CCSA

Question 1

When you upload a package or license to the appropriate repository in SmartUpdate, where is the package or license stored?
1. Security Gateway
2. Check Point user center
3. Security Management Server
4. SmartConsole installed device

Answer 1

Security Management Server

Question 2

Which software blade does NOT accompany the Threat Prevention policy?
1. Anti-virus
2. IPS
3. Threat Emulation
4. Application Control and URL Filtering

Answer 2

Application Control and URL Filtering

Question 3

Where can you trigger a failover of the cluster members?
1. Log in to Security Gateway CLI and run command clusterXL_admin down.
2. In SmartView Monitor right-click the Security Gateway member and select Cluster member stop.
3. Log into Security Gateway CLI and run command chphaprob down.

Is it:
1. 1,2 and 3
2. 2 and 3
3. 1 and 2
4. 1 and 3

Answer 3

1 and 2

Log in to Security Gateway CLI and run command clusterXL_admin down.
In SmartView Monitor right-click the Security Gateway member and select Cluster member stop.

Question 4

Which of the following is NOT a valid configuration screen of an Access Role Object?
1. Users
2. Networks
3. Time
4. Machine

Answer 4

Time

Question 5

What is NOT an advantage of Packet Filtering?
1. Low Security and No Screening above Network Layer
2. Application Independence
3. High Performance
4. Scalability

Answer 5

Low Security and No Screening above Network Layer

Question 6

What is the Transport layer of the TCP/IP model responsible for?
1. It transports packets as datagrams along different routes to reach their destination.
2. It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.
3. It defines the protocols that are used to exchange data between networks and how host programs interact with the Application layer.
4. It deals with all aspects of the physical components of network connectivity and connects with the different network types.

Answer 6

It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.

Question 7

In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?
1. Pentagon
2. Combined
3. Meshed
4. Star

Answer 7

Star

Question 8

What is the Implicit Clean-up Rule?
1. A setting that is defined in the Global Properties for all policies.
2. A setting that is configured per Policy Layer.
3. Another name for the Clean-up Rule.
4. Automatically created when the Clean-up Rule is defined.

Answer 8

A setting that is defined in the Global Properties for all policies.
A setting that is configured per Policy Layer.

Question 8

Fill in the blank: (\_\_\_\_\_\_\_\_) information is included in “Full log” tracking option, but is not included in “Log” tracking option?
1. Destination port
2. Data Type
3. File attributes
4. Application

Answer 8

Data Type

Question 9

What Check Point technologies deny or permit network traffic?
1. Application Control, DLP
2. Packet Filtering, Stateful Inspection, Application Layer Firewall
3. ACL, SandBlast, MPT
4. IPS, Mobile Threat Protection

Answer 9

Packet Filtering, Stateful Inspection, Application Layer Firewall

Question 9

Fill in the blank: \_\_\_\_ software blade enables Application Security policies to allow, block, or limit website access on user, group, and machine identities.
1. Application Control
2. Data Awareness
3. URL Filtering
4. Threat Emulation

Answer 9

URL Filtering

Question 10

What are the three conflict resolution rules in the Threat Prevention Policy Layers?
1. Conflict on action, conflict on exception, and conflict on settings
2. Conflict on scope, conflict on settings, and conflict on exception
3. conflict on settings, conflict on address, and conflict on exception
4. Conflict on action, conflict on destination, and conflict on settings

Answer 10

Conflict on action, conflict on exception, and conflict on settings

Question 11

Packages and licenses are loaded from all of these sources EXCEPT
1. Download Center Web Site
2. UserUpdate
3. User Center
4. Check Point DVD

Answer 11

UserUpdate

Question 12

The “Hit count” feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits even if the Track option is set to “None”?
1. No, it will not work independently. Hit Count will be shown only for rules with Track option set as Log or alert.
2. Yes it will work independently as long as “analyze all rules” tick box is enabled on the Security Gateway.
3. No, it will not work independently because hit count requires all rules to be logged.
4. Yes it will work independently because when you enable Hit Count, the SMS collects the data from supported Security Gateways.

Answer 12

Yes it will work independently because when you enable Hit Count, the SMS collects the data from supported Security Gateways.

Question 13

How is communication between different Check Point components secured in R80? As with all questions, select the BEST answer.

1. By using IPSEC.
2. By using SIC.
3. By using ICA.
4. By using 3DES.

Answer 13

By using SIC

Question 14

Which of the following is NOT a VPN routing option available in a star community?
1. To satellites through center only
2. To center, or through the center to other satellites, to internet and other VPN targets
3. To center and to other satellites through center
4. To center only

Answer 14

To satellites through center only

Question 15

What is the default shell of Gaia CLI?
1. Monitor
2. CLI.sh
3. Read-only
4. Bash

Answer 15

CLI.sh

Question 16

Which option would allow you to make a back up copy of the OS and Check Point configuration, without stopping Check Point processes?
1. All options stop Check Point processes.
2. backup
3. migrate export
4. snapshot

Answer 16

backup

Question 17

Fill in the blank: RADIUS Accounting gets (____) data from requests generated by the accounting client
1. Destination
2. Identity
3. Payload
4. Location

Answer 17

Identity

Question 18

Which of the following is NOT a type of Endpoint Identity Agent?
1. Terminal
2. Light
3. full
4. Custom

Answer 18

1. Terminal

Question 19

An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server. While configuring the VPN community to specify the pre-shared secret the administrator found that the check box to enable pre-shared secret is shaded and cannot be enabled. Why does it not allow him to specify the pre-shared secret?

1. IPsec VPN blade should be enabled on both Security Gateway.
2. Pre-shared can only be used while creating a VPN between a third party vendor and Check Point Security gateway.
3. Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS.
4. The Security Gateways are pre-R75.40.

Answer 19

3. Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS.

Question 20

Harriet wants to protect sensitive information from intentional loss when users browse to a specific URL: https://personal.mymail.com, which blade will she enable to achieve her goal?
1. DLP
2. SSL Inspection
3. Application Control
4. URL Filtering

Answer 20

1. DLP

Question 21

Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the (____) algorithm.
1. SHA-256
2. SHA-200
3. MD5
4. SHA-128

Answer 21

1.SHA-256

Question 22

Fill in the blank: The (____) feature allows administrators to share a policy with other policy packages.
1. Shared policy packages
2. Shared policies
3. Concurrent policy packages
4. Concurrent policies

Answer 22

2. Shared policies

Question 23

You are unabled to login to SmartDashboard. You log into the management server and run `cpwd_admin list` with the following output: What reason could possibly BEST explain why you are unable to connect to SmartDashboard? 1. CPD id down 2. SVR is down 3. CPM is down 4. CPSM is down

Answer 23

3.CPM is down

Question 24

What are the three types of UserCheck messages? 1. Inform, ask, and block 2. Block, action, and warn 3. Action, inform, and ask 4. Ask, block, and notify

Answer 24

1. Inform, ask, and block

Question 25

Which option, when applied to a rule, allows all encrypted and non-VPN traffic that matches the rule? 1. All Site-to-Site VPN Communities 2. Accept all encrypted traffic 3. All Connections (Clear or Encrypted) 4. Specific VPN Communities

Answer 25

3. All Connections (Clear or Encrypted)

Question 26

What command shows the configuration of the management server? 1. `show configuration all` 2. `show confd configuration` 3. `show confd configuration all` 4. `show configuration`

Answer 26

4. `show configuration`

Question 27

Which authentication scheme requires a user to posses a token? 1. TACACS 2. SecureID 3. Check Point password 4. RADIUS

Answer 27

2. SecureID

Question 28

Your internal networks 10.1.1.0/24, 10.2.2.0/24 and 192.168.0.0/16 are behind the internet Security Gateway. Considering that Layer 2 and Layer 3 setup is correct, what are the steps you will need to do in SmartConsole in order to get the correction working? Select the BEST answer. 1. Define an accept rule in Security Policy. Define Security Gateway to hide all internal networks behind the gateway's external IP. Publish and install the policy. 2. Define an accept rule in Security Policy. Configure automatic NAT for each network to NAT the networks behind a public IP. Publish the policy. 3. Define an accept rule in Security Policy. Configure automatic NAT for each network to NAT the networks behind a public IP. 4. Define an accept rule in Security Policy. Define Security Gateway to hide all internal networks behind the gateway's external IP. Publish the policy.

Answer 28

1. Define an accept rule in Security Policy. Define Security Gateway to hide all internal networks behind the gateway's external IP. Publish and install the policy.

Question 29

Which of the following blades is NOT a subscription-based and therefore does not have to be renewed on a regular basis? 1. Application Control 2. Threat Emulation 3. Anti-Virus 4. Advanced Networking Blade

Answer 29

4. Advanced Networking Blade

Question 30

Fill in the blank: There are` (_________)` types of software containers: `(________)`. 1. Three, security management, Security Gateway, and endpoint security 2. Three, Security Gateway, endpoint security, and gateway management 3. Two, security management and endpoint security 4. Two, endpoint security and Security Gateway

Answer 30

1. Three, security management, Security Gateway, and endpoint security

Question 31

Fill in the blanks: Default port numbers for an LDAP server is `(________)` for standard connections and `(__________)` SSL connections. 1. 675; 389 2. 389; 636 3. 636; 290 4. 290; 675

Answer 31

2. 389; 636

Question 32

Which of the following ClusterXL modes uses a non-unicast MAC address for the cluster IP address? 1. High Availability 2. Load Sharing Multicast 3. Load Sharing Pivot 4. Master/Backup

Answer 32

2. Load Sharing Multicast

Question 33

Fill in the blanks: A Security Policy is created in `(_______)`, stored in the `(_________)`, and Distributed to the various `(___________)`. 1. Rule base, Security Management Server, Security Gateways 2. SmartConsole, Security Gateway, Security Management Servers 3. SmartConsole, Security Management Server, Security Gateways 4. The Check Point database, SmartConsole, Security Gateways

Answer 33

3.SmartConsole, Security Management Server, Security Gateways

Question 34

Where can administrator edit a list of trusted SmartConsole clients in R80? 1. `cpconfig` on a Security Management Server, in the WebUI logged into a Security Management Server. 2. Only in SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients 3. In `cpconfig` on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole. Manage and Settings > Permissions and Administrators > Trusted Clients. 4. WebUI client logged to Security Management Server, SmartDashboard: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients, via `cpconfig` on a Security Gateway.

Answer 34

3. In `cpconfig` on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole. Manage and Settings > Permissions and Administrators > Trusted Clients.

Question 35

What will be the effect of running the following command on the Security Management Server? ``` fw unloadlocal ``` 1. Remove the installed Security Management Server 2. Remove the local ACL lists 3. No effect 4. Reset SIC on all gateways

Answer 35

3. No effect

Question 36

Which Threat Prevention Software Blade provides comprehensive protection against malicious and unwanted network traffic, focusing on application and server vulnerabilities? 1. Anti-Virus 2. IPS 3. Anti-Spam 4. Anti-bot

Answer 36

2. IPS

Question 37

Which Check Point feature enables application scanning and the detection? 1. Application Dictionary 2. AppWiki 3. Application Library 4. CPApp

Answer 37

2. AppWiki

Question 38

Which tool is used to enable ClusterXL? 1. SmartUpdate 2. cpconfig 3. SmartConsole 4. sysconfig

Answer 38

2. cpconfig

Question 39

Fill in the blank: With the User Directory Software Blade, you can create R80 user definitions on a(an) Server? 1. SecurID 2. NT domain 3. SMTP 4. LDAP

Answer 39

4. LDAP

Question 40

Fill in the blank: The command provides the most complete restoration of a R80 configuration. 1. `cpconfig` 2. `upgrade_export` 3. `fwm dbimport -p ` 4. `cpinfo-recover`

Answer 40

2. `upgrade_export` ## Footnote Explanation (Should be "migrate import") "migrate import" Restores backed up configuration for R80 version, in previous versions the command was " upgrade_export ".

Question 41

Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when. 1. The IP address of the Security Management or Security Gateway has changed 2. The license is upgraded 3. The license is attached to the wrong Security Gateway 4. The existing license expires

Answer 41

The license is attached to the wrong Security Gateway ## Footnote Explanation There is no need to generate new license in this situation, just need to detach license from wrong Security Gateway and attach it to the right one.

Question 42

Which of the following are types of VPN communicates? 1. Combined and star 2. Pentagon, star, and combination 3. Meshed, star, and combination 4. Star, octagon, and combination

Answer 42

Meshed, star, and combination

Question 43

You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the right protections in place. Check Point has been selected for the security vendor. Which Check Point products protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users? 1. IPS, anti-virus and e-mail security 2. Sand Blast 3. IPS and Application Control 4. IPS, anti-virus and anti-bot

Answer 43

Sand Blast ## Footnote Explanation Sand Blast Zero-Day Protection Hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. Zero-day exploit protection from Check Point provides a deeper level of inspection so you can prevent more malware and zero-day attacks, while ensuring quick delivery of safe content to your users.

Question 44

Which utility shows the security gateway general system information statistics like operating system information and resource usage, and individual software blade statistics of VPN, Identity Awareness and DLP? 1. `fw ctl pstat` 2. `cp view` 3. `fw ctl multik stat` 4. `cpconfig`

