Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Check Point > CCSE > Flashcards

CCSE Flashcards

1
Q

What is the port used for SmartConsole to connect to the Security Management Server:

A

CPMI port 18191/TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which is the correct order of a log flow processed by SmartEvents components

A

Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

A

Mail, Block Source, Block Event Activity, External Script, SNMP Trap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which components allow you to reset a VPN tunnel?

A

SmartView monitor only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When synchronizing clusters, which of the following statements is FALSE?

A. The state of connections using resources is maintained in a Security Server, so their connections cannot be synchronized.
B. Only cluster members running on the same OS platform can be synchronized.
C. In the case of a failover, accounting information on the failed member may be lost despite a properly working synchronization.
D. Client Authentication or Session Authentication connections through a cluster member will be lost if the cluster member fails.

A

Client Authentication or Session Authentication connections through a cluster member will be lost if the cluster member fails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

A

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control
over the rule base flow and which security functionalities take precedence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In R80.10, how do you manage your Mobile Access Policy?

A

From SmartDashboard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

You find one of your cluster gateways showing “Down” when you run the “cphaprob stat” command. You then run the “clusterXL_admin up” on the down member
but unfortunately the member continues to show down. What command do you run to determine the case?

A

cphaprob -a list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SandBlast offers flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day
Protection?

A

Threat Agent Solution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following is NOT a valid way to view interface’s IP address settings in Gaia?

A

Using the command sthtool in Expert Mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Check Point recommends configuring Disk Space Management parameters to delete old log entities when available disk space is less than or equal to?

A

15%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What API command below creates a new host with the name “New Host” and IP address of “192.168.0.10”?

A

add host name “New Host” ip-address “192.168.0.10”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are types of Check Point APIs available currently as part of R80.10 code?

A

Management API, Threat Prevention API, Identity Awareness Web Services API and OPSEC SDK API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following is NOT an internal/native Check Point command?

A. fwaccel on
B. fw ct1 debug
C. tcpdump
D. cphaprob

A

tcpdump

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the SandBlast Agent designed to do?

A

If malware enters an end user’s system, the SandBlast Agent prevents the malware form spreading with the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The SmartEvent R80 Web application for real-time event monitoring is called:

A

SmartView Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What Shell is required in Gaia to use WinSCP?

A

Bash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which one of the following is true about Threat Emulation?

A

Takes minutes to complete (less than 3 minutes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the minimum open server hardware requirements for a Security Management Server/Standalone in R80.10?

A

4 CPU cores, 8GB of RAM and 500GB of disk space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The “MAC magic” value must be modified under the following condition:

A

A firewall cluster is configured to use Broadcast for CCP traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The Correlation Unit performs all but which of the following actions:

A

Assigns a severity level to the event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The following command is used to verify the CPUSE version:

A

HostName:0>show installer status build

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which statement is true regarding redundancy?

A

Both Cluster XL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_ report.pdf file was
delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing
some graphs, tables and links. Which component of SandBlast protection is her company using on a Gateway?

A

SandBlast Threat Extraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which command collects diagnostic data for analyzing customer setup remotely?

A

cpinfo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

When deploying multiple clustered firewalls on the same subnet, what does the firewall administrator need to configure to prevent CCP broadcasts being sent to
the wrong cluster?

A

Set the cluster global ID using the command “cphaconf cluster_id set “

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which of these options is an implicit MEP option?

A

Primary-backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

John detected high load on sync interface. Which is most recommended solution?

A

For short connections like http service - delay sync for 2 seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the SOLR database for?

A

Used for full text search and enables powerful matching capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

A

Wire Mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

On R80.10 the IPS Blade is managed by:

A

Threat Prevention policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which packet info is ignored with Session Rate Acceleration?

A

source port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the purpose of Priority Delta in VRRP?

A

When an Interface fail, Effective Priority = Priority - Priority Delta

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the purpose of a SmartEvent Correlation Unit?

A

The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

The CDT utility supports which of the following?

A

All upgrades

The Central Deployment Tool (CDT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

The Firewall kernel is replicated multiple times, therefore:

A

The Firewall can run the same policy on all cores

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.

A

Asymmetric routing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which is not a blade option when configuring SmartEvent?

A. Correlation Unit
B. SmartEvent Unit
C. SmartEvent Server
D. Log Server

A

SmartEvent Unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What command would show the API server status?

A

api status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don’t have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. How can you enable them?

A

fw cti multik set_mode 9

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

You have existing dbedit scripts from R77. Can you use them with R80.10?

A

dbedit scripts are being replaced by mgmt._cli in R80.10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

A

This statement is true because SecureXL does improve this traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are the three components for Check Point Capsule?

A

Capsule Workspace, Capsule Docs, Capsule Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

A

mgmt_ cli add host name “Server_ 1” ip-address “10.15.123.10” - format json

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

When defining QoS global properties, which option below is not valid?

A. Weight
B. Authenticated timeout
C. Schedule
D. Rate

A

Schedule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Check Point APIs allow system engineers and developers to make changes to their organization’s security policy with CLI tools and Web Services for all of the following except?

A. Create new dashboards to manage 3rd party task
B. Create products that use and enhance 3rd party solutions.
C. Execute automated scripts to perform common tasks.
D. Create products that use and enhance the Check Point Solution.

A

Create new dashboards to manage 3rd party task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What happen when IPS profile is set in Detect-Only Mode for troubleshooting?

A

It will not block malicious traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

When simulating a problem on CLusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what
command allows you remove the problematic state?

A

cphaprob -d STOP unregister

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

You are investigating issues with two gateway cluster members that are not able to establish the first initial cluster synchronization. What service is used by the
FWD daemon to do a Full Synchronization?

A

TCP port 256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Which command shows the current connections distributed by CoreXL FW instances?

A

fw ctl multik stat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

A

Synchronized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What GUI client would you use to view an IPS packet capture?

A

SmartView Tracker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is the valid range for VRID value in VRRP configuration?

A

1 - 255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

A. Detects and blocks malware by correlating multiple detection engines before users are affected.
B. Configure rules to limit the available network bandwidth for specified users or groups.
C. Use UserCheck to help users understand that certain websites are against the company’s security policy.
D. Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.

A

Detects and blocks malware by correlating multiple detection engines before users are affected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Which command will reset the kernel debug options to default settings?

A

fw ctl debug 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

You need to change the number of firewall instances used by CoreXL. How can you achieve this goal?

A

cpconfig; reboot required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

A

Full layer3 VPN -IPSec VPN that gives users network access to all mobile applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What does the command vpn crl__zap do?

A

Erases all CRL’s from the gateway cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Firewall policies must be configured to accept VRRP packets on the GAiA platform if it runs Firewall software. The Multicast destination assigned by the Internet Assigned Numbers Authority (IANA) for VRRP is:

A

224.0.0.18

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?

