Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Check Point > CCCS > Flashcards

CCCS Flashcards

1
Q

Meaning SDDC

A

Software defined datacenter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Meaning CSP

A

Cloud Service Provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

SDN Benefits

A

Deliver and share system resources quickly and efficiently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

3 layers of SDN framework

A

Control Layer
Infrastructure Layer
Application Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How does Control Layer of the SDN operate

A

SDN operations using OpenFlow protocol to connect supported devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is contained within Infrastructure Layer SDN

A

Represents physical components e.g. switches and routers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does the Application Layer of an SDN provide

A

Open areas to develop end-user apps and services. It also includes configuration, management, monitoring, t-shooting, policies and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Conventional Network V SDN Architecture

A

Control plane and data plane fused; therefore limits capacity of virtualizing network resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What role API play SDN

A

API’s are send to send and receive requests to resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How is SDN routing differ from conventional

A

direct software programming of routing instead of relying routing protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Three Types of Cloud Deployment

A
  1. Public
  2. Private
  3. Hybrid
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Three Cloud Service Model

A

Infrastructure-as-a-Service (IaaS)
Platform-as-a-Service (PaaS)
Software-as-a-Service (SaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the features Infrastructure-as-a-Service (IaaS)

A

IaaS solutions host data center infrastructure and help customize design of their SDNs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What features Platform-as-a-Service (PaaS)

A

PaaS provides organizations with virtual resources that support developing software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What features Software-as-a-Service (SaaS)

A

SaaS refers to a cloud service that delivers applications to an organization’s end users through a web browser.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is AWS network called

A

VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Azure network called

A

vNet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is GCP network called

A

VPC Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is AWS access to the internet called

A

Internet Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Azure internet called

A

Public IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is GCP access to the internet called

A

Internet Gateway Route

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is AWS autoscaling called

A

AutoScaling Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Azure autoscaling called

A

Virtual Machine scale sets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is GCP autoscaling called

A

Instance groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the basis for AWS access control

A

Security groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the basis for Azure access control

A

Network security group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the basis for GCP access control

A

Firewall rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is AWS automation called

A

Cloud Formation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is Azure automation called

A

Cloud Deployment Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are advantages of cloud

A
  1. Flexible
  2. Efficiency
    3, Accessibility
  3. Savings
  4. Innovation
  5. Opportunities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a limitation of CSP Native Security Controls

A

Lacking and generally only cover the infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What direction are attacks not often protected from

A

Lateral Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Why are traditional network attacks more abundant in the cloud.

A

rapidly changing workloads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Four Cloudguard offerings for private and public cloud

A

IaaS for Public Cloud
IaaS for Private Cloud
SaaS
Dome9

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the difference between Public and Private CloudGuard IaaS

A

Public (AWS) v Private Vendors (ESXi)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What type of applications CloudGuard SaaS protect

A

Email and other SaaS based apps (dropbox..Etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What type of Cloudguard provides security posture management and compliance.

A

CloudGuard Dome9

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What characteristics best define CloudGuard

A

Centralized Management
Cloud Diversity
Dev Ops Ready
Adaptive and Automatic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What do security layers in policy provide

A

Granular control and access delegation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are the primary components of SMS

A
  1. SmartConsole
  2. Management Server
  3. SmartEvent (optional)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does the Cloud GuardController do?

A

provides visibility and allows for automation and adaptive secuirty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What do CloudGuard IaaS security Gateways provide

A

perimeter and east-west traffic protection in public / private cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

In Cloudguard what functionality does the identity awareness blade provide.

A

Allows security policy to be defined by cloud resources collected by the CloudGuard controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Elastic licensing

A

Licensing that provides quick provisioning of assets using cores licensed to deployed gateways.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

The shared security model requires consumers to provide what 2 items.

A

Data Security

Network access security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

CloudGuard IaaS defends cloud resources via

A

firewall
data security
advanced threat prevention
forensic analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What are the five underlying security principles of secure public cloud

A 
Security with Advanced Threat Prevention
Network Segmentation
Agility
Automation. Efficiency, and Elasticity 
Borderless
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What are the three layers of network segmentation within the CloudGuard solution.

A
  1. The first layer applies a Security Gateway that enforces firewall policies to accept legitimate network traffic flows and deny unauthorized network traffic.
  2. The second layer uses advanced Threat Prevention Software Blades to extend the Security Gateway’s traffic inspection by identifying and blocking malicious behavior within east-west traffic flows.
  3. The third layer advances security with micro-segmentation to allow a clear separation of networks and different operating concerns associated with Development. Operations, and IT teams.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Define micro-segmentation

A

Micro-segmentation creates boundaries by placing inspection points between different applications, sendees, senders, and single hosts within the same network segment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Why use hub and spoke for Cloud Blueprint

A

All traffic that enters and exits each spoke must travel through a hub. Spokes use network segmentation to clearly separate SDNs from one another and isolate their workloads. This allows differing ownership in the spoke while controlling security in the hubs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is a hub in a secure public cloud blueprint layout

A

Hubs operate as software defined data centers that use Security Gateways in combination with network traffic load balancers to protect the cloud’s perimeter according to its current scale. Each hub manages and delivers traffic to the spoke networks. Individual hubs communicate with one another through the SDN’s routing switches.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What type of traffic does the northbound hub protect

A

The Northbound hub serves as the front end of the SDDC that permits inbound web communications such as HTTP traffic from the Internet to reach spoke SDNs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What components commonly in northbound hub

A

Public IP
External Load Balancers
Security Gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Does any inbound traffic not go through northbound hub

A

Non-transitive traffic, done through peering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What does southbound hub do

A

outbound transit traffic from the spokes
communication applications
software updates
VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What do you use to avoid double NAT in a Azure Southbound peering

A

UDR (User defined routes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

How do you route transit transit traffic without a UDR in AWS & GCP

A

VPN’s, leveraging VTI (VPN tunnel Interface) and BGP

OSPF cannot be used layer 2, which does not exist cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Checkpoint HA CSP Hub Limitations

A

two Security Gateway members
AWS and Azure require Security Gateways to reside in the same location in a region
SDNs do not allow HA with state synchronization failover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Which hub (north or South) allows automatic HA deployment

A

Northbound

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What components are commonly found southbound hub to support SDDC connectivity

A

Load Balancers

VPN Gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

At a minimum what components should be present in a secure public cloud blueprint

A

SMS
one or two hubs with security gateways (IaaS)
Peering connection between spokes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Following the Secure Cloud Blueprint what is the Azure recommended config

A
  1. Northbound Hub - Supports incoming public facing Internet traffic.
  2. Southbound Hub - Manages outbound access to Internet and VPN connections to corporate on-premise locations
  3. Spoke - Represents segmented SDNs with different resources, security, and access levels (IPSEC + BGP)
  4. CloudGuard Auto Scaling - Protects the Northbound hub entrance with an elastic set of automated Security Gateway deployments.
  5. Spoke - Represents segmented SDNs with different resources, security, and access levels.
    (See document for diagram for more specifics)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Moving applications or services in an SDDC significantly improves what?

A

Less time

Resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

in a public cloud what are two ways of IaaS Security gateway deployment.

A

Standalone=Combined security gateway and management

distributed= seperate vm for gateway and management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Why might it be preferred to deploy SMS not in the cloud, but on prem

A

Can then manage on prem gateways as well as cloud instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

SDDN cluster limitations

A
  1. Cluster installations support High Availability mode only. This cluster configuration excludes ClusterXL load sharing or the Virtual Router Redundancy Protocol (VRRP)
  2. Security Gateways with HA configurations must communicate with the SDDC to achieve failover with the secondary Security Gateway member. The failover process requires extra time to complete since the Security Gateways must communicate with the SDDC first.
  3. Clusters must include a maximum of two members.
  4. Avoid deploying management servers and cluster members in a stand alone configuration.
  5. Both cluster members must reside in the same region and location.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Three ways you can deploy CloudGuard IaaS

A
  1. CSP Portal - Provides access to create, view, and manage CloudGuard resources.
  2. PowerShell - Uses predefined CloudGuard IaaS Security Gateway templates for automated deployments.
  3. Command Line Interface (CLI) - Launches CloudGuard Security Gateways with command line scripts.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Understanding CSP resources “Geographic Region”

A

AWS uses Availability Zones
Azure refers to them as Locations
GCP describes them as Zones

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Understanding CSP resources “Network”

A

Make sure correct network association

New cloudguard IaaS will be needed to protect each network segment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Understanding CSP resources “Subnets”

A

only contains itself and no other VM’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Understanding CSP resources “Public IP”

A

Public IP: Ensure static IP for external

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Understanding CSP resources “Private IP”

A

Private IP: Internal resource connectivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Understanding CSP resources “Load Balancers”

A
  1. In the cloud’s inbound perimeter, external load balancers direct Internet traffic to spoke networks with an inbound NAT configuration.
  2. Within spoke networks, internal load balancers distribute traffic loads between servers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Understanding CSP resources “Security Group”

A
  1. protects inbound and outbound traffic access to virtual machines.
  2. VMs in the same subnet receive coverage from different Security Groups
  3. VMs do not receive a Security Group assignment during their deployment, the CSP assigns a default Security Group to them.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Understanding CSP resources “Tags”

A

CSPs use tags (labels) to attach identifying information to cloud resources
CloudGuard Controller uses tags to discover new. automated CloudGuard IaaS Security Gateway deployments to include in the Security Policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Understanding CSP resources “Identity and Access Management”

A

Identity and Access Management (IAM) credential represents a user or application that needs to contact the SDDC to cany out an operation.
Activating IAM permission on CloudGuard IaaS required add client-id during VM deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What to check when deplying CloudGuard IaaS

A

Tags - Review each VM to confirm it reflects the correct tag associations.
IAM - Verify each CloudGuard IaaS deployment contains the relevant IAM client-id and client-secret credentials.
Networks and Subnets - Examine each CloudGuard deployment and validate that it maps to the correct SDN and subnet.
Installation Time - Wait for the deployment process to finish completely before proceeding with the next phase of configuring security protections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Some CSP related issues when deploying IaaS

A

AWS - Register software subscription agreements before deploying CloudGuard IaaS VMs or the CSP will roll back the deployment.
Azure - CloudGuard IaaS deployments require approximately fifteen minutes to finish.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What are the five management tools in CloudGuard IaaS to create and manage policy

A
  1. Gaia Portal
  2. Smartconsole
  3. CLI
  4. Security Objects
  5. Rule base
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What is Gaia Portal

A

Functions as the primary web user interface for the Gaia OS platform. Through this portal, Security Administrators may configure the SMS and Security Gateway properties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What is SmartConsole

A

Acts as a GUI that configures and enforces the Security Policies that protect the environment)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What are Security Objects

A

Represent all the network components such as Security Gateways, web servers, networks, and services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

What is CLI

A

Provides the interface that activates commands to configure the operation of the CloudGuard IaaS security solution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What is Rule Base

A

Establishes a set of rules that define and protect the SDDC’s perimeter and connections to SDNs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What are to types of policy approaches used in Check Point Policy

A
  1. Ordered

2. Inline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

What is Ordered Policy

A

Performs one or more security actions to the rule base in a top-down order against every layer of the Security Policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What is Inline Policy

A

Optimizes the rule matching process by reusing the same security layer in the same policy or in multiple policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

CloudGuard IaaS security policy combines what two policy types

A
  1. Traditional Security Policy

2. Context Aware / Adaptive Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What does an adaptive security policy provide

A
  1. This policy format broadens the scope of network security by protecting resources created from one or more CSPs.
  2. application owners gain control of their application deployments since they can add and remove resources without impacting security.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Which cloud defined objects assist in security policy creation

A
  1. Data Center Objects

2. Tags

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

What can an imported data center object contain

A

subnets,
hosts,
tags
entire cloud data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What options are available when importing data center objects

A

Region View - Imports SDNs, subnets, and VMs as security objects by region.
Tags View - Identifies all VM resources with a specific tag key or tag value.
Search View - Uses a search field to locate a specific cloud resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What are some guidelines when creating tags

A

AWS allows only one data center per region to use a specific tag.
Azure and GCP associate tags with one data center per CSP subscription.
All CSPs permit assigning multiple tags to a single virtual machine

94
Q

What components are required automated security policy

A

SMS
CloudGuard Controller
Security Gateway

95
Q

What is the one thing that all gateways require to make API calls to SDDC

A

IAM private key registration

96
Q

Where do you activate cloud guard controller to communicate via API calls to the SDDC

A

SMS

97
Q

What does the SMS require to enforce policy on gateway

A

SIC

98
Q

What component of CloudGuard scans the environment for changes in cloud resources.

A

CloudGuard Controller

99
Q

What happens when CloudGuard Controller detects a new or modified object

A

New=create a new DC object

Modified=updates IA and then object configuration and then updates policy

100
Q

How many phases in the cloudguard workflow.

A

2

101
Q

What are the steps in phase 1

A
  1. Connect to the Cloud - Requires the Security Gateway to authenticate with the cloud environment with an IAM registration.
  2. Retrieve Cloud Resources - Imports cloud resources from Data Center A and stores them inside the CloudGuard Data Center server’s repository. After each scan, the system compares cloud objects m Data Center A against the Data Center objects stored m the Data Center Repository to synchronize any changes to the Security Policy.
102
Q

What are the steps in phase 2

A
  1. Import Data Center Object - Add the Data Center object or its tag into a rule.
  2. Manual Security Policy Installation - Converts Data Center objects into an Identity Awareness Access Role, which authorizes the Security Gateway to receive dynamic updates any time the Data Center object’s configuration changes.
  3. Automated Access Role Updates - Uses the CloudGuard Enforcer to deliver Access Rol updates from the SMS to the Security Gateway.
103
Q

What must gateways maintain with SMS to receive automated security policy updates

A

SIC

104
Q

How do you check the state of the CloudGuard process

A

go to the CLI of the SMS and execute cloudguard on

105
Q

How do you verify connectivity between SMS and SDDC

A

Open data center object in the SMS and select test configuration button

106
Q

What log is used for t-shooting CloudGuard Controller

A

Cloud_proxy.elg

107
Q

What type of traffic needs to be allowed between SDDC and security gateway

A

http
VPN connections
HIgh availability sync
SDDC traffic

108
Q

What does the forward proxy provide in traffic management

A

converts web traffic going from spoke to internet 8080 to 80 so can be delivered northbound hub

109
Q

Does each security gateway require a VPN domain for connectivity

A

yes

110
Q

What type of VPN domain configuration is required to communicate SDN

A

Star

111
Q

What is the required setting for high availability gateway sync

A

Eth0 & Eth1 must have Sync as their type (may need to be changed depending on CSP mods)

112
Q

Does the CSP or the gateway provide anti-spoofing

A

The CSP, if not disabled on gateway may reject load balancer traffic

113
Q

What setting is required to ensure the original IP address information

A

Gateways X-forward setting (CSP does not hide the source IP of internet traffic behind load balancers

114
Q

Describe the components that CloudGuard IaaS uses to develop a Security Policy.

A
  • Gaia Portal - Functions as the primary web interface for the Gaia OS platform. This tool configures SMS and Security Gateway properties
  • Smart Console -Acts as a GUI that configures and enforces the Securityt Policies that protect the environment
  • Security Objects - Represent all the network components in the cloud environment such as Security Gateways, web sewers, networks, and sendees
  • CLI - Provides the interface that activates commands to configure the operation of the CloudGuard IaaS security solution
  • Rule Base - Establishes a set of rules that define and protect the SDDC’s perimeter and connections to SDNs
115
Q

Discuss the phases of the CloudGuard Controller workflow process to import and secure cloud Data Center objects.

A

Phase I:
The Security Gateway must establish a secure connection to the cloud with an IAM registration.
Then the CloudGuard Controller scans the cloud and pulls Data Center objects from the data center and stores them inside the Data Center Repository. The Controller continues to scans the environment to fmd changes to Data Center objects. When the system finds a modified Data Center object, it updates the Security Policy with the changes.
Phase 11: Incorporates Data Center object changes into the Security Policy:
First, import the Data Center object or its tag into a rule.
Next, manually install the Security Policy so the object converts into an Identity Awareness Access Role that the Security Gateway can monitor and update any time the Data Center object changes.
After, the manual Security Policy installation, the CloudGuard Enforcer automates the deiner of Access Role updates from the SMS to the Security Gateway.

116
Q

Discuss the traffic management settings that Security Gateways to accept traffic from the cloud.

A

The Forward Proxy setting allows the Security Gateway to transfer outgoing proxy traffic out of a spoke to reach the Internet.
Security Gateways require a VPN domain configuration to connect with SNDs in the SDDC. The VPN domain requires a star configuration that accepts center-to-satellite connections
High Availabililty Security Gateway cluster members require their ethO and ethl interfaces to include the Sync network type setting.
Security Gateways must include a configuration that disables Anti-Spoofing to accept legitimate traffic from load balancers.
The X-Forwarding setting allows Security Administrators to see original packet’s IP address information.

117
Q

Describe the two advantages of deploying resources in the cloud.

A
  1. Creating new deployments or transferring resources to another SDN requires less time.
  2. Issuing new applications instead of deploying hardware streamlines deployment processes and involves fewer resources.
118
Q

Identify the limitations associated with deploying a CloudGuard Security Gateway cluster.

A

Cluster installations support High Availability mode only.
The failover process requires extra time to complete since the Security Gateways must communicate with the SDDC first.
Clusters must include a maximum of two members.
Avoid deploying management servers and cluster members in a stand alone configuration. Both cluster members must reside in the same region and location.

119
Q

Discuss which network setting misconfigurations impact the success of CloudGuard deployments.

A

Missing tags prevent VMs from reflecting the correct network associations.
VMs without 1AM user credentials cannot communicate with the SDDC.

120
Q

Describe the elements of the CloudGuard architecture

A

Security Management Platform - includes a Management server core, SmartConsole, GUI, and SmartEvent to perform security operations and reporting functions

CloudGuard Controller - a sub-component of the Security Management Server that gathers cloud resources to define Security Policy with an identity-based context.

Security Gateway Protections - Virtual Machines that operate in the cloud to protect its perimeter, secure east-west traffic, and establish l^PNs to securely connect SDNs with onpremises networks.

Next Generation Threat Prevention - Inspects cloud applications and virtual resources for malicious threat activity.

Identity Awareness - Monitors and logs traffic based on the identity of cloud resources.

Elastic Licensing - Uses a central license pool to add/remove licenses to Security Gateway deployments.

121
Q

Discuss the components of the Secure Public Cloud Blueprint.

A

Hubs - Operate as Software Defined Data Centers that permit inbound/outbound web traffic into the perimeter of the data center. Northbound hubs include public IP addresses, external load balancers, and automated CloudGuard IaaS Security Gateways. Southbound hubs manage outbound Internet traffic and transit traffic connections between the SDDC and on-premise networks.

Spokes - Function as isolated environments for applications and services. Spokes allow internal access and/or public access to their contents.

Network Connections - Peering connects SDNs directly without going through hubs to reach spoke networks.

122
Q

Identify the minimum system requirements of a secure public cloud.

A

A secure public cloud should include a Security Management Server that resides in the SDDC or in an on-premise location. The environment should also contain one or two hubs with CloudGuard IaaS Security Gateways, and Peering connections between spoke networks.

123
Q

Discuss the advantages of cloud network architecture?

A

Enables direct programming of the network configuration to improve network performance and monitoring.

Uses a centralized management layer to deliver faster performance than conventional networks.

Allows virtualization of network resources to process at faster speeds and dynamically respond to network loads.

124
Q

Describe the cloud service models and their benefits

A

laaS - Hosts an infrastructure to create custom SDNs and store data. This service model meets the requirements of network architects.

PaaS - Build software applications, web servers, and databases in an SDN managed by CSP. 77iis service model also provides organizations with needs to develop, test, and deploy their applications.

SaaS - Delivers applications for end-users to consume through a web browser. CSPs manage and host data for the application and the OS. This service model reduces operating expenses and IT resources to deploy SaaS.

125
Q

Which SDN components provide advantages to cloud networking in comparison to traditional networking.

A

The SDN controller centralizes management of SDN operations.

Programmable routing switches deliver network traffic in the most optimal, efficient route possible.

The Application layer provides automation capabilities for network functions and services.

126
Q

Describe the CSP resources that support automation.

A

REST APIs support the interactions between cloud resources, on-premise equipment, scripts, orchestration playbooks, and CloudGuard IaaS.

CLIs carries out repetitive tasks, communicates with the SDN’s OS, and perform scripts that automate processes.

Scripts represent written programs that automate the execution of operational tasks.

PowerShell operates as an open source platform with a command line shell and a scripting language that can access services in the OS to automate tasks.

Templates use text files to generate scripts to create automated deployments.

127
Q

Describe the orchestration playbook process for creating a new spoke and an automated Security Gateway.

A

An event trigger initiates an orchestration playbook.

The playbook launches a template to deploy an automated resource and configure its application software.

To protect the new resource, the playbook deploys a Security Gateway.

The Security Gateway receives a new inline Security Policy to protect the spoke.

128
Q

What is the primary difference between vertical and horizontal autoscaling?

A

Vertical scaling requires a virtual machine to completely shut down while system resources move to a different size machine.

Horizontal scaling achieves the transfer of resources to a different VAS automatically without the need to power down the VM

129
Q

Identify the process CloudGuard Dome9 uses to integrate with cloud accounts.

A

Dome9 requires LAM account credentials to connect to public cloud accounts through REST APIs. Once connected it gathers cloud configuration data to deploy protections.

130
Q

Describe the CloudGuard Dome9 mechanisms that administer automated compliance remediation’s.

A

Automated software applications known as CloudBots address non-compliance issues. CloudBots operate in the cloud account to perform remediations such as quarantining or germinating cloud instances. Automatic remediation may apply to a single cloud account or several cloud accounts at one time.

131
Q

Discuss the module that uses cloud data analytics to provide an overview of the cloud account’s security status.

A

Magellan operates as an intelligent threat prevention technology and an investigative tool that examines and gathers information about cloud activity. This module gathers cloud inventory, cloud configurations, system monitoring, and intelligence. Security Administrators may use this information to streamline Network Security operations, reduce the lead time for threat detection, and detect abnormal use of cloud resources.

132
Q

The Cloud Blueprint Provides

A

Automating or auto-provisioning Security Gateway deployments follows a predefined repeated, consistent deployment process to adapt to the environment’s capacity.

133
Q

Which hub provides the ability for automating Cloud deployment

A

Northbound

134
Q

Auto deployment follows these steps

A
  1. An event trigger or a set of triggers monitors the traffic volume and responds when traffic increases.
  2. When (the Security Gateway capacity reaches a defined threshold, the event trigger initiates deploying a new automated Security Gateway.
  3. The new Security Gateway operates in a High Availability mode after it receives a Security Policy to enforce.
135
Q

What CSP automation tools are used to provide automated deployment

A
  1. API
  2. CLI
  3. Scipts
  4. Powershell
  5. Templates
136
Q

API

A

Public clouds and Hybrid clouds use Representational State Transfer (REST) APIs to support the interactions between cloud resources, on-premise equipment, scripts, orchestration playbooks.

137
Q

What operations are done via API with CloudGuard IaaS

A
  • Automate creating and deleting policy objects
  • Access Roles, VPN domains, and session management
  • Build, publish, and install Access Control and Threat Prevention Security Policies
  • Contact the SDDC
  • Authorize the identity of Data Center objects
138
Q

What does CLI allow

A

efficient tool for carrying out repetitive tasks in an automated manner.

139
Q

What functions of CLI does the SMS server leverage

A
  • Process scripting commarjds
  • Transfer data between SDNs
  • Manage day-to-day troubleshooting
  • Examine configuration and operational issues
140
Q

What are scriptsand how is it used

A

Scripts represent written programs that send instructions to APIs in order to automate the execution of operational tasks. CloudGuard uses JavaScript Object Notation (JSON), a language independent script, to develop templates that automate Security Gateway deployments.

141
Q

What is powershell and how is it used

A

PowerShell operates as an open source platform tool that includes a command line shell and a scripting language. The command line shell provides access to services within the OS for the purpose of automating tasks. Each CSP provides their own PowerShell tool to develop automation scripts.

142
Q

What are templates and how is it used

A
  • Templates represent text files with JSON scripts that automate cloud deployments.
  • CloudGuard IaaS deployment templates support SMS and Security Gateway configurations
  • An infrastructure deployment service in a CSP Portal creates and manages automated deployment templates
143
Q

What is the name of each CSP Template resource

A

AWS :CloudFormation
Azure: Resource Manager
Google Clouds: Deployment Manager

144
Q

What component is essential in SDDC to automation.

A

APIs as they have an orchestration layer

145
Q

What initiates a playbook for automation

A

event trigger

146
Q

A common orchestration platform that has a checkpoint module

A

Ansible

147
Q

What is autoscaling

A

Autoscaling deploys identical VMs, and other resources such as Security Gateways, as a single group

148
Q

What tools does autoscaling leverage within the CSP

A
  1. CSP Portal
  2. CLI
  3. Powershell
149
Q

Does autoscaling require pre-provisioning

A

No

150
Q

What determine the scale of the automated deployements

A

Rules

151
Q

Common event triggers

A
  1. performance metrics
  2. Application resources
  3. Time schedules
152
Q

What are two types of autoscaling

A
  1. Vertical

2. Horizontal

153
Q

Characteristics of vertical scaling

A
  1. Tune env up and down (e.g. smaller to bigger VM)

2. Requires shutdown of resources

154
Q

Characteristics of horizontal scaling

A
  1. adds or removes resources

2. no system shutdown

155
Q

Which autoscaling method is recommended by Check Point Secure Cloud Blueprint

A

Horizontal

156
Q

api status

A

Performs a system check of the API status.

157
Q

api restart

A

Restarts the API

158
Q

api reconf

A

Reconfigures the API instead of restarting it.

159
Q

service autoprovision test

A

Checks the connectivity of auto- provisioned resources and identifies auto-provisioning issues.

160
Q

tail -f$FWDIR/log/autoprovision.elg

A

Reveals any issues that occur during the autoprovision process.

161
Q

‘tail -f $FWDIR/log/api.

A

Investigates system issues with API calls

162
Q

Important log files to debug

A 
/var/log/doiid-user-data 
/varlog/ ftwinstall. log 
SFWDIR/log'autopro vision. elg * files 
SFWDIR/conf/autoprovision j son file
/opt'CPsuite-RSO/fw 1 /scripts/monitor.py
163
Q

Describe the CSP resources that support automation

A
  1. REST APIs support the interactions between cloud resources, on-premise equipment, scripts, orchestration playbooks, and CloudGuard IaaS.
  2. CLI carries out repetitive tasks, communicates with the SDN’s OS, and perform scripts that automate processes.
  3. Scripts represent written programs that automate the execution of operational tasks.
  4. PowerShell operates as an open source platform with a command line shell and a scripting language that can access services in the OS to automate tasks.
164
Q

Describe the orchestration playbook process for creating a new spoke and an automated Security Gateway.

A
  1. An event trigger initiates an orchestration playbook.
  2. The playbook launches a template to deploy an automated resource and configure its application software.
  3. To protect the new resource, the playbook deploys a Security Gateway.
  4. The Security Gateway> receives a new> inline Security Policy to protect the spoke.
165
Q

What is the primary difference between vertical and horizontal autoscaling?

A
  1. Vertical scaling requires a virtual machine to completely shut down while system resources move to a different size machine.
  2. Horizontal scaling achieves the transfer of resources to a different VÙT automatically without the need to power down the VM.
166
Q

CloudGuard Dome9 capabilities

A
  • Detect and remediate cloud native security misconfigurations
  • Protect against identity theft and data loss prevention
  • Visualize and assess the security posture of hybrid clouds
  • Enforce compliance standards across multi-cloud environments
167
Q

CloudGuard Dome9 serves organizations that support following characteristics:

A
  • Environments that support an integrated DevOps culture
  • Public clouds for Development and Testing operations
  • Organizations using IaaS public clouds such as AWS, Azure, and GCP
  • Data centers with cloud-based production systems
168
Q

Dome9 uses what to connect, communicate, and collect information from cloud accounts and third party tools.

A

APIs

169
Q

CloudGuard Dome9 consists of what modules

A
  • Cloud Inventory
  • Network Security
  • Compliance and Governance
  • IAM Safety
  • Magellan
170
Q

What does the Cloud Inventory module provide.

A

Automates collecting inventory data from cloud environments.

171
Q

What does the Network Security module provide.

A

Provides a real-time regional topology map of cloud networks.

172
Q

What does the Compliance and Governance module provide.

A

Verifies compliance against industry standards.

173
Q

What does the IAM Safety module provide.

A

Granularly controls IAM users, roles, and actions

174
Q

Magellan

A

Analyzes cloud traffic and audits security events to provide an overview of the cloud’s security status.

175
Q

What allows CloudGuard Dome 9 to connect to the CSP’s

A

IAM credentials

176
Q

What fundamental operations do rest Rest APIs provide in Dome9

A
  1. system notifications
  2. detect new cloud resources
  3. deliver threat intelligence feeds
  4. Enforce compliance policies
  5. Apply security enhancements to the environment
177
Q

What procedures do Rest APIs perform

A
  • Manage locking and unlocking cloud-based Security Groups and regions
  • Create time-sensitive, on-demand dynamic access leases to services and ports
  • Run the compliance engine and Security Policy groups
  • Remediate non-compliant cloud resources with Cloudbots
178
Q

Is CloudGuard Dome 9 install an agent

A

No, it is agentless

179
Q

Does CloudGuard Dome 9 set a default security posture after install

A

yes

180
Q

What authentication method does CloudGuard Dome 9 support for administration

A
  1. Username and Password
  2. SSO
  3. 2-Factor
181
Q

What are the role designation in CloudGuard Dome 9

A
  • Super User - Accesses and manages account resources, creates new users, and modifies other user’s privileges.
  • Account Owner - Retains Super User privileges and manages CloudGuard Dome9 account related issues such as billing and subscription plans.
  • Normal User - Assigns privileges to manage account access, create new servers, or issue Security Groups.
182
Q

Which 2 role definitions can grant user permissions actions in CloudGuard Dome 9

A
  1. Super Users

2. Account Owners

183
Q

What are the permission typed provided by CloudGuard Dome 9

A
  • Dynamic Access - Issue dynamic access leases to cloud accounts.
  • Create - Generate Dome9 agents on hosts using legacy software versions.
  • Manage - Create, change, or remove Dome9 account assets.
  • View - Access all system resources with read-only privileges.
184
Q

Two rule base bundles in CloudGuard Dome 9

A
  • Best Practices Bundle - Contains all CloudGuard Dome9 rules.
  • Network Security Bundle - Includes all port based rules and Network Security rules.
185
Q

What is GSL, and what does it provide

A

Governance Specific Language (GSL), GSL provides a simple, but expressive language that defines configurations and network traffic flows.

Format: should < Condition
Ex. [key=’owner].

186
Q

What feature of CloudGuard Dome 9 allows administrators to test policy without any damaging effects

A

CloudGuard Dome 9 Playground

187
Q

Does CloudGuard Dome 9 provide an audit trail of access and actions

A

Yes

188
Q

Where does a CloudGuard Dome 9 administrator manage cloud accounts and access

A

Cloud Inventory module

189
Q

What operations does Cloud Inventory module perform

A
  • Search for Cloud Accounts
  • Review the security posture of cloud accounts)
  • Apply uniform changes to the environment
  • Respond to cloud account permissions behaviors
190
Q

During CloudGuard Dome 9 acquisition in AWS, Azure, or GCP what are three operational roles you can assign, and what do they allow

A
  • Read Only - Monitors and visualizes cloud accounts through CloudGuard Dome9.
  • Full Protection - Enforces access to cloud accounts and reverts system changes to cloud assets or Security Groups
  • Region Lock - Adds new Security Groups with Full Protection mode, which deletes all inbound ‘outbound Security Policy rules to the group.
191
Q

What activities does the network security cloud module perform

A
  • Visualizes Security Policies in cloud environments
  • Manages Network Security Groups
  • Controls access to protected cloud assets with short-term dynamic access leases
192
Q

What does Clarity in CloudGuard Dome 9 provide to the administrator

A

Clarity displays the security posture of public clouds, which represents the cloud’s overall cyber security strength.

193
Q

What are the two layers of visibility provided by Clarity CloudGuard Dome9

A
  1. contains a regional overview of the public clouds. This layer uses a topology map view to define each cloud’s relationship to one another.
  2. includes a Security Group view that maps cloud resources and services into security zones. Cloud resources and services reside in different Security Groups based on their level of exposure to the external world.
194
Q

What CloudGuard Dome9 module provide a place to adjust security precautions and explains the effect of the changes

A

Network Security Module

195
Q

What CloudGuard Dome9 module provides predefined reports about compliance and security

A

Compliance and Governance Module

196
Q

What are the steps in the compliance workflow

A
  1. Initial Assessment
  2. Review Results
  3. Customize
  4. Continuous Monitoring
  5. Automated Remediation
197
Q

Describe the Initial Assessment phase of the compliance workflow

A

Requires defining the compliance framework and assets that require compliance assessments.

198
Q

Describe the Review Results phase of the compliance workflow

A

Identifies any system controls that counteract compliance and discovers non-compliant assets.

199
Q

Describe the Customize phase of the compliance workflow

A

Creates a custom continuous compliance configuration with rules and exceptions to apply to specific resources in the cloud environment.

200
Q

Describe the Continuous Monitoring phase of the compliance workflow

A

Delivers system notifications and compliance reports that reveal cloud resources which require compliance updates.

201
Q

Describe the Automated Remediation phase of the compliance workflow

A

Administers compliance remediation efforts with automated software applications known as CloudBots and integrates with third party remediation tools.

202
Q

What dashboard provides an overview of security policy configuration

A

Compliance Dashboard

203
Q

What tool automates the notification and remediation of compliance issues

A

The continuous compliance tool

204
Q

What features of CloudGuard Dome9 actively fixes out of compliance assets

A

CloudBots

205
Q

Can CloudBots remediate a single or multiple clouds.

A

Multiple Clouds

206
Q

What automatic remediation’s can be done by CloudBots

A
  • Encrypt databases
  • Rotate encryption keys
  • Force password changes
  • Quarantine instances
  • Add privacy settings to storage buckets
  • Suspend users or roles
207
Q

What platform supports CloudBot auto remediation.

A

AWS

208
Q

What authentication mechanisms are used for CloudGuard Dome9 IAM account protections

A
  1. Two-factor

2. Attribute based authorization

209
Q

What does CloudGuard Dome9 Privileged Access Protection provide

A

time-sensitive authorization

210
Q

Is it recommended to apply CloudGuard Dome9 protections before or after IAM accounts have receive access to protected assets

A

Before

211
Q

CloudGuard Dome9 IAM protections fall into 2 types

A
  1. Protected - Blocks any protected IAM user from applying protected actions to cloud services
  2. Protected with Elevation - Authorizes CloudGuard Dome9 users access to protected services for a limited time period.
212
Q

What feature of CloudGuard Dome9 protects security groups from unapproved changes

A

CloudGuard Dome9 tamper protection

213
Q

How many types of IAM reports are available

A

2

Policy
Credential

214
Q

What information is provided to CloudGuard Dome9 Magellan in determining security status.

A
  1. Cloud account configurations

2. Data flows

215
Q

What functions does CloudGuard Dome9 Magellan serve

A
  1. intelligent threat prevention technology

2. investigative tool that examines cloud activity

216
Q

What does Magellan cloud-native security intelligence mechanism deliver

A
  1. Intrusion Detection
  2. Network Traffic visualization
  3. Activity Analytics
217
Q

What type of algorithms does CloudGuard Dome9 Magellan use

A

Object-mapping

218
Q

How does Magellan streamline Network Security operations

A
  1. reduce the lead time for threat detection
  2. detect abnormal use of cloud resources
  3. compliance validation
  4. list of unapproved assets
219
Q

What is included in Magellan’s enrichment engine.

A
  • threat feeds
  • geographic databases
  • inventory, configuration
  • traffic flow logs
  • cloud native compliance and auditing data
220
Q

What format is Maegllan’s enriched data displayed

A

Graphical

221
Q

What graphical item are presented by Magellan

A
  1. Compliance notifications
  2. Intrusion Alerts
  3. Enriched log data stream
222
Q

What predefine queries are provided by Magellan

A
  • Login and Authentication - Reflects console logins from new regions, creating API keys in a new region, and brute force attacks on a cloud account.
  • Security Configurations - Identifies outbound traffic using SSH or RDP, changes in the cloud account’s activity monitoring settings, and internal port scans.
  • Resource Abuse - Scans the environment for new machine types in use. modifications to storage size, and database deletions.
223
Q

Describe the CloudGuard Dome9 mechanisms that administer automated compliance remediation’s.

A

Automated software applications known as CloudBots address non-compliance issues. CloudBots operate in the cloud account to perform remediation’s such as quarantining or terminating cloud instances. Automatic remediation may apply to a single cloud account or several cloud accounts at one time.

224
Q

Discuss the module that uses cloud data analytics to provide an overview of the cloud account’s security status.

A

Magellan operates as an intelligent threat prevention technology and an investigative tool that examines and gathers information about cloud activity. This module gathers cloud inventory, cloud configurations, system monitoring, and intelligence. Security Administrators may use this information to streamline Network Security operations, reduce the lead time for threat detection, and detect abnormal use of cloud resources.

225
Q

Do you need to turn off Anti-spoofing in Azure

A

Yes, interfered with routing

226
Q

What unit are AWS cloud formation templates organized into

A

Stacks

227
Q

What CSP service do you need to employ to allow the SMS to autoprovision resources

A

IAM

228
Q

What command do you run on SMS to see version of the autoprovision module

A

cat $FWDIR|/scripts/autoprovision/version

229
Q

What is the command to establish autoprovision on the SMS server

A

autoprov-cfg

230
Q

What is the command to check autoprovision configuration details on SMS

A

autoprov-cfg show all

231
Q

What is the command to test autoprovision configuration on the SMS server

A

service autoprovision test

232
Q

What is the command to set autoprovision template configuration on the SMS server

A

autoprov-cfg set template

Check Point (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions