Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cygate > CCSA > Flashcards

CCSA Flashcards

1
Q

When you upload a package or license to the appropriate repository in SmartUpdate, where is the package or license stored?
1. Security Gateway
2. Check Point user center
3. Security Management Server
4. SmartConsole installed device

A

Security Management Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which software blade does NOT accompany the Threat Prevention policy?
1. Anti-virus
2. IPS
3. Threat Emulation
4. Application Control and URL Filtering

A

Application Control and URL Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Where can you trigger a failover of the cluster members?
1. Log in to Security Gateway CLI and run command clusterXL_admin down.
2. In SmartView Monitor right-click the Security Gateway member and select Cluster member stop.
3. Log into Security Gateway CLI and run command chphaprob down.

Is it:
1. 1,2 and 3
2. 2 and 3
3. 1 and 2
4. 1 and 3

A

1 and 2

Log in to Security Gateway CLI and run command clusterXL_admin down.
In SmartView Monitor right-click the Security Gateway member and select Cluster member stop.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following is NOT a valid configuration screen of an Access Role Object?
1. Users
2. Networks
3. Time
4. Machine

A

Time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is NOT an advantage of Packet Filtering?
1. Low Security and No Screening above Network Layer
2. Application Independence
3. High Performance
4. Scalability

A

Low Security and No Screening above Network Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the Transport layer of the TCP/IP model responsible for?
1. It transports packets as datagrams along different routes to reach their destination.
2. It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.
3. It defines the protocols that are used to exchange data between networks and how host programs interact with the Application layer.
4. It deals with all aspects of the physical components of network connectivity and connects with the different network types.

A

It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?
1. Pentagon
2. Combined
3. Meshed
4. Star

A

Star

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the Implicit Clean-up Rule?
1. A setting that is defined in the Global Properties for all policies.
2. A setting that is configured per Policy Layer.
3. Another name for the Clean-up Rule.
4. Automatically created when the Clean-up Rule is defined.

A

A setting that is defined in the Global Properties for all policies.
A setting that is configured per Policy Layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Fill in the blank: (\_\_\_\_\_\_\_\_) information is included in “Full log” tracking option, but is not included in “Log” tracking option?
1. Destination port
2. Data Type
3. File attributes
4. Application

A

Data Type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What Check Point technologies deny or permit network traffic?
1. Application Control, DLP
2. Packet Filtering, Stateful Inspection, Application Layer Firewall
3. ACL, SandBlast, MPT
4. IPS, Mobile Threat Protection

A

Packet Filtering, Stateful Inspection, Application Layer Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Fill in the blank: \_\_\_\_ software blade enables Application Security policies to allow, block, or limit website access on user, group, and machine identities.
1. Application Control
2. Data Awareness
3. URL Filtering
4. Threat Emulation

A

URL Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the three conflict resolution rules in the Threat Prevention Policy Layers?
1. Conflict on action, conflict on exception, and conflict on settings
2. Conflict on scope, conflict on settings, and conflict on exception
3. conflict on settings, conflict on address, and conflict on exception
4. Conflict on action, conflict on destination, and conflict on settings

A

Conflict on action, conflict on exception, and conflict on settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Packages and licenses are loaded from all of these sources EXCEPT
1. Download Center Web Site
2. UserUpdate
3. User Center
4. Check Point DVD

A

UserUpdate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The “Hit count” feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits even if the Track option is set to “None”?
1. No, it will not work independently. Hit Count will be shown only for rules with Track option set as Log or alert.
2. Yes it will work independently as long as “analyze all rules” tick box is enabled on the Security Gateway.
3. No, it will not work independently because hit count requires all rules to be logged.
4. Yes it will work independently because when you enable Hit Count, the SMS collects the data from supported Security Gateways.

A

Yes it will work independently because when you enable Hit Count, the SMS collects the data from supported Security Gateways.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How is communication between different Check Point components secured in R80? As with all questions, select the BEST answer.

  1. By using IPSEC.
  2. By using SIC.
  3. By using ICA.
  4. By using 3DES.
A

By using SIC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following is NOT a VPN routing option available in a star community?
1. To satellites through center only
2. To center, or through the center to other satellites, to internet and other VPN targets
3. To center and to other satellites through center
4. To center only

A

To satellites through center only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the default shell of Gaia CLI?
1. Monitor
2. CLI.sh
3. Read-only
4. Bash

A

CLI.sh

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which option would allow you to make a back up copy of the OS and Check Point configuration, without stopping Check Point processes?
1. All options stop Check Point processes.
2. backup
3. migrate export
4. snapshot

A 
backup
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Fill in the blank: RADIUS Accounting gets (____) data from requests generated by the accounting client
1. Destination
2. Identity
3. Payload
4. Location

A

Identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following is NOT a type of Endpoint Identity Agent?
1. Terminal
2. Light
3. full
4. Custom

A
  1. Terminal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server. While configuring the VPN community to specify the pre-shared secret the administrator found that the check box to enable pre-shared secret is shaded and cannot be enabled. Why does it not allow him to specify the pre-shared secret?

  1. IPsec VPN blade should be enabled on both Security Gateway.
  2. Pre-shared can only be used while creating a VPN between a third party vendor and Check Point Security gateway.
  3. Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS.
  4. The Security Gateways are pre-R75.40.
A
  1. Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Harriet wants to protect sensitive information from intentional loss when users browse to a specific URL: https://personal.mymail.com, which blade will she enable to achieve her goal?
1. DLP
2. SSL Inspection
3. Application Control
4. URL Filtering

A
  1. DLP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the (____) algorithm.
1. SHA-256
2. SHA-200
3. MD5
4. SHA-128

A

1.SHA-256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Fill in the blank: The (____) feature allows administrators to share a policy with other policy packages.
1. Shared policy packages
2. Shared policies
3. Concurrent policy packages
4. Concurrent policies

A
  1. Shared policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

You are unabled to login to SmartDashboard. You log into the management server and run cpwd_admin list with the following output:

What reason could possibly BEST explain why you are unable to connect to SmartDashboard?
1. CPD id down
2. SVR is down
3. CPM is down
4. CPSM is down

A

3.CPM is down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the three types of UserCheck messages?
1. Inform, ask, and block
2. Block, action, and warn
3. Action, inform, and ask
4. Ask, block, and notify

A
  1. Inform, ask, and block
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which option, when applied to a rule, allows all encrypted and non-VPN traffic that matches the rule?
1. All Site-to-Site VPN Communities
2. Accept all encrypted traffic
3. All Connections (Clear or Encrypted)
4. Specific VPN Communities

A
  1. All Connections (Clear or Encrypted)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What command shows the configuration of the management server?
1. show configuration all
2. show confd configuration
3. show confd configuration all
4. show configuration

A
  1. show configuration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which authentication scheme requires a user to posses a token?
1. TACACS
2. SecureID
3. Check Point password
4. RADIUS

A
  1. SecureID
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Your internal networks 10.1.1.0/24, 10.2.2.0/24 and 192.168.0.0/16 are behind the internet Security Gateway. Considering that Layer 2 and Layer 3 setup is correct, what are the steps you will need to do in SmartConsole in order to get the correction working? Select the BEST answer.
1. Define an accept rule in Security Policy. Define Security Gateway to hide all internal networks behind the gateway’s external IP. Publish and install the policy.
2. Define an accept rule in Security Policy. Configure automatic NAT for each network to NAT the networks behind a public IP. Publish the policy.
3. Define an accept rule in Security Policy. Configure automatic NAT for each network to NAT the networks behind a public IP.
4. Define an accept rule in Security Policy. Define Security Gateway to hide all internal networks behind the gateway’s external IP. Publish the policy.

A
  1. Define an accept rule in Security Policy. Define Security Gateway to hide all internal networks behind the gateway’s external IP. Publish and install the policy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which of the following blades is NOT a subscription-based and therefore does not have to be renewed on a regular basis?
1. Application Control
2. Threat Emulation
3. Anti-Virus
4. Advanced Networking Blade

A
  1. Advanced Networking Blade
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Fill in the blank: There are (\_\_\_\_\_\_\_\_\_) types of software containers: (\_\_\_\_\_\_\_\_).
1. Three, security management, Security Gateway, and endpoint security
2. Three, Security Gateway, endpoint security, and gateway management
3. Two, security management and endpoint security
4. Two, endpoint security and Security Gateway

A
  1. Three, security management, Security Gateway, and endpoint security
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Fill in the blanks: Default port numbers for an LDAP server is (\_\_\_\_\_\_\_\_) for standard connections and (\_\_\_\_\_\_\_\_\_\_) SSL connections.
1. 675; 389
2. 389; 636
3. 636; 290
4. 290; 675

A
  1. 389; 636
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which of the following ClusterXL modes uses a non-unicast MAC address for the cluster IP address?
1. High Availability
2. Load Sharing Multicast
3. Load Sharing Pivot
4. Master/Backup

A
  1. Load Sharing Multicast
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Fill in the blanks: A Security Policy is created in (\_\_\_\_\_\_\_), stored in the (\_\_\_\_\_\_\_\_\_), and Distributed to the various (\_\_\_\_\_\_\_\_\_\_\_).
1. Rule base, Security Management Server, Security Gateways
2. SmartConsole, Security Gateway, Security Management Servers
3. SmartConsole, Security Management Server, Security Gateways
4. The Check Point database, SmartConsole, Security Gateways

A

3.SmartConsole, Security Management Server, Security Gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Where can administrator edit a list of trusted SmartConsole clients in R80?
1. cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server.
2. Only in SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients
3. In cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole. Manage and Settings > Permissions and Administrators > Trusted Clients.
4. WebUI client logged to Security Management Server, SmartDashboard: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients, via cpconfig on a Security Gateway.

A
  1. In cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole. Manage and Settings > Permissions and Administrators > Trusted Clients.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What will be the effect of running the following command on the Security Management Server?
~~~
fw unloadlocal
~~~
1. Remove the installed Security Management Server
2. Remove the local ACL lists
3. No effect
4. Reset SIC on all gateways

A
  1. No effect
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which Threat Prevention Software Blade provides comprehensive protection against malicious and unwanted network traffic, focusing on application and server vulnerabilities?
1. Anti-Virus
2. IPS
3. Anti-Spam
4. Anti-bot

A
  1. IPS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which Check Point feature enables application scanning and the detection?
1. Application Dictionary
2. AppWiki
3. Application Library
4. CPApp

A
  1. AppWiki
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which tool is used to enable ClusterXL?
1. SmartUpdate
2. cpconfig
3. SmartConsole
4. sysconfig

A
  1. cpconfig
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Fill in the blank: With the User Directory Software Blade, you can create R80 user definitions on a(an) Server?

  1. SecurID
  2. NT domain
  3. SMTP
  4. LDAP
A
  1. LDAP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Fill in the blank: The command provides the most complete restoration of a R80 configuration.

  1. cpconfig
  2. upgrade_export
  3. fwm dbimport -p <export file>
  4. cpinfo-recover
A
  1. upgrade_export

Explanation
(Should be “migrate import”)

“migrate import” Restores backed up configuration for R80 version, in previous versions the command was “ upgrade_export “.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when.
1. The IP address of the Security Management or Security Gateway has changed
2. The license is upgraded
3. The license is attached to the wrong Security Gateway
4. The existing license expires

A

The license is attached to the wrong Security Gateway

Explanation
There is no need to generate new license in this situation, just need to detach license from wrong Security Gateway and attach it to the right one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Which of the following are types of VPN communicates?
1. Combined and star
2. Pentagon, star, and combination
3. Meshed, star, and combination
4. Star, octagon, and combination

A

Meshed, star, and combination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the right protections in place. Check Point has been selected for the security vendor. Which Check Point products protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?
1. IPS, anti-virus and e-mail security
2. Sand Blast
3. IPS and Application Control
4. IPS, anti-virus and anti-bot

A

Sand Blast

Explanation
Sand Blast Zero-Day Protection

Hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. Zero-day exploit protection from Check Point provides a deeper level of inspection so you can prevent more malware and zero-day attacks, while ensuring quick delivery of safe content to your users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which utility shows the security gateway general system information statistics like operating system information and resource usage, and individual software blade statistics of VPN, Identity Awareness and DLP?
1. fw ctl pstat
2. cp view
3. fw ctl multik stat
4. cpconfig

A 
cp view

Explanation
CPView Utility is a text based built-in utility that can be run (‘cpview’ command) on Security Gateway / Security Management Server / Multi-Domain Security Management Server. CPView Utility shows statistical data that contain both general system information (CPU, Memory, Disk space) and information for different Software Blades (only on Security Gateway). The data is continuously updated in easy to access views.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Which of the following is TRUE regarding Gaia command line?
1. Configuration changes should be done in mgmt-cli and use expert-mode for OS-level tasks.
2. All configuration changes should be made in CLISH and expert-mode should be used for OS-level tasks.
3. Configuration changes should be done in expert-mode and CLISH is used for monitoring.
4. Configuration changes should be done in mgmt_cli and use CLISH for monitoring, Expert mode is used only for OS level tasks.

A

Configuration changes should be done in mgmt_cli and use CLISH for monitoring, Expert mode is used only for OS level tasks.

Explanation
To make changes available to all administrators, and to unlock the objects and rules that are being edited, the administrator must publish the session.

To make your changes available to other administrators, and to save the database before installing a policy, you must publish the session. When you publish a session, a new database version is created.

When you select Install Policy, you are prompted to publish all unpublished changes. You cannot install a policy if the included changes are not published.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

The security Gateway is installed on GAiA R80 The default port for the WEB User Interface is.
1. TCP 18211
2. TCP 443
3. TCP 4433
4. TCP 257

A

TCP 443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Joey wants to configure NTP on R80 Security Management Server. He decided to do this via WebUI. What is the correct address to access the Web UI for Gaia platform via browser?
~~~
1. https://<Device_IP_Address>:10000
2. https://<Device_IP_Address>:443
3. https://<Device_IP_Address>
4. https://<Device_IP_Address>:4434
~~~</Device_IP_Address></Device_IP_Address></Device_IP_Address></Device_IP_Address>

A

https://<Device_IP_Address>

Explanation
Logging in to the WebUI

Logging in

To log in to the WebUI:

  1. Enter this URL in your browser: https://<Gaia></Gaia>
  2. Enter your user name and password.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Which of the following is NOT a back up method?
1. snapshot
2. Migrate
3. System backup
4. Save backup

A

Save backup

Explanation
The built-in Gaia backup procedures:

Snapshot Management

System Backup (and System Restore)

Save/Show Configuration (and Load Configuration)

Check Point provides three different procedures for backing up (and restoring) the operating system and networking parameters on your appliances.

Snapshot (Revert)

Backup (Restore)

upgrade_export (Migrate)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the two high availability modes?
1. Load Sharing and Legacy
2. New and Legacy
3. Active and Standby
4. Traditional and New

A

New and Legacy

Explanation
ClusterXL has four working modes. This section briefly describes each mode and its relative advantages and disadvantages.