A

TCP port 256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

GAiA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

A

Check Point Upgrade Service Engine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Which one of these is NOT a firewall chain?

A. RTM packet in (rtm)
B. VPN node add (vpnad)
C. IP Options restore (in) (ipopt_res)
D. Fw SCV inbound (scv)

A

VPN node add (vpnad)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Which is a suitable command to check whether Drop Templates are activated or not?

A

fwaccel stat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Which directory below contains log files?

A

/opt/CPsuite-R80/fw1/log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is the responsibility of SOLR process on R80.10 management server?

A

It generates indexes of data written to the database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

VPN Tunnel Sharing can be configured with any of the options below, EXCEPT One:

A. Gateway-based
B. Subnet-based
C. IP range based
D. Host-based

A

IP range based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

You want to store the GAiA configuration in a file for later reference. What command should you use?

A

save configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What can you do to see the current number of kernel instances in a system with CoreXL enabled?

A

Execute command cpconfig

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of

A

VolP & VPN Encrypted Traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Why would you not see a CoreXL configuration option in cpconfig?

A

The gateway only has one processor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

In SPLAT the command to set the timeout was idle. In order to achieve this and increase the timeout for Gaia, what command do you use?

A

set inactivity-timeout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What makes Anti-Bot unique compared to other Threat Prevention mechanisms, such as URL Filtering, Anti-Virus, IPS, and Threat Emulation?

A

Anti-Bot is a post-infection malware protection to prevent a host from establishing a connection to a Command & Control Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

SmartEvent does NOT use which of the following procedures to identify events?

A. Matching a log against each event definition
B. Create an event candidate
C. Matching a log against local exclusions
D. Matching a log against global exclusions

A

Matching a log against local exclusions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

In Gaia, if one is unsure about a possible command, what command lists all possible commands.

A

show commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

In which case is a Sticky Decision Function relevant?

A

Load Sharing - Multicast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

The Security Gateway is installed on GAiA R80. The default port for the Web User Interface is _______.

A

TCP 443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

A

SmartEvent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Fill in the blank: The tool ___________ generates a R80 Security Gateway configuration report.

A

cpinfo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Fill in the blank: The R80 utility fw monitor is used to troubleshoot __________.

A

Traffic issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

A

Create a separate Security Policy package for each remote Security Gateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will be need if he
does NOT include a SmartConsole machine in his calculations?

A

Two machines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Fill in the blank: The command _______________ provides the most complete restoration of a R80 configuration.

A

upgrade_import

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Which of the following statements is TRUE about R80 management plug-ins?

A

A management plug-in interacts with a Security Management Server to provide new features and support for new products.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Fill in the blank: The R80 feature ________ permits blocking specific IP addresses for a specified time period.

A

Suspicious Activity Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

In R80 spoofing is defined as a method of:

A

Making packets appear as if they come from an authorized IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Which features are only supported with R80.10 Gateways but not R77.x?

A

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control
over the rule base flow and which security functionalities take precedence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

For best practices, what is the recommended time for automatic unlocking of locked admin accounts?

A

30 minutes at least

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What scenario indicates that SecureXL is enabled?

A

fwaccel commands can be used in clish

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What is the command to show SecureXL status?

A

fwaccel stat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Which web services protocol is used to communicate to the Check Point R80 identity Awareness Web APi?

A

REST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Which file gives you a list of all security servers in use, including port number?

A

$FWDIR/conf/fwauthd.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What CLI command will reset the IPS pattern matcher statistics?

A

ips pmstats reset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

GAiA Software update packages can be imported and installed offline in situation where:

A

Security Gateway with GAiA does NOT have access to Internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

The Event List within the Events tab contains:

A

events generated by a query.

Query
Statistics
List
Preview

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What is mandatory for ClusterXL to work properly?

A

The Magic MAC number must be unique per cluster node.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Which one of the following processes below would not start if there was a licensing issue.

A

CPD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Aaron is a Cyber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R80.10.
Company’s Network Security Developer Team is having issue testing new API with newly deployed R80.10 Security Management Server and blames Check
Point Security Management Server as root cause. The ticket has been created and issue is at Aaron’s desk for an investigation. What do you recommend as the
best suggestion for Aaron to make sure API testing works as expected?

A

Aaron should check API Server status from expert CLI by “api status” and if it’s stopped he should start using command “api start” on Security Management
Server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What utility would you use to configure route-based VPNs?

A

vpn shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Where do you create and modify the Mobile Access policy in R80?

A

SmartDashboard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Customer’s R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

A

CPUSE offline upgrade

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

CPD is a core Check Point process that does all of the following EXCEPT:

A. AMON status pull from the Gateway
B. Management High Availability (HA) sync
C. SIC (Secure Internal Communication) functions
D. Policy installation

A

Management High Availability (HA) sync

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What processes does CPM control?

A

web_services, dle_server and object_Store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Please choose correct command syntax to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI?

A

mgmt. add host name emailserver1 ip-address 10.50.23.90

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Where you can see and search records of action done by R80 SmartConsole administrators?

A

In the Logs & Monitor view, select “Open Audit Log View”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What are the different command sources that allow you to communicate with the API server?

A

SmartConsole GUI Console, mgmt_cli Tool, Gaia CLI, Web Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Both ClusterXL and VRRP are fully supported by Gaia R80.10 and available to all Check Point appliances. Which of the following command is NOT related to
redundancy and functions?

A. cphaprob stat
B. cphaprob -a if
C. cphaprob -l list
D. cphaprob all show stat

A

cphaprob all show stat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What are the steps to configure the HTTPS Inspection Policy?

A

Go to Manage&Settings>Blades>HTTPS Inspection>Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was blocked, what would be the query
syntax?

A

blade: “application control” AND action:block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core
CPU. After installation, is the administrator required to perform any additional tasks?

A

Go to clish-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig |Reboot Security Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Identify the API that is not supported by Check Point currently.

A. R80 Management API-
B. Identify Awareness Web Services API
C. Open REST API
D. OPSEC SDK

A

Open REST API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Which command can you use to enable or disable multi-queue per interface?

A

cpmq set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Which of the following is NOT a type of Check Point API available in R80.10?

A. Ientity Awareness Web Services
B. OPSEC SDK
C. Mobile Access
D. Management

A

Mobile Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

What is the limitation of employing Sticky Decision Function?

A

Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

When configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

A

18184

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

Mobile Access supports all of the following methods of Link Translation EXCEPT:

A. Hostname Translation (HT)
B. Path Translation (PT)
C. URL Translation (UT)
D. Identity Translation (IT)

A

Identity Translation (IT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

What is true of the API server on R80.10?

A

By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8 GB of RAM (more)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

How many images are included with Check Point TE appliance in Recommended Mode?