Answer 44

``` cp view ``` ## Footnote Explanation CPView Utility is a text based built-in utility that can be run ('cpview' command) on Security Gateway / Security Management Server / Multi-Domain Security Management Server. CPView Utility shows statistical data that contain both general system information (CPU, Memory, Disk space) and information for different Software Blades (only on Security Gateway). The data is continuously updated in easy to access views.

Question 45

Which of the following is TRUE regarding Gaia command line? 1. Configuration changes should be done in mgmt-cli and use expert-mode for OS-level tasks. 2. All configuration changes should be made in CLISH and expert-mode should be used for OS-level tasks. 3. Configuration changes should be done in expert-mode and CLISH is used for monitoring. 4. Configuration changes should be done in mgmt_cli and use CLISH for monitoring, Expert mode is used only for OS level tasks.

Answer 45

Configuration changes should be done in mgmt_cli and use CLISH for monitoring, Expert mode is used only for OS level tasks. ## Footnote Explanation To make changes available to all administrators, and to unlock the objects and rules that are being edited, the administrator must publish the session. To make your changes available to other administrators, and to save the database before installing a policy, you must publish the session. When you publish a session, a new database version is created. When you select Install Policy, you are prompted to publish all unpublished changes. You cannot install a policy if the included changes are not published.

Question 46

The security Gateway is installed on GAiA R80 The default port for the WEB User Interface is. 1. TCP 18211 2. TCP 443 3. TCP 4433 4. TCP 257

Answer 46

TCP 443

Question 47

Joey wants to configure NTP on R80 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser? ``` 1. https://:10000 2. https://:443 3. https:// 4. https://:4434 ```

Answer 47

`https://` ## Footnote Explanation Logging in to the WebUI Logging in To log in to the WebUI: 1. Enter this URL in your browser: https:// 2. Enter your user name and password.

Question 48

Which of the following is NOT a back up method? 1. snapshot 2. Migrate 3. System backup 4. Save backup

Answer 48

Save backup ## Footnote Explanation The built-in Gaia backup procedures: Snapshot Management System Backup (and System Restore) Save/Show Configuration (and Load Configuration) Check Point provides three different procedures for backing up (and restoring) the operating system and networking parameters on your appliances. Snapshot (Revert) Backup (Restore) upgrade_export (Migrate)

Question 49

What are the two high availability modes? 1. Load Sharing and Legacy 2. New and Legacy 3. Active and Standby 4. Traditional and New

Answer 49

New and Legacy ## Footnote Explanation ClusterXL has four working modes. This section briefly describes each mode and its relative advantages and disadvantages. Load Sharing Multicast Mode Load Sharing Unicast Mode New High Availability Mode High Availability Legacy Mode

Question 50

Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from Threat Cloud? 1. Antivirus 2. Anti-spam and Email Security 3. Firewall 4. Application Control

Answer 50

Antivirus ## Footnote Explanation The enhanced Check Point Antivirus Software Blade uses real-time virus signatures and anomaly-based protections from Threat Cloud, the first collaborative network to fight cybercrime, to detect and block malware at the gateway before users are affected.

Question 51

Fill in the blank: The R80 feature permits blocking specific IP addresses for a specified time period. 1. Adaptive Threat Prevention 2. Suspicious Activity Monitoring 3. Block Port Overflow 4. Local Interface Spoofing

Answer 51

Suspicious Activity Monitoring ## Footnote Explanation Suspicious Activity Rules Solution Suspicious Activity Rules is a utility integrated into SmartView Monitor that is used to modify access privileges upon detection of any suspicious network activity (for example, several attempts to gain unauthorized access). The detection of suspicious activity is based on the creation of Suspicious Activity rules. Suspicious Activity rules are Firewall rules that enable the system administrator to instantly block suspicious connections that are not restricted by the currently enforced security policy. These rules, once set (usually with an expiration date), can be applied immediately without the need to perform an Install Policy operation

Question 52

Which feature is NOT provided by all Check Point Mobile Access solutions? 1. Support for IPv6 2. Strong user authentication 3. Secure connectivity 4. Granular access control

Answer 52

Support for IPv6 ## Footnote Explanation Types of Solutions All of Check Point's Remote Access solutions provide: Enterprise-grade, secure connectivity to corporate resources. Strong user authentication. Granular access control

Question 53

Fill in the blank: Each cluster has interfaces. 1. Four 2. Two 3. Five 4. Three

Answer 53

Three ## Footnote Explanation Each cluster member has three interfaces: one external interface, one internal interface, and one for synchronization. Cluster member interfaces facing in each direction are connected via a switch, router, or VLAN switch.

Question 54

What is the default method for destination NAT? 1. Source side 2. Destination side 3. Client side 4. Server side

Answer 54

Client side ## Footnote Explanation Client Side NAT - destination is NAT`d by the inbound kernel

Question 55

What is the default shell for the command line interface? 1. Normal 2. Clish 3. Expert 4. Admin

Answer 55

Clish ## Footnote Explanation The default shell of the CLI is called clish

Question 56

In R80, Unified Policy is a combination of 1. Firewall policy, address Translation and application and URL filtering, QoS Policy, Desktop Security Policy and Threat Prevention Policy. 2. Access control policy, QoS Policy, Desktop Security Policy and VPN policy. 3. Access control policy, QoS Policy, Desktop Security Policy and Threat Prevention Policy. 4. Access control policy, QoS Policy, Desktop Security Policy and endpoint policy.

Answer 56

Access control policy, QoS Policy, Desktop Security Policy and VPN policy. ## Footnote Explanation D is the best answer given the choices. Unified Policy In R80 the Access Control policy unifies the policies of these pre-R80 Software Blades: Firewall and VPN Application Control and URL Filtering Identity Awareness Data Awareness Mobile Access Security Zones

Question 57

Fill in the blank: The R80 utility fw monitor is used to troubleshoot `____` 1. Traffic issues 2. User data base corruption 3. LDAP conflicts 4. Phase two key negotiation

Answer 57

Traffic issues ## Footnote Explanation Check Point's FW Monitor is a powerful built-in tool for capturing network traffic at the packet level. The FW Monitor utility captures network packets at multiple capture points along the FireWall inspection chains. These captured packets can be inspected later using the WireShark

Question 58

Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address? 1. Local 2. Corporate 3. Formal 4. Central

Answer 58

Local

Question 59

Administrator wishes to update IPS from Smart Console by clicking on the option “update now” under the IPS tab. Which device requires internet access for the update to work? 1. Security Gateway 2. Device where Smart Console is installed 3. Smart Event 4. SMS

Answer 59

Device where Smart Console is installed ## Footnote Explanation Updating IPS Manually You can immediately update IPS with real-time information on attacks and all the latest protections from the IPS website. You can only manually update IPS if a proxy is defined in Internet Explorer settings. To obtain updates of all the latest protections from the IPS website: 1. Configure the settings for the proxy server in Internet Explorer. 1. In Microsoft Internet Explorer, open Tools > Internet Options > Connections tab > LAN Settings. The LAN Settings window opens. 2. Select Use a proxy server for your LAN. 3. Configure the IP address and port number for the proxy server. 4. Click OK. The settings for the Internet Explorer proxy server are configured. In the IPS tab, select Download Updates and click Update Now. If you chose to automatically mark new protections for Follow Up, you have the option to open the Follow Up page directly to see the new protections

Question 60

Office mode means that: 1. Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client. 2. Users authenticate with an Internet browser and use secure HTTPS connection. 3. Secure ID client assigns a routable MAC address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client. 4. Local ISP (Internet service Provider) assigns a non-routable IP address to the remote user.

Answer 60

Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client. ## Footnote Explanation Office Mode enables a Security Gateway to assign internal IP addresses to SecureClient users. This IP address will not be exposed to the public network, but is encapsulated inside the VPN tunnel between the client and the Gateway. The IP to be used externally should be assigned to the client in the usual way by the Internet Service provider used for the Internet connection. This mode allows a Security Administrator to control which addresses are used by remote clients inside the local network and makes them part of the local network. The mechanism is based on an IKE protocol extension through which the Security Gateway can send an internal IP address to the client.

Question 61

Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a Smart Console machine in his calculations? 1. One machine, but it needs to be installed using Secure Platform for compatibility purposes. 2. Three machines 3. One machine 4. Two machines

Answer 61

Two machines ## Footnote Explanation One for Security Management Server and the other one for the Security Gateway.

Question 62

Which options are given on features, when editing a Role on Gaia Platform? 1. Read/Write, Read Only 2. Read Only, None 3. Read/Write, None 4. Read/Write, Read only, None

Answer 62

Read/Write, Read only, None ## Footnote Explanation Role-based administration (RBA) lets you create administrative roles for users. With RBA, an administrator can allow Gaia users to access specified features by including those features in a role and assigning that role to users. Each role can include a combination of administrative (read/write) access to some features, monitoring (read-only) access to other features, and no access to other features. You can also specify which access mechanisms (WebUI or the CLI) are available to the user. Note - When users log in to the WebUI, they see only those features that they have read-only or read/write access to. If they have read-only access to a feature, they can see the settings pages, but cannot change the settings. Gaia includes these predefined roles: adminRole - Gives the user read/write access to all features. monitorRole- Gives the user read-only access to all features. You cannot delete or change the predefined roles. Note - Do not define a new user for external users. An external user is one that is defined on an authentication server (such as RADIUS or TACACS) and not on the local Gaia system.

Question 63

When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control? 1. AD Query 2. RADIUS 3. Remote Access and RADIUS 4. AD Query and Browser-based Authentication

Answer 63

AD Query and Browser-based Authentication ## Footnote Explanation Explanation: Identity Awareness gets identities from these acquisition sources: AD Query Browser-Based Authentication Endpoint Identity Agent Terminal Servers Identity Agent

Question 64

Which policy type has its own Exceptions section? 1. Threat Emulation 2. Access Control 3. Desktop Security 4. Threat Prevention

Answer 64

Threat Prevention ## Footnote Explanation The Exceptions Groups pane lets you define exception groups. When necessary, you can create exception groups to use in the Rule Base. An exception group contains one or more defined exceptions. This option facilitates ease-of-use so you do not have to manually define exceptions in multiple rules for commonly required exceptions. You can choose to which rules you want to add exception groups. This means they can be added to some rules and not to others, depending on necessity.

Question 65

When you upload a package or license to the appropriate repository in Smart Update, where is the package or license stored. 1. Check Point user center 2. Security Gateway 3. Smart Console installed device 4. Security Management Server

Answer 65

Security Management Server ## Footnote Explanation Smart Update installs two repositories on the Security Management server: License & Contract Repository, which is stored on all platforms in the directory $FWDIR\conf\. Package Repository, which is stored: - on Windows machines in C:\SUroot. - on UNIX machines in /var/SUroot. The Package Repository requires a separate license, in addition to the license for the Security Management server. This license should stipulate the number of nodes that can be managed in the Package Repository.

Question 66

Which of the following is NOT an advantage to using multiple LDAP servers? 1. You achieve compartmentalization by allowing a large number of users to be distributed across several servers 2. Information on a user is hidden, yet distributed across several servers 3. You gain High Availability by replicating the same information on several servers 4. You achieve a faster access time by placing LDAP servers containing the database at remote sites

Answer 66

Information on a user is hidden, yet distributed across several servers

Question 67

With which command can you view the running configuration of Gaia-based system? 1. `show configuration active` 2. `show running-configuration` 3. `show configuration` 4. `show conf-active`

Answer 67

``` show configuration ```

Question 68

By default, which port does the Web UI listen on? 1. 80 2. 8080 3. 443 4. 4434

Answer 68

443

Question 69

Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities? 1. Anti-bot 2. Anti-Virus 3. Anti-Spam 4. IPS

Answer 69

IPS ## Footnote Explanation The IPS Software Blade provides a complete Intrusion Prevention System security solution, providing comprehensive network protection against malicious and unwanted network traffic, including: Malware attacks Dos and DDoS attacks Application and server vulnerabilities Insider threats Unwanted application traffic, including IM and P2P

Question 70

The Gaia operating system supports which routing protocols? 1. BGP, OSPF, EIGRP, PIM, IGMP 2. BGP, OSPF, RIP, PIM, IGMP 3. BGP, OSPF, RIP, EIGRP 4. BGP, OSPF, RIP

Answer 70

BGP, OSPF, RIP ## Footnote Explanation The Advanced Routing Suite CLI is available as part of the For organizations looking to implement scalable, fault-tolerant, secure networks, the Advanced Networking blade enables them to run industry-standard dynamic routing protocols including BGP, OSPF, RIPv1, and RIPv2 on security gateways. OSPF, RIPv1, and RIPv2 enable dynamic routing over a single autonomous system—like a single department, company, or service provider—to avoid network failures. BGP provides dynamic routing support across more complex networks involving multiple autonomous systems—such as when a company uses two service providers or divides a network into multiple areas with different administrators responsible for the performance of each.

Question 71

Which one of the following is the preferred licensing model? Select the Best answer. 1. Local licensing because it ties the package license to the IP-address of the gateway and has no dependency of the Security Management Server. 2. Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency of the gateway. 3. Local licensing because it ties the package license to the MAC-address of the gateway management interface and has no Security Management Server dependency.

Answer 71

Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency of the gateway. ## Footnote Explanation Central License A Central License is a license attached to the Security Management server IP address, rather than the gateway IP address. The benefits of a Central License are: Only one IP address is needed for all licenses. A license can be taken from one gateway and given to another. The new license remains valid when changing the gateway IP address. There is no need to create and install a new license.

Question 72

You have enabled “Full Log” as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason? 1. Data Awareness is not enabled. 2. Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database. 3. Logs are arriving from Pre-R80 gateways. 4. Identity Awareness is not enabled.

Answer 72

Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database. ## Footnote Explanation The most likely reason for the logs data to stop is the low disk space on the logging device, which can be the Management Server or the Gateway Server.

Question 73

Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers? 1. Active Directory Query. 2. User Directory Query. 3. Account Unit Query. 4. User Check.

Answer 73

Active Directory Query. ## Footnote Explanation AD Query extracts user and computer identity information from the Active Directory Security Event Logs. The system generates a Security Event log entry when a user or computer accesses a network resource. For example, this occurs when a user logs in, unlocks a screen, or accesses a network drive.

Question 74

Fill in the blank: To build an effective Security Policy, use a and _ rule? 1. Implicit; explicit 2. Stealth; implicit 3. Cleanup; default 4. Cleanup; stealth

Answer 74

Cleanup; stealth

Question 75

Which of the following is NOT a license activation method? 1. Offline Activation 2. Smart Console Wizard 3. Online Activation 4. License Activation Wizard

Answer 75

Smart Console Wizard

Question 76

While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain? 1. Identity Awareness is not enabled on Global properties 2. Smart Console machine is not part of the domain 3. SMS is not part of the domain 4. Security Gateways is not part of the Domain

Answer 76

Smart Console machine is not part of the domain ## Footnote Explanation To enable Identity Awareness: 1. Log in to Smart Dashboard. 2. From the Network Objects tree, expand the Check Point branch. 3. Double-click the Security Gateway on which to enable Identity Awareness. 4. In the Software Blades section, select Identity Awareness on the Network Security tab. The Identity Awareness Configuration wizard opens. 5. Select one or more options. These options set the methods for acquiring identities of managed and unmanaged assets. AD Query - Lets the Security Gateway seamlessly identify Active Directory users and computers. Browser-Based Authentication - Sends users to a Web page to acquire identities from unidentified users. If Transparent Kerberos Authentication is configured, AD users may be identified transparently. Terminal Servers - Identify users in a Terminal Server environment (originating from one IP address). See Choosing Identity Sources. Note - When you enable Browser-Based Authentication on a Security Gateway that is on an IP Series appliance, make sure to set the Voyager management application port to a port other than 443 or 80. 6. Click Next. The Integration With Active Directory window opens. When Smart Dashboard is part of the domain, Smart Dashboard suggests this domain automatically. If you select this domain, the system creates an LDAP Account Unit with all of the domain controllers in the organization's Active Directory.

Question 77

When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component? 1. Secure Client 2. Smart Console 3. Security Gateway 4. None, Security Management Server would be installed by itself.

Answer 77

Security Gateway ## Footnote Explanation There are different deployment scenarios for Check Point software products.

Question 78

What are the three authentication methods for SIC? 1. Certificates, Passwords, and Tokens 2. Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption 3. Packet Filtering, certificates, and 3DES or AES128 for encryption 4. Passwords, Users, and standards-based SSL for the creation of security channels

Answer 78

Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption ## Footnote Explanation Secure Internal Communication (SIC) Secure Internal Communication (SIC) lets Check Point platforms and products authenticate with each other. The SIC procedure creates a trusted status between gateways, management servers and other Check Point components. SIC is required to install polices on gateways and to send logs between gateways and management servers. These security measures make sure of the safety of SIC: Certificates for authentication Standards-based SSL for the creation of the secure channel 3DES for encryption

Question 79

What is the purpose of Captive Portal? 1. It authenticates users, allowing them access to the Internet and corporate resources 2.It authenticates users, allowing them access to the Gaia OS 3.It provides remote access to Smart Console 4.It manages user permission in Smart Console

Answer 79

It authenticates users, allowing them access to the Internet and corporate resources ## Footnote Explanation Captive Portal – a simple method that authenticates users through a web interface before granting them access to Intranet resources. When users try to access a protected resource, they get a web page that must be filled out to continue.