Load Sharing Multicast Mode Load Sharing Unicast Mode

New High Availability Mode

High Availability Legacy Mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from Threat Cloud?
1. Antivirus
2. Anti-spam and Email Security
3. Firewall
4. Application Control

A

Antivirus

Explanation
The enhanced Check Point Antivirus Software Blade uses real-time virus signatures and anomaly-based protections from Threat Cloud, the first collaborative network to fight cybercrime, to detect and block malware at the gateway before users are affected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Fill in the blank: The R80 feature permits blocking specific IP addresses for a specified time period.
1. Adaptive Threat Prevention
2. Suspicious Activity Monitoring
3. Block Port Overflow
4. Local Interface Spoofing

A

Suspicious Activity Monitoring

Explanation
Suspicious Activity Rules Solution

Suspicious Activity Rules is a utility integrated into SmartView Monitor that is used to modify access privileges upon detection of any suspicious network activity (for example, several attempts to gain unauthorized access).

The detection of suspicious activity is based on the creation of Suspicious Activity rules. Suspicious Activity rules are Firewall rules that enable the system administrator to instantly block suspicious connections that are not restricted by the currently enforced security policy. These rules, once set (usually with an expiration date), can be applied immediately without the need to perform an Install Policy operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Which feature is NOT provided by all Check Point Mobile Access solutions?
1. Support for IPv6
2. Strong user authentication
3. Secure connectivity
4. Granular access control

A

Support for IPv6

Explanation
Types of Solutions

All of Check Point’s Remote Access solutions provide:

Enterprise-grade, secure connectivity to corporate resources. Strong user authentication.

Granular access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Fill in the blank: Each cluster has interfaces.
1. Four
2. Two
3. Five
4. Three

A

Three

Explanation
Each cluster member has three interfaces: one external interface, one internal interface, and one for synchronization. Cluster member interfaces facing in each direction are connected via a switch, router, or VLAN switch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is the default method for destination NAT?
1. Source side
2. Destination side
3. Client side
4. Server side

A

Client side

Explanation
Client Side NAT - destination is NAT`d by the inbound kernel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is the default shell for the command line interface?
1. Normal
2. Clish
3. Expert
4. Admin

A

Clish

Explanation
The default shell of the CLI is called clish

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

In R80, Unified Policy is a combination of
1. Firewall policy, address Translation and application and URL filtering, QoS Policy, Desktop Security Policy and Threat Prevention Policy.
2. Access control policy, QoS Policy, Desktop Security Policy and VPN policy.
3. Access control policy, QoS Policy, Desktop Security Policy and Threat Prevention Policy.
4. Access control policy, QoS Policy, Desktop Security Policy and endpoint policy.

A

Access control policy, QoS Policy, Desktop Security Policy and VPN policy.

Explanation
D is the best answer given the choices. Unified Policy

In R80 the Access Control policy unifies the policies of these pre-R80 Software Blades:

Firewall and VPN

Application Control and URL Filtering Identity Awareness

Data Awareness Mobile Access Security Zones

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Fill in the blank: The R80 utility fw monitor is used to troubleshoot \_\_\_\_
1. Traffic issues
2. User data base corruption
3. LDAP conflicts
4. Phase two key negotiation

A

Traffic issues

Explanation
Check Point’s FW Monitor is a powerful built-in tool for capturing network traffic at the packet level. The FW Monitor utility captures network packets at multiple capture points along the FireWall inspection chains. These captured packets can be inspected later using the WireShark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?
1. Local
2. Corporate
3. Formal
4. Central

A

Local

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Administrator wishes to update IPS from Smart Console by clicking on the option “update now” under the IPS tab. Which device requires internet access for the update to work?
1. Security Gateway
2. Device where Smart Console is installed
3. Smart Event
4. SMS

A

Device where Smart Console is installed

Explanation
Updating IPS Manually

You can immediately update IPS with real-time information on attacks and all the latest protections from the IPS website. You can only manually update IPS if a proxy is defined in Internet Explorer settings.

To obtain updates of all the latest protections from the IPS website:

  1. Configure the settings for the proxy server in Internet Explorer.
  2. In Microsoft Internet Explorer, open Tools > Internet Options > Connections tab > LAN Settings. The LAN Settings window opens.
  3. Select Use a proxy server for your LAN.
  4. Configure the IP address and port number for the proxy server.
  5. Click OK.

The settings for the Internet Explorer proxy server are configured.

In the IPS tab, select Download Updates and click Update Now.

If you chose to automatically mark new protections for Follow Up, you have the option to open the Follow Up page directly to see the new protections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Office mode means that:
1. Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.
2. Users authenticate with an Internet browser and use secure HTTPS connection.
3. Secure ID client assigns a routable MAC address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.
4. Local ISP (Internet service Provider) assigns a non-routable IP address to the remote user.

A

Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

Explanation
Office Mode enables a Security Gateway to assign internal IP addresses to SecureClient users. This IP address will not be exposed to the public network, but is encapsulated inside the VPN tunnel between the client and the Gateway. The IP to be used externally should be assigned to the client in the usual way by the Internet Service provider used for the Internet connection. This mode allows a Security Administrator to control which addresses are used by remote clients inside the local network and makes them part of the local network. The mechanism is based on an IKE protocol extension through which the Security Gateway can send an internal IP address to the client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a Smart Console machine in his calculations?
1. One machine, but it needs to be installed using Secure Platform for compatibility purposes.
2. Three machines
3. One machine
4. Two machines

A

Two machines

Explanation
One for Security Management Server and the other one for the Security Gateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Which options are given on features, when editing a Role on Gaia Platform?
1. Read/Write, Read Only
2. Read Only, None
3. Read/Write, None
4. Read/Write, Read only, None

A

Read/Write, Read only, None

Explanation
Role-based administration (RBA) lets you create administrative roles for users. With RBA, an administrator can allow Gaia users to access specified features by including those features in a role and assigning that role to users. Each role can include a combination of administrative (read/write) access to some features, monitoring (read-only) access to other features, and no access to other features.

You can also specify which access mechanisms (WebUI or the CLI) are available to the user.

Note - When users log in to the WebUI, they see only those features that they have read-only or read/write access to. If they have read-only access to a feature, they can see the settings pages, but cannot change the settings.

Gaia includes these predefined roles:

adminRole - Gives the user read/write access to all features.

monitorRole- Gives the user read-only access to all features. You cannot delete or change the predefined roles.

Note - Do not define a new user for external users. An external user is one that is defined on an authentication server (such as RADIUS or TACACS) and not on the local Gaia system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?
1. AD Query
2. RADIUS
3. Remote Access and RADIUS
4. AD Query and Browser-based Authentication

A

AD Query and Browser-based Authentication

Explanation
Explanation:

Identity Awareness gets identities from these acquisition sources:

AD Query

Browser-Based Authentication Endpoint Identity Agent Terminal Servers Identity Agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Which policy type has its own Exceptions section?
1. Threat Emulation
2. Access Control
3. Desktop Security
4. Threat Prevention

A

Threat Prevention

Explanation
The Exceptions Groups pane lets you define exception groups. When necessary, you can create exception groups to use in the Rule Base. An exception group contains one or more defined exceptions. This option facilitates ease-of-use so you do not have to manually define exceptions in multiple rules for commonly required exceptions. You can choose to which rules you want to add exception groups. This means they can be added to some rules and not to others, depending on necessity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

When you upload a package or license to the appropriate repository in Smart Update, where is the package or license stored.
1. Check Point user center
2. Security Gateway
3. Smart Console installed device
4. Security Management Server

A

Security Management Server

Explanation
Smart Update installs two repositories on the Security Management server:

License & Contract Repository, which is stored on all platforms in the directory $FWDIR\conf.

Package Repository, which is stored:

  • on Windows machines in C:\SUroot.
  • on UNIX machines in /var/SUroot.

The Package Repository requires a separate license, in addition to the license for the Security Management server. This license should stipulate the number of nodes that can be managed in the Package Repository.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Which of the following is NOT an advantage to using multiple LDAP servers?
1. You achieve compartmentalization by allowing a large number of users to be distributed across several servers
2. Information on a user is hidden, yet distributed across several servers
3. You gain High Availability by replicating the same information on several servers
4. You achieve a faster access time by placing LDAP servers containing the database at remote sites

A

Information on a user is hidden, yet distributed across several servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

With which command can you view the running configuration of Gaia-based system?
1. show configuration active
2. show running-configuration
3. show configuration
4. show conf-active

A 
show configuration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

By default, which port does the Web UI listen on?
1. 80
2. 8080
3. 443
4. 4434

A

443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?
1. Anti-bot
2. Anti-Virus
3. Anti-Spam
4. IPS

A

IPS

Explanation
The IPS Software Blade provides a complete Intrusion Prevention System security solution, providing comprehensive network protection against malicious and unwanted network traffic, including:

Malware attacks

Dos and DDoS attacks

Application and server vulnerabilities Insider threats

Unwanted application traffic, including IM and P2P

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

The Gaia operating system supports which routing protocols?
1. BGP, OSPF, EIGRP, PIM, IGMP
2. BGP, OSPF, RIP, PIM, IGMP
3. BGP, OSPF, RIP, EIGRP
4. BGP, OSPF, RIP

A

BGP, OSPF, RIP

Explanation
The Advanced Routing Suite CLI is available as part of the For organizations looking to implement scalable, fault-tolerant, secure networks, the Advanced Networking blade enables them to run industry-standard dynamic routing protocols including BGP, OSPF, RIPv1, and RIPv2 on security gateways. OSPF, RIPv1, and RIPv2 enable dynamic routing over a single autonomous system—like a single department, company, or service provider—to avoid network failures. BGP provides dynamic routing support across more complex networks involving multiple autonomous systems—such as when a company uses two service providers or divides a network into multiple areas with different administrators responsible for the performance of each.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Which one of the following is the preferred licensing model? Select the Best answer.
1. Local licensing because it ties the package license to the IP-address of the gateway and has no dependency of the Security Management Server.
2. Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency of the gateway.
3. Local licensing because it ties the package license to the MAC-address of the gateway management interface and has no Security Management Server dependency.

A

Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency of the gateway.

Explanation
Central License

A Central License is a license attached to the Security Management server IP address, rather than the gateway IP address. The benefits of a Central License

are:

Only one IP address is needed for all licenses.

A license can be taken from one gateway and given to another.

The new license remains valid when changing the gateway IP address. There is no need to create and install a new license.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

You have enabled “Full Log” as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?
1. Data Awareness is not enabled.
2. Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database.
3. Logs are arriving from Pre-R80 gateways.
4. Identity Awareness is not enabled.

A

Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database.

Explanation
The most likely reason for the logs data to stop is the low disk space on the logging device, which can be the Management Server or the Gateway Server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?
1. Active Directory Query.
2. User Directory Query.
3. Account Unit Query.
4. User Check.

A

Active Directory Query.

Explanation
AD Query extracts user and computer identity information from the Active Directory Security Event Logs. The system generates a Security Event log entry when a user or computer accesses a network resource. For example, this occurs when a user logs in, unlocks a screen, or accesses a network drive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Fill in the blank: To build an effective Security Policy, use a and _ rule?
1. Implicit; explicit
2. Stealth; implicit
3. Cleanup; default
4. Cleanup; stealth

A

Cleanup; stealth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Which of the following is NOT a license activation method?
1. Offline Activation
2. Smart Console Wizard
3. Online Activation
4. License Activation Wizard

A

Smart Console Wizard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?
1. Identity Awareness is not enabled on Global properties
2. Smart Console machine is not part of the domain
3. SMS is not part of the domain
4. Security Gateways is not part of the Domain

A

Smart Console machine is not part of the domain

Explanation
To enable Identity Awareness:

  1. Log in to Smart Dashboard.
  2. From the Network Objects tree, expand the Check Point branch.
  3. Double-click the Security Gateway on which to enable Identity Awareness.
  4. In the Software Blades section, select Identity Awareness on the Network Security tab. The Identity Awareness Configuration wizard opens.
  5. Select one or more options. These options set the methods for acquiring identities of managed and unmanaged assets.

AD Query - Lets the Security Gateway seamlessly identify Active Directory users and computers.

Browser-Based Authentication - Sends users to a Web page to acquire identities from unidentified users. If Transparent Kerberos Authentication is configured, AD users may be identified transparently.

Terminal Servers - Identify users in a Terminal Server environment (originating from one IP address). See Choosing Identity Sources.

Note - When you enable Browser-Based Authentication on a Security Gateway that is on an IP Series appliance, make sure to set the Voyager management application port to a port other than 443 or 80.

  1. Click Next.

The Integration With Active Directory window opens.

When Smart Dashboard is part of the domain, Smart Dashboard suggests this domain automatically. If you select this domain, the system creates an LDAP Account Unit with all of the domain controllers in the organization’s Active Directory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?
1. Secure Client
2. Smart Console
3. Security Gateway
4. None, Security Management Server would be installed by itself.

A

Security Gateway

Explanation
There are different deployment scenarios for Check Point software products.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What are the three authentication methods for SIC?
1. Certificates, Passwords, and Tokens
2. Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption
3. Packet Filtering, certificates, and 3DES or AES128 for encryption
4. Passwords, Users, and standards-based SSL for the creation of security channels

A

Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption

Explanation
Secure Internal Communication (SIC) Secure Internal Communication (SIC) lets Check Point platforms and products authenticate with each other. The SIC procedure creates a trusted status between gateways, management servers and other Check Point components. SIC is required to install polices on gateways and to send logs between gateways and management servers.

These security measures make sure of the safety of SIC: Certificates for authentication Standards-based SSL for the creation of the secure channel 3DES for encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What is the purpose of Captive Portal?
1. It authenticates users, allowing them access to the Internet and corporate resources
2.It authenticates users, allowing them access to the Gaia OS
3.It provides remote access to Smart Console
4.It manages user permission in Smart Console

A

It authenticates users, allowing them access to the Internet and corporate resources

Explanation
Captive Portal – a simple method that authenticates users through a web interface before granting them access to Intranet resources. When users try to access a protected resource, they get a web page that must be filled out to continue.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What is the order of NAT priorities?
1. Static NAT, hide NAT, IP pool NAT
2. IP pool NAT, static NAT, hide NAT
3. Static NAT, automatic NAT, hide NAT
4. Static NAT, IP pool NAT, hide NAT

A

Static NAT, IP pool NAT, hide NAT

Explanation
The order of NAT priorities is:

  1. Static NAT
  2. IP Pool NAT
  3. Hide NAT

Since Static NAT has all of the advantages of IP Pool NAT and more, it has a higher priority than the other NAT methods.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Which of the following is NOT a component of a Distinguished Name?
1. Common name
2. Organization Unit
3. User container
4. Country

A

User container

Explanation
Distinguished Name Components

CN=common name, OU=organizational unit, O=organization, L=locality, ST=state or province, C=country name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Which command is used to add users to or from existing roles?
1. Add rba user <User Name>
2. Add user <User Name>
3. Add rba user <User Name> roles <List>
4. Add user <User Name> roles <List>

A 
Add rba user <User Name> roles <List>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet. Which of the following statements about the order of rule enforcement is true?
1. If the Action is Accept, the gateway continues to check rules in the next Policy Layer down.
2. If the Action is Drop, the gateway continues to check rules in the next Policy Layer down.
3. If the Action is Drop, the gateway applies the Implicit Clean-up Rule for that Policy Layer.
4. If the Action is Accept, the gateway allows the packet to pass through the gateway.