A

2 (OS) images

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Which deployment methods can an administrator choose when deploying the Sandblast agent?

A

Use both SCCM and GPO for the deployment agent and End Point Management to push the Agent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R80.10 SmartConsole application?

A

IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

What’s true about Troubleshooting option in the IPS profile properties?

A

Temporarily set all protections to track (log) in SmartView Tracker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

What is the mechanism behind Threat Extraction?

A

Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Which command will allow you to see the interface status?

A

cphaprob -a if

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

What is the least ideal Synchronization Status for Security Management Server High Availability deployment?

A

Lagging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data
loss. Providing the Active Security Management Server is responsive, which of these steps should NOT be performed:

A

Rename the hostname of the Standby member to match exactly the hostname of the Active member.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should
you try to remediate first?

A

Host having a Critical event found by Threat Emulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

What is correct statement about Security Gateway and Security Management Server failover in Check Point R80.X in terms of Check Point Redundancy driven
solutions?

A

Security Gateway failover is an automatic procedure but Security Management Server failover is a manual procedure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

You want to verify if your management server is ready to upgrade to R80.10. What tool could you use in this process?

A

pre_upgrade_verifier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

After successfully exporting a policy package, how would you import that package into another SMS database in R80.10?

A

upgrade_import

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

Choose the ClusterXL process that is defined by default as a critical device?

A

fwd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Security Checkup Summary can be easily conducted within:

A

Views

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Which of the SecureXL templates are enabled by default on Security Gateway?

A

Accept

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

As an administrator, you may be required to add the company logo to reports. To do this, you would save the logo as a PNG file with the name ‘cover-company-
logo.png’ and then copy that image file to which directory on the SmartEvent server?

A

$RTDIR/smartview/conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

Which NAT rules are prioritized first?

A

Manual/Pre-Automatic NAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

What CLI command compiles and installs a Security Policy on the target’s Security Gateways?

A

fwm load

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

What is the command to see cluster status in cli expert mode?

A

cphaprob stat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

What are the methods of SandBlast Threat Emulation deployment?

A

Cloud, Appliance and Hybrid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

Which command is used to display status information for various components?

A

show sysenv all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

Which is NOT an example of a Check Point API?

A. Gateway API
B. Management API
C. OPSEC SDK
D. Threat Prevention API

A

Gateway API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

NAT rules are prioritized in which order?

  1. Automatic Static NAT
  2. Automatic Hide NAT
  3. Manual/Pre-Automatic NAT
  4. Post-Automatic/Manual NAT rules
A

3, 1, 2, 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

Events can be categorized and assigned to System Administrators to track their path through the workflow. Which of the following is NOT an option?

A. Under Investigation
B. Pending Investigation
C. False Positive
D. Open

A

Open

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

How is the processing order for overall inspection and routing of packets?

A

Firewall, NAT, Routing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

When Configuring Endpoint Compliance Settings for Applications and Gateways within Mobile Access, which of the three approaches will allow you to configure -individual policies for each application?

A. Basic Approach
B. Strong Approach
C. Advanced Approach
D. Medium Approach

A

Advanced Approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

What is true about VRRP implementations?

A

You cannot have a standalone deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

When using Monitored circuit VRRP, what is a priority delta?

A

When an interface fails the priority delta is subtracted from the priority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

Which one of the following is true about Threat Extraction?

A

almost instantaneous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

Daisy need to review how the Security Gateway Cluster, Jonas, behaves when a cluster member comes back on line. Where would she review the behavior of
cluster member recovery in the Dashboard?

A

Open SmartDashboard, select and open the Cluster Object Jonas, Select Topology - Advanced Options and review the High Availability recovery options.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
147
Q

What is considered Hybrid Emulation Mode?

A

Load sharing of emulation between an on premise appliance and the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
148
Q

To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the
source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of these IS NOT a SecureXL template?

A. Accept Template
B. Deny template
C. Drop Template
D. NAT Template

A

Deny template

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
149
Q

What is the difference between an event and a log?

A

A log entry becomes an event when it matches any rule defined in Event Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
150
Q

Jack is using SmartEvent and does not see the identities of the users on the events. As an administrator with full access, what does he need to do to fix his issue?

A

Open SmartEvent, go to the Policy Tab, select General Settings from the left column > User Identities and check the box Show Identities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
151
Q

What command can you use to have cpinfo display all installed hotfixes?

A

cpinfo -y all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
152
Q

Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. CPM allows the GUI client and management server to communicate via web service using ______.

A

TCP Port 18190

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
153
Q

What is true about the IPS-Blade?

A

in R80, IPS is managed by the Threat Prevention Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
154
Q

Which statement is correct about the Sticky Decision Function?

A

It is not supported with either the Performance pack or a hardware based accelerator card

155
Q

Which of the following is NOT an attribute of packet acceleration?

A. Source address
B. Protocol
C. Destination port
D. Application Awareness

A

Application Awareness

156
Q

You have successfully backed up your Check Point configurations without the OS information. What command would you use to restore this backup?

A

migrate import

157
Q

You need to change the MAC-address on eth2 interface of the gateway. What command and what mode will you use to achieve this goal?

A

set interface eth2 mac-addr 11:11:11:11:11:11; CLISH

158
Q

What command verifies that the API server is responding?

A

api status

159
Q

Session unique identifiers are passed to the web api using which http header option?

A

Proxy-Authorization

160
Q

What does the command vpn crl_zap do?

A

Erases all CRL’s from the gateway cache

161
Q

What are the main stages of a policy installation?

A

Verification & Compilation, Transfer and Installation

162
Q

What are the available options for downloading Check Point hotfixes in Gaia WebUI (CPUSE)?

A

Manually, Scheduled, Automatic

163
Q

What is the main difference between Threat Extraction and Threat Emulation?

A

Threat Extraction always delivers a file and takes less than a second to complete

164
Q

The concept of layers was introduced in R80. What is the biggest benefit of layers?

A

Policy Layers and Sub-Policies enable flexible control over the security policy.

165
Q

What Factors preclude Secure XL Templating?

A

Source Port Ranges/Encrypted Connections

166
Q

Automation and Orchestration differ in that:

A

Automation relates to codifying tasks, whereas orchestration relates to codifying processes.

167
Q

You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores. How many cores can be used
in a Cluster for Firewall-kernel on the new device?

A

2

168
Q

If an administrator wants to add manual NAT for addresses not owned by the Check Point firewall, what else is necessary to be completed for it to function
properly?

A

Add the proxy ARP configuration in a file called $FWDIR/conf/local.arp

169
Q

Which of the following commands shows the status of processes?

A

cpwd_admin list

170
Q

The Regulatory Compliance pane shows compliance statistics for selected regulatory standards, based on the Security Best Practice scan. Which of the
following does NOT show in this pane?