Question 80

What is the order of NAT priorities? 1. Static NAT, hide NAT, IP pool NAT 2. IP pool NAT, static NAT, hide NAT 3. Static NAT, automatic NAT, hide NAT 4. Static NAT, IP pool NAT, hide NAT

Answer 80

Static NAT, IP pool NAT, hide NAT ## Footnote Explanation The order of NAT priorities is: 1. Static NAT 2. IP Pool NAT 3. Hide NAT Since Static NAT has all of the advantages of IP Pool NAT and more, it has a higher priority than the other NAT methods.

Question 81

Which of the following is NOT a component of a Distinguished Name? 1. Common name 2. Organization Unit 3. User container 4. Country

Answer 81

User container ## Footnote Explanation Distinguished Name Components CN=common name, OU=organizational unit, O=organization, L=locality, ST=state or province, C=country name

Question 82

Which command is used to add users to or from existing roles? 1. `Add rba user ` 2. `Add user ` 3. `Add rba user roles ` 4. `Add user roles `

Answer 82

``` Add rba user roles ```

Question 83

When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true? 1. If the Action is Accept, the gateway continues to check rules in the next Policy Layer down. 2. If the Action is Drop, the gateway continues to check rules in the next Policy Layer down. 3. If the Action is Drop, the gateway applies the Implicit Clean-up Rule for that Policy Layer. 4. If the Action is Accept, the gateway allows the packet to pass through the gateway.

Answer 83

If the Action is Accept, the gateway continues to check rules in the next Policy Layer down.

Question 84

Which of the following ClusterXL modes uses a non-unicast MAC address for the cluster IP address. 1. Load Sharing Pivot 2. Load Sharing Multicast 3. High Availability 4. Master/Backup

Answer 84

Load Sharing Multicast ## Footnote Explanation ClusterXL uses the Multicast mechanism to associate the virtual cluster IP addresses with all cluster members. By binding these IP addresses to a Multicast MAC address, it ensures that all packets sent to the cluster, acting as a gateway, will reach all members in the cluste

Question 85

What is the default time length that Hit Count Data is kept? 1. 4 weeks 2. 12 months 3. 3 month 4. 6 months

Answer 85

6 months ## Footnote Explanation Keep Hit Count data up to - Select one of the time range options. The default is 6 months. Data is kept in the Security Management Server database for this period and is shown in the Hits column.

Question 86

Which type of the Check Point license ties the package license to the IP address of the Security Management Server? 1. Formal 2. Local 3. Corporate 4. Central

Answer 86

Central

Question 87

When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times. No other VPN-related log entries are present. Which phase of the VPN negotiations has failed? 1. IKE Phase 2 2. IKE Phase 1 3. IPSEC Phase 2 4. IPSEC Phase 1

Answer 87

IKE Phase 1

Question 88

What are the two types of address translation rules? 1. Translated packet and untranslated packet 2. Untranslated packet and manipulated packet 3. Manipulated packet and original packet 4. Original packet and translated packet

Answer 88

Original packet and translated packet ## Footnote Explanation NAT Rule Base The NAT Rule Base has two sections that specify how the IP addresses are translated: Original Packet Translated Packet

Question 89

Which authentication scheme requires a user to possess a token? 1. RADIUS 2. SecurID 3. TACACS 4. Check Point password

Answer 89

SecurID ## Footnote Explanation SecurID SecurID requires users to both possess a token authenticator and to supply a PIN or password

Question 90

In order to modify Security Policies, the administrator can use which of the following tools? Select the BEST answer. 1. Smart Console or mgmt_cli on any computer where Smart Console is installed. 2. Command line of the Security Management Server or mgmt_cli.exe on any Windows computer. 3. Smart Console and Web UI on the Security Management Server. 4. mgmt_cli or Web UI on Security Gateway and Smart Console on the Security Management Server.

Answer 90

Smart Console or mgmt_cli on any computer where Smart Console is installed.

Question 91

Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and: 1. add users to your Gaia system. 2. edit the home directory of the user. 3. assign privileges to users. 4. assign user rights to their home directory in the Security Management Server

Answer 91

assign user rights to their home directory in the Security Management Server ## Footnote Explanation Users Use the WebUI and CLI to manage user accounts. You can: Add users to your Gaia system. Edit the home directory of the user. Edit the default shell for a user. Give a password to a user. Give privileges to users.

Question 92

Fill in the blank: The feature allows administrators to share a policy with other policy packages. 1. Concurrent policy packages 2. Shared policies 3. Concurrent policies 4. Shared policy packages

Answer 92

Shared policy

Question 93

Which of the following is TRUE about the Check Point Host object? 1. When you upgrade to R80 from R77.30 or earlier versions, Check Point Host objects are converted to gateway objects. 2. Check Point Host is capable of having an IP forwarding mechanism. 3. Check Point Host can act as a firewall. 4. Check Point Host has no routing ability even if it has more than one interface installed.

Answer 93

Check Point Host has no routing ability even if it has more than one interface installed. ## Footnote Explanation A Check Point host is a host with only one interface, on which Check Point software has been installed, and which is managed by the Security Management server. It is not a routing mechanism and is not capable of IP forwarding.

Question 94

NAT can NOT be configured on which of the following objects? 1. Gateway 2. Host 3. Address Range 4. HTTP Logical Server

Answer 94

HTTP Logical Server

Question 95

Where do we need to reset the SIC on a gateway object? 1. Smart Update > Edit Security Management Server Object > SIC 2. Smart Dashboard > Edit Gateway Object > General Properties > Communication 3. Smart Update > Edit Gateway Object > Communication 4. Smart Dashboard > Edit Security Management Server Object > SIC

Answer 95

Smart Dashboard > Edit Gateway Object > General Properties > Communication

Question 96

Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as 1. User Check 2. User Directory 3. User Administration 4. User Center

Answer 96

User Directory ## Footnote Explanation Check Point User Directory integrates LDAP, and other external user management technologies, with the Check Point solution. If you have a large user count, we recommend that you use an external user management database such as LDAP for enhanced Security Management Server performance.

Question 97

Fill in the blanks: A High Availability deployment is referred to as a cluster and a Load Sharing deployment is referred to as a cluster. 1. Active/standby; active/active 2. Standby/standby; active/active 3. Active/active; active/standby; 4. Active/active; standby/standby

Answer 97

Active/standby; active/active ## Footnote Explanation In a High Availability cluster, only one member is active (Active/Standby operation). ClusterXL Load Sharing distributes traffic within a cluster so that the total throughput of multiple members is increased. In Load Sharing configurations, all functioning members in the cluster are active, and handle network traffic (Active/Active operation).

Question 98

Message digests use which of the following? 1. SSL and MD4 2. DES and RC4 3. IDEA and RC4 4. SHA-1 and MD5

Answer 98

SHA-1 and MD5

Question 99

You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the most likely cause? 1. The POP3 rule is hidden. 2. The POP3 rule is disabled. 3. POP3 is accepted in Global Properties. 4. POP3 is one of 3 services (POP3, IMAP, and SMTP) accepted by the default mail object in R77.

Answer 99

The POP3 rule is hidden.

Question 100

What is the default shell of Gaia CLI? 1. Monitor 2. Bash 3. CLI.sh 4. Read-only

Answer 100

CLI.sh ## Footnote Explanation This chapter gives an introduction to the Gaia command line interface (CLI). The default shell of the CLI is called clish.

Question 101

What action can be performed from Smart Update R77? 1.`fw stat -1` 2. `cpinfo` 3. `upgrade_export` 4. `remote_uninstall_verifier`

Answer 101

cpinfo

Question 102

Fill in the blank: Once a license is activated, a should be installed. 1. License Contract file 2. License Management file 3. Service Contract file 4. Security Gateway Contract file

Answer 102

Service Contract file ## Footnote Explanation Service Contract File Following the activation of the license, a Service Contract File should be installed. This file contains important information about all subscriptions purchased for a specific device and is installed via Smart Update. A detailed explanation of the Service Contract File can be found in sk33089.

Question 103

Which of these components does NOT require a Security Gateway R77 license? 1. Check Point Gateway 2. Smart Console 3. Smart Update upgrading/patching 4. Security Management Server

Answer 103

Smart Console

Question 104

Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in: 1. If Joe tries to make changes, he won't, database will be locked. 2. Bob will be prompt that Joe logged in. 3. When Joe logs in, Bob will be log out automatically. 4. Since they both are log in on different interfaces, they both will be able to make changes.

Answer 104

If Joe tries to make changes, he won't, database will be locked.

Question 105

You are going to upgrade from R77 to R80. Before the upgrade, you want to back up the system so that, if there are any problems, you can easily restore to the old version with all configuration and management files intact. What is the BEST backup method in this scenario? 1. Database Revision 2. backup 3. snapshot 4. migrate export

Answer 105

snapshot ## Footnote Explanation Snapshot Management The snapshot creates a binary image of the entire root (lv_current) disk partition. This includes Check Point products, configuration, and operating system. Starting in R77.10, exporting an image from one machine and importing that image on another machine of the same type is supported. The log partition is not included in the snapshot. Therefore, any locally stored Firewall logs will not be saved.

Question 106

Which of the following is NOT an element of VPN Simplified Mode and VPN Communities? 1. Configuration checkbox “Accept all encrypted traffic” 2. “Encrypt” action in the Rule Base 3. “VPN” column in the Rule Base 4. Permanent Tunnels

Answer 106

“Encrypt” action in the Rule Base ## Footnote Explanation Migrating from Traditional Mode to Simplified Mode To migrate from Traditional Mode VPN to Simplified Mode: 1. On the Global Properties > VPN page, select one of these options: * Simplified mode to all new Firewall Policies * Traditional or Simplified per new Firewall Policy 2. Click OK. 3. From the R80 Smart Console Menu, select Manage policies. The Manage Policies window opens. 4. Click New. The New Policy window opens. 5. Give a name to the new policy and select Access Control. In the Security Policy Rule Base, a new column marked VPN shows and the Encrypt option is no longer available in the Action column. You are now working in Simplified Mode.

Question 107

Which of the following is NOT a set of Regulatory Requirements related to Information Security? 1. HIPPA 2. Sarbanes Oxley (SOX) 3. ISO 37001 4. PCI

Answer 107

ISO 37001 ## Footnote Explanation ISO 37001 - Anti-bribery management systems

Question 108

Which Check Point software blade provides protection from zero-day and undiscovered threats? 1. Firewall 2. Threat Emulation 3. Application Control 4. Threat Extraction

Answer 108

Threat Emulation

Question 109

Which of the following licenses are considered temporary? 1. Plug-and-play and Evaluation 2. Subscription and Perpetual 3. Evaluation and Subscription 4. Perpetual and Trial

Answer 109

Plug-and-play and Evaluation ## Footnote Explanation Should be Trial or Evaluation, even Plug-and-play (all are synonyms ). Answer B is the best choice.

Question 110

Choose the Smart Log property that is TRUE. 1. Smart Log is a client of Smart Console that enables enterprises to centrally track log records and security activity with Google-like search. 2. Smart Log has been an option since release R71.10. 3. Smart Log and SmartView Tracker are mutually exclusive. 4. Smart Log is not a Check Point product.

Answer 110

Smart Log is a client of Smart Console that enables enterprises to centrally track log records and security activity with Google-like search.

Question 111

Choose what BEST describes users on Gaia Platform. 1. There are two default users that cannot be deleted and one Smart Console Administrator. 2. There is one default user that cannot be deleted. 3. There are two default users and one cannot be deleted. 4. There is one default user that can be deleted.

Answer 111

There are two default users and one cannot be deleted. ## Footnote Explanation These users are created by default and cannot be deleted: admin — Has full read/write capabilities for all Gaia features, from the WebUI and the CLI. This user has a User ID of 0, and therefore has all of the privileges of a root user. monitor — Has read-only capabilities for all features in the WebUI and the CLI, and can change its own password. You must give a password for this user before the account can be used.

Question 112

To install a brand-new Check Point Cluster, the Mega Corp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster. Which type of cluster is it? 1. Full HA Cluster 2. Standalone 3. High Availability 4. Distributed

Answer 112

High Availability

Question 113

What happens if the identity of a user is known? 1. If the user credentials do not match an Access Role, the system displays a sandbox. 2. If the user credentials match an Access Role, the rule is applied and traffic is accepted or dropped based on the defined action. 3. If the user credentials do not match an Access Role, the system displays the Captive Portal. 4. If the user credentials do not match an Access Role, the traffic is automatically dropped.

Answer 113

If the user credentials match an Access Role, the rule is applied and traffic is accepted or dropped based on the defined action.

Question 114

Which of the following is NOT a VPN routing option available in a star community? 1. To satellites through center only 2. To center, or through the center to other satellites, to Internet and other VPN targets 3. To center and to other satellites through center 4. To center only

Answer 114

1 and 4 ## Footnote Explanation Smart Console For simple hubs and spokes (or if there is only one Hub), the easiest way is to configure a VPN star community in R80 Smart Console: 1. On the Star Community window, in the: a. Center Gateways section, select the Security Gateway that functions as the "Hub". b. Satellite Gateways section, select Security Gateways as the "spokes", or satellites. 2. On the VPN Routing page, Enable VPN routing for satellites section, select one of these options: a. To center and to other Satellites through center - This allows connectivity between the Security Gateways, for example if the spoke Security Gateways are DAIP Security Gateways, and the Hub is a Security Gateway with a static IP address. b. To center, or through the center to other satellites, to internet and other VPN targets - This allows connectivity between the Security Gateways as well as the ability to inspect all communication passing through the Hub to the Internet. 1. Create an appropriate Access Control Policy rule. 2. NAT the satellite Security Gateways on the Hub if the Hub is used to route connections from Satellites to the Internet. The two Dynamic Objects (DAIP Security Gateways) can securely route communication through the Security Gateway with the static IP address.

Question 115

Which of the following statements accurately describes the command snapshot? 1. snapshot creates a full OS-level backup, including network-interface data, Check Point production information, and configuration settings of a GAiA Security Gateway. 2. snapshot creates a Security Management Server full system-level backup on any OS 3. snapshot stores only the system-configuration settings on the Gateway 4. A Gateway snapshot includes configuration settings and Check Point product information from the remote Security Management Server

Answer 115

snapshot creates a full OS-level backup, including network-interface data, Check Point production information, and configuration settings of a GAiA Security Gateway.

Question 116

Which policy type is used to enforce bandwidth and traffic control rules? 1. Threat Prevention 2. Access Control 3. QoS 4. Threat Emulation

Answer 116

QoS ## Footnote Explanation Check Point's QoS Solution QoS is a policy-based QoS management solution from Check Point Software Technologies Ltd., satisfies your needs for a bandwidth management solution. QoS is a unique, software-only based application that manages traffic end-to-end across networks, by distributing enforcement throughout network hardware and software.

Question 117

R80 Security Management Server can be installed on which of the following operating systems? 1. Gaia, SPLAT, Windows Server only 2. Gaia, SPLAT, Windows Server and IPSO only 3. Gaia and SPLAT only 4. Gaia only

Answer 117

Gaia only ## Footnote Explanation R80 can be installed only on GAIA OS. Supported Check Point Installations All R80 servers are supported on the Gaia Operating System: * Security Management Server * Multi-Domain Security Management Server * Log Server * Multi-Domain Log Server * Smart Event Server

Question 118

Admin A and Admin B are both logged in on Smart Console. What does it mean if Admin B sees a locked icon on a rule? Choose the BEST answer. 1. Rule is locked by Admin A and will make it available if session is published. 2. Rule is locked by Admin A because an object on that rule is been edited. 3. Rule is locked by Admin A, and if the session is saved, rule will be available 4. Rule is locked by Admin A, because the save bottom has not been press.

Answer 118

Rule is locked by Admin A and will make it available if session is published.

Question 119

Anti-Spoofing is typically set up on which object type? 1. Network 2. Host 3. Security Gateway 4. Security Management object

Answer 119

Security Gateway

Question 120

The most important part of a site-to-site VPN deployment is the . 1. VPN gateways 2. Encrypted VPN tunnel 3. Internet 4. Remote users

Answer 120

Encrypted VPN tunnel ## Footnote Explanation Site to Site VPN The basis of Site to Site VPN is the encrypted VPN tunnel. Two Security Gateways negotiate a link and create a VPN tunnel and each tunnel can contain more than one VPN connection. One Security Gateway can maintain more than one VPN tunnel at the same time. Reference:

Question 121

What CLI utility allows an administrator to capture traffic along the firewall inspection chain? 1. fw monitor 2. tcpdump 3. tcpdump /snoop 4. show interface (interface) –chain

Answer 121

fw monitor

Question 122

Mesh and Star are two types of VPN topologies. Which statement below is TRUE about these types of communities? 1. In a star community, satellite gateways cannot communicate with each other. 2. In a mesh community, member gateways cannot communicate directly with each other. 3. In a mesh community, all members can create a tunnel with any other member. 4. A star community requires Check Point gateways, as it is a Check Point proprietary technology.

Answer 122

In a mesh community, all members can create a tunnel with any other member.

Question 123

Fill in the blank: A is used by a VPN gateway to send traffic as if it were a physical interface. 1. VPN router 2. VPN Tunnel Interface 3. VPN interface 4. VPN community

Answer 123

VPN Tunnel Interface ## Footnote Explanation Route Based VPN VPN traffic is routed according to the routing settings (static or dynamic) of the Security Gateway operating system. The Security Gateway uses a VTI (VPN Tunnel Interface) to send the VPN traffic as if it were a physical interface. The VTIs of Security Gateways in a VPN community connect and can support dynamic routing protocols.

Question 124

Fill in the blanks: A Check Point software license consists of a`_____________` and`____________` . 1. Software container; software package 2. Software package; signature 3. Software blade; software container 4. Signature; software blade

Answer 124

Software blade; software container ## Footnote Explanation Check Point's licensing is designed to be scalable and modular. To this end, Check Point offers both predefined packages as well as the ability to custom build a solution tailored to the needs of the Network Administrator. This is accomplished by the use of the following license components: Software Blades Container

Question 125

Look at the following screenshot and select the BEST answer. 1. Internal clients can upload and download any-files to FTP_Ext-server using FTP. 2. Clients external to the Security Gateway can upload any files to the FTP_Ext-server using FTP. 3. Clients external to the Security Gateway can download archive files from FTP_Ext server using FTP. 4. Internal clients can upload and download archive-files to FTP_Ext server using FTP.

Answer 125

Clients external to the Security Gateway can download archive files from FTP_Ext server using FTP.

Question 126

Choose what BEST describes a Session? 1. Sessions locks the policy package for editing. 2. Starts when an Administrator logs in to the Security Management Server through Smart Console and ends when it is published. 3. Starts when an Administrator publishes all the changes made on Smart Console. 4. Sessions ends when policy is pushed to the Security Gateway.

Answer 126

Starts when an Administrator logs in to the Security Management Server through Smart Console and ends when it is published. ## Footnote Explanation Administrator Collaboration More than one administrator can connect to the Security Management Server at the same time. Every administrator has their own username, and works in a session that is independent of the other administrators. When an administrator logs in to the Security Management Server through SmartConsole, a new editing session starts. The changes that the administrator makes during the session are only available to that administrator. Other administrators see a lock icon on object and rules that are being edited. To make changes available to all administrators, and to unlock the objects and rules that are being edited, the administrator must publish the session.

Question 127

What statement is true regarding Visitor Mode? 1. All VPN traffic is tunneled through UDP port 4500. 2. VPN authentication and encrypted traffic are tunneled through port TCP 443. 3. Only Main mode and Quick mode traffic are tunneled on TCP port 443. 4. Only ESP traffic is tunneled through port TCP 443.

Answer 127

VPN authentication and encrypted traffic are tunneled through port TCP 443.

Question 128

Which of the following is NOT an alert option? 1. SNMP 2. User defined alert 3. Mail 4. High alert

Answer 128

High alert ## Footnote Explanation In Action, select: none - No alert. log - Sends a log entry to the database. alert - Opens a pop-up window to your desktop. mail - Sends a mail alert to your Inbox. snmptrap - Sends an SNMP alert. useralert - Runs a script. Make sure a user-defined action is available. Go to SmartDashboard > Global Properties > Log and Alert > Alert Commands.

Question 129

When using LDAP as an authentication method for Identity Awareness, the query: 1. Requires client and server-side software. 2. Is transparent, requiring no client or server-side software, or client intervention. 3. Prompts the user to enter credentials. 4. Requires administrators to specifically allow LDAP traffic to and from the LDAP Server and the Security Gateway.

Answer 129

Is transparent, requiring no client or server-side software, or client intervention.

Question 130

Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256 for IKE phase 2. Why is this a problematic setup? 1. All is fine as the longest key length has been chosen for encrypting the data and a shorter key length for higher performance for setting up the tunnel. 2. Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in phase 2 only costs performance and does not add security due to a shorter key in phase 1 . 3. All is fine and can be used as is. 4. The two algorithms do not have the same key length and so don't work together. You will get the error … No proposal chosen…

Answer 130

Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in phase 2 only costs performance and does not add security due to a shorter key in phase 1.

Question 131

The organization's security manager wishes to back up just the Gaia operating system parameters. Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries? 1. `backup` 2. `up grade export` 3. `show configuration` 4. `migrate export`

Answer 131

`backup` ## Footnote Explanation System Backup (and System Restore) System Backup can be used to backup current system configuration. A backup creates a compressed file that contains the Check Point configuration including the networking and operating system parameters, such as routing and interface configuration etc., but unlike a snapshot, it does not include the operating system, product binaries, and hotfixes.

Question 132

If there is an Accept Implied Policy set to “First”, what is the reason Jorge cannot see any logs? 1. Log Implied Rule was not selected on Global Properties. 2. Log Implied Rule was not set correctly on the track column on the rules base. 3. Track log column is set to none. 4. Track log column is set to Log instead of Full Log

Answer 132

Log Implied Rule was not selected on Global Properties. ## Footnote Explanation Implied Rules are configured only on Global Properties.

Question 133

You installed Security Management Server on a computer using GAiA in the MegaCorp home office. You use IP address 10.1.1.1. You also installed the Security Gateway on a second GAiA computer, which you plan to ship to another Administrator at a MegaCorp hub office. What is the correct order for pushing SIC certificates to the Gateway before shipping it? 1. Run cpconfig on the Gateway, select Secure Internal Communication, enter the activation key, and reconfirm. 2. Initialize Internal Certificate Authority (ICA) on the Security Management Server. 3. Configure the Gateway object with the host name and IP addresses for the remote site. 4. Click the Communication button in the Gateway object's General screen, enter the activation key, and click Initialize and OK. 5. Install the Security Policy. * 2, 1, 3, 4, 5 * 2, 3, 4, 1, 5 * 2, 3, 4, 5,1 * 1, 3, 2, 4, 5

Answer 133

2, 1, 3, 4, 5

Question 134

Which directory holds the Smart Log index files by default? 1. `$FWDIR/smart log` 2. `$SMARTLOGDIR/data` 3. `$FWDIR/log` 4. `$SMARTLOG/dir`

Answer 134

``` $SMARTLOGDIR/data ```

Question 135

Your bank's distributed R77 installation has Security Gateways up for renewal. Which Smart Console application will tell you which Security Gateways have licenses that will expire within the next 30 days? 1. Smart Dashboard 2. Smart Update 3. SmartView Tracker 4. Smart Portal

Answer 135

Smart Update

Question 136

Can a Check Point gateway translate both source IP address and destination IP address in a given packet? 1. Yes. 2. Yes, but only when using Manual NAT. 3. No. 4. Yes, but only when using Automatic NAT.

Answer 136

Yes.

Question 137

Which of the following is NOT defined by an Access Role object? 1. Source Server 2. Source Machine 3. Source User 4. Source Network

Answer 137

Source Server

Question 138

What port is used for delivering logs from the gateway to the management server? 1. Port 18209 2. Port 258 3. Port 981 4. Port 257

Answer 138

Port 257

Question 139

Which utility allows you to configure the DHCP service on Gaia from the command line? 1. `ifconfig` 2. `dhcp_cfg` 3. `sysconfig` 4. `cpconfig`

Answer 139

``` sysconfig ```

Question 140

Packages and licenses are loaded from all of these sources **EXCEPT** 1. Download Center Web site 2. UserUpdate 3. User Center 4. Check Point DVD

Answer 140

UserUpdate

Question 141

Which message indicates IKE Phase 2 has completed successfully? 1. Quick Mode Complete 2. Aggressive Mode Complete 3. Main Mode Complete 4. IKE Mode Complete

Answer 141

Quick Mode Complete

Question 142

Which back up method uses the command line to create an image of the OS? 1. System backup 2. Save Configuration 3. Migrate 4. `snapshot`

Answer 142

``` snapshot ```

Question 143

Which of the following is **NOT** a valid application tab in the R80 SmartConsole? 1. Manage and Command Line 2. Logs and Monitor 3. Security Policies 4. Gateway and Servers

Answer 143

Manage and Command Line

Question 144

Choose the **BEST** place to find a Security Management Server backup file named bachup_fw on a Check Point Appliance. 1. `/var/log/CPbackup/backup_fw.tgz` 2. `/var/log/CPbackup/backups/backup_fw.tar` 3. `/var/CPbackup/backups/backup_fw.tar` 4. `/var/CPbackup/backups/backup_fw.tgz`

Answer 144

`/var/log/CPbackup/backup_fw.tgz`

Question 145

What is the most complete definition of the difference between the Install Policy.... button on the SmartConsole's tab, and the Install Policy.... button within a specific policy? 1. The Global one also saves and publishes the session before the installation. 2. The Global one can install multipleselected policies at the same time. 3. The local one does not install the Anti-Malware policy along with the Network policy. 4. The second one pre-selects the installation for only the current policy and for the applicable gateways.

Answer 145

The second one pre-selects the installation for only the current policy and for the applicable gateways.

Question 146

Your internal networks 10.1.1.0/24. 10.2.2.0/24 and 192.168.0.0/16 are behind the internet Security Gateway. Considering that Layer 2 and Layer 3 setup is correct, what are the steps you will need to do in SmartConsole in order to get the connection working? Select the **BEST** answer. A) 2. Define an accept rule in Security Policy. 2. Define Security Gateway to hide all internal networks behind the gateway's external IP. 3. Publish and install the policy. B) 1. Define an accept rule in Security Policy. 2. Configure automatic NAT for each network to NAT the networks behind a public IP. 3.Publish the policy. C) 1. Define an accept rule in Security Policy. 2. Configure automatic NAT for each network to NAT the networks behind a public IP. 3. Publish and install policy. D) 1. Define an accept rule in Security Policy. 2. Define Security Gateway to hide all internal networks behind the gateway's external IP. 3. Publish the policy.

Answer 146

A) 1. Define an accept rule in Security Policy. 2. Define Security Gateway to hide all internal networks behind the gateway's external IP. 3. Publish and install policy.

Question 147

You have enabled "Full log" as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason? 1. Logging has disk space issues, Change logging storage options on the logging server or Security Management Server properties and install database. 2. Data Awareness is not enabled. 3. Identity Awareness is not enabled. 4. Logs are arriving from Pre-R80 gateways.

Answer 147

Data Awarenes is not enabled

Question 148

In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway? 1. Pentagon 2. Combined 3. Meshed 4. Star

Answer 148

Star

Question 149

In which scenario is it a valid option to transfer a license from one hardware device to another? 1. From a 4400 Appliance to an HP Open Server. 2. From an IBM Open Server to an HP Open Server. 3. From a 4400 Appliance to a 2200 Appliance. 4. From an IBM Open Server to a 2200 Appliance.

Answer 149

From an IBM Open Server to an HP Open Server.

Question 150

Fill in the blank: Service blades must be attached to a `_________` 1. Security Gateway 2. Management container 3. Management server 4. Security Gateway container

Answer 150

Security Gateway container

Question 151

Fill in the blank: In Security Gateways R75 and above, SIC uses `________` for encryption. 1. AES-128 2. AES-256 3. DES 4. 3DES

Answer 151

AES-128

Question 152

Fill in the blank: The `_______` software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities. 1. Application Control 2. Data Awareness 3. URL Filtering 4. Threat Emulation

Answer 152

URL Filtering

Question 153

Which of the following licenses are considered temporary? 1. Perpetual and Trial 2. Plug-and-play and Evaluation 3. Subscription and Perpetual 4. Evaluation and Subscription

Answer 153

Plug-and-play and Evaluation

Question 154

You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have recieved a call by one of the management users stating that they are unable to browse the Internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway. How do you review the logs to see what the problem may be? 1. Open SmartLog and connected remotely to the IP of the wireless controller. 2. Open SmartView Tracker and filter the logs for the IP address of the tablet. 3. Open SmartView Tracker and check all the IP logs for the tablet. 4. Open SmartLog and query for the IP address of the Manager's tablet.

Answer 154

Open SmartLog and query for the IP address of the Manager's tablet.

Question 155

Which of the following is NOT a set of Regulatory Requirements related to Information Security? 1. ISO 37001 2. Sarbanes Oxley (SOX) 3. HIPAA 4. PCI

Answer 155

ISO 37001

Question 156

What is the most recommended installation method for Check Point appliances? 1. SmartUpdate installation 2. DVD media created with Check Point ISOMorphic. 3. USB media created with Check Point ISOMorphic. 4. Cloud based installation.

Answer 156

USB media created with Check Point ISOMorphic.

Question 157

Which product correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices? 1. SmartView Monitor 2. SmartEvent 3. SmartUpdate 4. SmartDashboard

Answer 157

SmartEvent

Question 158

How do you manage Gaia? 1. Through CLI and WebUI 2. Through CLI only 3. Through SmartDashboard only 4. Through CLI, WebUI, and SmartDashboard

Answer 158

Through CLI and WebUI

Question 159

Which of the following is an authentication method used for Identity Awareness? 1. SSL 2. Captive Portal 3. PKI 4. RSA

Answer 159

Captive Portal

Question 160

What protocol is specifically used for clustered environments? 1. Cluster Protocol 2. Synchronized Cluster Protocol 3. Control Cluster Protocol 4. Cluster Control Protocol

Answer 160

Cluster Control Protocol

Question 161

When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control? 1. RADIUS 2. Remote Access and RADIUS 3. AD Query 4. AD Query and Browser-based Authentication

Answer 161

AD Query and Browser-based Authentication

Question 162

Fill in the blank: Once a certificate is revoked from the Security Gateway by the Security Gateway by the Security Management Server, the certificate information is `_________`. 1. Sent to the Internal Certificate Authority. 2. Sent to the Security Administrator. 3. Stored on the Security Management Server. 4. Stored on the Certificate Revocation List.

Answer 162

Stored on the Certificate Revocation List.