A

If the Action is Accept, the gateway continues to check rules in the next Policy Layer down.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Which of the following ClusterXL modes uses a non-unicast MAC address for the cluster IP address.
1. Load Sharing Pivot
2. Load Sharing Multicast
3. High Availability
4. Master/Backup

A

Load Sharing Multicast

Explanation
ClusterXL uses the Multicast mechanism to associate the virtual cluster IP addresses with all cluster members. By binding these IP addresses to a Multicast MAC address, it ensures that all packets sent to the cluster, acting as a gateway, will reach all members in the cluste

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What is the default time length that Hit Count Data is kept?
1. 4 weeks
2. 12 months
3. 3 month
4. 6 months

A

6 months

Explanation
Keep Hit Count data up to - Select one of the time range options. The default is 6 months. Data is kept in the Security Management Server database for this period and is shown in the Hits column.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Which type of the Check Point license ties the package license to the IP address of the Security Management Server?
1. Formal
2. Local
3. Corporate
4. Central

A

Central

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

When attempting to start a VPN tunnel, in the logs the error ‘no proposal chosen’ is seen numerous times. No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?
1. IKE Phase 2
2. IKE Phase 1
3. IPSEC Phase 2
4. IPSEC Phase 1

A

IKE Phase 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What are the two types of address translation rules?
1. Translated packet and untranslated packet
2. Untranslated packet and manipulated packet
3. Manipulated packet and original packet
4. Original packet and translated packet

A

Original packet and translated packet

Explanation
NAT Rule Base

The NAT Rule Base has two sections that specify how the IP addresses are translated:

Original Packet Translated Packet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Which authentication scheme requires a user to possess a token?
1. RADIUS
2. SecurID
3. TACACS
4. Check Point password

A

SecurID

Explanation
SecurID

SecurID requires users to both possess a token authenticator and to supply a PIN or password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

In order to modify Security Policies, the administrator can use which of the following tools? Select the BEST answer.
1. Smart Console or mgmt_cli on any computer where Smart Console is installed.
2. Command line of the Security Management Server or mgmt_cli.exe on any Windows computer.
3. Smart Console and Web UI on the Security Management Server.
4. mgmt_cli or Web UI on Security Gateway and Smart Console on the Security Management Server.

A

Smart Console or mgmt_cli on any computer where Smart Console is installed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Which of the completed statements is NOT true? The WebUI can be used to manage user accounts and:
1. add users to your Gaia system.
2. edit the home directory of the user.
3. assign privileges to users.
4. assign user rights to their home directory in the Security Management Server

A

assign user rights to their home directory in the Security Management Server

Explanation
Users

Use the WebUI and CLI to manage user accounts. You can:

Add users to your Gaia system. Edit the home directory of the user. Edit the default shell for a user.

Give a password to a user. Give privileges to users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Fill in the blank: The feature allows administrators to share a policy with other policy packages.
1. Concurrent policy packages
2. Shared policies
3. Concurrent policies
4. Shared policy packages

A

Shared policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Which of the following is TRUE about the Check Point Host object?
1. When you upgrade to R80 from R77.30 or earlier versions, Check Point Host objects are converted to gateway objects.
2. Check Point Host is capable of having an IP forwarding mechanism.
3. Check Point Host can act as a firewall.
4. Check Point Host has no routing ability even if it has more than one interface installed.

A

Check Point Host has no routing ability even if it has more than one interface installed.

Explanation
A Check Point host is a host with only one interface, on which Check Point software has been installed, and which is managed by the Security Management server. It is not a routing mechanism and is not capable of IP forwarding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

NAT can NOT be configured on which of the following objects?
1. Gateway
2. Host
3. Address Range
4. HTTP Logical Server

A

HTTP Logical Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Where do we need to reset the SIC on a gateway object?
1. Smart Update > Edit Security Management Server Object > SIC
2. Smart Dashboard > Edit Gateway Object > General Properties > Communication
3. Smart Update > Edit Gateway Object > Communication
4. Smart Dashboard > Edit Security Management Server Object > SIC

A

Smart Dashboard > Edit Gateway Object > General Properties > Communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as
1. User Check
2. User Directory
3. User Administration
4. User Center

A

User Directory

Explanation
Check Point User Directory integrates LDAP, and other external user management technologies, with the Check Point solution. If you have a large user count, we recommend that you use an external user management database such as LDAP for enhanced Security Management Server performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Fill in the blanks: A High Availability deployment is referred to as a cluster and a Load Sharing deployment is referred to as a cluster.
1. Active/standby; active/active
2. Standby/standby; active/active
3. Active/active; active/standby;
4. Active/active; standby/standby

A

Active/standby; active/active

Explanation
In a High Availability cluster, only one member is active (Active/Standby operation).

ClusterXL Load Sharing distributes traffic within a cluster so that the total throughput of multiple members is increased. In Load Sharing configurations, all functioning members in the cluster are active, and handle network traffic (Active/Active operation).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Message digests use which of the following?
1. SSL and MD4
2. DES and RC4
3. IDEA and RC4
4. SHA-1 and MD5

A

SHA-1 and MD5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the most likely cause?
1. The POP3 rule is hidden.
2. The POP3 rule is disabled.
3. POP3 is accepted in Global Properties.
4. POP3 is one of 3 services (POP3, IMAP, and SMTP) accepted by the default mail object in R77.

A

The POP3 rule is hidden.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What is the default shell of Gaia CLI?
1. Monitor
2. Bash
3. CLI.sh
4. Read-only

A

CLI.sh

Explanation
This chapter gives an introduction to the Gaia command line interface (CLI). The default shell of the CLI is called clish.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What action can be performed from Smart Update R77?
1.fw stat -1
2. cpinfo
3. upgrade_export
4. remote_uninstall_verifier

A

cpinfo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Fill in the blank: Once a license is activated, a should be installed.
1. License Contract file
2. License Management file
3. Service Contract file
4. Security Gateway Contract file

A

Service Contract file

Explanation
Service Contract File

Following the activation of the license, a Service Contract File should be installed. This file contains important information about all subscriptions purchased for a specific device and is installed via Smart Update. A detailed explanation of the Service Contract File can be found in sk33089.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Which of these components does NOT require a Security Gateway R77 license?
1. Check Point Gateway
2. Smart Console
3. Smart Update upgrading/patching
4. Security Management Server

A

Smart Console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in:
1. If Joe tries to make changes, he won’t, database will be locked.
2. Bob will be prompt that Joe logged in.
3. When Joe logs in, Bob will be log out automatically.
4. Since they both are log in on different interfaces, they both will be able to make changes.

A

If Joe tries to make changes, he won’t, database will be locked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

You are going to upgrade from R77 to R80. Before the upgrade, you want to back up the system so that, if there are any problems, you can easily restore to the old version with all configuration and management files intact. What is the BEST backup method in this scenario?
1. Database Revision
2. backup
3. snapshot
4. migrate export

A

snapshot

Explanation
Snapshot Management

The snapshot creates a binary image of the entire root (lv_current) disk partition. This includes Check Point products, configuration, and operating system. Starting in R77.10, exporting an image from one machine and importing that image on another machine of the same type is supported.

The log partition is not included in the snapshot. Therefore, any locally stored Firewall logs will not be saved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Which of the following is NOT an element of VPN Simplified Mode and VPN Communities?
1. Configuration checkbox “Accept all encrypted traffic”
2. “Encrypt” action in the Rule Base
3. “VPN” column in the Rule Base
4. Permanent Tunnels

A

“Encrypt” action in the Rule Base

Explanation
Migrating from Traditional Mode to Simplified Mode

To migrate from Traditional Mode VPN to Simplified Mode:

  1. On the Global Properties > VPN page, select one of these options:

  • Simplified mode to all new Firewall Policies *

Traditional or Simplified per new Firewall Policy

  1. Click OK.
  2. From the R80 Smart Console Menu, select Manage policies.

The Manage Policies window opens.

  1. Click New.

The New Policy window opens.

  1. Give a name to the new policy and select Access Control.

In the Security Policy Rule Base, a new column marked VPN shows and the Encrypt option is no longer available in the Action column. You are now working in Simplified Mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Which of the following is NOT a set of Regulatory Requirements related to Information Security?
1. HIPPA
2. Sarbanes Oxley (SOX)
3. ISO 37001
4. PCI

A

ISO 37001

Explanation
ISO 37001 - Anti-bribery management systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Which Check Point software blade provides protection from zero-day and undiscovered threats?
1. Firewall
2. Threat Emulation
3. Application Control
4. Threat Extraction

A

Threat Emulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Which of the following licenses are considered temporary?
1. Plug-and-play and Evaluation
2. Subscription and Perpetual
3. Evaluation and Subscription
4. Perpetual and Trial

A

Plug-and-play and Evaluation

Explanation
Should be Trial or Evaluation, even Plug-and-play (all are synonyms ). Answer B is the best choice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Choose the Smart Log property that is TRUE.
1. Smart Log is a client of Smart Console that enables enterprises to centrally track log records and security activity with Google-like search.
2. Smart Log has been an option since release R71.10.
3. Smart Log and SmartView Tracker are mutually exclusive.
4. Smart Log is not a Check Point product.

A

Smart Log is a client of Smart Console that enables enterprises to centrally track log records and security activity with Google-like search.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Choose what BEST describes users on Gaia Platform.
1. There are two default users that cannot be deleted and one Smart Console Administrator.
2. There is one default user that cannot be deleted.
3. There are two default users and one cannot be deleted.
4. There is one default user that can be deleted.

A

There are two default users and one cannot be deleted.

Explanation
These users are created by default and cannot be deleted:

admin — Has full read/write capabilities for all Gaia features, from the WebUI and the CLI. This user has a User ID of 0, and therefore has all of the privileges of a root user.

monitor — Has read-only capabilities for all features in the WebUI and the CLI, and can change its own password. You must give a password for this user before the account can be used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

To install a brand-new Check Point Cluster, the Mega Corp IT department bought 1 Smart-1 and 2 Security Gateway Appliances to run a cluster. Which type of cluster is it?
1. Full HA Cluster
2. Standalone
3. High Availability
4. Distributed

A

High Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

What happens if the identity of a user is known?
1. If the user credentials do not match an Access Role, the system displays a sandbox.
2. If the user credentials match an Access Role, the rule is applied and traffic is accepted or dropped based on the defined action.
3. If the user credentials do not match an Access Role, the system displays the Captive Portal.
4. If the user credentials do not match an Access Role, the traffic is automatically dropped.

A

If the user credentials match an Access Role, the rule is applied and traffic is accepted or dropped based on the defined action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Which of the following is NOT a VPN routing option available in a star community?
1. To satellites through center only
2. To center, or through the center to other satellites, to Internet and other VPN targets
3. To center and to other satellites through center
4. To center only

A

1 and 4

Explanation
Smart Console

For simple hubs and spokes (or if there is only one Hub), the easiest way is to configure a VPN star community in R80 Smart Console:

  1. On the Star Community window, in the:

a. Center Gateways section, select the Security Gateway that functions as the “Hub”.

b. Satellite Gateways section, select Security Gateways as the “spokes”, or satellites.

  1. On the VPN Routing page, Enable VPN routing for satellites section, select one of these options:

a. To center and to other Satellites through center - This allows connectivity between the Security Gateways, for example if the spoke Security Gateways are DAIP Security Gateways, and the Hub is a Security Gateway with a static IP address.

b. To center, or through the center to other satellites, to internet and other VPN targets - This allows connectivity between the Security Gateways as well as the ability to inspect all communication passing through the Hub to the Internet.

  1. Create an appropriate Access Control Policy rule.
  2. NAT the satellite Security Gateways on the Hub if the Hub is used to route connections from Satellites to the Internet.

The two Dynamic Objects (DAIP Security Gateways) can securely route communication through the Security Gateway with the static IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

Which of the following statements accurately describes the command snapshot?
1. snapshot creates a full OS-level backup, including network-interface data, Check Point production information, and configuration settings of a GAiA Security Gateway.
2. snapshot creates a Security Management Server full system-level backup on any OS
3. snapshot stores only the system-configuration settings on the Gateway
4. A Gateway snapshot includes configuration settings and Check Point product information from the remote Security Management Server

A

snapshot creates a full OS-level backup, including network-interface data, Check Point production information, and configuration settings of a GAiA Security Gateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Which policy type is used to enforce bandwidth and traffic control rules?
1. Threat Prevention
2. Access Control
3. QoS
4. Threat Emulation

A

QoS

Explanation
Check Point’s QoS Solution

QoS is a policy-based QoS management solution from Check Point Software Technologies Ltd., satisfies your needs for a bandwidth management solution. QoS is a unique, software-only based application that manages traffic end-to-end across networks, by distributing enforcement throughout network hardware and software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

R80 Security Management Server can be installed on which of the following operating systems?
1. Gaia, SPLAT, Windows Server only
2. Gaia, SPLAT, Windows Server and IPSO only
3. Gaia and SPLAT only
4. Gaia only

A

Gaia only

Explanation
R80 can be installed only on GAIA OS.

Supported Check Point Installations All R80 servers are supported on the Gaia Operating System:

  • Security Management Server
  • Multi-Domain Security Management Server
  • Log Server
  • Multi-Domain Log Server
  • Smart Event Server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Admin A and Admin B are both logged in on Smart Console. What does it mean if Admin B sees a locked icon on a rule? Choose the BEST answer.
1. Rule is locked by Admin A and will make it available if session is published.
2. Rule is locked by Admin A because an object on that rule is been edited.
3. Rule is locked by Admin A, and if the session is saved, rule will be available
4. Rule is locked by Admin A, because the save bottom has not been press.

A

Rule is locked by Admin A and will make it available if session is published.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Anti-Spoofing is typically set up on which object type?
1. Network
2. Host
3. Security Gateway
4. Security Management object

A

Security Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

The most important part of a site-to-site VPN deployment is the .
1. VPN gateways
2. Encrypted VPN tunnel
3. Internet
4. Remote users

A

Encrypted VPN tunnel

Explanation
Site to Site VPN

The basis of Site to Site VPN is the encrypted VPN tunnel. Two Security Gateways negotiate a link and create a VPN tunnel and each tunnel can contain more than one VPN connection. One Security Gateway can maintain more than one VPN tunnel at the same time. Reference:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

What CLI utility allows an administrator to capture traffic along the firewall inspection chain?
1. fw monitor
2. tcpdump
3. tcpdump /snoop
4. show interface (interface) –chain

A

fw monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Mesh and Star are two types of VPN topologies. Which statement below is TRUE about these types of communities?
1. In a star community, satellite gateways cannot communicate with each other.
2. In a mesh community, member gateways cannot communicate directly with each other.
3. In a mesh community, all members can create a tunnel with any other member.
4. A star community requires Check Point gateways, as it is a Check Point proprietary technology.

A

In a mesh community, all members can create a tunnel with any other member.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

Fill in the blank: A is used by a VPN gateway to send traffic as if it were a physical interface.
1. VPN router
2. VPN Tunnel Interface
3. VPN interface
4. VPN community

A

VPN Tunnel Interface

Explanation
Route Based VPN

VPN traffic is routed according to the routing settings (static or dynamic) of the Security Gateway operating system. The Security Gateway uses a VTI (VPN Tunnel Interface) to send the VPN traffic as if it were a physical interface. The VTIs of Security Gateways in a VPN community connect and can support dynamic routing protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

Fill in the blanks: A Check Point software license consists of a\_\_\_\_\_\_\_\_\_\_\_\_\_ and\_\_\_\_\_\_\_\_\_\_\_\_ .
1. Software container; software package
2. Software package; signature
3. Software blade; software container
4. Signature; software blade

A

Software blade; software container

Explanation
Check Point’s licensing is designed to be scalable and modular. To this end, Check Point offers both predefined packages as well as the ability to custom build a solution tailored to the needs of the Network Administrator. This is accomplished by the use of the following license components:

Software Blades

Container

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Look at the following screenshot and select the BEST answer.
1. Internal clients can upload and download any-files to FTP_Ext-server using FTP.
2. Clients external to the Security Gateway can upload any files to the FTP_Ext-server using FTP.
3. Clients external to the Security Gateway can download archive files from FTP_Ext server using FTP.
4. Internal clients can upload and download archive-files to FTP_Ext server using FTP.

A

Clients external to the Security Gateway can download archive files from FTP_Ext server using FTP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Choose what BEST describes a Session?
1. Sessions locks the policy package for editing.
2. Starts when an Administrator logs in to the Security Management Server through Smart Console and ends when it is published.
3. Starts when an Administrator publishes all the changes made on Smart Console.
4. Sessions ends when policy is pushed to the Security Gateway.

A

Starts when an Administrator logs in to the Security Management Server through Smart Console and ends when it is published.

Explanation
Administrator Collaboration

More than one administrator can connect to the Security Management Server at the same time. Every administrator has their own username, and works in a session that is independent of the other administrators.

When an administrator logs in to the Security Management Server through SmartConsole, a new editing session starts. The changes that the administrator makes during the session are only available to that administrator. Other administrators see a lock icon on object and rules that are being edited.

To make changes available to all administrators, and to unlock the objects and rules that are being edited, the administrator must publish the session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

What statement is true regarding Visitor Mode?
1. All VPN traffic is tunneled through UDP port 4500.
2. VPN authentication and encrypted traffic are tunneled through port TCP 443.
3. Only Main mode and Quick mode traffic are tunneled on TCP port 443.
4. Only ESP traffic is tunneled through port TCP 443.

A

VPN authentication and encrypted traffic are tunneled through port TCP 443.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

Which of the following is NOT an alert option?
1. SNMP
2. User defined alert
3. Mail
4. High alert

A

High alert

Explanation
In Action, select: none - No alert. log

  • Sends a log entry to the database.

alert - Opens a pop-up window to your desktop. mail - Sends a mail alert to your Inbox. snmptrap - Sends an SNMP alert. useralert - Runs a script. Make sure a user-defined action is available. Go to SmartDashboard > Global Properties > Log and Alert > Alert Commands.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

When using LDAP as an authentication method for Identity Awareness, the query:
1. Requires client and server-side software.
2. Is transparent, requiring no client or server-side software, or client intervention.
3. Prompts the user to enter credentials.
4. Requires administrators to specifically allow LDAP traffic to and from the LDAP Server and the Security Gateway.

A

Is transparent, requiring no client or server-side software, or client intervention.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256 for IKE phase 2. Why is this a problematic setup?
1. All is fine as the longest key length has been chosen for encrypting the data and a shorter key length for higher performance for setting up the tunnel.
2. Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in phase 2 only costs performance and does not add security due to a shorter key in phase 1 .
3. All is fine and can be used as is.
4. The two algorithms do not have the same key length and so don’t work together. You will get the error … No proposal chosen…

A

Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in phase 2 only costs performance and does not add security due to a shorter key in phase 1.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

The organization’s security manager wishes to back up just the Gaia operating system parameters. Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries?
1. backup
2. up grade export
3. show configuration
4. migrate export

A

backup

Explanation
System Backup (and System Restore)

System Backup can be used to backup current system configuration. A backup creates a compressed file that contains the Check Point configuration including the networking and operating system parameters, such as routing and interface configuration etc., but unlike a snapshot, it does not include the operating system, product binaries, and hotfixes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

If there is an Accept Implied Policy set to “First”, what is the reason Jorge cannot see any logs?
1. Log Implied Rule was not selected on Global Properties.
2. Log Implied Rule was not set correctly on the track column on the rules base.
3. Track log column is set to none.
4. Track log column is set to Log instead of Full Log

A

Log Implied Rule was not selected on Global Properties.

Explanation
Implied Rules are configured only on Global Properties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

You installed Security Management Server on a computer using GAiA in the MegaCorp home office. You use IP address 10.1.1.1. You also installed the Security Gateway on a second GAiA computer, which you plan to ship to another Administrator at a MegaCorp hub office. What is the correct order for pushing SIC certificates to the Gateway before shipping it?
1. Run cpconfig on the Gateway, select Secure Internal Communication, enter the activation key, and reconfirm.
2. Initialize Internal Certificate Authority (ICA) on the Security Management Server.
3. Configure the Gateway object with the host name and IP addresses for the remote site.
4. Click the Communication button in the Gateway object’s General screen, enter the activation key, and click Initialize and OK.
5. Install the Security Policy.
* 2, 1, 3, 4, 5
* 2, 3, 4, 1, 5
* 2, 3, 4, 5,1
* 1, 3, 2, 4, 5

A

2, 1, 3, 4, 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Which directory holds the Smart Log index files by default?
1. $FWDIR/smart log
2. $SMARTLOGDIR/data
3. $FWDIR/log
4. $SMARTLOG/dir

A 
$SMARTLOGDIR/data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

Your bank’s distributed R77 installation has Security Gateways up for renewal. Which Smart Console application will tell you which Security Gateways have licenses that will expire within the next 30 days?
1. Smart Dashboard
2. Smart Update
3. SmartView Tracker
4. Smart Portal

A

Smart Update

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

Can a Check Point gateway translate both source IP address and destination IP address in a given packet?
1. Yes.
2. Yes, but only when using Manual NAT.
3. No.
4. Yes, but only when using Automatic NAT.

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

Which of the following is NOT defined by an Access Role object?
1. Source Server
2. Source Machine
3. Source User
4. Source Network

A

Source Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

What port is used for delivering logs from the gateway to the management server?
1. Port 18209
2. Port 258
3. Port 981
4. Port 257

A

Port 257

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

Which utility allows you to configure the DHCP service on Gaia from the command line?
1. ifconfig
2. dhcp_cfg
3. sysconfig
4. cpconfig

A 
sysconfig
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

Packages and licenses are loaded from all of these sources EXCEPT
1. Download Center Web site
2. UserUpdate
3. User Center
4. Check Point DVD

A

UserUpdate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

Which message indicates IKE Phase 2 has completed successfully?
1. Quick Mode Complete
2. Aggressive Mode Complete
3. Main Mode Complete
4. IKE Mode Complete

A

Quick Mode Complete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

Which back up method uses the command line to create an image of the OS?
1. System backup
2. Save Configuration
3. Migrate
4. snapshot

A 
snapshot
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

Which of the following is NOT a valid application tab in the R80 SmartConsole?
1. Manage and Command Line
2. Logs and Monitor
3. Security Policies
4. Gateway and Servers

A

Manage and Command Line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

Choose the BEST place to find a Security Management Server backup file named bachup_fw on a Check Point Appliance.
1. /var/log/CPbackup/backup_fw.tgz
2. /var/log/CPbackup/backups/backup_fw.tar
3. /var/CPbackup/backups/backup_fw.tar
4. /var/CPbackup/backups/backup_fw.tgz

A

/var/log/CPbackup/backup_fw.tgz

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

What is the most complete definition of the difference between the Install Policy…. button on the SmartConsole’s tab, and the Install Policy…. button within a specific policy?
1. The Global one also saves and publishes the session before the installation.
2. The Global one can install multipleselected policies at the same time.
3. The local one does not install the Anti-Malware policy along with the Network policy.
4. The second one pre-selects the installation for only the current policy and for the applicable gateways.

A

The second one pre-selects the installation for only the current policy and for the applicable gateways.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

Your internal networks 10.1.1.0/24. 10.2.2.0/24 and 192.168.0.0/16 are behind the internet Security Gateway. Considering that Layer 2 and Layer 3 setup is correct, what are the steps you will need to do in SmartConsole in order to get the connection working? Select the BEST answer.
A)
2. Define an accept rule in Security Policy.
2. Define Security Gateway to hide all internal networks behind the gateway’s external IP.
3. Publish and install the policy.
B)
1. Define an accept rule in Security Policy.
2. Configure automatic NAT for each network to NAT the networks behind a public IP.
3.Publish the policy.
C)
1. Define an accept rule in Security Policy.
2. Configure automatic NAT for each network to NAT the networks behind a public IP.
3. Publish and install policy.
D)
1. Define an accept rule in Security Policy.
2. Define Security Gateway to hide all internal networks behind the gateway’s external IP.
3. Publish the policy.

A

A)
1. Define an accept rule in Security Policy.
2. Define Security Gateway to hide all internal networks behind the gateway’s external IP.
3. Publish and install policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
147
Q

You have enabled “Full log” as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?
1. Logging has disk space issues, Change logging storage options on the logging server or Security Management Server properties and install database.
2. Data Awareness is not enabled.
3. Identity Awareness is not enabled.
4. Logs are arriving from Pre-R80 gateways.

A

Data Awarenes is not enabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
148
Q

In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?
1. Pentagon
2. Combined
3. Meshed
4. Star

A

Star

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
149
Q

In which scenario is it a valid option to transfer a license from one hardware device to another?
1. From a 4400 Appliance to an HP Open Server.
2. From an IBM Open Server to an HP Open Server.
3. From a 4400 Appliance to a 2200 Appliance.
4. From an IBM Open Server to a 2200 Appliance.

A

From an IBM Open Server to an HP Open Server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
150
Q

Fill in the blank: Service blades must be attached to a \_\_\_\_\_\_\_\_\_
1. Security Gateway
2. Management container
3. Management server
4. Security Gateway container

A

Security Gateway container

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
151
Q

Fill in the blank: In Security Gateways R75 and above, SIC uses \_\_\_\_\_\_\_\_ for encryption.
1. AES-128
2. AES-256
3. DES
4. 3DES

A

AES-128

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
152
Q

Fill in the blank: The \_\_\_\_\_\_\_ software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities.
1. Application Control
2. Data Awareness
3. URL Filtering
4. Threat Emulation

A

URL Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
153
Q

Which of the following licenses are considered temporary?
1. Perpetual and Trial
2. Plug-and-play and Evaluation
3. Subscription and Perpetual
4. Evaluation and Subscription

A

Plug-and-play and Evaluation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
154
Q

You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have recieved a call by one of the management users stating that they are unable to browse the Internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway. How do you review the logs to see what the problem may be?
1. Open SmartLog and connected remotely to the IP of the wireless controller.
2. Open SmartView Tracker and filter the logs for the IP address of the tablet.
3. Open SmartView Tracker and check all the IP logs for the tablet.
4. Open SmartLog and query for the IP address of the Manager’s tablet.

A

Open SmartLog and query for the IP address of the Manager’s tablet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
155
Q

Which of the following is NOT a set of Regulatory Requirements related to Information Security?
1. ISO 37001
2. Sarbanes Oxley (SOX)
3. HIPAA
4. PCI

A

ISO 37001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
156
Q

What is the most recommended installation method for Check Point appliances?
1. SmartUpdate installation
2. DVD media created with Check Point ISOMorphic.
3. USB media created with Check Point ISOMorphic.
4. Cloud based installation.

A

USB media created with Check Point ISOMorphic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
157
Q

Which product correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices?
1. SmartView Monitor
2. SmartEvent
3. SmartUpdate
4. SmartDashboard

A

SmartEvent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
158
Q

How do you manage Gaia?
1. Through CLI and WebUI
2. Through CLI only
3. Through SmartDashboard only
4. Through CLI, WebUI, and SmartDashboard

A

Through CLI and WebUI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
159
Q

Which of the following is an authentication method used for Identity Awareness?
1. SSL
2. Captive Portal
3. PKI
4. RSA

A

Captive Portal

160
Q

What protocol is specifically used for clustered environments?
1. Cluster Protocol
2. Synchronized Cluster Protocol
3. Control Cluster Protocol
4. Cluster Control Protocol

A

Cluster Control Protocol

161
Q

When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?
1. RADIUS
2. Remote Access and RADIUS
3. AD Query
4. AD Query and Browser-based Authentication

A

AD Query and Browser-based Authentication

162
Q

Fill in the blank: Once a certificate is revoked from the Security Gateway by the Security Gateway by the Security Management Server, the certificate information is \_\_\_\_\_\_\_\_\_.
1. Sent to the Internal Certificate Authority.
2. Sent to the Security Administrator.
3. Stored on the Security Management Server.
4. Stored on the Certificate Revocation List.

A

Stored on the Certificate Revocation List.

163
Q

Where can you trigger a failover of the cluster members?
1. Log in to Security Gateway CLI and run command clusterXL_admin down.
2. In SmartView Monitor right-click the Security Gateway member and select Cluster Member stop.
3. Log into Security Gateway CLI and run command cphaprob down

A) 1, 2 and 3
B) 2 and 3
C) 1 and 2
D) 1 and 3

A

B) 2 and 3

164
Q

Phase 1 of the two-phase negotiation process conducted by IKE operates in \_\_\_\_\_\_\_\_\_ mode.
1. Main
2. Authentication
3. Quick
4. High Alert

A

Main

165
Q

Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in:
1. When Joe logs in, Bob will be log out automatically.
2. Since they both are log in on different interfaces, they both will be able to make changes.
3. If Joe tries to make changes, he won’t, database will be locked.
4. Bob will be prompt that Joe logged in.

A

If Joe tries to make changes, he won’t, database will be locked.

166
Q

Fill in the blanks: A Security Policy is created in \_\_\_\_\_\_\_, stored in the \_\_\_\_\_\_\_, and Distrubuted to the various \_\_\_\_\_\_\_\_\_.
1. Rule base, Security Management Server, Security Gateways.
2. SmartConsole, Security Gateway, Security Management Gateways.
3. SmartConsole, Security Management Server, Security Gateways.
4. The Check Point database, SmartConsole, Security Gateways.

A

SmartConsole, Security Management Server, Security Gateways

167
Q

Fill in the blank: A(n)\_\_\_\_\_\_\_\_ rule is created by an administrator and is located before the first and before last rules in the Rule Base.
1. Firewall drop
2. Explicit
3. Implicit accept
4. Implicit drop

A

Explicit

168
Q

Fill in the blank: A \_\_\_\_\_\_\_\_\_ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser.
1. Clientless remote access
2. Clientless direct access
3. Client-based remote access
4. Direct access

A

Clientless remote access

169
Q

Which type of Endpoint Identity Agent includes packet tagging and computer authentication?
1. Full
2. Light
3. Custom
4. Complete

A

Full

170
Q

Choose what BEST describes a Session.
1. Starts when an Administrator publishes all the changes made on SmartConsole.
2. Starts when an Administrator logs in to the Security Management Server through SmartConsole and ends when it is published.
3. Sessions ends when policy is pushed to the Security Gateway.
4. Sessions locks the plicy package for editing.

A

Starts when an Administrator logs in to the Security Management Server through SmartConsole and ends when it is published.

171
Q

Administrator Dave, logs into R80 Management Server to review and makes some rule changes. He notices that there is a padlock sign next to the DNS rule in the Rule Base.
1. DNS Rule is using one of the new features of R80 where an administrator can mark a rule with the padlock icon to let other administrators know it is important.
2. Another administrator is logged into the Management and currently editing the DNS Rule.
3. DNS Rule is a placeholder rule for a rule that existed in the past but was deleted.
4. This is normal behavior in R80 when there are duplicate rules in the Rule Base.

A

Another administrator is logged into the Management and currently editing the DNS Rule.

172
Q

What is the default shell of Gaia CLI?
1. Monitor
2. CLI.sh
3. Read-only
4. Bash

A

CLI.sh

173
Q

Fill in the blank: RADIUS protocol uses \_\_\_\_\_\_\_\_ to communicate with the gateway.
1. UDP
2. TDP
3. CCP
4. HTTP

A

UDP

174
Q

Which authentication scheme requires a user to possess a token?
1. TACACS
2. SecureID
3. Check Point password
4. RADIUS

A

SecureID

175
Q

What are the two high availability modes?
1. Load Sharing and Legacy
2. Traditional and New
3. Active and Standby
4. New and Legacy

A

New and Legacy

176
Q

If there is an Accept Implied Policy set to “First”, what is the reason Jorge cannot see any logs?
1. Log Implied Rule was not selected on Global Properties.
2. Log Implied Rule was not set correctly on the track column on the rules base.
3. Track log column is set to none.
4. Track log column is set to Log instead of Full Log.

A

Log Implied Rule was not selected on Global Properties.

177
Q

Which deployment adds a Security Gateway to an existing environment without changing IP routing?
1. Distrubuted
2. Bridge Mode
3. Remote
4. Standalone

A

Bridge Mode

178
Q

Which of the following is NOT an alert option?
1. SNMP
2. High Alert
3. Mail
4. User defined

A

High Alert

179
Q

In the Check Point Security Management Architecture, which component(s) can store logs?
1. SmartConsole
2. Security Management Server and Security Gateway.
3. Security Management Server
4. SmartConsole and Security Management Server

A

Security Management Server and Security Gateway.

180
Q

Which of the following licenses are considered temporary?
1. Perpetual and Trial
2. Plug-and-play and Evaluation
3. Subscription and Perpetual
4. Evaluation and Subscription

A

Plug-and-play and Evaluation

181
Q

Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using \_\_\_\_\_\_\_\_.
1. User Directory
2. Captive Portal And Transparent Kerberos Authentication
3. Captive Portal
4. UserCheck

A

Captive Portal and Transparent Kerberos Authentication

182
Q

which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?
1. All Connections (Clear or Encrypted)
2. Accept all encrypted traffic
3. Specific VPN communities
4. All Site-to-Site VPN Communities

A

Specific VPN Communities

183
Q

Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as \_\_\_\_\_\_\_\_
1. UserCheck
2. User Directory
3. User Administration
4. User Center

A

User Directory

184
Q

What two ordered layers make up the Access Control Policy Layer?
1. URL Filtering and Network
2. Network and Threat Prevention
3. Application Control and URL Filtering
4. Network and Application Control

A

Network and Application Control

185
Q

While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain. Why does it not detect the windows domain?
1. Security Gateway is not part of the Domain
2. SmartConsole machine is not part of the domain
3. SMS is not part of the domain
4. Identity Awareness is not enabled on Global properties

A

SmartConsole machine is not part of the domain.

186
Q

Which of the following is TRUE about the Check Point Host object?
1. Check Point Host has no routing ability even if it has more than one interface installed.
2. When you upgrade to R80 from R77.30 or earlier versions, Check Point Host object are converted to gateway objects.
3. Check Point Host is capable of having an IP forwarding mechanism.
4. Check Point Host can act as a firewall.

A

Check Point Host has no routing ability even if it has more than one interface installed.

187
Q

What is the Implicit Clean-up Rule?
1. A setting that is defined in the Global Properties for all policies.
2. A setting that is configured per Policy Layer.
3. Another name for the Clean-up Rule.
4. Automatically created when the Clean-up Rule is defined.

A

A setting that is defined in the Global Properties for all policies.

188
Q

In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server (Security Management Server)?
1. Display policies and logs on the administrator’s workstation.
2. Verify and compile Security Policies.
3. Processing and sending alerts such as SNMP traps and email notifications.
4. Store firewall logs to hard drive storage.

A

Display policies and logs on the administrator’s workstation.

189
Q

Which command shows the installed licenses?
~~~
1. cplic print
2. print cplic
3. fwlic print
4. show licenses
~~~

A 
cplic print
190
Q

Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?
1. Firewall
2. Identity Awareness
3. Application Control
4. URL Filtering

A

Identity Awareness

191
Q

Fill in the blank: Once a license is activated, a \_\_\_\_\_\_\_ should be installed.
1. License Management file
2. Security Gateway Contract file
3. Service Contract file
4. License Contract file

A

Service Contract File

192
Q

You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have recieved a call by one of the management users stating that they are unable to browse the internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway. How do you review the logs to see what the problem may be?
1. Open SmartLog and connect remotely to the IP of the wireless controller.
2. Open SmartView Tracker and filter the logs for the IP address of the tablet.
3. Open SmartView Tracker and check all the IP logs for the tablet.
4. Open SmartLog and query for the IP address of the Manager’s tablet.

A

Open SmartLog and query for the IP address of the Manager’s tablet.

193
Q

True or False: In R80, more than one administrator can login to the Security Management Server with write permission at the same time.
1. False, this feature has to be enabled in the Global Properties.
2. True, every administrator works in a session that is independent of the other administrators.
3. True, every administrator works on a different database that is independant of the other administrators.
4. False, only one administrator can login with write permission.

A

True, every administrator works in a session that is independant of the other administrators.

194
Q

Fill in the blank: \_\_\_\_\_\_\_\_\_\_ information is included in “Full Log” tracking option, but is not included in “Log” tracking option?
1. Destination port
2. Data type
3. File attributes
4. Application

A

Data type

195
Q

Fill in the blank: In the network policy layer, the default action for the implied rule is \_\_\_\_\_\_\_\_ all traffic. However, in the Application Control policy layer, the default action is \_\_\_\_\_\_\_\_\_\_ all traffic.
1. Accept; redirect
2. Accept; drop
3. Redirect; drop
4. Drop; accept

A

Drop; accept

196
Q

Fill in the blank: It is Best Practice to have a \_\_\_\_\_\_\_ rule at the end of each policy layer.
1. Explicit Drop
2. Implied Drop
3. Explicit Cleanup
4. Implicit Drop

A

Explicit Cleanup

197
Q

At what point is the Internal Certificate Authority (ICA) created?
1. Upon creation of a certificate
2. During the primary Security Management Server installation process.
3. When an administrator decides to create one.
4. When an administrator initially logs into SmartConsole.

A

During the primary Security Management Server installation process.

198
Q

Fill in the blank: Each cluster has \_\_\_\_\_\_\_ interfaces.
1. Five
2. Two
3. Three
4. Four

A

Three

199
Q

What are the three authentication methods for SIC?
1. Passwords, Users, and standards-based SSL for the creation of secure channels.
2. Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption.
3. Packet Filtering, certificates, and 3DES or AES128 for encryption
4. Certificates, Passwords, and Tokens

A

Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption.

200
Q

Which of the following commands is used to monitor cluster members?
~~~
1. cphaprob state
2. cphaprob status
3. cphaprob
4. cluster state
~~~

A

cphaprob state

201
Q

To enforce the Security Policy correctly, a Security Gateway requires:
1. a routing table
2. awareness if the network topology.
3. a Demilitarized Zone.
4. a Security Policy install

A

awareness of the network topology

202
Q

Which of the following are types of VPN communities?
1. Pentagon, star, and combination
2. Star, octagon, and combination
3. Combined and star
4. Meshed, star, and combination

A

Meshed, star, and combination

203
Q

Which Threat Preventation Software Blade provides protection from malicious software that can infect your network computers?
1. Anti-Malware
2. IPS
3. Anti-bot
4. Anti-spam

A

IPS

204
Q

Fill in the blank: Back up and restores can be accomplished through \_\_\_\_\_\_\_\_.
1. SmartConsole, WebUI, or CLI
2. WebUI, CLI, or SmartUpdate
3. CLI, SmartUpdate, or SmartBackup
4. SmartUpdate, SmartBackup, or SmartConsole

A

SmartConsole, WebUI, or CLI

205
Q

There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High Availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A’s interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically?
1. No, since “maintain current active cluster member” option on the cluster object properties is enabled by default.
2. No, since “maintain current active cluster member” option is enabled by default on the Global Properties.
3. Yes, since “Switch to higher priority cluster member” option on the cluster object properties is enabled by default.
4. Yes, since “Switch to higher priority cluster member” option is enabled by default on the Global Properties.

A

No, since “maintain current active cluster member” option on the cluster object properties is enabled by default.

206
Q

Fill in the blank: Authentication rules are defined for \_\_\_\_\_\_\_\_\_.
1. User Groups
2. Users using UserCheck
3. Individual users
4. All users in the database

A

User groups

207
Q

How can the changes made by an administrator before publishing the session be seen by a superuser administrator?
1. By impersonating the administrator with the “Login as…” option.
2. They cannot be seen.
3. From the SmartView Tracker audit log.
4. From Manage and Settings > Sessions, right-click on the session and click “View Changes…”

A

They cannot be seen

208
Q

Fill in the blank: When a policy is installed, \_\_\_\_\_\_\_ are also distributed to the target installation Security Gateways.
1. User and objects databases
2. Network databases
3. SmartConsole databases
4. User databases

A

User and objects databases

209
Q

Fill in the blanks: With each new policy layer, the \_\_\_\_\_\_ rule is automatically set to \_\_\_\_\_\_\_\_ all traffic.
1. Explicit default; drop
2. Implicit default; accept
3. Implicit cleanup; drop
4. Explicit default; accept

A

Explicit default; drop

210
Q

Phase 1 of the two-phase negotioation process conducted by IKE operates in \_\_\_\_\_\_\_\_ mode.
1. Main
2. Authentication
3. Quick
4. High Alert

A

Main

211
Q

Which of the following is NOT an element of VPN Simplified Mode and VPN communitites?
1. “Encrypt” action in the Rule Base
2. Permanent Tunnels
3. “VPN” column in the Rule Base
4. Configuration checkbox “Accept all encrypted traffic”

A

“Encrypted” action in the Rule Base

212
Q

When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?
1. RADIUS
2. Remote Access and RADIUS
3. AD Query
4. AD Query and Browser-based Authentication

A

AD Query and Browser-based Authentication.

213
Q

What is NOT an advantage of Packet Filtering?
1. Low Security and No Screening above Network Layer
2. Application Independence
3. High Performance
4. Scalability

A

Low Security and No Screening above Network Layer

214
Q

Check Point uses these technologies to deny or permit network traffic:
1. Packet Filtering
2. Statefull Inspection
3. Application Layer Firewall
4. All the above

A

All the above
* Packet Filtering
* Statefull Inspection
* Application Layer Firewall

Managing firewalls and monitoring network traffic is the key role of a network security administrator. Effectively controlling network traffic helps to improve overall network performance and organizational security. The Firewall, or the Security Gateway with a firewall enabled, will deny or permit traffic based on rules defined in the security policy. The following technologies are used to deny or permit network traffic:
Packet Filtering
Stateful Inspection
Application Layer Firewall

215
Q

The Check Point Firewall kernel module inspects packets between which layers?
1. layers 1 and 2
2. layers 2 and 3
3. layers 1 and 4
4. layers 3 and 7

A

Layers 2 and 3

216
Q

Packet Filtering
Packets include the following elements:
1. Source and destination address, source and destination port, protocol
2. Source and destination port, protocol, data packets
3. Source and destination address, source and destination port, data frames
4. Source and destination port, protocol, data streams

A

Source and destination address, source and destination port, protocol

217
Q

What are Pros and cons of Packet Filtering?
1. Pros: High Security, High Performance, Scalability. Cons: No screening above Network Layer (No “state or application context information”)
2. Pros: Application Independance, High Performance, Scalability. Cons: Low Security, No Screening above Network Layer (No “state or application context information”)

A

Pros: Application Independance, High Performance, Scalability. Cons: Low Security, No Screening above Network Layer (No “state or application context information”)

218
Q

How does the Stateful Inspection work?

A
  1. Examines the context of a packet.
  2. Monitors the state of the connection.
  3. Uses Check Point’s INSPECT Engine to extract state related information from the packet.

Stateful inspection analyzes a packet’s source and destination addresses, source and destination ports, protocol and contents. With Stateful inspection, the state of the connection is monitored and state tables are created to compile the information. State tables hold useful information in regards to monitoring performance through a Security Gateway. As a result filtering includes content that has been established by previous packets passed through the Firewall. For example, Stateful Inspection provides a security measure against port scanning by closing all ports until the specific port is requested.

Check Point’s INSPECT Engine, which is installed on a Security Gateway, is used to extract state related information from the packets and store that information in state tables. State tables are key components of the Stateful Inspection technology because they are vital in maintaining state information needed to correctly inspect packets. When new packets arrive, their contents are compared to the state tables to determine whether they are denied or permitted.

219
Q

How does Stateful Inspection and Packet Filtering Differ?

A

Stateful Inspection
* Examines the packet header and contents
* Only one rule required for each connection

Packet Filtering
* Examines the packet header
* Requires two rules for each connection

Stateful Inspection differs from Packet Filtering in that it deeply examines a packet not only in its header, but also the contents of the packet up through the Application layer to determine more about the packet than just information about its source and destination. In addition, Packet filtering requires creating two rules for each user or computer that needs to access resources. For example, if a computer with IP address 10.1.1.201 needs to access 8.8.8.8 on the Internet for DNS, an outgoing request rule is needed for connecting to the server on the Internet and a second rule is required for the incoming reply for the same connection. The creation of Stateful Inspection eliminated the need for two rules. The Firewall remembers each reply for an existing request using the state tables. Therefore only one rule is required for each connection.

220
Q

What does OSI in OSI-Model stands for?

A

Open Systems Interconnect

221
Q

Which icon in the WebUI indicates that read/write access is enabled?
A. Eyeglasses
B. Pencil
C. Padlock
D. Book

A

B. Pencil

222
Q

Which default Gaia user has full read/write access?
A. superuser
B. monitor
C. altuser
D. admin

A

D. admin

223
Q

Which SmartConsole tab is used to monitor network and security performance?
A. Logs Monitor
B. Manage Settings
C. Security Policies
D. Gateway Servers

A

A. Logs Monitor

224
Q

Check Point Update Service Engine (CPUSE), also known as Deployment Agent [DA], is an advanced and intuitive mechanism for software deployment on Gaia OS. What software packages are supported for deployment?

A. It supports deployments of single HotFixes (HF), and of Major Versions. Blink Packages and HotFix Accumulators (Jumbo) are not supported.
B. It supports deployments of single HotFixes (HF), of HotFix Accumulators (Jumbo), and of Major Versions.
C. It supports deployments of Major Versions and Blink packages only.
D. It supports deployments of single HotFixes (HF), of HotFix Accumulators (Jumbo), but not of Major Versions.

A

B. It supports deployments of single HotFixes (HF), of HotFix Accumulators (Jumbo), and of Major Versions.

225
Q

Vanessa is firewall administrator in her company; her company is using Check Point firewalls on central and remote locations, which are managed centrally by
R80 Security Management Server. One central location has an installed R77.30 Gateway on Open server. Remote location is using Check Point UTM-1 570 series appliance with R71. Which encryption is used in Secure Internal Communication (SIC) between central management and firewall on each location?

A. On central firewall AES128 encryption is used for SIC, on Remote firewall 3DES encryption is used for SIC.
B. On both firewalls, the same encryption is used for SIC. This is AES-GCM-256.
C. The Firewall Administrator can choose which encryption suite will be used by SIC.
D. On central firewall AES256 encryption is used for SIC, on Remote firewall AES128 encryption is used for SIC.

A

A. On central firewall AES128 encryption is used for SIC, on Remote firewall 3DES encryption is used for SIC.

226
Q

Which of the following is NOT a SecureXL traffic flow?
A. Medium Path
B. Accelerated Path
C. High Priority Path
D. Slow Path

A

C. High Priority Path

SecureXL is an acceleration solution that maximizes performance of the Firewall and does not compromise security. When SecureXL is enabled on a Security
Gateway, some CPU intensive operations are processed by virtualized software instead of the Firewall kernel. The Firewall can inspect and process connections more efficiently and accelerate throughput and connection rates. These are the SecureXL traffic flows:
Slow path - Packets and connections that are inspected by the Firewall and are not processed by SecureXL.
Accelerated path - Packets and connections that are offloaded to SecureXL and are not processed by the Firewall.
Medium path - Packets that require deeper inspection cannot use the accelerated path. It is not necessary for the Firewall to inspect these packets, they can be offloaded and do not use the slow path. For example, packets that are inspected by IPS cannot use the accelerated path and can be offloaded to the IPS PSL
(Passive Streaming Library). SecureXL processes these packets more quickly than packets on the slow path.

227
Q

Which of the following Automatically Generated Rules NAT rules have the lowest implementation priority?
A. Machine Hide NAT
B. Address Range Hide NAT
C. Network Hide NAT
D. Machine Static NAT

A

B. Address Range Hide NAT
C. Network Hide NAT

SmartDashboard organizes the automatic NAT rules in this order:
1. Static NAT rules for Firewall, or node (computer or server) objects
2. Hide NAT rules for Firewall, or node objects
3. Static NAT rules for network or address range objects
4. Hide NAT rules for network or address range objects

228
Q

VPN gateways authenticate using ___________ and ___________ .
A. Passwords; tokens
B. Certificates; pre-shared secrets
C. Certificates; passwords
D. Tokens; pre-shared secrets

A

VPN gateways authenticate using Digital Certificates and Pre-shared secrets.

229
Q

In R80 spoofing is defined as a method of:
A. Disguising an illegal IP address behind an authorized IP address through Port Address Translation.
B. Hiding your firewall from unauthorized users.
C. Detecting people using false or wrong authentication logins
D. Making packets appear as if they come from an authorized IP address.

A

D. Making packets appear as if they come from an authorized IP address.

IP spoofing replaces the untrusted source IP address with a fake, trusted one, to hijack connections to your network. Attackers use IP spoofing to send malware and bots to your protected network, to execute DoS attacks, or to gain unauthorized access.

230
Q

The __________ is used to obtain identification and security information about network users.
A. User Directory
B. User server
C. UserCheck
D. User index

A

A. User Directory

231
Q

Which Check Point Application Control feature enables application scanning and detection?
A. Application Dictionary
B. AppWiki
C. Application Library
D. CPApp

A

B. AppWiki

AppWiki Application Classification Library
AppWiki enables application scanning and detection of more than 5,000 distinct applications and over 300,000 Web 2.0 widgets including instant messaging, social networking, video streaming, VoIP, games and more.

232
Q

DLP and Geo Policy are examples of what type of Policy?
A. Standard Policies
B. Shared Policies
C. Inspection Policies
D. Unified Policies

A

B. Shared Policies

233
Q

In which deployment is the security management server and Security Gateway installed on the same appliance?
A. Bridge Mode
B. Remote
C. Standalone
D. Distributed

A

C. Standalone

Installing Standalone -
Standalone Deployment - The Security Management Server and the Security Gateway are installed on the same computer or appliance.

234
Q

A _________ VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser.
A. Clientless remote access
B. Clientless direct access
C. Client-based remote access
D. Direct access

A

Clientless - Users connect through a web browser and use HTTPS connections. Clientless solutions usually supply access to web-based corporate resources.

235
Q

Which of the following statements is TRUE about R80 management plug-ins?

A. The plug-in is a package installed on the Security Gateway.
B. Installing a management plug-in requires a Snapshot, just like any upgrade process.
C. A management plug-in interacts with a Security Management Server to provide new features and support for new products.
D. Using a plug-in offers full central management only if special licensing is applied to specific features of the plug-in.

A

C. A management plug-in interacts with a Security Management Server to provide new features and support for new products.

236
Q

Gaia can be configured using the _______ or ______ .
A. GaiaUI; command line interface
B. WebUI; Gaia Interface
C. Command line interface; WebUI
D. Gaia Interface; GaiaUI

A

C. Command line interface; WebUI

Configuring Gaia for the First Time
In This Section:
Running the First Time Configuration Wizard in WebUI
Running the First Time Configuration Wizard in CLI
After you install Gaia for the first time, use the First Time Configuration Wizard to configure the system and the Check Point products on it.

237
Q

Where can you trigger a failover of the cluster members?
1. Log in to Security Gateway CLI and run command clusterXL_admin down.
2. In SmartView Monitor right-click the Security Gateway member and select Cluster member stop.
3. Log into Security Gateway CLI and run command cphaprob down.
A. 1, 2, and 3
B. 2 and 3
C. 1 and 2
D. 1 and 3

A

C. 1 and 2

238
Q

What are the three main components of the Check Point Three-Tier Architecture?

A
  1. SmartConsole
  2. Security Management Server
  3. Security Gateway
239
Q

What is the main purpose of SmartConsole?

A

SmartConsole is the management component. It is software installed on a Windows platform that provides a graphical interface for centralized management of the Check Point environment.

240
Q

What is the main purpose of a Security Management Server?

A

The Security Management Server is a dedicated server that runs Check Point software to manage the objects and policies in a Check Point environment.

The Security Management Server software is installed on a server running the Check Point Gaia operating system.

241
Q

What is the main purpose of a Security Gateway?

A

A Security Gateway is an entry point or cyber barrier that prevents unauthorized traffic from entering a company’s network. It stands between incoming and outgoing traffic and enforces an organization’s security policy. Security Gateways are placed at the perimeter of the network topology to protect an organization’s environment through enforcement of security policies.

242
Q

List the two main shells that the Gaia operating system provides.

A
  1. Gaia Clish
  2. Bash (Expert mode)
243
Q

Which shell is most restrictive?

A

Gaia Clish

244
Q

What is the default shell?

A

Gaia Clish

245
Q

What is the default password for Expert mode?

A

There is no default password for Expert mode. It must be defined using the set expert-password command.

246
Q

Give at least one example of a physical component that network objects represent.

A

Network Objects represent physical components such as Gateways, Management Servers, and users.

247
Q

Give at least one example of a logical component that network objects represent.

A

Network Objects represent logical components such as applications, IP address ranges, and services.

248
Q

What Permissions Profile allows unrestricted permissions?

A

Super User

249
Q

Name the three types of Software Containers.

A
  1. Security Management
  2. Security Gateway
  3. Endpoint Security
250
Q

What are Subscription Blades?

A

Service blades, such as IPS, URL Filtering, and Application Control are considered subscription blades. Licenses for subscription blades can expire. The license includes both the software subscription and the associated Support Services Contract. These blades are licensed and renewed for a specified period of time, which is typically 1, 2, or 3 years.

251
Q

Name one reason to generate and install a new license.

A
  • Existing license expires
  • License is upgraded
  • IP address of the Security Management or Security Gateway has changed
252
Q

What type of rules are created by the Security Gateway?

A

Implied Rules

253
Q

What type of rules are created by the administrator?

A

Explicit Rules

254
Q

Where should the Cleanup rule be placed?

A

At the bottom of the rulebase

255
Q

What is the purpose of Policy layers?

A

Policy layers are sets of rules or a rulebase. They let you divide a policy, such as the Access Control policy, into smaller, more manageable sections that serve a certain purpose. The layers concept also provides more options for policy management, including the ability to set different views and edit permissions per layer for different administrator roles.

256
Q

What type of Policy layer is independent of the rest of the rulebase?

A

Inline

257
Q

List the two types of rules that Check Point NAT supports for address translation

A
  • Automatic
  • Manual
258
Q

What is the difference between Hide NAT and Static NAT?

A

Hide NAT is a solution that only allows outgoing connections. It involves translating many private addresses to one public address. Using Hide NAT, the defined hosts and networks share the same address when their traffic is routed by the gateway. Different source port numbers are used to identify internal IP addresses on the one shared IP address. The source IP address is changed to the shared address and the source port is modified to the identifier port. Hide NAT is most often used to allow internal users access to external resources.

Static NAT allows both incoming and outgoing connections. It involves the translation of one private IP address to a unique public IP address to the private address. Static NAT allows a host with a private IP address to be translated to a unique public address. Static NAT allows a host with a private IP address to be translated to a unique public address. This method of translation is often used for Internet Web Servers and Check Point Security Management Servers. Any application that requires both inbound and outbound connectivity, or the ability for external hosts to connect to the servers requires a Static NAT configuration.

259
Q

List at least two use cases for Application Control

A
  • Learn About Application
  • Create a Granular Policy
  • Track Employees Online Usage
  • Keep Policies Updated
  • Customize Application, Sites, Categories, and Groups
260
Q

How does URL filtering work?

A

URL filtering works by comparing all web traffic against URL filters, which are typically contained in a database of sites that users are permitted to access or denied from accessing.

261
Q

What is the recommended profile supported by Autonomous Threat Prevention?

A

Perimeter (Recommended)

262
Q

What is a VPN community?

A

A VPN community is a named collection of VPN domains (hosts/networks that use the Security Gateway to send/recieve VPN traffic), each protected by a VPN Gateway. All the attributes of the VPN Tunnels are defined in the VPN Community.

263
Q

Define IKEv1 and IKEv2

A
  • IKEv1 is the default version which is supported on most new and older systems.
  • IKEv2 is the newer version supporting IPv6, but currently Check Point Remote Access VPN clients do not support it.
264
Q

List the two topologies on which VPN communities can be based

A

VPN communities can be based on Mesh and Star topologies

265
Q

Which tool can be used to collect and view logs and monitor devices?

A

SmartConsole

266
Q

How many logs are typically displayed in the default view?

A

50

267
Q

What information is available in the Gateway & Servers Monitor?

A
  • Device Status
  • License Status
  • System Counters
  • Traffic
268
Q

Give at least two situations in which a snapshot is recommended.

A
  • After a fresh installation of Gaia
  • Before making a major configuration
  • Before an upgrade or hotfix changes
269
Q

Why is it recommended to schedule regular backups?

A

To preserve the Gaia operating system configuration and Firewall database

270
Q

Why is it recommended to schedule regular backups?

A

Backup and Restore

271
Q

In what compressed file format is a backup saved?

A

A *.tgz file

272
Q

What is Application Interfaces (APIs)?

A

Check Point offers a variety of APIs to automate security tasks, including administrative duties and incident detection and response. Also known as Check Point Management APIs.

273
Q

What does Cluster mean?

A

Two or more Security Gateways that work together in a redundant configuration - High Availability or Load Sharing.

274
Q

What is CoreXL?

A

Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point firewall instances run in parallel on multiple CPU cores.

275
Q

What is CPUSE?

A

Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS and the Gaia OS itself.

276
Q

What does Distributed Deployment mean?

A

Configuration in which the Check Point Security Gateway and the Security Management Server products are installed on different computers.

277
Q

What is Gaia Clish?

A

Local command line shell in Check Point Gaia operating system.

278
Q

What is Gaia Portal?

A

Web interface for the Check Point Gaia operating system.

279
Q

What is SecureXL?

A

Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway.

280
Q

What is SIC?

A

Secure Internal Communication is a Check Point proprietary mechanism with Check Point computers that run Check Point software authenticate each othe over SSL for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server.

281
Q

What is a VPN?

A

Virtual Private Network, is a technology that provides a secure, private connection between two points communicating over a network.

282
Q

Which tool allows automatic update of Gaia OS and Check Point products installed on Gaia OS?
1. CPDAS - Check Point Deployment Agent Service
2. CPUSE - Check Point Upgrade Service Engine
3. CPASE - Check Point Automatic Service Engine
4. CPAUE - Check Point Automatic Update Engine

A

2.CPUSE - Check Point Upgrade Service Engine

283
Q

In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server?
1. Verify and compile Security Policies.
2. Display policies and logs on the administrator’s workstation.
3. Store firewall logs to hard drive storage.
4. Manage the object database.

A

2.Display policies and logs on the administrator’s workstation.

284
Q

True or False: More than one administrator can log into the Security Management Server with SmartConsole with write permission at the same time.
1. True, every administrator works on a different database that is independent of the other administrators
2. False, only one administrator can login with write permission
3. True, every administrator works in a session that is independent of the other administrators
4. False, this feature has to be enabled in the Global Properties

A

3.True, every administrator works in a session that is independent of the other administrators

285
Q

What are the two deployment options available for a security gateway?
1. Bridge and Switch
2. Local and Remote
3. Cloud and Router
4. Standalone and Distributed

A

4.Standalone and Distributed

286
Q

One of major features in SmartConsole is concurrent administration. Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?
1. AdminB sees a pencil icon next the rule that AdminB is currently editing.
2. AdminA, AdminB and AdminC are editing three different rules at the same time.
3. AdminA and AdminB are editing the same rule at the same time.
4. AdminC sees a lock icon which indicates that the rule is locked for editing by another administrator.

A

3.AdminA and AdminB are editing the same rule at the same time.

287
Q

Which one of the following is the preferred licensing model? Select the BEST answer.
1. Local licensing because it ties the package license to the IP-address of the gateway and has no dependency of the Security Management Server.
2. Local licensing because it ties the package license to the MAC-address of the gateway management interface and has no Security Management Server dependency.
3. Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency on the gateway.
4. Central licensing because it ties the package license to the MAC-address of the Security Management Server’s Mgmt-interface and has no dependency on the gateway.

A

3.Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency on the gateway.

288
Q

A Check Point Software license consists of two components, the Software Blade and the Software Container. There are _____ types of Software Containers: _____.
1. Two; Security Management and Endpoint Security
2. Three; Security Management, Security Gateway, and Endpoint Security
3. Three; Security Gateway, Endpoint Security, and Gateway Management
4. Two; Endpoint Security and Security Gateway

A

2.Three; Security Management, Security Gateway, and Endpoint Security

289
Q

Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?
1. Formal
2. Central
3. Local
4. Corporate

A

3.Local

290
Q

Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made?
1. Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.
2. Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes.
3. Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.
4. Tom’s changes will be lost since he lost connectivity and he will have to start again.

A

3.Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.

291
Q

In which deployment is the security management server and Security Gateway installed on the same appliance?
1. Switch
2. Standalone
3. Distributed
4. Remote

A
  1. Standalone
292
Q

Which software blade enables Access Control policies to accept, drop, or limit web site access based on user, group, and/or machine?
1. Data Awareness
2. Threat Emulation
3. Application Control
4. Identity Awareness

A
  1. Identity Awareness
293
Q

DLP and Mobile Access Policy are examples of what type of Policy?
1. Shared Policies
2. Unified Policies
3. Inspection Policies
4. Standard Policies

A

1.Shared Policies

294
Q

What is the default shell of Gaia CLI?
1. Read-only
2. Expert
3. Clish
4. Bash

A

3.Clish

295
Q

Which of the following is NOT a valid application navigation tab in SmartConsole?
1. WEBUI & COMMAND LINE
2. SECURITY POLICIES
3. GATEWAYS & SERVERS
4. LOGS & MONITOR

A

1.WEBUI & COMMAND LINE

296
Q

What are two basic rules Check Point recommends for building an effective security policy?
1. Accept Rule and Drop Rule
2. Explicit Rule and Implied Rule
3. Cleanup Rule and Stealth Rule
4. NAT Rule and Reject Rule

A

3.Cleanup Rule and Stealth Rule

297
Q

When dealing with policy layers, what two layer types can be utilized?
1. Inbound Layers and Outbound Layers
2. Ordered Layers and Inline Layers
3. Structured Layers and Overlap Layers
4. R81.X does not support Layers

A

2.Ordered Layers and Inline Layers

298
Q

What are the three main components of Check Point security management architecture?
1. Smart Console, Standalone, Security Management Server
2. Policy-Client, Security Management Server, Security Gateway
3. SmartConsole, Security Policy Server, Logs & Monitoring
4. SmartConsole, Security Management Server, Security Gateway

A

4.SmartConsole, Security Management Server, Security Gateway

299
Q

Which Check Point software blade provides protection from zero-day and undiscovered threats?
1. Threat Extraction
2. Threat Emulation
3. Firewall
4. Application Control

A

2.Threat Emulation

300
Q

What are the three types of UserCheck messages?
1. ask, block, and notify
2. block, action, and warn
3. action, inform, and ask
4. inform, ask, and drop

A

1.ask, block, and notify

301
Q

By default, which port is used to connect to the GAiA Portal?
1. 4434
2. 80
3. 8080
4. 443

A
  1. 443
302
Q

Choose what BEST describes a Session.
1. Sessions ends when policy is pushed to the Security Gateway.
2. Sessions locks the policy package for editing.
3. Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out.
4. Starts when an Administrator publishes all the changes made on SmartConsole.

A

3.Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out.

303
Q

Which command shows detailed information about VPN tunnels?
1. cat $FWDIR/conf/vpn.conf
2. vpn tu tlist
3. vpn tu
4. cpview

A
  1. vpn tu tlist
304
Q

After a new Log Server is added to the environment and the SIC trust has been established with the SMS what will the gateways do?
1. Gateways will send new firewall logs to the new Log Server as soon as the SIC trust is set up between the SMS and the new Log Server.
2. Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.
3. The firewalls will detect the new Log Server after the next policy install and redirect the new logs to the new Log Server.
4. The gateways can only send logs to an SMS and cannot send logs to a Log Server. Log Servers are proprietary log archive servers.

A

2.Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.

305
Q

Which of the following is a valid deployment option?
1. CloudSec deployment
2. Disliked deployment
3. Router only deployment
4. Standalone deployment

A

4.Standalone deployment

306
Q

Using the SmartConsole, which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?
1. Read Only All
2. Full Access
3. Editor
4. Super User

A

1.Read Only All

307
Q

URL Filtering cannot be used to:
* Control Data Security
* Decrease legal liability
* Improve organizational security
* Control Bandwidth issues

A

Control Data Security

308
Q

After a new Log Server is added to the environment and the SIC trust has been established with the SMS what will the gateways do?
* Gateways will send new firewall logs to the new Log Server as soon as the SIC trust is set up between the SMS and the new Log Server.
* Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.
* The firewalls will detect the new Log Server after the next policy install and redirect the new logs to the new Log Server.
* The gateways can only send logs to an SMS and cannot send logs to a Log Server. Log Servers are proprietary log archive servers.

A

Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.

309
Q

Which Autonomous Threat Prevention profile uses sanitization technology?
* Cloud/data Center
* Guest Network
* Sandbox
* Perimeter

A

Perimeter

310
Q

Which part of SmartConsole allows administrators to add, edit, delete, and clone objects?
* Object Explorer
* Object Navigator
* Object Editor
* Object Browser

A

Object Editor

311
Q

For Automatic Hide NAT rules created by the administrator what is a TRUE statement?
* Source Port Address Translation (PAT) is enabled by default.
* Source Port Address Translation (PAT) is disabled by default.
* Automatic NAT rules are supported for Network objects only.
* Automatic NAT rules are supported for Host objects only.

A

Source Port Address Translation (PAT) is disabled by default.

312
Q

What is the default tracking option of a rule?
* None
* Alert
* Log
* Tracking

A

None

313
Q

By default, which port is used to connect to the GAiA Portal?
* 4434
* 80
* 8080
* 443

A

443

314
Q

Which of the following is NOT a type of Check Point API available in R80.x?
* Identity Awareness Web Services
* OPSEC SDK
* Management
* Mobile Access

A

Mobile Access

315
Q

What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?
* VPN Routing Mode
* Stateless Mode
* Stateful Mode
* Wire Mode

A

Wire Mode

316
Q

How many versions, besides the destination version, are supported in a Multi-Version Cluster Upgrade?
* 4
* 3
* 2
* 1

A

1

317
Q

After some changes in the firewall policy, you run into some issues. You want to test if the policy from two weeks ago has the same issue. You don’t want to lose the changes from the last weeks. What is the best way to do it?
* In SmartConsole under Security Policies go to the Installation History view of the Gateway, select the policy version from two weeks ago and press the ‘Install specific version’ button
* Use the Gaia WebUI to take a backup of the Gateway. In SmartConsole under Security Policies go to the Installation History view of the Gateway, select the policy version from two weeks ago and press the ‘Install specific version’ button
* In SmartConsole under Manage & Settings go to Sessions –> Revisions and select the revision from two weeks ago. Run the action ‘Revert to this revision…’.
* Use the Gaia WebUI to take a snapshot of management. In the In SmartConsole under Manage & Settings go to Sessions -> Revisions and select the revision from two weeks ago. Run the action ‘Revert to this revision…’ Restore the management snapshot.

A

In SmartConsole under Security Policies go to the Installation History view of the Gateway, select the policy version from two weeks ago and press the ‘Install specific version’ button

318
Q

Which information is included in the “Extended Log” tracking option, but is not included in the “Log” tracking option?
* data type information
* application information
* file attributes
* destination port

A

file attributes

319
Q

In HTTPS Inspection policy, what actions are available in the “Actions” column of a rule?
* “Inspect”, “Bypass”, “Block”
* “Inspect”, “Bypass”, “Categorize”
* “Inspect”, “Bypass”
* “Detect”, “Bypass”

A

“Inspect”, “Bypass”, “Block”

320
Q

What is the purpose of the Stealth Rule?
* To reduce the amount of logs for performance issues.
* To reduce the number of rules in the database.
* To prevent users from directly connecting to a Security Gateway.
* To make the gateway visible to the Internet.

A

To prevent users from directly connecting to a Security Gateway.

321
Q

Which application is used for the central management and deployment of licenses and packages?
* Deployment Agent
* SmartLicense
* SmartProvisioning
* SmartUpdate

A

SmartUpdate

322
Q

True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway.
* True, Central Licenses can be installed with CPLIC command on a Security Gateway
* True, CLI is the preferred method for Licensing
* False, Central Licenses are installed via Gaia on Security Gateways
* False, Central Licenses are handled via Security Management Server

A

False, Central Licenses are handled via Security Management Server

323
Q

Which of the following is NOT a tracking log option in R81.x?
* Full Log
* Log
* Detailed Log
* Extended Log

A

Detailed Log

324
Q

What are two basic rules Check Point recommends for building an effective security policy?
* Accept Rule and Drop Rule
* Explicit Rule and Implied Rule
* Cleanup Rule and Stealth Rule
* NAT Rule and Reject Rule

A

Cleanup Rule and Stealth Rule

325
Q

In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories. Which of the following is NOT an objects category?
* Network Object
* IP Address
* Limit
* Custom Application / Site

A

IP Address

326
Q

What is the purpose of a Stealth Rule?
* A rule that allows administrators to access SmartConsole from any device.
* To drop any traffic destined for the firewall that is not otherwise explicitly allowed.
* A rule at the end of your policy to drop any traffic that is not explicitly allowed.
* A rule used to hide a server’s IP address from the outside world.

A

To drop any traffic destined for the firewall that is not otherwise explicitly allowed.

327
Q

What is the main objective when using Application Control?
* To see what users are doing.
* Ensure security and privacy of information.
* To filter out specific content.
* To assist the firewall blade with handling traffic.

A

Ensure security and privacy of information.

328
Q

Which of the following is considered a “Subscription Blade”, requiring renewal every 1-3 years?
* IPS blade
* IPSEC VPN Blade
* Firewall Blade
* Identity Awareness Blade

A

Identity Awareness Blade

329
Q

Which of the following statements about Site-to-Site VPN Domain-based is NOT true?
* Route-based- The Security Gateways will have a Virtual Tunnel Interface (VTI) for each VPN Tunnel with a peer VPN Gateway. The Routing Table can have routes to forward traffic to these VTIs. Any traffic routed through a VTI is automatically identified as VPN Traffic and is passed through the VPN Tunnel associated with the VTI.
* Domain-based- VPN domains are pre-defined for all VPN Gateways.
A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway.
* Domain-based- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a host or network that can send or receive VPN traffic through a VPN Gateway.
* Domain-based- VPN domains are pre-defined for all VPN Gateways.
When the Security Gateway encounters traffic originating from one VPN Domain with the destination to a VPN Domain of another VPN Gateway, that traffic is identified as VPN traffic and is sent through the VPN Tunnel between the two Gateways.

A

Route-based- The Security Gateways will have a Virtual Tunnel Interface (VTI) for each VPN Tunnel with a peer VPN Gateway. The Routing Table can have routes to forward traffic to these VTIs. Any traffic routed through a VTI is automatically identified as VPN Traffic and is passed through the VPN Tunnel associated with the VTI.

330
Q

The VPN Link Selection will perform the following if the primary VPN link goes down?
* The Firewall will send out the packet on all interfaces
* The Firewall will inform the client that the tunnel is down
* The Firewall can update the Link Selection entries to start using a different link for the same tunnel
* The Firewall will drop the packets

A

The Firewall can update the Link Selection entries to start using a different link for the same tunnel

331
Q

Fill in the blanks: The _____ collects logs and sends them to the _____.
* Log server; Security Gateway
* Security Gateways; log server
* Log server; security management server
* Security management server; Security Gateway

A

Security Gateways; log server

332
Q

Fill in the blank: The position of an Implied rule is manipulated in the ________ window.
* Firewall
* Object Explorer
* Global Properties
* NAT

A

Global Properties

333
Q

Main Mode in iKEv1 uses how many packages for negotiation?
* 3
* depends on the make of the peer gateway
* 6
* 4

A

6

334
Q

Fill in the blanks: Gaia can be configured using the BLANK or BLANK.
* GaiaUI; command line interface (serial console only)
* Gaia Interface; Gaia Ultimate Shell
* Command line interface; GAiA Portal
* Web Ultimate Interface; Gaia Interface (SSH)

A

Command line interface; GAiA Portal

335
Q

Where is the “Hit Count” feature enabled or disabled in SmartConsole?
* In Global Properties.
* On each Security Gateway.
* On the Policy layer.
* On the Policy Package.

A

On the Policy layer.

336
Q

Check Point licenses come in two forms. What are those forms?
* Security Gateway and Security Management.
* On-premise and Public Cloud.
* Central and Local.
* Access Control and Threat Prevention.

A

Central and Local.

337
Q

Choose what BEST describes users on Gaia Platform.
* There is one default user that can be deleted.
* There are two default users and neither can be deleted.
* There is only one default user that cannot be deleted.
* There are two default users and one cannot be deleted.

A

There are two default users and neither can be deleted.

338
Q

Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use which operating system?
* Gaia iOS
* Red Hat Enterprise Linux version 4
* Centos Unix
* Gaia embedded

A

Gaia iOS

339
Q

A security zone is a group of one or more network interfaces from different centrally managed gateways. What is considered part of the zone?
* Security Zones are not supported by Check Point firewalls.
* The firewall rule can be configured to include one or more subnets in a zone.
* The zone is based on the network topology and determined according to where the interface leads to.
* The local directly connected subnet defined by the subnet IP and subnet mask.

A

The zone is based on the network topology and determined according to where the interface leads to.

340
Q

What is the command used to activate Multi-Version Cluster mode?
* set mvc on in Clish
* set cluster member mvc on in Clish
* set cluster mvc on in Expert Mode
* set cluster MVC on in Expert Mode

A

set cluster member mvc on in Clish

341
Q

The Online Activation method is available for Check Point manufactured appliances. How does the administrator use the Online Activation method?
* The cpinfo command must be run on the firewall with the switch -online-license-activation.
* Using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts.
* The SmartLicensing GUI tool must be launched from the SmartConsole for the Online Activation tool to start automatically.
* No action is required if the firewall has internet access and a DNS server to resolve domain names.

A

Using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts.

342
Q

In a Distributed deployment, the Security Gateway and the Security Management software are installed on what platforms?
* The installation can be done on virtual machines only, but not on appliances and not in mixed environments.
* The installation is done on different computers or appliances.
* The installation is done on the same computer or appliance.
* The installation is allowed in Azure only but not in AWS cloud environments.

A

The installation is done on different computers or appliances.

343
Q

How many layers make up the TCP/IP model?
* 6
* 4
* 7
* 2

A

4

344
Q

How many users can have read/write access in Gaia Operating System at one time?
* one
* two
* three
* infinite

A

infinite

345
Q

What is the main difference between Static NAT and Hide NAT?
* Static NAT only allows outgoing connections. Hide NAT allows incoming and outgoing connections.
* Hide NAT only allows incoming connections to protect your network.
* Static NAT allow incoming and outgoing connections. Hide NAT only allows outgoing connections.
* Static NAT only allows incoming connections to protect your network.

A

Static NAT allow incoming and outgoing connections. Hide NAT only allows outgoing connections.

346
Q

You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic?
* Open SmartEvent to see why they are being blocked.
* From SmartConsole, go to the Log & Monitor tab and filter for the IP address of the tablet.
* Open SmartMonitor and connect remotely to the wireless controller.
* Open SmartUpdate and review the logs tab.

A

From SmartConsole, go to the Log & Monitor tab and filter for the IP address of the tablet.

347
Q

Which encryption algorithm is the least secured?
* 3DES
* AES-128
* DES
* AES-256

A

DES

348
Q

Fill in the blank: SmartConsole, SmartEvent GUI client, and \_\_\_\_\_\_\_\_ allow viewing of billions of consolidated logs and shows them as prioritized security events.
* SmartMonitor
* SmartReporter
* SmartTracker
* SmartView Web Application

A

SmartView Web Application

349
Q

Which of the following situations would not require a new license to be generated and installed?
* The existing license expires.
* The Security Gateway is upgraded.
* The license is upgraded.
* The IP address of the Security Management or Security Gateway has changed.

A

The Security Gateway is upgraded.

350
Q

Fill in the blank: In order to install a license, it must first be added to the \_\_\_\_\_.
* Package repository
* Download Center Web site
* License and Contract repository
* User Center

A

License and Contract repository

351
Q

What is required for a certificate-based VPN tunnel between two gateways with separate management systems?
* Shared Secret Passwords
* Unique Passwords
* Shared User Certificates
* Mutually Trusted Certificate Authorities

A

Mutually Trusted Certificate Authorities

352
Q

Which is a main component of the Check Point security management architecture?
* Proxy Server
* Endpoint VPN client
* Identity Collector
* SmartConsole

A

SmartConsole

353
Q

Why is a Central License the preferred and recommended method of licensing?
* Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.
* Central Licensing actually not supported with Gaia.
* Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed.
* Central Licensing is the only option when deploying Gaia.

A

Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.

354
Q

Fill in the blanks: The Application Layer Firewalls inspect traffic through the \_\_\_\_\_\_\_\_ layer(s) of the TCP/IP model and up to and including the \_\_\_\_\_\_\_\_ layer.
* Upper; Application
* Lower; Application
* First two; Internet
* First two; Transport

A

Lower; Application

355
Q

Which command shows detailed information about VPN tunnels?
* cat $FWDIR/conf/vpn.conf
* vpn tu tlist
* vpn tu
* cpview

A

vpn tu tlist

356
Q

The purpose of the Communication Initialization process is to establish a trust between the Security Management Server (SMS) to other Check Point Gateways and Servers. Which statement best describes this Secure Internal Communication (SIC)?
* After successful initialization, the gateway can communicate with any Check Point node that possesses a SIC certificate signed by the same ICA.
* New firewalls can easily establish the trust by using the expert password defined on the SMS and the SMS IP address.
* A SIC certificate is automatically generated on the gateway because the gateway hosts a subordinate CA to the SMS ICA.
* Secure Internal Communications authenticates the security gateway to the SMS before http communications are allowed.

A

After successful initialization, the gateway can communicate with any Check Point node that possesses a SIC certificate signed by the same ICA.

357
Q

Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?
* Formal
* Central
* Local
* Corporate

A

Local

358
Q

Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance?
* Logging and Status
* Monitoring
* Threat Emulation
* Application Control

A

Monitoring

359
Q

You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic?
* Open SmartEvent to see why they are being blocked.
* From SmartConsole, go to the Log & Monitor tab and filter for the IP address of the tablet.
* Open SmartMonitor and connect remotely to the wireless controller.
* Open SmartUpdate and review the logs tab.

A

From SmartConsole, go to the Log & Monitor tab and filter for the IP address of the tablet.

360
Q

Fill in the blank: In order to install a license, it must first be added to the\_\_\_\_\_.
* Package repository
* Download Center Web site
* License and Contract repository
* User Center

A

License and Contract repository

361
Q

Both major kinds of NAT support Hide and Static NAT. However, one offers more flexibility. Which statement is true?
* Manual NAT can offer more flexibility than Automatic NAT.
* Dynamic NAT with Port Address Translation can offer more flexibility than Network Address Translation (NAT) Overloading.
* Automatic NAT can offer more flexibility than Manual NAT.
* Dynamic Network Address Translation (NAT) Overloading can offer more flexibility than Port Address Translation.

A

Manual NAT can offer more flexibility than Automatic NAT.

362
Q

Which of the following technologies extracts detailed information from packets and stores that information in different tables?
* Application Layer Firewall
* Packet Filtering
* Next-Generation Firewall
* Stateful Inspection

A

Stateful Inspection

363
Q

Of all the Check Point components in your network, which one changes most often and should be backed up most frequently?
* Security Management Server
* Security Gateway
* SmartConsole
* SmartManager

A

Security Management Server

364
Q

Application Control/URL filtering database library is known as:
* AppWiki
* Application-Forensic Database
* Application Library
* Application database

A

AppWiki

365
Q

Fill in the blanks: In \_\_\_\_\_\_\_ NAT, Only the \_\_\_\_\_\_\_\_ is translated.
* Hide; source
* Simple; source
* Static; source
* Hide; destination

A

Hide; source

366
Q

What kind of NAT enables Source Port Address Translation by default?
* Automatic Hide NAT
* Automatic Static NAT
* Manual Static NAT
* Manual Hide NAT

A

Automatic Hide NAT

367
Q

Which of the following is NOT an authentication scheme used for accounts created through SmartConsole?
* RADIUS
* SecurID
* Check Point password
* Security questions

A

Security questions

368
Q

If there is an Accept Implied Policy set to “First”, what is the reason Jorge cannot see any logs?
* Track log column is set to Log instead of Full Log.
* Log Implied Rule was not selected on Global Properties.
* Track log column is set to none.
* Log Implied Rule was not set correctly on the track column on the rules base.

A

Log Implied Rule was not selected on Global Properties.

369
Q

What is required for a site-to-site VPN tunnel that does not use certificates?
* Unique Passwords
* Pre-Shared Secret
* SecureID
* RSA Token

A

Pre-Shared Secret

370
Q

In order to see real-time and historical graph views of Security Gateway statistics in SmartView Monitor, what feature needs to be enabled on the Security Gateway?
* Monitoring Blade
* SNMP
* None - the data is available by default
* Logging & Monitoring

A

Monitoring Blade

371
Q

What are the two deployment options available for a security gateway?
* Bridge and Switch
* Local and Remote
* Cloud and Router
* Standalone and Distributed

A

Standalone and Distributed

372
Q

One of major features in SmartConsole is concurrent administration. Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?
* AdminB sees a pencil icon next the rule that AdminB is currently editing.
* AdminA, AdminB and AdminC are editing three different rules at the same time.
* AdminA and AdminB are editing the same rule at the same time.
* AdminC sees a lock icon which indicates that the rule is locked for editing by another administrator.

A

AdminA and AdminB are editing the same rule at the same time.

373
Q

A Check Point Software license consists of two components, the Software Blade and the Software Container. There are \_\_\_\_\_\_\_ types of Software Containers: \_\_\_\_\_\_\_\_\_\_ .
* Two; Security Management and Endpoint Security
* Three; Security Management, Security Gateway, and Endpoint Security
* Three; Security Gateway, Endpoint Security, and Gateway Management
* Two; Endpoint Security and Security Gateway

A

Three; Security Management, Security Gateway, and Endpoint Security

374
Q

Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made?
* Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.
* Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes.
* Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.
* Tom’s changes will be lost since he lost connectivity and he will have to start again.

A

Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.

375
Q

Which software blade enables Access Control policies to accept, drop, or limit web site access based on user, group, and/or machine?
* Data Awareness
* Threat Emulation
* Application Control
* Identity Awareness

A

Identity Awareness

376
Q

DLP and Mobile Access Policy are examples of what type of Policy?
* Shared Policies
* Unified Policies
* Inspection Policies
* Standard Policies

A

Shared Policies

377
Q

Which of the following is NOT a valid application navigation tab in SmartConsole?
* WEBUI & COMMAND LINE
* SECURITY POLICIES
* GATEWAYS & SERVERS
* LOGS & MONITOR

A

WEBUI & COMMAND LINE

378
Q

When dealing with policy layers, what two layer types can be utilized?
* Inbound Layers and Outbound Layers
* Ordered Layers and Inline Layers
* Structured Layers and Overlap Layers
* R81.X does not support Layers

A

Ordered Layers and Inline Layers

379
Q

Which Check Point software blade provides protection from zero-day and undiscovered threats?
* Threat Extraction
* Threat Emulation
* Firewall
* Application Control

A

Threat Emulation

380
Q

Which of the completed statements is NOT true? The GAiA Portal (WebUI) can be used to manage Operating System user accounts and:
* assign privileges to users.
* assign user rights to the directory structure on the Security Management Server.
* add more users to the Gaia operating system.
* change the home directory of the user.

A

assign user rights to the directory structure on the Security Management Server.

381
Q

What are the two types of NAT supported by the Security Gateway?
* Destination and Hide
* Source and Destination
* Static and Source
* Hide and Static

A

Hide and Static

382
Q

When a Security Gateway communicates about its status to an IP address other than its own, which deployment option was chosen?
* Targeted
* Bridge Mode
* Distributed
* Standalone

A

Distributed

383
Q

A layer can support different combinations of blades. What are the supported blades:
* Firewall, NAT, Content Awareness and Mobile Access
* Firewall, URLF, Content Awareness and Mobile Access
* Firewall (Network Access Control), Application & URL Filtering and Content Awareness
* Firewall (Network Access Control), Application & URL Filtering, Content Awareness and Mobile Access

A

Firewall (Network Access Control), Application & URL Filtering, Content Awareness and Mobile Access

384
Q

Choose what BEST describes a Session.
* Sessions ends when policy is pushed to the Security Gateway.
* Sessions locks the policy package for editing.
* Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out.
* Starts when an Administrator publishes all the changes made on SmartConsole.

A

Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out.

385
Q

Using the SmartConsole, which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?
* Read Only All
* Full Access
* Editor
* Super User

A

Read Only All

386
Q

Which one of the following is TRUE?
* One policy can be either inline or ordered, but not both.
* Inline layer can be defined as a rule action.
* Ordered policy is a sub-policy within another policy.
* Pre-R80 Gateways do not support ordered layers.

A

Inline layer can be defined as a rule action.

387
Q

Which of the following is used to initially create trust between a Gateway and Security Management Server?
* One-time Password
* Token
* Certificate
* Internal Certificate Authority

A

One-time Password

388
Q

Which of the following log queries would show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1?
* 192.168.1.1 AND 172.26.1.1 AND drop
* src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop
* 192.168.1.1 OR 172.26.1.1 AND action:Drop
* src:192.168.1.1 OR dst:172.26.1.1 AND action:Drop

A

src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop

389
Q

When configuring Anti-Spoofing, which tracking options can an Administrator select?
* Log, Alert, None
* Drop Packet, Alert, None
* Log, Allow Packets, Email
* Log, Send SNMP Trap, Email

A

Log, Alert, None

390
Q

Fill in the blanks: A \_\_\_\_\_\_\_\_ license requires an administrator to designate a gateway for attachment whereas a license is automatically attached to a Security Gateway.
* Local; formal
* Central; local
* Formal; corporate
* Local; central

A

Central; local

391
Q

What default layers are included when creating a new policy layer?
* Application Control, URL Filtering and Threat Prevention
* Firewall, Application Control and IPSec VPN
* Firewall, Application Control and IPS
* Access Control, Threat Prevention and HTTPS Inspection

A

Access Control, Threat Prevention and HTTPS Inspection

392
Q

What are the software components used by Autonomous Threat Prevention Profiles in R81.20 and higher?
* Sandbox, ThreatCloud, Zero Phishing, Sanitization, C&C Protection, IPS, File and URL Reputation
* IPS, Threat Emulation and Threat Extraction
* Sandbox, ThreatCloud, Sanitization, C&C Protection, IPS
* IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction

A

Sandbox, ThreatCloud, Zero Phishing, Sanitization, C&C Protection, IPS, File and URL Reputation

393
Q

How do logs change when the “Accounting” tracking option is enabled on a traffic rule?
* Involved traffic logs are updated every 10 minutes to show how much data has passed on the connection.
* Involved traffic logs will be forwarded to a log server.
* Provides additional information to the connected user.
* Provides log details view email to the Administrator.

A

Involved traffic logs are updated every 10 minutes to show how much data has passed on the connection.

394
Q

You have enabled “Extended Log” as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?
* Log Trimming is enabled.
* Content Awareness is not enabled.
* Logging has disk space issues.
* Identity Awareness is not enabled.

A

Content Awareness is not enabled.

395
Q

When URL Filtering is set, what identifying data gets sent to the Check Point Online Web Service?
* The full URL, including page data, is sent to the Check Point Online Web Service.
* The URL and IP address are sent to the Check Point Online Web Service.
* The host part of the URL is sent to the Check Point Online Web Service.
* The URL and server certificate are sent to the Check Point Online Web Service.

A

The host part of the URL is sent to the Check Point Online Web Service.

396
Q

In large organizations where there are a number of managed Check Point firewalls that generate a lot of logs it is recommended to install the Log Server on a dedicated computer. Which statement is FALSE?
* The dedicated Log Server must be the same version as the Security Management Server.
* A Log Server has a SIC certificate which allows secure communication with the SMS and Security Gateways.
* More than one Log Server can be installed.
* A dedicated SmartEvent server is required for a separate Log Server to be deployed in the SmartEvent server.

A

A dedicated SmartEvent server is required for a separate Log Server to be deployed in the SmartEvent server.

397
Q

Which option in tracking allows you to see the amount of data passed in the connection?
* Advanced
* Accounting
* Data
* Logs

A

Accounting

398
Q

What are valid authentication methods for mutual authenticating the VPN gateways?
* Pre-shared Secret and PKI Certificates
* PKI Certificates and Kerberos Tickets
* Pre-Shared Secrets and Kerberos Ticket
* PKI Certificates and DynamicID OTP

A

Pre-shared Secret and PKI Certificates

399
Q

What licensing feature automatically verifies current licenses and activates new licenses added to the License and Contracts repository?
* Automatic Licensing and Verification tool
* Verification licensing
* Verification tool
* Automatic licensing

A

Automatic licensing

Cygate (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions