CCSA Flashcards
Pass the CheckPoint CCSA certification test
What are the three main components in Check Point Security Architecture?
- SmartConsole - GUI for connection to the mgmt section of the security mgmt servers
- Security Management Server - Manages Security Gateways with defined security policies and monitors security events on the network.
- Security Gateways - Which serve as entry points and cyber barriers to traffic.
What can the SmartConsole interface provide for necessarey monitoring and and configurations?
4 main areas
- Security Policy Management
- Log Analysis
- System Health Monitoring
- Multi-Domain Security Management
What are the 7 layers of the OSI model?
Application - 7
Presentation - 6
Session - 5
Transportation - 4
Network - 3
Data Link - 2
Physical - 1
What are the 4 layers of the TCP/IP model?
Application - 4
Transport - 3
Internet - 2
Network interface - 1
Which three technologies are used to deny or permit network traffic?
- Packet Filtering
- Stateful Inspection
- Application Layer Firewall
Which of the following is NOT an integral part of VPN communication within a network?
A. VPN key
B. VPN community
C. VPN trust entities
D. VPN domain
A
Why are “State Tables” a key component in the Stateful Inspeciton?
They maintain the information needed to correctly inspect packetss.
What is the purpose of security gateways?
It prevents unathourized traffic from entering the companys network
Name 5 Check Point appliances
- Small business and branch office appliances
- Enterprise network security appliances
- Data center security systems
- Chassis systems
- Rugged Appliances
True or False
Licensing can be transferred between old and new hardware.
True
Hardware must be supported by Check Point
What are the three deployment options?
- Standalone
- Distributed
- Bridge mode
Explain “Standalone Deployment”
In a standalone deployment, the Security Management Server and Security Gateway are installed on the same computer or appliance.
Explain “Distributed Deployment”
In a distributed deployment, the Security Gateway and Security Management Server are installed on different computers or appliances.
Explain “Bridge Mode Deployment”
A bridge mode deployment adds a Security Gateway to an existing enviroment without changing IP routing.
What is Gaia?
Check Point’s operating system
Name the two main shells for Check Point’s CLI
Clish and Expert
What are the two default users in Gaia?
admin and monitor
What are two main hardware options for deploying Check Point technology?
Check Point Appliance and Open Server
What is a private package?
It’s a Hotfix, which is located on the Check Point Support Center, and is only available to limited audiences.
What is Secure Internal Communication (SIC)
SIC is a certificate-based channel for communications between modules (CP components).
What are the three status that SIC can display?
- Communicating - Secure communication is established
- Unknown - Gateway and Management Server have no connection
- Not Communicating - Management Server can contact the Gateway but cannot establish SIC
What is SmartConsole used for?
It’s a GUI that manage:
* Network Elements
* Servers
* Security Gateways
What does SmartEvent do?
Correlates logs and detects real security threats
What is the SmartConsole application called that displays a complete picture of network and security performance, letting you monitor changes to Gateways (FW), tunnels, remote users, and security activities?
SmartView Monitor
When is a session created in SmartConsole?
Each time an administrator logs in
Changes are saved automatically
What is a required action that an administrator have to do for making changes available to all administrators and user?
The administrator have to publish the session.
Name one task that takes place on the Gateway & Servers tab.
- Manage Security Gateways
- Configure Gateway Blade Activation
- View Gateway Status
One of these^
Name the 2 components that the Check Point License consists of
- Software Blade
- Software Container
What does the Software Blade enable?
Specific features or functionalities
Each software blad must be attached to a Software Container
What does the Software container do?
It houses the Software Blades
Name the three types of Software Containers
- Security Management
- Security Gateway
- Endpoint Security
How long is a Plug-and-Play license valid?
15 days
What’s the difference between the two different license forms Central and Local?
- Central ties the package license to the IP address och the Management Server and has no dependency on Gateway IP
- Local license is tied to the IP address of a specific Security Gateway, it cannot be transferred to a Gateway with a different IP
What are the three features of automatic licensing?
- Checks periodically to verify licenses
- Activates new licenses added to the repository
- Automatically adds new blades to SmartConsole
What two tabs are within the SmartUpdate tab?
- Package Management tab
- License & Contracts tab
In what ways can you add a license to “License & Contract Repository”?
Through SmartUpdate
- From the User Center
- From a file
- Manually
Name the three types of Software Containers
- Security Management
- Security Gateway
- Endpoint Security
What are Subscription Blades?
Licenses for different services such as IPS, URL filtering and Application Control. These licenses can expire. Often renewd after a specified period of time.
Name one reason for generating and installing a new license
- Existing license expires
- License is upgraded
- IP address of the Security Management or Security Gateway has changed.
How many zones can an interface be assigned to?
Only one
A policy package can have which different policy type?
- Acces control
- QoS
- Desktop Security
- Threat Prevention
- HTTPS Inspection
What is a policy package?
It’s a group of different types of policies that are installed together on the same installation targets
What’s the difference between a perpetual and a subscription based license?
- A perpetual license doesn’t have an expiration date
- A subscription license can have an expiration date
Explain a “Stealth rule”
A Stealth rule is a rule that should be located as early in your policy as possible, typically immediately after any Management rules so as to drop any traffic destined for the Firewall that is not otherwise explicitly allowed.
Name one thing that a basic rule consists of
- Rule number
- Name of the rule
- Source
- Destination
- Whether or not VPN will be used
- Services & Applications
- Action to take if the session criteria matches
- If and how the rule activity should be tracked
- Which Firewall object(s) will enforce the rule
- The time period for the rule
What are the building blocks of Security Policy rules?
Objects are the building blocks of Security Policy rules and are stored in the Objects database on the management server.
What is the purpose of a UserCheck?
UserCheck is a communication tool used by the Security Gateway to inform a user about a website or application they are trying to access.
It communicates messages about the company’s Security Policy or a change in the company’s Security Policy to the person trying to access the application or Internet site. This tool provides users the ability to create, edit, or delete UserCheck interaction objects in the Access Control and Threat Prevention policy.
What Blades can a Policy Layer contain?
- Firewall (Network Access Control)
- Application & URL Filtering
- Content Awareness
- Mobile Access
Name the two types of Policy Layer
- Ordered Layer
- Inline Layer
What is the prupose of Policy Layers?
They are a set of rules or a rulebase that let you divide a policy into smaller more manageable sections to serve a certain purpose.
What type of Policy Layer is independet of the rest of the rulebase?
Inline
What type of Policy Layer is NOT independant of the rest of the rulebase?
Ordered
Describe a main purpose Application Control & URL filtering
They make it possible for IT administrators to protect corporate resources by creating policies the detect or block thousands of applications and internet sites.
True or False
When URL filtering is set, employee data is kept private when attempting to determine site category. Only the host part of the URL is sent to the Check Point Online Web Service.
True
Which are the private IPs ?
- 10.0.0.0-10.255.255.255/8
- 172.16.0.0-172.31.255.255/12
- 192.168.0.0-192.168.255.255/16
What is the difference between STATIC NAT and HIDE NAT?
HIDE NAT is a translation solution that only allows outgoing traffic. I translates many private adresses to one public address. They are seperated by unique port numbers along with sharing the sam public IP. Used for internal users accessing external resources.
STATIC NAT allows both incoming and outgoing traffic. The translation is one to one meaning one private address translates into one public address. Often used for internet web servers and configured to any application that need inbound and outbound connectivity.
What are the three types of Endpoint Identity Agents?
- Full Endpoint Identity Agent
- Light Endpoint Identity Agent
- Custom Endpoint Identity Agent
What are the four elements a Distinguished Name (DN) include?
- Common Name (CN)
- Organizational Unit (ON)
- Organization Name
- Domain Controller (DC)
What purpose does the user directory serve?
- Users can be managed externally by a User Director (LDAP) server
- The management server can use the LDAP data to authenticate users
- User data from other applications gathered in the LDAP users database can be shared by different applications
Name one of the itemsa the Identity Awareness feature lets you configure network access and auditing based on.
- Network location
- The identity of a user
- The identity of a machine
Name one authentication scheme that Check Point supports.
- Active Directory Query
- Browser-Based Authentication
- Identity Agents
- Terminal Servers Agent
- RADIUS
- Remote Access
What is the purpose for collecting logs?
To research alerts, rejected connections and failed authentication attempts. Collecting logs helps with analysing network traffic patterns and meeting compliance requirements.
Name at least one search filter when creating log queries.
- Action
- Blade
- Confidence Level
- Destination
- Origin
- Protection
- Protection Type
- Risk
- Severity
- Source
- User
What are Boolean Operators?
They are used to refine search results. The operators AND, OR, and NOT are used to create queries with multiple filter criteria in order to refine search results.
The monitoring views of SmartConsole and SmartView Monitor show real-time and historical graphical views of:
- Gateway Status
- Remote Users (SmartView Monitor only)
- System counters
- VPN tunnel monitoring (SmartView Monitor only)
- Cooperative Enforcment for Endpoint Security Servers
- Traffic
What does SAM stand for and what does it monitor?
Suspicious Activity Monitoring is a utility that is inegrated in SmartView Monitor. It can be used to block activities that are displayed in the monitor results and appear to be suspicious.
Where can alerts be seen?
Alerts are sent by the gateways to the management server. They can be seen in SmartView Monitor.
Name the Threat Prevention software components available.
- IPS
- Anti-Bot
- Anti-Virus
- Threat Emulation
- Threat Extraction
What is the default Threat Prevention Profile?
Perimiter
Which Threat Prevention feature protects from unknow threats by simulation the behavior of the potential threat before it enters the network?
Threat Emulation
Which Threat Prevention feature protects the network from threats attempting to infiltrate the systems?
Anti-Virus
Which Threat Prevention feature removes potential threats from inbound communications that would otherwise be innocent?
Threat Excursion
When enabling tracking on a rule, what is the default option?
A. Accounting Log
B. Extended Log
C. Log
D. Detailed Log
C
Gaia includes Check Point Upgrade Service Engine (CPUSE), which can directly receive updates for what components?
A. The Security Gateway (SG) and Security Management Server (SMS) software and the CPUSE engine.
B. Licensed Check Point products for the Gala operating system and the Gaia operating system itself.
C. The CPUSE engine and the Gaia operating system.
D. The Gaia operating system only.
B
Name the file that is an electronically signed file used by Check Point to translate the features in the license into a code?
A. Both License (.lic) and Contract (.xml) files
B. cp.macro
C. Contract file (.xml)
D. license File (.lie)
B
Fill in the blank: When LDAP is integrated with Check Point Security Management, it is then referred to as ….
A. User Center
B. User Administration
C. User Directory
D. UserCheck
C
Can you use the same layer in multiple policies or rulebases?
A. Yes - a layer can be shared with multiple policies and rules.
B. No - each layer must be unique.
C. No - layers cannot be shared or reused, but an identical one can be created.
D. Yes - but it must be copied and pasted with a different name.
A
Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made?
A. Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes.
B. Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.
C. Tom’s changes will be lost since he lost connectivity and he will have to start again.
D. Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.
D
Security Gateway software blades must be attached to what?
A. Security Gateway
B. Security Gateway container
C. Management server
D. Management container
B
Which tool allows you to monitor the top bandwidth on smart console?
A. Logs & Monitoring
B. Smart Event
C. Gateways & Severs Tab
D. SmartView Monitor
D
A security zone is a group of one or more network interfaces from different centrally managed gateways. What is considered part of the zone?
A. The zone is based on the network topology and determined according to where the interface leads to.
B. Security Zones are not supported by Check Point firewalls.
C. The firewall rule can be configured to include one or more subnets in a zone.
D. The local directly connected subnet defined by the subnet IP and subnet mask.
A
When comparing Stateful Inspection and Packet Filtering, what is a benefit that Stateful Inspection offers over Packer Filtering?
A. Stateful Inspection offers unlimited connections because of virtual memory usage.
B. Stateful Inspection offers no benefits over Packet Filtering.
C. Stateful Inspection does not use memory to record the protocol used by the connection.
D. Only one rule is required for each connection.
D
Which type of Endpoint Identity Agent includes packet tagging and computer authentication?
A. Full
B. Custom
C. Complete
D. Light
A
