to engage when SYN packets exceed
2000 per second, but the SYN proxy is not engaging.
What is causing the problem?

Question65: You have enabled BGP on your ScreenOS device and configured a single EBGP peer. The CLI shows that the BGP connection is transitioning between the CONNECT and ACTIVE states, but never reaching the ESTABLISHED state.
What are three reasons for this behavior? (Choose three.)

Question66: -- Exhibit --
set admin name "admin"
set admin password "nOsYMqrbAs/McFsJrs6HwcIt3AF6yn"
set admin user "User1" password "nLZwKErINPPCcphC6sFMXrJ" privilege "read-only" set admin port 8080
set admin access attempts 5
set admin access lock-on-failure 5
set admin auth web timeout 10
set admin auth server "Local"
-- Exhibit --
User1 wants to create the policy in the ScreenOS device, but is not successful.
Referring to the exhibit, what is the problem?

Question67: You must verify on your ScreenOS device that you have configured the correct tunnel peer and determine which IKE proposals the remote device is sending and accepting.
Which command should you use?

Question68: Click the Exhibit button.

Which two statements are true regarding the route shown in the exhibit? (Choose two.)

Question69: -- Exhibit --
ssg5(M)-> get conf | incl ethernet1/2
set interface "ethernet1/2" zone "Untrust"
set interface ethernet1/2 ip 10.0.0.1/24
set interface ethernet1/2 route
set interface "ethernet1/2" description "Internet Connection 1"
set interface ethernet1/2 ip manageable
set interface ethernet1/2 manage ping
-- Exhibit --
You need to add a DIP pool to the interface shown in the exhibit. The DIP pool has been assigned the IP addresses 20.20.20.1 through 20.20.20.10.
Which command would you use to accomplish this task?

Question70: HostA is in the Trust zone and has an IP address of. ServerA is a Web server in the DMZ zone and has an IP address of.
Which three configuration statements are required to allow traffic from HostA to communicate with ServerA? (Choose three.)

Question71: You have been making changes on an NSRP cluster and find that the ScreenOS devices are out of sync.
You want to synchronize the devices' configurations together.
Which command and process are needed to accomplish this task?

Question72: What are three required policy elements? (Choose three.)

Question73: Click the Exhibit button.

Given the output shown in the exhibit, which command would you use to view the number of attacks that have been blocked by the Screen options on the Untrust zone?

Question74: Click the Exhibit button.

In the network shown in the exhibit, you have been asked to enable users in the Untrust zone to contact Server1 on TCP port 80 using IP address 1.1.1.1. You also need to allow Server1 to make connections to hosts in the Untrust zone. When Server1 makes connections to the Untrust zone, the source address of its traffic should be translated to 1.1.1.1.
What would you use to configure this behavior?

Question75: How is a route-based VPN different from a policy-based VPN?

Question76: -- Exhibit --
ns5gt-> get int
Interfaces in vsys Root:
Name IP Address Zone MAC VLAN State VSD
eth1 192.168.1.1/24 Trust 0014.f693.edc2 - U -
eth2 2.2.2.2/30 Untrust 0014.f693.edc8 - U -
ns5gt-> get db stream
****** .0: <Trust/ethernet1> packet received [69]******
ipid = 22281(5709), @059ff214
packet passed sanity check.
flow_decap_vector IPv4 process
ethernet1:192.168.1.102/52380->4.2.2.2/53,17<Root>
no session found
flow_first_sanity_check: in <ethernet1>, out <N/A>
chose interface ethernet1 as incoming nat if.
flow_first_routing: in <ethernet1>, out <N/A>
search route to (ethernet1, 192.168.1.102->4.2.2.2) in vr trust-vr for vsd-0/flag-0/ifp-null
[Dest] 7.route 4.2.2.2->2.2.2.1, to ethernet2
routed (x_dst_ip 4.2.2.2) from ethernet1 (ethernet1 in 0) to ethernet2
Permitted by policy 1
dip id = 2, 192.168.1.102/52380->2.2.2.2/2157
choose interface ethernet2 as outgoing phy if
no loop on ifp ethernet2.
routed (x_dst_ip 4.2.2.2) from ethernet1 (ethernet1 in 0) to ethernet2
policy search from zone 2-> zone 1
-- Exhibit --
Referring to the debug output shown in the exhibit, which NAT configuration is being used?

Question77: Which ScreenOS security feature helps protect against port scans and denial of service attacks?

Question78: Which two statements are true about VPN Monitor on a ScreenOS device? (Choose two.)

Question79: Which two Diffie-Hellman (DH) groups are supported by ScreenOS software? (Choose two.)

Question80: -- Exhibit --
ns5gt-> get int eth2
Interface ethernet2:
description ethernet2
number 8, if_info 704, if_index 0, mode route
link up, phy-link up/full-duplex
status change:7, last change:09/26/2012 23:08:22
vsys Root, zone Untrust, vr trust-vr
dhcp client disabled
PPPoE disabled
admin mtu 0, operating mtu 1500, default mtu 1500
*ip 171.211.111.111/30 mac 0014.f693.edc8
*manage ip 171.211.111.111, mac 0014.f693.edc8
route-deny disable
pmtu-v4 disabled
ping disabled, telnet enabled, SSH disabled, SNMP disabled
web enabled, ident-reset disabled, SSL disabled
DNS Proxy disabled, webauth disabled, g-arp enabled, webauth-ip 0.0.0.0 OSPF disabled BGP disabled RIP disabled RIPng disabled mtrace disabled
PIM: not configured IGMP not configured
MLD not configured
NHRP disabled
bandwidth: physical 100000kbps, configured egress [gbw 0kbps mbw 0kbps] configured ingress mbw 0kbps, current bw 0kbps
total allocated gbw 0kbps
DHCP-Relay disabled at interface level
DHCP-server disabled
-- Exhibit --
You are the administrator of a NetScreen 5GT. For troubleshooting purposes, you must be able to ping untrusted interfaces.
Referring to the exhibit, how do you enable ping for interface eth2?

Question81: Click the Exhibit button.

You are setting up security policies to allow access to the servers on the 1.1.1.0/24 subnet.
Referring to the exhibit, which two host addresses will be able to access the Web servers using FTP?
(Choose two.)

Question82: A ScreenOS device detects a large number of sessions that match the same deep inspection attack object.
What are two ways to configure the device? (Choose two.)

Question83: You want to enable the integrated Web-filtering feature on a ScreenOS device.
Which Web-filtering technology would be used?

Question84: You have configured a single-port VIP to forward HTTP traffic from the untrust interface on your ScreenOS device to an internal Web server. You have configured a policy to allow this traffic. Traffic from the untrust interface that matches this policy is unable to connect to the Web server. What is a solution to this problem?

Question85: In a policy, which two statements are true about the no-hw-sess command? (Choose two.)

Question86: When a new session is created on the primary ScreenOS device, what are two results that happen on the backup device? (Choose two.)

Question87: Which action does a ScreenOS device perform first when processing a packet?

Question88: Given the following output, what do you know about this session?
id /s01,vsys 0,flag 18200450/4004/0083,policy 10,time 5, dip 0 module 0 if 14(nspflag 0905):10.10.10.10/51112->8.8.8.8/443,6,000000000000,sess token 44,vlan 990,tun 0,vsd
0,route 315,wsf 0
if 8(nspflag 0904):10.10.10.10/51112<-8.8.8.8/443,6,000000000000,sess token 36,vlan 991,tun 0,vsd
0,route 293,wsf 0

Question89: Click the Exhibit button.

Referring to the exhibit, what does the log show?

Question90: You want to ensure that the IKE Phase 2 key is totally independent of the IKE Phase 1 key.
Which IKE feature would you enable?

Question91: You are building an IPsec VPN and want to authenticate and encrypt the content.
Which two Phase 1/Phase 2 (P1/P2) proposals would achieve this goal? (Choose two.)

Question92: What is the initial default username and password for all ScreenOS devices?

Question93: Which three types of status can a member of an NSRP cluster have? (Choose three.)

Question94: When you create a new virtual system, which zone is automatically created within the vsys-specific VR?

Question95: Which two configuration elements are synchronized between the members of an NSRP cluster? (Choose two.)

Question96: You have only one public IP address available and you must allow external access to three servers on a DMZ network. Which two NAT types would allow you to accomplish your objective? (Choose two.)

Question97: What is the default timeout for a fully established TCP session?

Question98: You have lost the admin user password for your NetScreen device. No other user accounts are configured on the device. How would you access the CLI?

Question99: On a ScreenOS device, which word appears at the beginning of configuration commands?

Question100: Which two statements are true about redundant interfaces on a ScreenOS device? (Choose two.)

Question101: Traffic is not passing the ScreenOS device due to an incorrectly configured policy. You must determine exactly which security policy the traffic is using.
Which two CLI commands should be used? (Choose two.)

Question102: Click the Exhibit button.

Referring to the output shown in the exhibit, which NAT configuration is being used?