Question 163

Where can you trigger a failover of the cluster members? 1. Log in to Security Gateway CLI and run command `clusterXL_admin down`. 2. In SmartView Monitor right-click the Security Gateway member and select **Cluster Member stop**. 3. Log into Security Gateway CLI and run command `cphaprob down` A) 1, 2 and 3 B) 2 and 3 C) 1 and 2 D) 1 and 3

Answer 163

B) 2 and 3

Question 164

Phase 1 of the two-phase negotiation process conducted by IKE operates in `_________` mode. 1. Main 2. Authentication 3. Quick 4. High Alert

Answer 164

Main

Question 165

Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in: 1. When Joe logs in, Bob will be log out automatically. 2. Since they both are log in on different interfaces, they both will be able to make changes. 3. If Joe tries to make changes, he won't, database will be locked. 4. Bob will be prompt that Joe logged in.

Answer 165

If Joe tries to make changes, he won't, database will be locked.

Question 166

Fill in the blanks: A Security Policy is created in `_______`, stored in the `_______`, and Distrubuted to the various `_________`. 1. Rule base, Security Management Server, Security Gateways. 2. SmartConsole, Security Gateway, Security Management Gateways. 3. SmartConsole, Security Management Server, Security Gateways. 4. The Check Point database, SmartConsole, Security Gateways.

Answer 166

SmartConsole, Security Management Server, Security Gateways

Question 167

Fill in the blank: A(n)`________` rule is created by an administrator and is located before the first and before last rules in the Rule Base. 1. Firewall drop 2. Explicit 3. Implicit accept 4. Implicit drop

Answer 167

Explicit

Question 168

Fill in the blank: A `_________` VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. 1. Clientless remote access 2. Clientless direct access 3. Client-based remote access 4. Direct access

Answer 168

Clientless remote access

Question 169

Which type of Endpoint Identity Agent includes packet tagging and computer authentication? 1. Full 2. Light 3. Custom 4. Complete

Answer 169

Full

Question 170

Choose what BEST describes a Session. 1. Starts when an Administrator publishes all the changes made on SmartConsole. 2. Starts when an Administrator logs in to the Security Management Server through SmartConsole and ends when it is published. 3. Sessions ends when policy is pushed to the Security Gateway. 4. Sessions locks the plicy package for editing.

Answer 170

Starts when an Administrator logs in to the Security Management Server through SmartConsole and ends when it is published.

Question 171

Administrator Dave, logs into R80 Management Server to review and makes some rule changes. He notices that there is a padlock sign next to the DNS rule in the Rule Base. 1. DNS Rule is using one of the new features of R80 where an administrator can mark a rule with the padlock icon to let other administrators know it is important. 2. Another administrator is logged into the Management and currently editing the DNS Rule. 3. DNS Rule is a placeholder rule for a rule that existed in the past but was deleted. 4. This is normal behavior in R80 when there are duplicate rules in the Rule Base.

Answer 171

Another administrator is logged into the Management and currently editing the DNS Rule.

Question 172

What is the default shell of Gaia CLI? 1. Monitor 2. CLI.sh 3. Read-only 4. Bash

Answer 172

CLI.sh

Question 173

Fill in the blank: RADIUS protocol uses `________` to communicate with the gateway. 1. UDP 2. TDP 3. CCP 4. HTTP

Answer 173

UDP

Question 174

Which authentication scheme requires a user to possess a token? 1. TACACS 2. SecureID 3. Check Point password 4. RADIUS

Answer 174

SecureID

Question 175

What are the two high availability modes? 1. Load Sharing and Legacy 2. Traditional and New 3. Active and Standby 4. New and Legacy

Answer 175

New and Legacy

Question 176

If there is an Accept Implied Policy set to "First", what is the reason Jorge cannot see any logs? 1. Log Implied Rule was not selected on Global Properties. 2. Log Implied Rule was not set correctly on the track column on the rules base. 3. Track log column is set to none. 4. Track log column is set to Log instead of Full Log.

Answer 176

Log Implied Rule was not selected on Global Properties.

Question 177

Which deployment adds a Security Gateway to an existing environment without changing IP routing? 1. Distrubuted 2. Bridge Mode 3. Remote 4. Standalone

Answer 177

Bridge Mode

Question 178

Which of the following is **NOT** an alert option? 1. SNMP 2. High Alert 3. Mail 4. User defined

Answer 178

High Alert

Question 179

In the Check Point Security Management Architecture, which component(s) can store logs? 1. SmartConsole 2. Security Management Server and Security Gateway. 3. Security Management Server 4. SmartConsole and Security Management Server

Answer 179

Security Management Server and Security Gateway.

Question 180

Which of the following licenses are considered temporary? 1. Perpetual and Trial 2. Plug-and-play and Evaluation 3. Subscription and Perpetual 4. Evaluation and Subscription

Answer 180

Plug-and-play and Evaluation

Question 181

Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using `________`. 1. User Directory 2. Captive Portal And Transparent Kerberos Authentication 3. Captive Portal 4. UserCheck

Answer 181

Captive Portal and Transparent Kerberos Authentication

Question 182

which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities? 1. All Connections (Clear or Encrypted) 2. Accept all encrypted traffic 3. Specific VPN communities 4. All Site-to-Site VPN Communities

Answer 182

Specific VPN Communities

Question 183

Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as `________` 1. UserCheck 2. User Directory 3. User Administration 4. User Center

Answer 183

User Directory

Question 184

What two ordered layers make up the Access Control Policy Layer? 1. URL Filtering and Network 2. Network and Threat Prevention 3. Application Control and URL Filtering 4. Network and Application Control

Answer 184

Network and Application Control

Question 185

While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain? 1. Security Gateway is not part of the Domain 2. SmartConsole machine is not part of the domain 3. SMS is not part of the domain 4. Identity Awareness is not enabled on Global properties

Answer 185

SmartConsole machine is not part of the domain.

Question 186

Which of the following is TRUE about the Check Point Host object? 1. Check Point Host has no routing ability even if it has more than one interface installed. 2. When you upgrade to R80 from R77.30 or earlier versions, Check Point Host object are converted to gateway objects. 3. Check Point Host is capable of having an IP forwarding mechanism. 4. Check Point Host can act as a firewall.

Answer 186

Check Point Host has no routing ability even if it has more than one interface installed.

Question 187

What is the Implicit Clean-up Rule? 1. A setting that is defined in the Global Properties for all policies. 2. A setting that is configured per Policy Layer. 3. Another name for the Clean-up Rule. 4. Automatically created when the Clean-up Rule is defined.

Answer 187

A setting that is defined in the Global Properties for all policies.

Question 188

In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server (Security Management Server)? 1. Display policies and logs on the administrator's workstation. 2. Verify and compile Security Policies. 3. Processing and sending alerts such as SNMP traps and email notifications. 4. Store firewall logs to hard drive storage.

Answer 188

Display policies and logs on the administrator's workstation.

Question 189

Which command shows the installed licenses? ``` 1. cplic print 2. print cplic 3. fwlic print 4. show licenses ```

Answer 189

``` cplic print ```

Question 190

Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies? 1. Firewall 2. Identity Awareness 3. Application Control 4. URL Filtering

Answer 190

Identity Awareness

Question 191

Fill in the blank: Once a license is activated, a `_______` should be installed. 1. License Management file 2. Security Gateway Contract file 3. Service Contract file 4. License Contract file

Answer 191

Service Contract File

Question 192

You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have recieved a call by one of the management users stating that they are unable to browse the internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway. How do you review the logs to see what the problem may be? 1. Open SmartLog and connect remotely to the IP of the wireless controller. 2. Open SmartView Tracker and filter the logs for the IP address of the tablet. 3. Open SmartView Tracker and check all the IP logs for the tablet. 4. Open SmartLog and query for the IP address of the Manager's tablet.

Answer 192

Open SmartLog and query for the IP address of the Manager's tablet.

Question 193

True or False: In R80, more than one administrator can login to the Security Management Server with write permission at the same time. 1. False, this feature has to be enabled in the Global Properties. 2. True, every administrator works in a session that is independent of the other administrators. 3. True, every administrator works on a different database that is independant of the other administrators. 4. False, only one administrator can login with write permission.

Answer 193

True, every administrator works in a session that is independant of the other administrators.

Question 194

Fill in the blank: `__________` information is included in "Full Log" tracking option, but is not included in "Log" tracking option? 1. Destination port 2. Data type 3. File attributes 4. Application

Answer 194

Data type

Question 195

Fill in the blank: In the network policy layer, the default action for the implied rule is `________` all traffic. However, in the Application Control policy layer, the default action is `__________` all traffic. 1. Accept; redirect 2. Accept; drop 3. Redirect; drop 4. Drop; accept

Answer 195

Drop; accept

Question 196

Fill in the blank: It is Best Practice to have a `_______` rule at the end of each policy layer. 1. Explicit Drop 2. Implied Drop 3. Explicit Cleanup 4. Implicit Drop

Answer 196

Explicit Cleanup

Question 197

At what point is the Internal Certificate Authority (ICA) created? 1. Upon creation of a certificate 2. During the primary Security Management Server installation process. 3. When an administrator decides to create one. 4. When an administrator initially logs into SmartConsole.

Answer 197

During the primary Security Management Server installation process.

Question 198

Fill in the blank: Each cluster has `_______` interfaces. 1. Five 2. Two 3. Three 4. Four

Answer 198

Three

Question 199

What are the three authentication methods for SIC? 1. Passwords, Users, and standards-based SSL for the creation of secure channels. 2. Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption. 3. Packet Filtering, certificates, and 3DES or AES128 for encryption 4. Certificates, Passwords, and Tokens

Answer 199

Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption.

Question 200

Which of the following commands is used to monitor cluster members? ``` 1. cphaprob state 2. cphaprob status 3. cphaprob 4. cluster state ```

Answer 200

`cphaprob state`

Question 201

To enforce the Security Policy correctly, a Security Gateway requires: 1. a routing table 2. awareness if the network topology. 3. a Demilitarized Zone. 4. a Security Policy install

Answer 201

awareness of the network topology

Question 202

Which of the following are types of VPN communities? 1. Pentagon, star, and combination 2. Star, octagon, and combination 3. Combined and star 4. Meshed, star, and combination

Answer 202

Meshed, star, and combination

Question 203

Which Threat Preventation Software Blade provides protection from malicious software that can infect your network computers? 1. Anti-Malware 2. IPS 3. Anti-bot 4. Anti-spam

Answer 203

IPS

Question 204

Fill in the blank: Back up and restores can be accomplished through `________`. 1. SmartConsole, WebUI, or CLI 2. WebUI, CLI, or SmartUpdate 3. CLI, SmartUpdate, or SmartBackup 4. SmartUpdate, SmartBackup, or SmartConsole

Answer 204

SmartConsole, WebUI, or CLI

Question 205

There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High Availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically? 1. No, since "maintain current active cluster member" option on the cluster object properties is enabled by default. 2. No, since "maintain current active cluster member" option is enabled by default on the Global Properties. 3. Yes, since "Switch to higher priority cluster member" option on the cluster object properties is enabled by default. 4. Yes, since "Switch to higher priority cluster member" option is enabled by default on the Global Properties.

Answer 205

No, since "maintain current active cluster member" option on the cluster object properties is enabled by default.

Question 206

Fill in the blank: Authentication rules are defined for `_________`. 1. User Groups 2. Users using UserCheck 3. Individual users 4. All users in the database

Answer 206

User groups

Question 207

How can the changes made by an administrator before publishing the session be seen by a superuser administrator? 1. By impersonating the administrator with the "Login as..." option. 2. They cannot be seen. 3. From the SmartView Tracker audit log. 4. From **Manage and Settings** > **Sessions**, right-click on the session and click "**View Changes**..."

Answer 207

They cannot be seen

Question 208

Fill in the blank: When a policy is installed, `_______` are also distributed to the target installation Security Gateways. 1. User and objects databases 2. Network databases 3. SmartConsole databases 4. User databases

Answer 208

User and objects databases

Question 209

Fill in the blanks: With each new policy layer, the `______` rule is automatically set to `________` all traffic. 1. Explicit default; drop 2. Implicit default; accept 3. Implicit cleanup; drop 4. Explicit default; accept

Answer 209

Explicit default; drop

Question 210

Phase 1 of the two-phase negotioation process conducted by IKE operates in `________` mode. 1. Main 2. Authentication 3. Quick 4. High Alert

Answer 210

Main

Question 211

Which of the following is NOT an element of VPN Simplified Mode and VPN communitites? 1. "Encrypt" action in the Rule Base 2. Permanent Tunnels 3. "VPN" column in the Rule Base 4. Configuration checkbox "Accept all encrypted traffic"

Answer 211

"Encrypted" action in the Rule Base

Question 212

When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control? 1. RADIUS 2. Remote Access and RADIUS 3. AD Query 4. AD Query and Browser-based Authentication

Answer 212

AD Query and Browser-based Authentication.

Question 213

What is NOT an advantage of Packet Filtering? 1. Low Security and No Screening above Network Layer 2. Application Independence 3. High Performance 4. Scalability

Answer 213

Low Security and No Screening above Network Layer

Question 214

Check Point uses these technologies to deny or permit network traffic: 1. Packet Filtering 2. Statefull Inspection 3. Application Layer Firewall 4. All the above

Answer 214

All the above * Packet Filtering * Statefull Inspection * Application Layer Firewall ## Footnote Managing firewalls and monitoring network traffic is the key role of a network security administrator. Effectively controlling network traffic helps to improve overall network performance and organizational security. The Firewall, or the Security Gateway with a firewall enabled, will deny or permit traffic based on rules defined in the security policy. The following technologies are used to deny or permit network traffic: Packet Filtering Stateful Inspection Application Layer Firewall

Question 215

The Check Point Firewall kernel module inspects packets between which layers? 1. layers 1 and 2 2. layers 2 and 3 3. layers 1 and 4 4. layers 3 and 7

Answer 215

Layers 2 and 3

Question 216

Packet Filtering Packets include the following elements: 1. Source and destination address, source and destination port, protocol 2. Source and destination port, protocol, data packets 3. Source and destination address, source and destination port, data frames 4. Source and destination port, protocol, data streams

Answer 216

Source and destination address, source and destination port, protocol

Question 217

What are Pros and cons of Packet Filtering? 1. Pros: High Security, High Performance, Scalability. Cons: No screening above Network Layer (No "state or application context information") 2. Pros: Application Independance, High Performance, Scalability. Cons: Low Security, No Screening above Network Layer (No "state or application context information")

Answer 217

Pros: Application Independance, High Performance, Scalability. Cons: Low Security, No Screening above Network Layer (No "state or application context information")

Question 218

How does the Stateful Inspection work?

Answer 218

1. Examines the context of a packet. 2. Monitors the state of the connection. 3. Uses Check Point's INSPECT Engine to extract state related information from the packet. ## Footnote Stateful inspection analyzes a packet’s source and destination addresses, source and destination ports, protocol and contents. With Stateful inspection, the state of the connection is monitored and state tables are created to compile the information. State tables hold useful information in regards to monitoring performance through a Security Gateway. As a result filtering includes content that has been established by previous packets passed through the Firewall. For example, Stateful Inspection provides a security measure against port scanning by closing all ports until the specific port is requested. Check Point’s INSPECT Engine, which is installed on a Security Gateway, is used to extract state related information from the packets and store that information in state tables. State tables are key components of the Stateful Inspection technology because they are vital in maintaining state information needed to correctly inspect packets. When new packets arrive, their contents are compared to the state tables to determine whether they are denied or permitted.

Question 219

How does **Stateful Inspection** and **Packet Filtering** Differ?

Answer 219

Stateful Inspection * Examines the packet header and contents * Only one rule required for each connection Packet Filtering * Examines the packet header * Requires two rules for each connection ## Footnote Stateful Inspection differs from Packet Filtering in that it deeply examines a packet not only in its header, but also the contents of the packet up through the Application layer to determine more about the packet than just information about its source and destination. In addition, Packet filtering requires creating two rules for each user or computer that needs to access resources. For example, if a computer with IP address 10.1.1.201 needs to access 8.8.8.8 on the Internet for DNS, an outgoing request rule is needed for connecting to the server on the Internet and a second rule is required for the incoming reply for the same connection. The creation of Stateful Inspection eliminated the need for two rules. The Firewall remembers each reply for an existing request using the state tables. Therefore only one rule is required for each connection.

Question 220

What does OSI in OSI-Model stands for?

Answer 220

Open Systems Interconnect

Question 221

Which icon in the WebUI indicates that read/write access is enabled? A. Eyeglasses B. Pencil C. Padlock D. Book

Answer 221

B. Pencil

Question 222

Which default Gaia user has full read/write access? A. superuser B. monitor C. altuser D. admin

Answer 222

D. admin

Question 223

Which SmartConsole tab is used to monitor network and security performance? A. Logs Monitor B. Manage Settings C. Security Policies D. Gateway Servers

Answer 223

A. Logs Monitor

Question 224

Check Point Update Service Engine (CPUSE), also known as Deployment Agent [DA], is an advanced and intuitive mechanism for software deployment on Gaia OS. What software packages are supported for deployment? A. It supports deployments of single HotFixes (HF), and of Major Versions. Blink Packages and HotFix Accumulators (Jumbo) are not supported. B. It supports deployments of single HotFixes (HF), of HotFix Accumulators (Jumbo), and of Major Versions. C. It supports deployments of Major Versions and Blink packages only. D. It supports deployments of single HotFixes (HF), of HotFix Accumulators (Jumbo), but not of Major Versions.

Answer 224

B. It supports deployments of single HotFixes (HF), of HotFix Accumulators (Jumbo), and of Major Versions.

Question 225

Vanessa is firewall administrator in her company; her company is using Check Point firewalls on central and remote locations, which are managed centrally by R80 Security Management Server. One central location has an installed R77.30 Gateway on Open server. Remote location is using Check Point UTM-1 570 series appliance with R71. Which encryption is used in Secure Internal Communication (SIC) between central management and firewall on each location? A. On central firewall AES128 encryption is used for SIC, on Remote firewall 3DES encryption is used for SIC. B. On both firewalls, the same encryption is used for SIC. This is AES-GCM-256. C. The Firewall Administrator can choose which encryption suite will be used by SIC. D. On central firewall AES256 encryption is used for SIC, on Remote firewall AES128 encryption is used for SIC.

Answer 225

A. On central firewall AES128 encryption is used for SIC, on Remote firewall 3DES encryption is used for SIC.

Question 226

Which of the following is NOT a SecureXL traffic flow? A. Medium Path B. Accelerated Path C. High Priority Path D. Slow Path

Answer 226

C. High Priority Path ## Footnote SecureXL is an acceleration solution that maximizes performance of the Firewall and does not compromise security. When SecureXL is enabled on a Security Gateway, some CPU intensive operations are processed by virtualized software instead of the Firewall kernel. The Firewall can inspect and process connections more efficiently and accelerate throughput and connection rates. These are the SecureXL traffic flows: Slow path - Packets and connections that are inspected by the Firewall and are not processed by SecureXL. Accelerated path - Packets and connections that are offloaded to SecureXL and are not processed by the Firewall. Medium path - Packets that require deeper inspection cannot use the accelerated path. It is not necessary for the Firewall to inspect these packets, they can be offloaded and do not use the slow path. For example, packets that are inspected by IPS cannot use the accelerated path and can be offloaded to the IPS PSL (Passive Streaming Library). SecureXL processes these packets more quickly than packets on the slow path.

Question 227

Which of the following Automatically Generated Rules NAT rules have the lowest implementation priority? A. Machine Hide NAT B. Address Range Hide NAT C. Network Hide NAT D. Machine Static NAT

Answer 227

B. Address Range Hide NAT C. Network Hide NAT ## Footnote SmartDashboard organizes the automatic NAT rules in this order: 1. Static NAT rules for Firewall, or node (computer or server) objects 2. Hide NAT rules for Firewall, or node objects 3. Static NAT rules for network or address range objects 4. Hide NAT rules for network or address range objects

Question 228

VPN gateways authenticate using ___________ and ___________ . A. Passwords; tokens B. Certificates; pre-shared secrets C. Certificates; passwords D. Tokens; pre-shared secrets

Answer 228

VPN gateways authenticate using Digital Certificates and Pre-shared secrets.

Question 229

In R80 spoofing is defined as a method of: A. Disguising an illegal IP address behind an authorized IP address through Port Address Translation. B. Hiding your firewall from unauthorized users. C. Detecting people using false or wrong authentication logins D. Making packets appear as if they come from an authorized IP address.

Answer 229

D. Making packets appear as if they come from an authorized IP address. ## Footnote IP spoofing replaces the untrusted source IP address with a fake, trusted one, to hijack connections to your network. Attackers use IP spoofing to send malware and bots to your protected network, to execute DoS attacks, or to gain unauthorized access.

Question 230

The __________ is used to obtain identification and security information about network users. A. User Directory B. User server C. UserCheck D. User index

Answer 230

A. User Directory

Question 231

Which Check Point Application Control feature enables application scanning and detection? A. Application Dictionary B. AppWiki C. Application Library D. CPApp

Answer 231

B. AppWiki ## Footnote AppWiki Application Classification Library AppWiki enables application scanning and detection of more than 5,000 distinct applications and over 300,000 Web 2.0 widgets including instant messaging, social networking, video streaming, VoIP, games and more.

Question 232

DLP and Geo Policy are examples of what type of Policy? A. Standard Policies B. Shared Policies C. Inspection Policies D. Unified Policies

Answer 232

B. Shared Policies

Question 233

In which deployment is the security management server and Security Gateway installed on the same appliance? A. Bridge Mode B. Remote C. Standalone D. Distributed

Answer 233

C. Standalone ## Footnote Installing Standalone - Standalone Deployment - The Security Management Server and the Security Gateway are installed on the same computer or appliance.

Question 234

A _________ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. A. Clientless remote access B. Clientless direct access C. Client-based remote access D. Direct access

Answer 234

Clientless - Users connect through a web browser and use HTTPS connections. Clientless solutions usually supply access to web-based corporate resources.

Question 235

Which of the following statements is TRUE about R80 management plug-ins? A. The plug-in is a package installed on the Security Gateway. B. Installing a management plug-in requires a Snapshot, just like any upgrade process. C. A management plug-in interacts with a Security Management Server to provide new features and support for new products. D. Using a plug-in offers full central management only if special licensing is applied to specific features of the plug-in.

Answer 235

C. A management plug-in interacts with a Security Management Server to provide new features and support for new products.

Question 236

Gaia can be configured using the _______ or ______ . A. GaiaUI; command line interface B. WebUI; Gaia Interface C. Command line interface; WebUI D. Gaia Interface; GaiaUI

Answer 236

C. Command line interface; WebUI ## Footnote Configuring Gaia for the First Time In This Section: Running the First Time Configuration Wizard in WebUI Running the First Time Configuration Wizard in CLI After you install Gaia for the first time, use the First Time Configuration Wizard to configure the system and the Check Point products on it.

Question 237

Where can you trigger a failover of the cluster members? 1. Log in to Security Gateway CLI and run command clusterXL_admin down. 2. In SmartView Monitor right-click the Security Gateway member and select Cluster member stop. 3. Log into Security Gateway CLI and run command cphaprob down. A. 1, 2, and 3 B. 2 and 3 C. 1 and 2 D. 1 and 3

Answer 237

C. 1 and 2

Question 238

What are the three main components of the Check Point Three-Tier Architecture?

Answer 238

1. SmartConsole 2. Security Management Server 3. Security Gateway

Question 239

What is the main purpose of SmartConsole?

Answer 239

SmartConsole is the management component. It is software installed on a Windows platform that provides a graphical interface for centralized management of the Check Point environment.

Question 240

What is the main purpose of a Security Management Server?

Answer 240

The Security Management Server is a dedicated server that runs Check Point software to manage the objects and policies in a Check Point environment. The Security Management Server software is installed on a server running the Check Point Gaia operating system.

Question 241

What is the main purpose of a Security Gateway?

Answer 241

A Security Gateway is an entry point or cyber barrier that prevents unauthorized traffic from entering a company's network. It stands between incoming and outgoing traffic and enforces an organization's security policy. Security Gateways are placed at the perimeter of the network topology to protect an organization's environment through enforcement of security policies.

Question 242

List the two main shells that the Gaia operating system provides.

Answer 242

1. Gaia Clish 2. Bash (Expert mode)

Question 243

Which shell is most restrictive?

Answer 243

Gaia Clish

Question 244

What is the default shell?

Answer 244

Gaia Clish

Question 245

What is the default password for Expert mode?

Answer 245

There is no default password for Expert mode. It must be defined using the `set expert-password` command.

Question 246

Give at least one example of a physical component that network objects represent.

Answer 246

Network Objects represent physical components such as Gateways, Management Servers, and users.

Question 247

Give at least one example of a logical component that network objects represent.

Answer 247

Network Objects represent logical components such as applications, IP address ranges, and services.

Question 248

What Permissions Profile allows unrestricted permissions?

Answer 248

Super User

Question 249

Name the three types of Software Containers.

Answer 249

1. Security Management 2. Security Gateway 3. Endpoint Security

Question 250

What are Subscription Blades?

Answer 250

Service blades, such as IPS, URL Filtering, and Application Control are considered subscription blades. Licenses for subscription blades can expire. The license includes both the software subscription and the associated Support Services Contract. These blades are licensed and renewed for a specified period of time, which is typically 1, 2, or 3 years.

Question 251

Name one reason to generate and install a new license.

Answer 251

* Existing license expires * License is upgraded * IP address of the Security Management or Security Gateway has changed

Question 252

What type of rules are created by the Security Gateway?

Answer 252

Implied Rules

Question 253

What type of rules are created by the administrator?

Answer 253

Explicit Rules

Question 254

Where should the Cleanup rule be placed?

Answer 254

At the bottom of the rulebase

Question 255

What is the purpose of Policy layers?

Answer 255

Policy layers are sets of rules or a rulebase. They let you divide a policy, such as the Access Control policy, into smaller, more manageable sections that serve a certain purpose. The layers concept also provides more options for policy management, including the ability to set different views and edit permissions per layer for different administrator roles.

Question 256

What type of Policy layer is independent of the rest of the rulebase?

Answer 256

Inline

Question 257

List the two types of rules that Check Point NAT supports for address translation

Answer 257

* Automatic * Manual

Question 258

What is the difference between Hide NAT and Static NAT?

Answer 258

Hide NAT is a solution that only allows outgoing connections. It involves translating many private addresses to one public address. Using Hide NAT, the defined hosts and networks share the same address when their traffic is routed by the gateway. Different source port numbers are used to identify internal IP addresses on the one shared IP address. The source IP address is changed to the shared address and the source port is modified to the identifier port. Hide NAT is most often used to allow internal users access to external resources. Static NAT allows both incoming and outgoing connections. It involves the translation of one private IP address to a unique public IP address to the private address. Static NAT allows a host with a private IP address to be translated to a unique public address. Static NAT allows a host with a private IP address to be translated to a unique public address. This method of translation is often used for Internet Web Servers and Check Point Security Management Servers. Any application that requires both inbound and outbound connectivity, or the ability for external hosts to connect to the servers requires a Static NAT configuration.

Question 259

List at least two use cases for Application Control

Answer 259

* Learn About Application * Create a Granular Policy * Track Employees Online Usage * Keep Policies Updated * Customize Application, Sites, Categories, and Groups

Question 260

How does URL filtering work?

Answer 260

URL filtering works by comparing all web traffic against URL filters, which are typically contained in a database of sites that users are permitted to access or denied from accessing.

Question 261

What is the recommended profile supported by Autonomous Threat Prevention?

Answer 261

Perimeter (Recommended)

Question 262

What is a VPN community?

Answer 262

A VPN community is a named collection of VPN domains (hosts/networks that use the Security Gateway to send/recieve VPN traffic), each protected by a VPN Gateway. All the attributes of the VPN Tunnels are defined in the VPN Community.

Question 263

Define IKEv1 and IKEv2

Answer 263

* IKEv1 is the default version which is supported on most new and older systems. * IKEv2 is the newer version supporting IPv6, but currently Check Point Remote Access VPN clients do not support it.

Question 264

List the two topologies on which VPN communities can be based

Answer 264

VPN communities can be based on Mesh and Star topologies

Question 265

Which tool can be used to collect and view logs and monitor devices?

Answer 265

SmartConsole

Question 266

How many logs are typically displayed in the default view?

Answer 266

50

Question 267

What information is available in the Gateway & Servers Monitor?

Answer 267

* Device Status * License Status * System Counters * Traffic

Question 268

Give at least two situations in which a snapshot is recommended.

Answer 268

* After a fresh installation of Gaia * Before making a major configuration * Before an upgrade or hotfix changes

Question 269

Why is it recommended to schedule regular backups?

Answer 269

To preserve the Gaia operating system configuration and Firewall database

Question 270

Why is it recommended to schedule regular backups?

Answer 270

Backup and Restore

Question 271

In what compressed file format is a backup saved?

Answer 271

A *.tgz file

Question 272

What is Application Interfaces (APIs)?

Answer 272

Check Point offers a variety of APIs to automate security tasks, including administrative duties and incident detection and response. Also known as Check Point Management APIs.

Question 273

What does Cluster mean?

Answer 273

Two or more Security Gateways that work together in a redundant configuration - High Availability or Load Sharing.

Question 274

What is CoreXL?

Answer 274

Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point firewall instances run in parallel on multiple CPU cores.

Question 275

What is CPUSE?

Answer 275

Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS and the Gaia OS itself.

Question 276

What does Distributed Deployment mean?

Answer 276

Configuration in which the Check Point Security Gateway and the Security Management Server products are installed on different computers.

Question 277

What is Gaia Clish?

Answer 277

Local command line shell in Check Point Gaia operating system.

Question 278

What is Gaia Portal?

Answer 278

Web interface for the Check Point Gaia operating system.

Question 279

What is SecureXL?

Answer 279

Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway.

Question 280

What is SIC?

Answer 280

Secure Internal Communication is a Check Point proprietary mechanism with Check Point computers that run Check Point software authenticate each othe over SSL for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server.

Question 281

What is a VPN?

Answer 281

Virtual Private Network, is a technology that provides a secure, private connection between two points communicating over a network.

Question 282

Which tool allows automatic update of Gaia OS and Check Point products installed on Gaia OS? 1. CPDAS - Check Point Deployment Agent Service 2. CPUSE - Check Point Upgrade Service Engine 3. CPASE - Check Point Automatic Service Engine 4. CPAUE - Check Point Automatic Update Engine

Answer 282

2.CPUSE - Check Point Upgrade Service Engine

Question 283

In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server? 1. Verify and compile Security Policies. 2. Display policies and logs on the administrator's workstation. 3. Store firewall logs to hard drive storage. 4. Manage the object database.

Answer 283

2.Display policies and logs on the administrator's workstation.

Question 284

True or False: More than one administrator can log into the Security Management Server with SmartConsole with write permission at the same time. 1. True, every administrator works on a different database that is independent of the other administrators 2. False, only one administrator can login with write permission 3. True, every administrator works in a session that is independent of the other administrators 4. False, this feature has to be enabled in the Global Properties

Answer 284

3.True, every administrator works in a session that is independent of the other administrators

Question 285

What are the two deployment options available for a security gateway? 1. Bridge and Switch 2. Local and Remote 3. Cloud and Router 4. Standalone and Distributed

Answer 285

4.Standalone and Distributed

Question 286

One of major features in SmartConsole is concurrent administration. Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy? 1. AdminB sees a pencil icon next the rule that AdminB is currently editing. 2. AdminA, AdminB and AdminC are editing three different rules at the same time. 3. AdminA and AdminB are editing the same rule at the same time. 4. AdminC sees a lock icon which indicates that the rule is locked for editing by another administrator.

Answer 286

3.AdminA and AdminB are editing the same rule at the same time.

Question 287

Which one of the following is the preferred licensing model? Select the BEST answer. 1. Local licensing because it ties the package license to the IP-address of the gateway and has no dependency of the Security Management Server. 2. Local licensing because it ties the package license to the MAC-address of the gateway management interface and has no Security Management Server dependency. 3. Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency on the gateway. 4. Central licensing because it ties the package license to the MAC-address of the Security Management Server's Mgmt-interface and has no dependency on the gateway.

Answer 287

3.Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency on the gateway.

Question 288

A Check Point Software license consists of two components, the Software Blade and the Software Container. There are _____ types of Software Containers: _____. 1. Two; Security Management and Endpoint Security 2. Three; Security Management, Security Gateway, and Endpoint Security 3. Three; Security Gateway, Endpoint Security, and Gateway Management 4. Two; Endpoint Security and Security Gateway

Answer 288

2.Three; Security Management, Security Gateway, and Endpoint Security

Question 289

Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address? 1. Formal 2. Central 3. Local 4. Corporate

Answer 289

3.Local

Question 290

Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made? 1. Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot. 2. Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes. 3. Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work. 4. Tom’s changes will be lost since he lost connectivity and he will have to start again.

Answer 290

3.Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work.

Question 291

In which deployment is the security management server and Security Gateway installed on the same appliance? 1. Switch 2. Standalone 3. Distributed 4. Remote

Answer 291

2. Standalone

Question 292

Which software blade enables Access Control policies to accept, drop, or limit web site access based on user, group, and/or machine? 1. Data Awareness 2. Threat Emulation 3. Application Control 4. Identity Awareness

Answer 292

4. Identity Awareness

Question 293

DLP and Mobile Access Policy are examples of what type of Policy? 1. Shared Policies 2. Unified Policies 3. Inspection Policies 4. Standard Policies

Answer 293

1.Shared Policies

Question 294

What is the default shell of Gaia CLI? 1. Read-only 2. Expert 3. Clish 4. Bash

Answer 294

3.Clish

Question 295

Which of the following is NOT a valid application navigation tab in SmartConsole? 1. WEBUI & COMMAND LINE 2. SECURITY POLICIES 3. GATEWAYS & SERVERS 4. LOGS & MONITOR

Answer 295

1.WEBUI & COMMAND LINE

Question 296

What are two basic rules Check Point recommends for building an effective security policy? 1. Accept Rule and Drop Rule 2. Explicit Rule and Implied Rule 3. Cleanup Rule and Stealth Rule 4. NAT Rule and Reject Rule

Answer 296

3.Cleanup Rule and Stealth Rule

Question 297

When dealing with policy layers, what two layer types can be utilized? 1. Inbound Layers and Outbound Layers 2. Ordered Layers and Inline Layers 3. Structured Layers and Overlap Layers 4. R81.X does not support Layers

Answer 297

2.Ordered Layers and Inline Layers

Question 298

What are the three main components of Check Point security management architecture? 1. Smart Console, Standalone, Security Management Server 2. Policy-Client, Security Management Server, Security Gateway 3. SmartConsole, Security Policy Server, Logs & Monitoring 4. SmartConsole, Security Management Server, Security Gateway

Answer 298

4.SmartConsole, Security Management Server, Security Gateway

Question 299

Which Check Point software blade provides protection from zero-day and undiscovered threats? 1. Threat Extraction 2. Threat Emulation 3. Firewall 4. Application Control

Answer 299

2.Threat Emulation

Question 300

What are the three types of UserCheck messages? 1. ask, block, and notify 2. block, action, and warn 3. action, inform, and ask 4. inform, ask, and drop

Answer 300

1.ask, block, and notify

Question 301

By default, which port is used to connect to the GAiA Portal? 1. 4434 2. 80 3. 8080 4. 443

Answer 301

4. 443

Question 302

Choose what BEST describes a Session. 1. Sessions ends when policy is pushed to the Security Gateway. 2. Sessions locks the policy package for editing. 3. Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out. 4. Starts when an Administrator publishes all the changes made on SmartConsole.

Answer 302

3.Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out.

Question 303

Which command shows detailed information about VPN tunnels? 1. cat $FWDIR/conf/vpn.conf 2. vpn tu tlist 3. vpn tu 4. cpview

Answer 303

2. vpn tu tlist

Question 304

After a new Log Server is added to the environment and the SIC trust has been established with the SMS what will the gateways do? 1. Gateways will send new firewall logs to the new Log Server as soon as the SIC trust is set up between the SMS and the new Log Server. 2. Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server. 3. The firewalls will detect the new Log Server after the next policy install and redirect the new logs to the new Log Server. 4. The gateways can only send logs to an SMS and cannot send logs to a Log Server. Log Servers are proprietary log archive servers.

Answer 304

2.Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.

Question 305

Which of the following is a valid deployment option? 1. CloudSec deployment 2. Disliked deployment 3. Router only deployment 4. Standalone deployment

Answer 305

4.Standalone deployment

Question 306

Using the SmartConsole, which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them? 1. Read Only All 2. Full Access 3. Editor 4. Super User

Answer 306

1.Read Only All

Question 307

URL Filtering cannot be used to: * Control Data Security * Decrease legal liability * Improve organizational security * Control Bandwidth issues

Answer 307

Control Data Security

Question 308

After a new Log Server is added to the environment and the SIC trust has been established with the SMS what will the gateways do? * Gateways will send new firewall logs to the new Log Server as soon as the SIC trust is set up between the SMS and the new Log Server. * Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server. * The firewalls will detect the new Log Server after the next policy install and redirect the new logs to the new Log Server. * The gateways can only send logs to an SMS and cannot send logs to a Log Server. Log Servers are proprietary log archive servers.

Answer 308

Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.

Question 309

Which Autonomous Threat Prevention profile uses sanitization technology? * Cloud/data Center * Guest Network * Sandbox * Perimeter

Answer 309

Perimeter

Question 310

Which part of SmartConsole allows administrators to add, edit, delete, and clone objects? * Object Explorer * Object Navigator * Object Editor * Object Browser

Answer 310

Object Editor

Question 311

For Automatic Hide NAT rules created by the administrator what is a TRUE statement? * Source Port Address Translation (PAT) is enabled by default. * Source Port Address Translation (PAT) is disabled by default. * Automatic NAT rules are supported for Network objects only. * Automatic NAT rules are supported for Host objects only.

Answer 311

Source Port Address Translation (PAT) is disabled by default.

Question 312

What is the default tracking option of a rule? * None * Alert * Log * Tracking

Answer 312

None

Question 313

By default, which port is used to connect to the GAiA Portal? * 4434 * 80 * 8080 * 443

Answer 313

443

Question 314

Which of the following is NOT a type of Check Point API available in R80.x? * Identity Awareness Web Services * OPSEC SDK * Management * Mobile Access

Answer 314

Mobile Access

Question 315

What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection? * VPN Routing Mode * Stateless Mode * Stateful Mode * Wire Mode

Answer 315

Wire Mode

Question 316

How many versions, besides the destination version, are supported in a Multi-Version Cluster Upgrade? * 4 * 3 * 2 * 1

Answer 316

1

Question 317

After some changes in the firewall policy, you run into some issues. You want to test if the policy from two weeks ago has the same issue. You don't want to lose the changes from the last weeks. What is the best way to do it? * In SmartConsole under Security Policies go to the Installation History view of the Gateway, select the policy version from two weeks ago and press the ‘Install specific version’ button * Use the Gaia WebUI to take a backup of the Gateway. In SmartConsole under Security Policies go to the Installation History view of the Gateway, select the policy version from two weeks ago and press the ‘Install specific version’ button * In SmartConsole under Manage & Settings go to Sessions –> Revisions and select the revision from two weeks ago. Run the action ‘Revert to this revision...’. * Use the Gaia WebUI to take a snapshot of management. In the In SmartConsole under Manage & Settings go to Sessions -> Revisions and select the revision from two weeks ago. Run the action ‘Revert to this revision...’ Restore the management snapshot.

Answer 317

In SmartConsole under Security Policies go to the Installation History view of the Gateway, select the policy version from two weeks ago and press the ‘Install specific version’ button

Question 318

Which information is included in the "Extended Log" tracking option, but is not included in the "Log" tracking option? * data type information * application information * file attributes * destination port

Answer 318

file attributes

Question 319

In HTTPS Inspection policy, what actions are available in the "Actions" column of a rule? * "Inspect", "Bypass", "Block" * "Inspect", "Bypass", "Categorize" * "Inspect", "Bypass" * "Detect", "Bypass"

Answer 319

"Inspect", "Bypass", "Block"

Question 320

What is the purpose of the Stealth Rule? * To reduce the amount of logs for performance issues. * To reduce the number of rules in the database. * To prevent users from directly connecting to a Security Gateway. * To make the gateway visible to the Internet.

Answer 320

To prevent users from directly connecting to a Security Gateway.

Question 321

Which application is used for the central management and deployment of licenses and packages? * Deployment Agent * SmartLicense * SmartProvisioning * SmartUpdate

Answer 321

SmartUpdate

Question 322

True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway. * True, Central Licenses can be installed with CPLIC command on a Security Gateway * True, CLI is the preferred method for Licensing * False, Central Licenses are installed via Gaia on Security Gateways * False, Central Licenses are handled via Security Management Server

Answer 322

False, Central Licenses are handled via Security Management Server

Question 323

Which of the following is NOT a tracking log option in R81.x? * Full Log * Log * Detailed Log * Extended Log

Answer 323

Detailed Log

Question 324

What are two basic rules Check Point recommends for building an effective security policy? * Accept Rule and Drop Rule * Explicit Rule and Implied Rule * Cleanup Rule and Stealth Rule * NAT Rule and Reject Rule

Answer 324

Cleanup Rule and Stealth Rule

Question 325

In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories. Which of the following is NOT an objects category? * Network Object * IP Address * Limit * Custom Application / Site

Answer 325

IP Address

Question 326

What is the purpose of a Stealth Rule? * A rule that allows administrators to access SmartConsole from any device. * To drop any traffic destined for the firewall that is not otherwise explicitly allowed. * A rule at the end of your policy to drop any traffic that is not explicitly allowed. * A rule used to hide a server's IP address from the outside world.

Answer 326

To drop any traffic destined for the firewall that is not otherwise explicitly allowed.

Question 327

What is the main objective when using Application Control? * To see what users are doing. * Ensure security and privacy of information. * To filter out specific content. * To assist the firewall blade with handling traffic.

Answer 327

Ensure security and privacy of information.

Question 328

Which of the following is considered a “Subscription Blade”, requiring renewal every 1-3 years? * IPS blade * IPSEC VPN Blade * Firewall Blade * Identity Awareness Blade

Answer 328

Identity Awareness Blade

Question 329

Which of the following statements about Site-to-Site VPN Domain-based is NOT true? * Route-based- The Security Gateways will have a Virtual Tunnel Interface (VTI) for each VPN Tunnel with a peer VPN Gateway. The Routing Table can have routes to forward traffic to these VTIs. Any traffic routed through a VTI is automatically identified as VPN Traffic and is passed through the VPN Tunnel associated with the VTI. * Domain-based- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway. * Domain-based- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a host or network that can send or receive VPN traffic through a VPN Gateway. * Domain-based- VPN domains are pre-defined for all VPN Gateways. When the Security Gateway encounters traffic originating from one VPN Domain with the destination to a VPN Domain of another VPN Gateway, that traffic is identified as VPN traffic and is sent through the VPN Tunnel between the two Gateways.

Answer 329

Route-based- The Security Gateways will have a Virtual Tunnel Interface (VTI) for each VPN Tunnel with a peer VPN Gateway. The Routing Table can have routes to forward traffic to these VTIs. Any traffic routed through a VTI is automatically identified as VPN Traffic and is passed through the VPN Tunnel associated with the VTI.

Question 330

The VPN Link Selection will perform the following if the primary VPN link goes down? * The Firewall will send out the packet on all interfaces * The Firewall will inform the client that the tunnel is down * The Firewall can update the Link Selection entries to start using a different link for the same tunnel * The Firewall will drop the packets

Answer 330

The Firewall can update the Link Selection entries to start using a different link for the same tunnel

Question 331

Fill in the blanks: The _____ collects logs and sends them to the _____. * Log server; Security Gateway * Security Gateways; log server * Log server; security management server * Security management server; Security Gateway

Answer 331

Security Gateways; log server

Question 332

Fill in the blank: The position of an Implied rule is manipulated in the ________ window. * Firewall * Object Explorer * Global Properties * NAT

Answer 332

Global Properties

Question 333

Main Mode in iKEv1 uses how many packages for negotiation? * 3 * depends on the make of the peer gateway * 6 * 4

Answer 333

6

Question 334

Fill in the blanks: Gaia can be configured using the BLANK or BLANK. * GaiaUI; command line interface (serial console only) * Gaia Interface; Gaia Ultimate Shell * Command line interface; GAiA Portal * Web Ultimate Interface; Gaia Interface (SSH)

Answer 334

Command line interface; GAiA Portal

Question 335

Where is the "Hit Count" feature enabled or disabled in SmartConsole? * In Global Properties. * On each Security Gateway. * On the Policy layer. * On the Policy Package.

Answer 335

On the Policy layer.

Question 336

Check Point licenses come in two forms. What are those forms? * Security Gateway and Security Management. * On-premise and Public Cloud. * Central and Local. * Access Control and Threat Prevention.

Answer 336

Central and Local.

Question 337

Choose what BEST describes users on Gaia Platform. * There is one default user that can be deleted. * There are two default users and neither can be deleted. * There is only one default user that cannot be deleted. * There are two default users and one cannot be deleted.

Answer 337

There are two default users and neither can be deleted.

Question 338

Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use which operating system? * Gaia iOS * Red Hat Enterprise Linux version 4 * Centos Unix * Gaia embedded

Answer 338

Gaia iOS

Question 339

A security zone is a group of one or more network interfaces from different centrally managed gateways. What is considered part of the zone? * Security Zones are not supported by Check Point firewalls. * The firewall rule can be configured to include one or more subnets in a zone. * The zone is based on the network topology and determined according to where the interface leads to. * The local directly connected subnet defined by the subnet IP and subnet mask.

Answer 339

The zone is based on the network topology and determined according to where the interface leads to.

Question 340

What is the command used to activate Multi-Version Cluster mode? * set mvc on in Clish * set cluster member mvc on in Clish * set cluster mvc on in Expert Mode * set cluster MVC on in Expert Mode

Answer 340

set cluster member mvc on in Clish

Question 341

The Online Activation method is available for Check Point manufactured appliances. How does the administrator use the Online Activation method? * The cpinfo command must be run on the firewall with the switch -online-license-activation. * Using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts. * The SmartLicensing GUI tool must be launched from the SmartConsole for the Online Activation tool to start automatically. * No action is required if the firewall has internet access and a DNS server to resolve domain names.

Answer 341

Using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts.

Question 342

In a Distributed deployment, the Security Gateway and the Security Management software are installed on what platforms? * The installation can be done on virtual machines only, but not on appliances and not in mixed environments. * The installation is done on different computers or appliances. * The installation is done on the same computer or appliance. * The installation is allowed in Azure only but not in AWS cloud environments.

Answer 342

The installation is done on different computers or appliances.

Question 343

How many layers make up the TCP/IP model? * 6 * 4 * 7 * 2

Answer 343

4

Question 344

How many users can have read/write access in Gaia Operating System at one time? * one * two * three * infinite

Answer 344

infinite

Question 345

What is the main difference between Static NAT and Hide NAT? * Static NAT only allows outgoing connections. Hide NAT allows incoming and outgoing connections. * Hide NAT only allows incoming connections to protect your network. * Static NAT allow incoming and outgoing connections. Hide NAT only allows outgoing connections. * Static NAT only allows incoming connections to protect your network.

Answer 345

Static NAT allow incoming and outgoing connections. Hide NAT only allows outgoing connections.

Question 346

You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic? * Open SmartEvent to see why they are being blocked. * From SmartConsole, go to the Log & Monitor tab and filter for the IP address of the tablet. * Open SmartMonitor and connect remotely to the wireless controller. * Open SmartUpdate and review the logs tab.

Answer 346

From SmartConsole, go to the Log & Monitor tab and filter for the IP address of the tablet.

Question 347

Which encryption algorithm is the least secured? * 3DES * AES-128 * DES * AES-256

Answer 347

DES

Question 348

Fill in the blank: SmartConsole, SmartEvent GUI client, and `________` allow viewing of billions of consolidated logs and shows them as prioritized security events. * SmartMonitor * SmartReporter * SmartTracker * SmartView Web Application

Answer 348

SmartView Web Application

Question 349

Which of the following situations would not require a new license to be generated and installed? * The existing license expires. * The Security Gateway is upgraded. * The license is upgraded. * The IP address of the Security Management or Security Gateway has changed.

Answer 349

The Security Gateway is upgraded.

Question 350

Fill in the blank: In order to install a license, it must first be added to the `_____`. * Package repository * Download Center Web site * License and Contract repository * User Center

Answer 350

License and Contract repository

Question 351

What is required for a certificate-based VPN tunnel between two gateways with separate management systems? * Shared Secret Passwords * Unique Passwords * Shared User Certificates * Mutually Trusted Certificate Authorities

Answer 351

Mutually Trusted Certificate Authorities

Question 352

Which is a main component of the Check Point security management architecture? * Proxy Server * Endpoint VPN client * Identity Collector * SmartConsole

Answer 352

SmartConsole

Question 353

Why is a Central License the preferred and recommended method of licensing? * Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. * Central Licensing actually not supported with Gaia. * Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed. * Central Licensing is the only option when deploying Gaia.

Answer 353

Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.

Question 354

Fill in the blanks: The Application Layer Firewalls inspect traffic through the `________` layer(s) of the TCP/IP model and up to and including the `________` layer. * Upper; Application * Lower; Application * First two; Internet * First two; Transport

Answer 354

Lower; Application

Question 355

Which command shows detailed information about VPN tunnels? * cat $FWDIR/conf/vpn.conf * vpn tu tlist * vpn tu * cpview

Answer 355

vpn tu tlist

Question 356

The purpose of the Communication Initialization process is to establish a trust between the Security Management Server (SMS) to other Check Point Gateways and Servers. Which statement best describes this Secure Internal Communication (SIC)? * After successful initialization, the gateway can communicate with any Check Point node that possesses a SIC certificate signed by the same ICA. * New firewalls can easily establish the trust by using the expert password defined on the SMS and the SMS IP address. * A SIC certificate is automatically generated on the gateway because the gateway hosts a subordinate CA to the SMS ICA. * Secure Internal Communications authenticates the security gateway to the SMS before http communications are allowed.

Answer 356

After successful initialization, the gateway can communicate with any Check Point node that possesses a SIC certificate signed by the same ICA.

Question 357

Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address? * Formal * Central * Local * Corporate

Answer 357

Local

Question 358

Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance? * Logging and Status * Monitoring * Threat Emulation * Application Control

Answer 358

Monitoring

Question 359

You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic? * Open SmartEvent to see why they are being blocked. * From SmartConsole, go to the Log & Monitor tab and filter for the IP address of the tablet. * Open SmartMonitor and connect remotely to the wireless controller. * Open SmartUpdate and review the logs tab.

Answer 359

From SmartConsole, go to the Log & Monitor tab and filter for the IP address of the tablet.

Question 360

Fill in the blank: In order to install a license, it must first be added to the`_____`. * Package repository * Download Center Web site * License and Contract repository * User Center

Answer 360

License and Contract repository

Question 361

Both major kinds of NAT support Hide and Static NAT. However, one offers more flexibility. Which statement is true? * Manual NAT can offer more flexibility than Automatic NAT. * Dynamic NAT with Port Address Translation can offer more flexibility than Network Address Translation (NAT) Overloading. * Automatic NAT can offer more flexibility than Manual NAT. * Dynamic Network Address Translation (NAT) Overloading can offer more flexibility than Port Address Translation.

Answer 361

Manual NAT can offer more flexibility than Automatic NAT.

Question 362

Which of the following technologies extracts detailed information from packets and stores that information in different tables? * Application Layer Firewall * Packet Filtering * Next-Generation Firewall * Stateful Inspection

Answer 362

Stateful Inspection

Question 363

Of all the Check Point components in your network, which one changes most often and should be backed up most frequently? * Security Management Server * Security Gateway * SmartConsole * SmartManager

Answer 363

Security Management Server

Question 364

Application Control/URL filtering database library is known as: * AppWiki * Application-Forensic Database * Application Library * Application database

Answer 364

AppWiki

Question 365

Fill in the blanks: In `_______` NAT, Only the `________` is translated. * Hide; source * Simple; source * Static; source * Hide; destination

Answer 365

Hide; source

Question 366

What kind of NAT enables Source Port Address Translation by default? * Automatic Hide NAT * Automatic Static NAT * Manual Static NAT * Manual Hide NAT

Answer 366

Automatic Hide NAT

Question 367

Which of the following is NOT an authentication scheme used for accounts created through SmartConsole? * RADIUS * SecurID * Check Point password * Security questions

Answer 367

Security questions

Question 368

If there is an Accept Implied Policy set to “First”, what is the reason Jorge cannot see any logs? * Track log column is set to Log instead of Full Log. * Log Implied Rule was not selected on Global Properties. * Track log column is set to none. * Log Implied Rule was not set correctly on the track column on the rules base.

Answer 368

Log Implied Rule was not selected on Global Properties.

Question 369

What is required for a site-to-site VPN tunnel that does not use certificates? * Unique Passwords * Pre-Shared Secret * SecureID * RSA Token

Answer 369

Pre-Shared Secret

Question 370

In order to see real-time and historical graph views of Security Gateway statistics in SmartView Monitor, what feature needs to be enabled on the Security Gateway? * Monitoring Blade * SNMP * None - the data is available by default * Logging & Monitoring

Answer 370

Monitoring Blade

Question 371

What are the two deployment options available for a security gateway? * Bridge and Switch * Local and Remote * Cloud and Router * Standalone and Distributed

Answer 371

Standalone and Distributed

Question 372

One of major features in SmartConsole is concurrent administration. Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy? * AdminB sees a pencil icon next the rule that AdminB is currently editing. * AdminA, AdminB and AdminC are editing three different rules at the same time. * AdminA and AdminB are editing the same rule at the same time. * AdminC sees a lock icon which indicates that the rule is locked for editing by another administrator.

Answer 372

AdminA and AdminB are editing the same rule at the same time.

Question 373

A Check Point Software license consists of two components, the Software Blade and the Software Container. There are `_______` types of Software Containers: `__________` . * Two; Security Management and Endpoint Security * Three; Security Management, Security Gateway, and Endpoint Security * Three; Security Gateway, Endpoint Security, and Gateway Management * Two; Endpoint Security and Security Gateway

Answer 373

Three; Security Management, Security Gateway, and Endpoint Security

Question 374

Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made? * Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot. * Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes. * Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work. * Tom’s changes will be lost since he lost connectivity and he will have to start again.

Answer 374

Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work.

Question 375

Which software blade enables Access Control policies to accept, drop, or limit web site access based on user, group, and/or machine? * Data Awareness * Threat Emulation * Application Control * Identity Awareness

Answer 375

Identity Awareness

Question 376

DLP and Mobile Access Policy are examples of what type of Policy? * Shared Policies * Unified Policies * Inspection Policies * Standard Policies

Answer 376

Shared Policies

Question 377

Which of the following is NOT a valid application navigation tab in SmartConsole? * WEBUI & COMMAND LINE * SECURITY POLICIES * GATEWAYS & SERVERS * LOGS & MONITOR

Answer 377

WEBUI & COMMAND LINE

Question 378

When dealing with policy layers, what two layer types can be utilized? * Inbound Layers and Outbound Layers * Ordered Layers and Inline Layers * Structured Layers and Overlap Layers * R81.X does not support Layers

Answer 378

Ordered Layers and Inline Layers

Question 379

Which Check Point software blade provides protection from zero-day and undiscovered threats? * Threat Extraction * Threat Emulation * Firewall * Application Control

Answer 379

Threat Emulation

Question 380

Which of the completed statements is NOT true? The GAiA Portal (WebUI) can be used to manage Operating System user accounts and: * assign privileges to users. * assign user rights to the directory structure on the Security Management Server. * add more users to the Gaia operating system. * change the home directory of the user.

Answer 380

assign user rights to the directory structure on the Security Management Server.

Question 381

What are the two types of NAT supported by the Security Gateway? * Destination and Hide * Source and Destination * Static and Source * Hide and Static

Answer 381

Hide and Static

Question 382

When a Security Gateway communicates about its status to an IP address other than its own, which deployment option was chosen? * Targeted * Bridge Mode * Distributed * Standalone

Answer 382

Distributed

Question 383

A layer can support different combinations of blades. What are the supported blades: * Firewall, NAT, Content Awareness and Mobile Access * Firewall, URLF, Content Awareness and Mobile Access * Firewall (Network Access Control), Application & URL Filtering and Content Awareness * Firewall (Network Access Control), Application & URL Filtering, Content Awareness and Mobile Access

Answer 383

Firewall (Network Access Control), Application & URL Filtering, Content Awareness and Mobile Access

Question 384

Choose what BEST describes a Session. * Sessions ends when policy is pushed to the Security Gateway. * Sessions locks the policy package for editing. * Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out. * Starts when an Administrator publishes all the changes made on SmartConsole.

Answer 384

Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out.

Question 385

Using the SmartConsole, which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them? * Read Only All * Full Access * Editor * Super User

Answer 385

Read Only All

Question 386

Which one of the following is TRUE? * One policy can be either inline or ordered, but not both. * Inline layer can be defined as a rule action. * Ordered policy is a sub-policy within another policy. * Pre-R80 Gateways do not support ordered layers.

Answer 386

Inline layer can be defined as a rule action.

Question 387

Which of the following is used to initially create trust between a Gateway and Security Management Server? * One-time Password * Token * Certificate * Internal Certificate Authority

Answer 387

One-time Password

Question 388

Which of the following log queries would show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1? * 192.168.1.1 AND 172.26.1.1 AND drop * src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop * 192.168.1.1 OR 172.26.1.1 AND action:Drop * src:192.168.1.1 OR dst:172.26.1.1 AND action:Drop

Answer 388

src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop

Question 389

When configuring Anti-Spoofing, which tracking options can an Administrator select? * Log, Alert, None * Drop Packet, Alert, None * Log, Allow Packets, Email * Log, Send SNMP Trap, Email

Answer 389

Log, Alert, None

Question 390

Fill in the blanks: A `________` license requires an administrator to designate a gateway for attachment whereas a license is automatically attached to a Security Gateway. * Local; formal * Central; local * Formal; corporate * Local; central

Answer 390

Central; local

Question 391

What default layers are included when creating a new policy layer? * Application Control, URL Filtering and Threat Prevention * Firewall, Application Control and IPSec VPN * Firewall, Application Control and IPS * Access Control, Threat Prevention and HTTPS Inspection

Answer 391

Access Control, Threat Prevention and HTTPS Inspection

Question 392

What are the software components used by Autonomous Threat Prevention Profiles in R81.20 and higher? * Sandbox, ThreatCloud, Zero Phishing, Sanitization, C&C Protection, IPS, File and URL Reputation * IPS, Threat Emulation and Threat Extraction * Sandbox, ThreatCloud, Sanitization, C&C Protection, IPS * IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction

Answer 392

Sandbox, ThreatCloud, Zero Phishing, Sanitization, C&C Protection, IPS, File and URL Reputation

Question 393

How do logs change when the "Accounting" tracking option is enabled on a traffic rule? * Involved traffic logs are updated every 10 minutes to show how much data has passed on the connection. * Involved traffic logs will be forwarded to a log server. * Provides additional information to the connected user. * Provides log details view email to the Administrator.

Answer 393

Involved traffic logs are updated every 10 minutes to show how much data has passed on the connection.

Question 394

You have enabled “Extended Log” as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason? * Log Trimming is enabled. * Content Awareness is not enabled. * Logging has disk space issues. * Identity Awareness is not enabled.

Answer 394

Content Awareness is not enabled.

Question 395

When URL Filtering is set, what identifying data gets sent to the Check Point Online Web Service? * The full URL, including page data, is sent to the Check Point Online Web Service. * The URL and IP address are sent to the Check Point Online Web Service. * The host part of the URL is sent to the Check Point Online Web Service. * The URL and server certificate are sent to the Check Point Online Web Service.

Answer 395

The host part of the URL is sent to the Check Point Online Web Service.

Question 396

In large organizations where there are a number of managed Check Point firewalls that generate a lot of logs it is recommended to install the Log Server on a dedicated computer. Which statement is FALSE? * The dedicated Log Server must be the same version as the Security Management Server. * A Log Server has a SIC certificate which allows secure communication with the SMS and Security Gateways. * More than one Log Server can be installed. * A dedicated SmartEvent server is required for a separate Log Server to be deployed in the SmartEvent server.

Answer 396

A dedicated SmartEvent server is required for a separate Log Server to be deployed in the SmartEvent server.

Question 397

Which option in tracking allows you to see the amount of data passed in the connection? * Advanced * Accounting * Data * Logs

Answer 397

Accounting

Question 398

What are valid authentication methods for mutual authenticating the VPN gateways? * Pre-shared Secret and PKI Certificates * PKI Certificates and Kerberos Tickets * Pre-Shared Secrets and Kerberos Ticket * PKI Certificates and DynamicID OTP

Answer 398

Pre-shared Secret and PKI Certificates

Question 399

What licensing feature automatically verifies current licenses and activates new licenses added to the License and Contracts repository? * Automatic Licensing and Verification tool * Verification licensing * Verification tool * Automatic licensing

Answer 399

Automatic licensing