A. The total number of Regulatory Requirements that are monitored
B. The Average compliance score for each regulation shown
C. The average number of Regulatory Requirements that are monitored
D. The Number of Regulatory Requirements for each Regulation

A

The average number of Regulatory Requirements that are monitored

171
Q

In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:

A

Basic, Optimized, Strict

172
Q

Advanced Security Checkups can be easily conducted within:

A

Reports

173
Q

The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API command can he use in the script to achieve the

A

add host name ip-address

174
Q

Which Check Point ClusterXL mode is used to synchronize the physical interface IP and MAC addresses on all clustered interfaces?

A

Multicast Mode Load Sharing

175
Q

Return oriented programming (ROP) exploits are detected by which security blade?

A

Check Point Anti-Virus / Threat Emulation

176
Q

What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

A

CCP and 8116

177
Q

If the first packet of an UDP session is rejected by a security policy, what does the firewall send to the client?

A

ICMP unreachable

178
Q

What has to be taken into consideration when configuring Management HA?

A

The Database revisions will not be synchronized between the management servers.

179
Q

You plan to automate creating new objects using new R80 Management API. You decide to use GAIA CLI for this task. What is the first step to run management
API commands on GAIA’s shell?

A

mgmt. login

180
Q

Which is NOT a SmartEvent component?

A. SmartEvent Server
B. Correlation Unit
C. Log Consolidator
D. Log Server

A

Log Consolidator

181
Q

To ensure that VMAC mode is enabled, which CLI command you should run on all cluster members?

A

fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1

182
Q

Which method below is NOT one of the ways to communicate using the Management API’s?

A. Typing API commands using the “mgmt._cli” command
B. Typing API commands from a dialog box inside the SmartConsole GUI application
C. Typing API commands using Gaia’s secure shell (clash)19+
D. Sending API commands over an http connection using web-services

A

Sending API commands over an http connection using web-services

183
Q

Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core
CPU. After installation, is the administrator required to perform any additional tasks?

A

Go to clash-Run cpconfig|Configure CoreXL to make use of the additional Cores|Exit cpconfig|Reboot Security Gateway

184
Q

When an encrypted packet is decrypted, where does this happen?

A

Inbound chain

185
Q

What are the main stages of a policy installation?

A

Verification & Compilation, Transfer and Installation

186
Q

Jack has finished building his new SMS server, Red, on new hardware. He used SCP to move over the Red-old.tgz export of his old SMS server. What is the
command he will use to import this into the new server?

A

. Expert@Red# ./migrate import Red-old.tgz

187
Q

What are the methods of SandBlast Threat Emulation deployment?

A

Cloud, Appliance and Hybrid

188
Q

What is the difference between an event and a log?

A

A log entry becomes an event when it matches any rule defined in Event Policy

189
Q

SandBlast agent extends 0 day prevention to what part of the network?

A

Web Browsers and user devices

190
Q

In a Client to Server scenario, which represents that the packet has already been checked against the tables and the Rule Base?

A

Big I

191
Q

When using Monitored circuit VRRP, what is a priority delta?

A

When an interface fails the priority delta is subtracted from the priority

192
Q

Which of the following is NOT an option to calculate the traffic direction?

A. Incoming
B. Internal
C. External
D. Outgoing

A

External

193
Q

During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should
you try to remediate first?

A

Host having a Critical event found by Anti-Bot

194
Q

What command lists all interfaces using Multi-Queue?

A

cpmq get

195
Q

From SecureXL perspective, what are the tree paths of traffic flow:

A

Firewall Path; Accelerated Path; Medium Path

196
Q

Joey and Vanessa are firewall administrators in their company. Joey wants to run Management API server on his Security Management server. He is logging in
to a Smart Console and goes to the Manage & Settings > Blade. In Management API section, he proceeds to Advanced Settings. He likes to set up the
Management API server to automatic run at startup. He is surprised, because this functionality is already selected by default. What is the reason, that
functionality is already enabled?

A

Joey is an administrator of Distributed Security Management with at least 4GB of RAM.

197
Q

The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and
checked for viruses. But it is not accelerated. What is the most likely reason that the traffic is not accelerated?

A

The traffic is originating from the gateway itself.

198
Q

Security Checkup Summary can be easily conducted within:

A

Reports

199
Q

Select the right answer to export IPS profiles to copy to another management server?

A

SmartDashboard - IPS tab - Profiles - select profile + right click and select “export profile”

200
Q

SandBlast has several functional components that work together to ensure that attacks are prevented in real-time. Which the following is NOT part of the
SandBlast component?

A. Threat Emulation
B. Mobile Access
C. Mail Transfer Agent
D. Threat Cloud

A

Mail Transfer Agent

201
Q

You want to gather data and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?

A

Check Point Protect

202
Q

After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?

A

cvpnrestart

203
Q

In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with ___________ will not apply.

A

2

204
Q

Joey is preparing a plan for Security management upgrade. He wants to upgrade management to R80.x. What is the lowest supported version of the Security
Management he can upgrade from?

A

R77.X with direct upgrade

205
Q

CPM process stores objects, policies, users, administrators, licenses and management data in a database. This database is:

A

Postgres SQL

206
Q

In what way in Secure Network Distributor (SND) a relevant feature of the Security Gateway?

A

SND is used to distribute packets among Firewall instances

207
Q

There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?

A. Using Web Services
B. Using Mgmt_cli tool
C. Using CLISH
D. Using SmartConsole GUI console

A

Using CLISH

208
Q

By default, the R80 web API uses which content-type in its response?

A

JSON

209
Q

What information is NOT collected from a Security Gateway in a Cpinfo?

A

Firewall logs

210
Q

What is the command to check the status of the SmartEvent Correlation Unit?

A

cpstat cpsead

211
Q

R80.10 management server can manage gateways with which versions installed?

A

Versions R75.20 and higher

212
Q

Which statement is most correct regarding about “CorrectXL Dynamic Dispatcher”

A

The CoreXL FW instances assignment mechanism is based on the utilization of CPU cores.

213
Q

Fred is troubleshooting a NAT issue and wants to check to see if the inbound connection from his internal network is being translated across the interface in the firewall correctly. He decides to use the fw monitor to capture the traffic from the source 192.168.3.5 or the destination of 10.1.1.25 on his Security Gateway,
Green that has an IP of 192.168.4.5. What command captures this traffic in a file that he can download and review with WireShark?

A

Expert@Green# fw monitor -e “accept src=192.168.4.5 or dst=10.1.1.25;” -o monitor.out

214
Q

Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client
communications, database manipulation, policy compilation and Management HA synchronization?

A

fwm

215
Q

UserCheck objects in the Application Control and URL Filtering rules allow the gateway to communicate with the users. Which action is not supported in
UserCheck objects?

A. Ask
B. Drop
C. Inform
D. Reject

A

Reject

216
Q

SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

A

19009, 443

217
Q

Which command gives us a perspective of the number of kernel tables?

A

fw tab -s

218
Q

Which command would you use to determine the current Cluster Global ID?

A

Expert -> cphaconf cluster_id get

219
Q

Automatic affinity means that is SecureXL is running, the affinity for each interface is automatically reset every.

A

60 sec

220
Q

Check Point security components are divided into the following components:

A

GUI Client, Security Management, Security Gateway

221
Q

What’s true about Troubleshooting option in the IPS profile properties?

A

Temporarily set all protections to track (log) in SmartView Tracker

222
Q

When installing a dedicated R80 SmartEvent server, what is the recommended size of the root partition?

A

At least 20 GB

223
Q

How many confidence levels are there for IPS?

A

five

224
Q

Which file is not in the $FWDIR directory collected by the CPInfo utility from the server?

A

cpd.elg

225
Q

An administrator would like to troubleshoot why templating is not working for some traffic. How can he determine at which rule templating id disabled?

A

He can use the fwaccel stat command on the gateway

226
Q

How can SmartView Web application be accessed.

A

https://management IP address/smartview/

227
Q

The WebUI offers several methods for downloading hotfixes via CPUSE except:

A. Automatic
B. Force override
C. Manually
D. Scheduled

A

Force override

228
Q

How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

A

You can utilize only Check Point Cloud Services for this scenario

229
Q

With SecureXL enabled, accelerated packets will pass through the following:

A

Network Interface Card and the Acceleration Device

230
Q

Which command shows the connection table in human readable format?

A

fw tab -t connections -f

231
Q

What is the default size of NAT table fwx_alloc?

A

25000

232
Q

What is the least amount of CPU cores required to enable CoreXL?

A

2

233
Q

Which TCP-port does CPM process listen to?

A

19009

234
Q

In order to optimize performance of a Security Gateway you plan to use SecureXL technology. Your company uses different types of applications. Identify
application traffic that will NOT be accelerated

A. Corporate relational database TCP traffic
B. Custom application multicast traffic
C. Transactions to the external application server using UDP
D. TCP connections to the corporate Web-server

A

Custom application multicast traffic

235
Q

Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?

A

tecli advanced attributes set prohibited_file_types exe,bat

236
Q

The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via which 2 processes?

A

cpm via cpd

237
Q

To help SmartEvent determine whether events originated internally or externally you must define using the initial settings under General Settings in the Policy
Tab. How many options are available to calculate the traffic direction?

A
  1. Incoming; Outgoing; Internal; Other
238
Q

Jack needs to configure CoreXL on his Red Security Gateway. What are the correct steps to enable CoreXL?

A

SSH to Red Security Gateway, run cpconfig> select Configure Check Point CoreXL > enable CoreXL > exit cpconfig> reboot the Security Gateway

239
Q

In a ClusterXL high-availability environment, what MAC address will answer for Virtual IP in the default configuration?

A

MAC address of Active Member

240
Q

What tool exports the Management Configuration into a single file?

A

migrate export

241
Q

Which of the following process pulls applications monitoring status?

A

cpd

242
Q

SandBlast appliances can be deployed in the following modes:

A

inline/prevent or detect

243
Q

What utility would you use to configure route-based VPNs?

A

vpn shell

244
Q

What SmartEvent component creates events?

A

Correlation Unit

245
Q

In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?

A

fw ctl affinity -l -a -r -v

246
Q

What is the proper CLISH syntax to configure a default route via 192.168.255.1 in Gaia?

A

set static-route default nexthop gateway address 192.168.255.1 priority 1 on

247
Q

What is the correct command to observe the Sync traffic in a VRRP environment?

A

fw monitor -e “accept dst=224.0.0.18;”

248
Q

To fully enable Dynamic Dispatcher on a Security Gateway:

A

run fw ctl multik set_mode 9 in Expert mode and then reboot

249
Q

How many interfaces can you configure to use the Multi-Queue feature?

A

5 interfaces

250
Q

A Threat Prevention profile is a set of configurations based on the following. (Choose all that apply.)

A

Anti-Virus settings, Anti-Bot settings, Threat Emulation settings, Intrusion-prevention settings

251
Q

Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. Which is NOT an option to adjust
or configure?

A. Severity
B. Automatic reactions
C. Policy
D. Threshold

A

Policy

252
Q

Which statement is NOT TRUE about Delta synchronization?

A. Using UDP Multicast or Broadcast on port 8161
B. Using UDP Multicast or Broadcast on port 8116
C. Quicker than Full Sync
D. Transfers changes in the Kernel labels between cluster members

A

Using UDP Multicast or Broadcast on port 8161

253
Q

SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this
architecture?

A

Analyzes this log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the
SmartEvent Server.

254
Q

The Check Point installation history feature in R80 provides the following:

A

Policy Installation Date, view install changes and install specific version

255
Q

What is not a component of Check Point SandBlast?

A. Threat Emulation
B. Threat Simulation
C. Threat Extraction
D. Threat Cloud

A

Threat Simulation

256
Q

How can you see historical data with cpview?

A

cpview -t

257
Q

Which configuration file contains the structure of the Security Servers showing the port numbers, corresponding protocol name, and status?

A

$FWDIR/conf/fwauthd.conf

258
Q

SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in a event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

A

ping, whois, nslookup, and Telnet

259
Q

Check Point Management (cpm) is the main management process in that it provides the architecture for the consolidated management console. It empowers the migration from legacy Client side logic to Server side-logic. The cpm process:

A

Performs database tasks such as creating, deleting, and modifying objects and compiling policy.

260
Q

How long may verification of one file take for Sandblast Threat Emulation?

A

within seconds cleaned file will be provided

261
Q

For Management High Availability, which of the following is NOT a valid synchronization status?

A. Collision
B. Down
C. Lagging
D. Never been synchronized

A

Down

262
Q

To fully enable Dynamic Dispatcher with Firewall Priority Queues on a Security Gateway, run the following command in Expert mode then reboot:

A

fw ctl multik set_mode 9

263
Q

How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

A

fw ctl set int fwha_vmac_global_param_enabled 1

264
Q

Holds configuration settings for Advanced Upgrade with Database Migration.

A

migrate.conf

265
Q

migrate

A

Runs Advance Upgrade with migration.

266
Q

pre_upgrade_verifier

A

Analyzes compatibility of the currently installed configuration with the upgrade version. It gives a report on the actions to take before and after the upgrade.

267
Q

Upgrade Verification Service

A
  • Updates released to correct an issue or provide enhancements and improvements.
  • HFA is a collection of stability and quality fixes.
  • The name of an hotfix identifies the version it is compatible with.
268
Q

CPUSE

A

̶ Manually
̶ Scheduled
̶ Automatic

269
Q

CDT

A

Automatically install CPUSE offline packages on multiple gateways and clusters members at same time

270
Q

Standard mode

A

(Clish) and provide commands for easy configuration and routine administration

271
Q

Expert mode

A

advanced Check Point system and underlying Linux functions

272
Q

Set client environment

A

set clienv

273
Q

save client environment

A

save client

274
Q

Acquire configuration lock

A

lock database override

275
Q

add and modify user accounts

A

add user “username” set “username”

276
Q

set message banner

A

set message banner on msgvalue “This system is private and confidential”

277
Q

enable SNMP

A

set snmp agent on

278
Q

To enable or disable core dumps

A

set core-dump [enable|disable]

279
Q

To create DHCP server subnets

A

add dhcp server
netmask
include-ip-pool start end
exclude-ip-pool start end

280
Q

CPM

A

Management process TCP 19009

281
Q

fwm

A

on all management products It provides GUI client communication, database manipulation, policy compilation, and Management High Availability synchronization

282
Q

fwd

A

allows other processes, including the kernel, to forward logs

283
Q

fwssd

A

child process of fwd

• which provide a higher level of protocol enforcement.

284
Q

cpd

A

Check Point Daemon (cpd) is a core process on every Check Point product. It allows Secure Internal Communication (SIC) functionality

285
Q

fwm

A

cpwd_admin utility shows the status of processes and configures cpwd

286
Q

Kernel Mode

A

Data Link layer

Every packet that goes through the Firewall is inspected

287
Q

User Mode

A

Firewall to function more efficiently in the Application layer.

288
Q

Input/Output

A

allow user and kernel processes to communicate

289
Q

Chain Modules

A

packet processing handlers,
decide which modules will inspect the packet and, based on the inspection, may then modify, pass, or drop the packets,
Inbound and outbound packets are inspected in both directions by chain modules

290
Q

Connections Table Format

A

6-tuple

291
Q

Verification & Compilation (6 stages)

A 
Initiation 
Database Dump 
Verification
Conversion
Fwm rexec 
Code Generation and Compilation
292
Q

policy installation process

three main stages

A

Verification & Compilation
Transfer (CPTA)
Commit

293
Q

Commit stage

A

• The cpd process on the gateway will execute the following command to load the policy which was just transferred to the gateway:
fw fetchlocal -d $FWDIR/state/_tmp/FW1
• The policy will then be loaded into the kernel.
• If successful, the new policy will be copied to the $FWDIR/state/FW1 folder on the gateway.
• If the fetchlocal process fails, cpd will get a notification regarding the failed process and will inform the fwm process that loading the policy has failed.

294
Q

NAT rules are prioritized according to the list below:

A
  1. Manual/Pre-Automatic NAT
  2. Automatic Static NAT
  3. Automatic Hide NAT
  4. Post-Automatic/Manual NAT rules
295
Q

configuration files /opt

A

CPsuite-R80 — Manages Firewall modules
CPshrd-R80 — Stores cpd database, licenses
CPEdgecmp-R80 — Manages Edge devices

296
Q

/lib

/conf

A

store definition files

Ex. $FWDIR/conf/fwauth.NDB = user definitions
Ex. $FWDIR/conf/fwauthd.conf= Security server configuration

297
Q

cpconfig

A

command line version of the Check Point Configuration tool and configure or reconfigure a Security Gateway/Management installation

298
Q

cplic print

A

details of Check Point licenses

299
Q

four inspection points

passes through the kernel:

A
  • i — Before the virtual machine, in the Inbound direction (pre-Inbound)
  • I — After the virtual machine, in the Inbound direction (post-Inbound)
  • o — Before the virtual machine, in the Outbound direction (pre-Outbound)
  • O — After the virtual machine, in the Outbound direction (post-Outbound)
300
Q

Three Stateful features provided with the Connections

A 
Streaming based applications, such as Web security
Sequence verification and translation
Hide NAT
Logging, accounting, and monitoring
Client and server identification
Data connections
301
Q

RESTful API

A

GET, PUT, POST, and DELETE

302
Q

packets that do not pass inspection send NACK

A

TCP=RST

USP=ICMP Unreachable

303
Q

processing order for the overall inspection

A
  1. Firewall — Inspection on the Original Packet.
  2. NAT — Translate the IP and/or port number as required.
  3. Routing — Forward on the resulting packet.
304
Q

Cluster Virtual MAC (VMAC)

A

allows all cluster members to use the same Virtual MAC address and minimizes possible traffic outages during a failover

305
Q

State Synchronization two modes

A

Full Synchronization

Delta Synchronization

306
Q

fw ctl pstat

A

monitor synchronization

307
Q

restrictions synchronizing cluster members

A

same platform
same software version
number of cores

308
Q

Cluster Connectivity Upgrade

A

synchronizes existing connections to maintain connectivity and eliminate downtime during cluster upgrades.

309
Q

How many members can clusterXL support

A

8

310
Q

How add new member

A
  1. Run cpconfig
  2. Change the IP address of the new cluster member to reflect the correct topology.
    Ensure that all Check Point products are installed on the new cluster member. All Check Point software components must be identical on each member of the cluster.
    In the Cluster Members page of the cluster object, create a new cluster member
    ensure that SIC is initialized and the topology is correctly defined.
    Ensure that the proper interfaces on the new cluster member are configured as cluster interfaces if the cluster mode is Load Sharing or New High Availability.
    Install the Security Policy on the cluster. The new member is now part of the cluster.
311
Q

The Sticky Decision Function

A

avoids Asymmetric Routing, but disables acceleration technologies.

312
Q

Secondary and Standby Security Management Servers

A

This transition from Standby to Active must be initiated manually.

313
Q

Synchronizing Management HA Active and Standby Servers

A

Automatic or Manual

For Management HA to function properly, the following data is backed up and synchronized:
Network Security Management Databases (such as the Network Objects, policy settings, and the Security Policy itself)
Configuration and Internal Certificate Authority (ICA) data (such as Objects and Users databases, certificate information, and the CRL, which is available to be fetched by the Check Point Security Gateways)
Endpoint Security databases, if applicable

314
Q

Synchronization Status management HA

A

Never been synchronized
Synchronized
Lagging
Advanced

315
Q

OPSEC Certified HA and Load Sharing products

A

Decide which cluster member will deal with each connection.
Perform health checks
Perform failover

316
Q

Virtual Routing Redundancy Protocol (VRRP)

A

VRRP is a network management protocol that is used to increase the availability of default gateway servicing hosts on the same subnet.

317
Q

VRRP Types

A

Simple Monitored Circuit VRRP

Advanced VRRP

318
Q

Advanced VRRP can be configured via WebUI or CLI

A

set vrrp interface VALUE

show vrrp interface VALUE

319
Q

SecureXL

A

Check Point security acceleration technology that accelerates multiple, intensive security operations, including operations carried out by Check Point’s

320
Q

SecureXL traffic flow

A

Firewall Path (Slow) — Packets and connections that are inspected by the Firewall. These packets and connections are not processed by SecureXL. This path is also referred to as the Slow Path.
Accelerated Path — Packets and connections that are offloaded from the Firewall to SecureXL. These packets and connections are quickly processed.
Medium Path — Packets that cannot use the accelerated path because they require deeper inspection. Although it is not necessary for the Firewall to inspect these packets, they can be offloaded by another feature. For example, packets that are examined by IPS cannot use the accelerated path and can be offloaded to the IPS Passive Streaming Library (PSL), which provides stream reassembly for TCP connections. As a result, SecureXL processes these packets quicker than packets on the slow path.

321
Q

Packet Acceleration requires

A 
Source address 
Destination address 
Source port 
Destination port
Protocol
322
Q

Secure XL session acceleration

A

To accelerate the rate of new connections, connections that do not match a specified 5-attributes are still processed by SecureXL by leveraging templates

323
Q

SecureXL connection templates

A

Accept Templates
Drop Templates
NAT Templates

324
Q

VPN Link Selection

A

allows multiple external interfaces to be configured for tunneling the VPN packets.

325
Q

Dynamic VPN Routing

A

allow the VPN domain to be determined dynamically instead of configuring a static VPN domain.

326
Q

Wire Mode Connections

A

allows trusted traffic to pass through without Stateful Inspection.

327
Q

CoreXL deafult number of cores

A

The default number of kernel instances is derived from the total number of cores in the system.

328
Q

Secure Network Distributor (SND)

A

Processing incoming traffic from the network interfaces.
Accelerating authorized packets (if SecureXL is running).
Distributing non accelerated packets among kernel instances

329
Q

Dynamic Dispatcher

A

Helps to improve load distribution and mitigates connectivity issues during traffic peaks

330
Q

fw ctl multik stat

A

distribution of connections across all CoreXL Firewall instances

331
Q

Firewall Priority Queues

A

Prioritizes traffic when the CPU cores are 100% utilized and packets need to be dropped.
Priorities packets based on the connection type

332
Q

How does CoreXL improve network performance

A

CoreXL acts as a load balancer and improves Security Gateway performance in situations where much of the traffic cannot be accelerated by SecureXL or when the gateway has many IPS features enabled, which disables SecureXL functionality

333
Q

When should you consider using Multi-Queue

A
  1. The CPU load for SND is high (idle is < 20%).
  2. The CPU load for CoreXL Firewall instances is low (idle is > 50%).
  3. There are no CPU cores left to be assigned to the SND by changing interface affinity.
334
Q

SmartEvent clients manage the SmartEvent server and provide an overview of security information for an organization’s environment.

A

SmartConsole — installed as an external application
SmartEvent GUI — requires client installation
SmartView Web application

335
Q

SmartEvent Deployment

A

standalone=on the managment server

distributed=Seperate boxes

336
Q

SmartEvent uses the following procedures to identify events:

A

Matching a log against global exclusions
Matching a log against each event definition
Creating an event candidate
Updating an event

337
Q

SmartEvent Event Definition

A

contains a filter which is comprised of multiple criteria that must be found in any matching log

338
Q

SmartEvent Event Candidate

A
  • Event Candidate allow SmartEvent to track logs until an event threshold is crossed and an event is generated.
  • Each event definition may have multiple event candidates.
339
Q

What happens when a candidate becomes an event

A

Correlation Unit forwards the event to the Event Database.

340
Q

SmartEvent Event Queries

A

A view is an interactive dashboard made up of widgets

341
Q

Remediating Security Events

A 
Threshold
Severity
Automatic reactions
Exceptions
Working hours
342
Q

VPN Installation Options

A
  1. Client-based — In this solution, the client application is installed on endpoint computers and devices. Clients are usually installed on a managed device, such as a company-owned computer or device. The client supplies access to most types of corporate resources according to the access privileges of the user.
  2. Clientless — In this solution, users connect through a web browser and use HTTPS connections instead of connecting through a managed device. Clientless solutions usually supply access to web-based corporate resources.
  3. On Demand Client — This remote access solution blends the first two options. A user connects with a web browser and installs a client when necessary. The client supplies access privileges to most types of corporate resources according to the access privileges of the user.
343
Q

IPSEC VPN how and what?

A

In a Layer 3 VPN solution, a resident VPN client is needed, which creates the Layer 3 virtual interface that any application can use. Better for managed devices

344
Q

SSL VPN how and what

A

only require a browser on the client side and allow mobile devices with a dedicated application to access corporate resources without establishing a VPN tunnel. Better for unmanaged devices

345
Q

Mobile Access Portal

A

clientless SSL VPN solution,requires a Mobile Access Software Blade license on the Security Gateway. used for web-based corporate resources

346
Q

SSL Network Extender (SNX)

A

thin SSL VPN on-demand client
a browser plug-in has 2 modes:
1.Network — Users can access all native IP-based and web-based applications in the internal network. Admin needs to define apps
2. Application — Users can access most native IP-based and web-based application types in the internal network. Admin needs to define apps

347
Q

Three main Clients Mobile Access

A

Check Point Mobile for Windows: IPSec, requires IPSec and mobile access software blade license
Check Point Mobile for iPhone and iPad: SSL required mobile access blade license
Check Point Mobile for Android: SSL required mobile access blade license

348
Q

Two additional client options

A

Check Point Capsule Workspace: Provides access separate applications

SecuRemote: limited fucntion IPSec VPN, requires IPSec blade license

349
Q

Check Point Capsule

A

Secure container with IAM control; helps control company data on personal devices
Capsule Workspace
Capsule Docs
Capsule Cloud

350
Q

Capsule Connect

A

Provide access to any application and uses IPSec vs SSL for capsule, but no data isolation

351
Q

Capsule Docs

A

Capsule Connect
Classify — Define a set of permissions, which may include markings such as headers, footers, and watermarks.
Share — Decide with whom to share the document.
Encrypt — Apply encryption (AES256 + RSA2048) to the document so that it is protected and accessed only by the authorized users and groups.

Offers cloud deployment

352
Q

Capsule Cloud

A

Capsule Cloud utilizes Check Point Software Blade solutions as a cloud-based service. Capsule Cloud enforces the organization’s in-network Security Policy to both on- and off-premise devices. It helps the enterprise to protect employees using laptops and mobile device when they are outside the secured office environment.

353
Q

Capsule Cloud

A

Set up policies for URL Filtering, Threat Prevention, and HTTPS Inspection
View user traffic and audit logs
Manage users and offices
Download Capsule Cloud applications and utilities
Change client and device settings
Access Capsule Cloud utilities
Determine location of roaming clients (via the Location Awareness feature)

354
Q

Check Point Mobile Access Software Blade

A

allows mobile and remote workers to easily and securely connect to the corporate network from any location. data is decrypted, filtered, and inspected in real-time by Check Point’s gateway security services. Can enforce security posture of the device

355
Q

Mobile Access User Authentication types

A 
Certificate (Internal or External Certificate Authority)
RADIUS server
SecurID
Username and password (internal, LDAP)
Dynamic ID One-Time Password (OTP)
356
Q

Mobile Access Security

A

Server Side Security:
Mobile Access uses IPS Web Intelligence to protect the network from web-related threats and attacks

Client Side:
can scan endpoint devices to verify their security compliance and make sure that their protections are up-to-date.

357
Q

Mobile Access Policy (Firewall)

A

The Mobile Access Policy defines how remote users can securely access internal company applications and resources using mobile devices. Mobile Access Policy rules are defined and unified in the Access Control policy. This includes all rules related to the Mobile Access Portal, Capsule Workspace, and on-demand clients.

358
Q

Mobile Access in the Access Control Policy

A
  1. The Mobile Access Software Blade must be enabled.
  2. Security Gateways with Mobile Access enabled, are automatically added to the Remote Access VPN Community.
  3. Mobile Access applications must be defined.
    Other application objects cannot be used for Mobile Access.
  4. Create access roles to give access to resources through specified remote access clients.
359
Q

Mobile Access policy best practices

A
  1. Place Mobile Access rules that authorize applications above rules that contain a related service.
  2. Create an inline layer for Mobile Access rules.
    When creating rules, do not use a Security Gateway as the destination.
360
Q

What is the difference between an SSL VPN and an IPSec VPN?

A
  1. In the SSL VPN solution, users can connect securely to business web-based applications through a web portal, which can be accessed using a web browser. This solution does not require users to install a VPN agent or client and can be configured to enforce two-factor authentication.
  2. IPSec, Layer 3 VPN requires remote workers to install a VPN client before gaining access to corporate resources. Once a user installs the client, the Layer 3 VPN provides a secured connection to both web-based and native business applications.
361
Q

How do Capsule Docs and Capsule Workspace work together?

A

As business documents are edited and viewed on personal devices using Capsule Workspace, Capsule Docs protects business data and documents no matter where it is transmitted.

362
Q

Intrusion Prevention System (IPS)

A

Protects users from malware on legitimate websites, controls network usage of selected applications, and more.

363
Q

Intrusion Prevention System (IPS) managed by what policy

A

Threat Prevention policy

364
Q

What command do you use to import or export IPS profiles

A

ips_export_import

365
Q

Geo-Protection

A
  1. Enforces or monitors traffic based on the source or destination country.
  2. A valid IPS contract and an IPS Software Blade license is required.
  3. The IP-To-Country database is downloaded to the gateway from a Check Point data center.
    Geo-Protection logs are aggregated by default.
366
Q

Antivirus

A
  1. Protects the network from malware attacks/ worms virus, backdoors
  2. Uses threat intelligence from ThreatCloud.
    Scans incoming files for malicious signatures.
  3. Updates ThreatCloud with any newly detected malware.
  4. Blocks access to websites with known connection to malware.
367
Q

Anti-Bot

A

Check Point’s Anti-Bot Software Blade identifies bot-infected machines using the ThreatSpect engine to analyze network traffic. The engine:
Performs a reputation check.
Reviews network signatures.
Searches for suspicious activity.

368
Q

Sandboxing

A
  1. Used to catch zero-day attacks and APTs.

2. Files are hosted and executed in a secured environment and then observed for suspicious routines.

369
Q

Two types of sanboxing

A

OS-Level

CPU-Level

370
Q

OS-Level Sandboxing

A

Emulates a standard operating system in an isolated environment to execute and screen files.

371
Q

How to avoid OS-Level Sandboxing

A

Delaying launch of a payload.
Searching for virtual machine indicators.
Checking for human interaction activities that are difficult to replicate virtually.
OS fingerprinting.

372
Q

CPU-Level Sandboxing

A

Addresses the limitations of traditional sandboxing.

by Monitoring exploits executed in CPU instruction codes.

373
Q

CPU Level Sandboxing Stages

A
  1. Finding Vulnerability
  2. Using an Exploit Method
  3. Running a Shellcode
  4. Running the Malware
374
Q

SandBlast Zero-Day

A

Check Point’s solution for zero-day attacks

375
Q

SandBlast Components

A

Threat Emulation
Threat Extraction
Threat Cloud
Mail Transfer Agent

376
Q

SandBlast Threat Emulation

A

Performs both CPU-Level and OS-Level inspection of files.

377
Q

SandBlast Threat Extraction

A

Threat Extraction provides users with a sanitized, reconstructed document using only safe elements.

Threat Extraction is typically used for incoming emails only; however, it can be used for outgoing emails as well. It supports widely used document file types, such as PDF and MS Word documents.

378
Q

Threat Cloud

A

1.Consolidates information from sources, such as:
Signature and reputation data from different Check Point systems.
2. External intelligence sources.
3. Data and research from Check Point’s Vulnerability Research and Incident Response teams.
(Keeps sandblast up to date)

379
Q

Mail Transfer Agent

A

Ensures that full emulation occurs without disruption.
Prevents email server timeout during emulation.
Manages the emulation of SMTP traffic.

380
Q

SandBlast Appliances Deploy in what 2 modes

A

Inline or Prevent

Detect Only

381
Q

SandBlast Cloud Deployment Options are:

A

Detect Mode-In Detect mode, incoming emails go straight to the inbox without interference
Prevent Mode- In Prevent mode, incoming emails are directed to a temporary quarantine folder within Office 365
Hybrid Deployment- on-premise Exchange server and Cloud Office 365 can use the following options for a hybrid deployment:

382
Q

SandBlast Agent

A

Extends SandBlast Protection to end-users.

383
Q

How does SandBlast Threat Emulation and Threat Extraction prevent threats like zero-day attacks and APT?

A

To prevent these threats, Threat Emulation performs CPU-level inspection of incoming files to look for signs of exploit methods. It runs the inspection in a sandbox environment, away from the organization’s network. If files exhibit malicious routines, Threat Emulation deletes them promptly.
While Threat Emulation performs the inspection, Threat Extraction provides a clean, sanitized version of the file. This is to avoid any disruption to the company’s daily operations.

384
Q

How does IPS complement the Firewall Software Blade when it comes to preventing threats?

A

While Firewall blocks network traffic based on source, destination, and port information, IPS analyzes its contents. This is to prevent threats such as drive by download, which are known to hide malicious codes behind hijacked, legitimate websites.

Check Point (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions