Free 156-215.81.20 Exam Dumps PDF Preview

Question 1

Single choice

Fill in the blanks: The Application Layer Firewalls inspect traffic through the ________ layer(s) of the TCP/ IP model and up to and including the ________ layer.

A
Lower; Application
B
First two; Internet
C
First two; Transport
D
Upper; Application

Reveal answer details Close answer details

Correct answerA

Question 2

Single choice

You want to define a selected administrator's permission to edit a layer. However, when you click the + sign in the "Select additional profile that will be able edit this layer" you do not see anything. What is the most likely cause of this problem? Select the BEST answer.

A
"Edit layers by Software Blades" is unselected in the Permission Profile
B
There are no permission profiles available and you need to create one first.
C
All permission profiles are in use.
D
"Edit layers by selected profiles in a layer editor" is unselected in the Permission profile.

Reveal answer details Close answer details

Correct answerB

Question 3

Single choice

You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet.
However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet.

How can you fix this?

A
Right click Accept in the rule, select "More", and then check "Enable Identity Captive Portal"
B
On the firewall object, Legacy Authentication screen, check "Enable Identity Captive Portal"
C
In the Captive Portal screen of Global Properties, check "Enable Identity Captive Portal"
D
On the Security Management Server object, check the box "Identity Logging"

Reveal answer details Close answer details

Correct answerA

Question 4

Single choice

Where can you trigger a failover of the cluster members?

1. Log in to Security Gateway CLI and run command clusterXL_admin down.
2. In SmartView Monitor right-click the Security Gateway member and select Cluster member down.
3. Log into Security Gateway CLI and run command cphaprob down.

A
1, 2, and 3
B
2 and 3
C
1 and 2
D
1 and 3

Reveal answer details Close answer details

Correct answerC

Explanation

How to Initiate Failover

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_ClusterXL_AdminGuide/7298.htm

Question 5

Single choice

You have discovered suspicious activity in your network.

What is the BEST immediate action to take?

A
Create a policy rule to block the traffic.
B
Create a suspicious action rule to block that traffic.
C
Wait until traffic has been identified before making any changes.
D
Contact ISP to block the traffic.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_LoggingAndMonitoring_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_LoggingAndMonitoring_AdminGuide/118300

Question 6

Single choice

What is required for a certificate-based VPN tunnel between two gateways with separate management systems?

A
Shared Secret Passwords
B
Unique Passwords
C
Shared User Certificates
D
Mutually Trusted Certificate Authorities

Reveal answer details Close answer details

Correct answerD

Question 7

Single choice

On the following graphic, you will find layers of policies.

What is a precedence of traffic inspection for the defined polices?

A
A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if implicit Drop Rule drops the packet, it comes next to IPS layer and then after accepting the packet it passes to Threat Prevention layer.
B
A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if there is any rule which accepts the packet, it comes next to IPS layer and then after accepting the packet it passes to Threat Prevention layer
C
A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if there is any rule which accepts the packet, it comes next to Threat Prevention layer and then after accepting the packet it passes to IPS layer.
D
A packet arrives at the gateway, it is checked against the rules in IPS policy layer and then it comes next to the Network policy layer and then after accepting the packet it passes to Threat Prevention layer.

Reveal answer details Close answer details

Correct answerB

Explanation

To simplify Policy management, R80 organizes the policy into Policy Layers. A layer is a set of rules, or a Rule Base.
For example, when you upgrade to R80 from earlier versions: Gateways that have the Firewall and the Application Control Software Blades enabled will have their Access Control Policy split into two ordered layers: Network and Applications.
When the gateway matches a rule in a layer, it starts to evaluate the rules in the next layer.
Gateways that have the IPS and Threat Emulation Software Blades enabled will have their Threat Prevention policies split into two parallel layers: IPS and Threat Prevention.
All layers are evaluated in parallel
References:
https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/126197

Question 8

Single choice

One of major features in SmartConsole is concurrent administration.

Which of the following is NOT possible considering that AdminA, AdminB and AdminC are editing the same Security Policy?

A
AdminB sees a pencil icon next the rule that AdminB is currently editing.
B
AdminA, AdminB and AdminC are editing three different rules at the same time.
C
AdminA and AdminB are editing the same rule at the same time.
D
AdminC sees a lock icon which indicates that the rule is locked for editing by another administrator.

Reveal answer details Close answer details

Correct answerC

Question 9

Single choice

Fill in the blank: Once a license is activated, a _____ should be installed.

A
License Management file
B
License Contract file
C
Security Gateway Contract file
D
Service Contract file

Reveal answer details Close answer details

Correct answerD

Question 10

Single choice

A layer can support different combinations of blades. What are the supported blades:

A
Firewall, NAT, Content Awareness and Mobile Access
B
Firewall, URLF, Content Awareness and Mobile Access
C
Firewall (Network Access Control), Application & URL Filtering and Content Awareness
D
Firewall (Network Access Control), Application & URL Filtering, Content Awareness and Mobile Access

Reveal answer details Close answer details

Correct answerD

Question 11

Single choice

Both major kinds of NAT support Hide and Static NAT. However, one offers more flexibility.

Which statement is true?

A
Manual NAT can offer more flexibility than Automatic NAT.
B
Dynamic NAT with Port Address Translation can offer more flexibility than Network Address Translation (NAT) Overloading.
C
Automatic NAT can offer more flexibility than Manual NAT.
D
Dynamic Network Address Translation (NAT) Overloading can offer more flexibility than Port Address Translation.

Reveal answer details Close answer details

Correct answerA

Question 12

Single choice

Which part of SmartConsole allows administrators to add, edit, delete, and clone objects?

A
Object Explorer
B
Object Navigator
C
Object Editor
D
Object Browser

Reveal answer details Close answer details

Correct answerA

Question 13

Single choice

To fully enable Dynamic Dispatcher on a Security Gateway:

A
run fw ctl multik set_mode 9 in Expert mode and then reboot
B
Using cpconfig, update the Dynamic Dispatcher value to "full" under the CoreXL menu
C
Edit /proc/interrupts to include multik set_mode 1 at the bottom of the file, save, and reboot
D
run fw ctl multik set_mode 1 in Expert mode and then reboot

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105261#Configuration%20R80.10

Question 14

Single choice

Fill in the blank: The __________ is used to obtain identification and security information about network users.

A
User Directory
B
User server
C
UserCheck
D
User index

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://www.checkpoint.com/downloads/product-related/datasheets/DS_UserDirectorySWB.pdf

Question 15

Single choice

Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

A
Detects and blocks malware by correlating multiple detection engines before users are affected.
B
Configure rules to limit the available network bandwidth for specified users or groups.
C
Use UserCheck to help users understand that certain websites are against the company's security policy.
D
Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_AppControl_WebAdmin/60902.htm

Question 16

Single choice

What type of NAT is a one-to-one relationship where each host is translated to a unique address?

A
Source
B
Static
C
Hide
D
Destination

Reveal answer details Close answer details

Correct answerB

Question 17

Single choice

Which of the following methods can be used to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server?

A
Save Policy
B
Install Database
C
Save session
D
Install Policy

Reveal answer details Close answer details

Correct answerD

Question 18

Single choice

Fill in the blank: Once a license is activated, a ________ should be installed.

A
License Management file
B
Security Gateway Contract file
C
Service Contract file
D
License Contract file

Reveal answer details Close answer details

Correct answerC

Explanation

Service Contract File
Following the activation of the license, a Service Contract File should be installed. This file contains important information about all subscriptions purchased for a specific device and is installed via SmartUpdate. A detailed explanation of the Service Contract File can be found in sk33089.
References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk11054

Question 19

Single choice

Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

A
Application Control
B
Threat Emulation
C
Anti-Virus
D
Advanced Networking Blade

Reveal answer details Close answer details

Correct answerB

Question 20

Single choice

An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG.

Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install). Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1- minute interval. If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.

Which of the following is the BEST explanation for this behavior?

A
The setting Log does not capture this level of detail for GRE. Set the rule tracking action to Audit since certain types of traffic can only be tracked this way.
B
The log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt. Because it is encrypted, the R77 Security Gateway cannot distinguish between GRE sessions.
This is a known issue with GRE.
Use IPSEC instead of the non-standard GRE protocol for encapsulation.
C
The Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.
D
The Log Server is failing to log GRE traffic properly because it is VPN traffic. Disable all VPN configuration to the partner site to enable proper logging.

Reveal answer details Close answer details

Correct answerC

Question 21

Single choice

What does the "unknown" SIC status shown on SmartConsole mean?

A
The SMS can contact the Security Gateway but cannot establish Secure Internal Communication.
B
SIC activation key requires a reset.
C
The SIC activation key is not known by any administrator.
D
There is no connection between the Security Gateway and SMS.

Reveal answer details Close answer details

Correct answerD

Explanation

The most typical status is Communicating. Any other status indicates that the SIC communication is problematic. For example, if the SIC status is Unknown then there is no connection between the Gateway and the Security Management server. If the SIC status is Not Communicating, the Security Management server is able to contact the gateway, but SIC communication cannot be established.

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_SecMan_WebAdmin/html_frameset.htm?topic=documents/R76/CP_R76_SecMan_WebAdmin/118037

Question 22

Single choice

What is the default shell of Gaia CLI?

A
Read-only
B
Expert
C
Clish
D
Bash

Reveal answer details Close answer details

Correct answerC

Question 23

Single choice

The SmartEvent R80 Web application for real-time event monitoring is called:

A
SmartView Monitor
B
SmartEventWeb
C
There is no Web application for SmartEvent
D
SmartView

Reveal answer details Close answer details

Correct answerB

Question 24

Single choice

Which of the following describes how Threat Extraction functions?

A
Detect threats and provides a detailed report of discovered threats
B
Proactively detects threats
C
Delivers file with original content
D
Delivers PDF versions of original files with active content removed

Reveal answer details Close answer details

Correct answerB

Question 25

Single choice

John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole.
To make John's changes available to other administrators, and to save the database before installing a policy, what must John do?

A
Logout of the session
B
File > Save
C
Install database
D
Publish the session

Reveal answer details Close answer details

Correct answerD

Explanation

Installing and Publishing
It is important to understand the differences between publishing and installing.

You must do this: After you did this: Publish Opened a session in SmartConsole and made changes.
The Publish operation sends all SmartConsole modifications to other administrators, and makes the changes you made in a private session public.
Install the database Modified network objects, such as servers, users, services, or IPS profiles, but not the Rule Base.

Updates are installed on management servers and log servers.
Install a policy Changed the Rule Base.
The Security Management Server installs the updated policy and the entire database on Security Gateways (even if you did not modify any network objects).

References:
https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/119225

Question 26

Single choice

Which repositories are installed on the Security Management Server by SmartUpdate?

A
License and Update
B
Package Repository and Licenses
C
Update and License & Contract
D
License & Contract and Package Repository

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_Installation_and_Upgrade_Guide-webAdmin/13128.htm

Question 27

Single choice

When a Security Gateway communicates about its status to an IP address other than its own, which deployment option was chosen?

A
Targeted
B
Bridge Mode
C
Distributed
D
Standalone

Reveal answer details Close answer details

Correct answerC

Question 28

Single choice

Which type of Check Point license ties the package license to the IP address of the Security Management Server?

A
Formal
B
Corporate
C
Central
D
Local

Reveal answer details Close answer details

Correct answerC

Question 29

Single choice

Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

A
No, Certificate based VPNs are only possible between Check Point devices
B
No, they cannot share certificate authorities
C
Yes, but they have to have a pre-shared secret key
D
Yes, but they need to have a mutually trusted certificate authority

Reveal answer details Close answer details

Correct answerD

Question 30

Single choice

Look at the screenshot below.

What CLISH command provides this output?

A
show configuration all
B
show confd configuration
C
show confd configuration all
D
show configuration

Reveal answer details Close answer details

Correct answerD

Explanation

References:
http://dl3.checkpoint.com/paid/0c/0caa9c0daa67e0c1f2af3dd06790bc81/CP_R77_Gaia_AdminGuide.pdf?HashKey=1479835768_76058f0fc4209e38bc801cd58a85d7c5&xtn=.pdf

Question 31

Single choice

Which of the following is NOT an advantage to using multiple LDAP servers?

A
You achieve a faster access time by placing LDAP servers containing the database at remote sites
B
Information on a user is hidden, yet distributed across several servers
C
You achieve compartmentalization by allowing a large number of users to be distributed across several servers
D
You gain High Availability by replicating the same information on several servers

Reveal answer details Close answer details

Correct answerB

Question 32

Single choice

How Capsule Connect and Capsule Workspace differ?

A
Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications
B
Capsule Workspace can provide access to any application
C
Capsule Connect provides Business data isolation
D
Capsule Connect does not require an installed application at client

Reveal answer details Close answer details

Correct answerA

Question 33

Single choice

Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?

A
Threat Emulation
B
Anti-Virus
C
Advanced Networking Blade
D
Application Control

Reveal answer details Close answer details

Correct answerC

Question 34

Single choice

Which of the following is NOT a valid deployment option for R80?

A
All-in-one (stand-alone)
B
Log server
C
SmartEvent
D
Multi-domain management server

Reveal answer details Close answer details

Correct answerD

Question 35

Single choice

Examine the following Rule Base.

What can we infer about the recent changes made to the Rule Base?

A
Rule 7 was created by the 'admin' administrator in the current session
B
8 changes have been made by administrators since the last policy installation
C
Te rules 1, 5 and 6 cannot be edited by the 'admin' administrator
D
Rule 1 and object webserver are locked by another administrator

Reveal answer details Close answer details

Correct answerD

Explanation

Explantation:
On top of the print screen there is a number "8" which consists for the number of changes made and not saved.
Session Management Toolbar (top of SmartConsole)

References:
https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/117948

Question 36

Single choice

What must a Security Administrator do to comply with a management requirement to log all traffic accepted through the perimeter Security Gateway?

A
In Global Properties > Reporting Tools check the box Enable tracking all rules (including rules marked
as None in the Track column). Send these logs to a secondary log server for a complete logging history. Use your normal log server for standard logging for troubleshooting.
B
Install the View Implicit Rules package using SmartUpdate.
C
Define two log servers on the R77 Gateway object. Lof Implied Rules on the first log server. Enable Log Rule Base on the second log server. Use SmartReporter to merge the two log server records into the same database for HIPPA log audits.
D
Check the Log Implied Rules Globally box on the R77 Gateway object.

Reveal answer details Close answer details

Correct answerA

Question 37

Single choice

Which of the below is the MOST correct process to reset SIC from SmartDashboard?

A
Run cpconfig, and click Reset.
B
Click the Communication button for the firewall object, then click Reset. Run cpconfig on the gateway and type a new activation key.
C
Run cpconfig, and select Secure Internal Communication > Change One Time Password.
D
Click Communication > Reset on the Gateway object, and type a new activation key.

Reveal answer details Close answer details

Correct answerB

Question 38

Single choice

What happens when you run the command: fw sam -J src [Source IP Address]?

A
Connections from the specified source are blocked without the need to change the Security Policy.
B
Connections to the specified target are blocked without the need to change the Security Policy.
C
Connections to and from the specified target are blocked without the need to change the Security Policy.
D
Connections to and from the specified target are blocked with the need to change the Security Policy.

Reveal answer details Close answer details

Correct answerA

Question 39

Single choice

Check Point ClusterXL Active/Active deployment is used when:

A
Only when there is Multicast solution set up
B
There is Load Sharing solution set up
C
Only when there is Unicast solution set up
D
There is High Availability solution set up

Reveal answer details Close answer details

Correct answerD

Question 40

Single choice

Which of the following is NOT an alert option?

A
SNMP
B
High alert
C
Mail
D
User defined alert

Reveal answer details Close answer details

Correct answerB

Explanation

In Action, select:
1. none - No alert.
2. log - Sends a log entry to the database.
3. alert - Opens a pop-up window to your desktop.
4. mail - Sends a mail alert to your Inbox.
5. snmptrap - Sends an SNMP alert.
6. useralert - Runs a script. Make sure a user-defined action is available. Go to SmartDashboard > Global
Properties > Log and Alert > Alert Commands.

References:
https://sc1.checkpoint.com/documents/R77/CP_R77_SmartViewMonitor_AdminGuide/101104.htm

Question 41

Single choice

Fill in the blanks: The Application Layer Firewalls inspect traffic through the _____ layer(s) of the TCP/IP model and up to and including the _____ layer.

A
Upper; Application
B
Lower; Application
C
First two; Internet
D
First two; Transport

Reveal answer details Close answer details

Correct answerB

Question 42

Single choice

Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?

A
Central
B
Corporate
C
Formal
D
Local

Reveal answer details Close answer details

Correct answerD

Question 43

Single choice

Which configuration element determines which traffic should be encrypted into a VPN tunnel vs.
sent in the clear?

A
The firewall topologies
B
NAT Rules
C
The Rule Base
D
The VPN Domains

Reveal answer details Close answer details

Correct answerC

Question 44

Single choice

Which policy type is used to enforce bandwidth and traffic control rules?

A
Threat Emulation
B
Access Control
C
QoS
D
Threat Prevention

Reveal answer details Close answer details

Correct answerC

Explanation

Check Point's QoS Solution
QoS is a policy-based QoS management solution from Check Point Software Technologies Ltd., satisfies your needs for a bandwidth management solution. QoS is a unique, software-only based application that manages traffic end-to-end across networks, by distributing enforcement throughout network hardware and software.
References:
https://sc1.checkpoint.com/documents/R76/CP_R76_QoS_AdminGuide/index.html

Question 45

Single choice

Of all the Check Point components in your network, which one changes most often and should be backed up most frequently?

A
SmartManager
B
SmartConsole
C
Security Gateway
D
Security Management Server

Reveal answer details Close answer details

Correct answerD

Question 46

Single choice

What is the difference between SSL VPN and IPSec VPN?

A
IPSec VPN does not require installation of a resident VPN client
B
SSL VPN requires installation of a resident VPN client
C
SSL VPN and IPSec VPN are the same
D
IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_Mobile_Access_WebAdmin/83586.htm

Question 47

Single choice

Which of the following are available SmartConsole clients which can be installed from the R77 Windows CD? Read all answers and select the most complete and valid list.

A
SmartView Tracker, SmartDashboard, CPINFO, SmartUpdate, SmartView Status
B
SmartView Tracker, SmartDashboard, SmartLSM, SmartView Monitor
C
SmartView Tracker, CPINFO, SmartUpdate
D
Security Policy Editor, Log Viewer, Real Time Monitor GUI

Reveal answer details Close answer details

Correct answerC

Question 48

Single choice

Choose what BEST describes a Session.

A
Sessions ends when policy is pushed to the Security Gateway.
B
Sessions locks the policy package for editing.
C
Starts when an Administrator logs in through SmartConsole and ends when the Administrator logs out.
D
Starts when an Administrator publishes all the changes made on SmartConsole.

Reveal answer details Close answer details

Correct answerC

Question 49

Single choice

Which of the following is NOT an option for internal network definition of Anti-spoofing?

A
Specific ?derived from a selected object
B
Route-based ?derived from gateway routing table
C
Network defined by the interface IP and Net Mask
D
Not-defined

Reveal answer details Close answer details

Correct answerB

Question 50

Single choice

What are the three deployment considerations for a secure network?

A
Distributed, Bridge Mode, and Remote
B
Bridge Mode, Remote, and Standalone
C
Remote, Standalone, and Distributed
D
Standalone, Distributed, and Bridge Mode

Reveal answer details Close answer details

Correct answerA

Question 51

Single choice

Which statement is NOT TRUE about Delta synchronization?

A
Using UDP Multicast or Broadcast on port 8161
B
Using UDP Multicast or Broadcast on port 8116
C
Quicker than Full sync
D
Transfers changes in the Kernel tables between cluster members

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_ClusterXL_AdminGuide/7288.htm

Question 52

Single choice

Which tool allows you to monitor the top bandwidth on smart console?

A
Smart Event
B
Gateways & Servers Tab
C
SmartView Monitor
D
Logs & Monitoring

Reveal answer details Close answer details

Correct answerC

Question 53

Single choice

In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log.

Which of the following options can you add to each Log, Detailed Log and Extended Log?

A
Accounting
B
Suppression
C
Accounting/Suppression
D
Accounting/Extended

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://sc1.checkpoint.com/documents/R80/CP_R80_LoggingAndMonitoring/html_frameset.htm?topic=documents/R80/CP_R80_LoggingAndMonitoring/131914

Question 54

Single choice

What is the purpose of a Stealth Rule?

A
A rule used to hide a server's IP address from the outside world.
B
A rule that allows administrators to access SmartDashboard from any device.
C
To drop any traffic destined for the firewall that is not otherwise explicitly allowed.
D
A rule at the end of your policy to drop any traffic that is not explicitly allowed.

Reveal answer details Close answer details

Correct answerC

Explanation

References:
http://www.pearsonitcertification.com/articles/article.aspx?p=387728&seqNum=3

Question 55

Single choice

A Cleanup rule:

A
logs connections that would otherwise be dropped without logging by default.
B
drops packets without logging connections that would otherwise be dropped and logged by default.
C
logs connections that would otherwise be accepted without logging by default.
D
drops packets without logging connections that would otherwise be accepted and logged by default.

Reveal answer details Close answer details

Correct answerA

Question 56

Single choice

What Check Point technologies deny or permit network traffic?

A
Application Control, DLP
B
Packet Filtering, Stateful Inspection, Application Layer Firewall.
C
ACL, SandBlast, MPT
D
IPS, Mobile Threat Protection

Reveal answer details Close answer details

Correct answerB

Question 57

Single choice

In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?

A
SND is a feature to accelerate multiple SSL VPN connections
B
SND is an alternative to IPSec Main Mode, using only 3 packets
C
SND is used to distribute packets among Firewall instances
D
SND is a feature of fw monitor to capture accelerated packets

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_PerformanceTuning_WebAdmin/6731.htm

Question 58

Single choice

Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.
After installation, is the administrator required to perform any additional tasks?

A
Go to clash-Run cpstop | Run cpstart
B
Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig |
Reboot Security Gateway
C
Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores
D
Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig |
Reboot Security Gateway | Install Security Policy

Reveal answer details Close answer details

Correct answerB

Question 59

Single choice

What are types of Check Point APIs available currently as part of R80.10 code?

A
Security Gateway API, Management API, Threat Prevention API and Identity Awareness Web Services
API
B
Management API, Threat Prevention API, Identity Awareness Web Services API and OPSEC SDK API
C
OSE API, OPSEC SDK API, Threat Prevention API and Policy Editor API
D
CPMI API, Management API, Threat Prevention API and Identity Awareness Web Services API

Reveal answer details Close answer details

Correct answerB

Explanation

References:
http://dl3.checkpoint.com/paid/29/29532b9eec50d0a947719ae631f640d0/CP_R80_CheckPoint_API_ReferenceGuide.pdf?HashKey=1517088487_4c0acda205460a92f44c83d399826a7b&xtn=.pdf

Question 60

Single choice

What happens if the identity of a user is known?

A
If the user credentials do not match an Access Role, the traffic is automatically dropped.
B
If the user credentials do not match an Access Role, the system displays a sandbox.
C
If the user credentials do not match an Access Role, the gateway moves onto the next rule.
D
If the user credentials do not match an Access Role, the system displays the Captive Portal.

Reveal answer details Close answer details

Correct answerC

Question 61

Single choice

How many users can have read/write access in Gaia Operating System at one time?

A
One
B
Two
C
Three
D
Infinite

Reveal answer details Close answer details

Correct answerA

Question 62

Single choice

AdminA and AdminB are both logged in on SmartConsole. What does it mean if AdminB sees a locked icon on a rule? Choose the BEST answer.

A
Rule is locked by AdminA, because the save bottom has not been press.
B
Rule is locked by AdminA, because an object on that rule is been edited.
C
Rule is locked by AdminA, and will make it available if session is published.
D
Rule is locked by AdminA, and if the session is saved, rule will be available

Reveal answer details Close answer details

Correct answerC

Question 63

Single choice

You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway.

How would you review the logs to see what is blocking this traffic?

A
Open SmartLog and connect remotely to the wireless controller
B
Open SmartEvent to see why they are being blocked
C
Open SmartDashboard and review the logs tab
D
Open SmartLog and filter for the IP address of the tablet

Reveal answer details Close answer details

Correct answerD

Question 64

Single choice

Which two of these Check Point Protocols are used by _____ ?

A
ELA and CPD
B
FWD and LEA
C
FWD and CPLOG
D
ELA and CPLOG

Reveal answer details Close answer details

Correct answerB

Question 65

Single choice

Which of the following is NOT a valid configuration screen of an Access Role Object?

A
Users
B
Networks
C
Time
D
Machines

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_IdentityAwareness_AdminGuide/62050.htm

Question 66

Single choice

Vanessa is a Firewall administrator. She wants to test a backup of her company's production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment.

Which details she need to fill in System Restore window before she can click OK button and test the backup?

A
Server, SCP, Username, Password, Path, Comment, Member
B
Server, TFTP, Username, Password, Path, Comment, All Members
C
Server, Protocol, Username, Password, Path, Comment, All Members
D
Server, Protocol, Username, Password, Path, Comment, Member

Reveal answer details Close answer details

Correct answerC

Question 67

Single choice

A security zone is a group of one or more network interfaces from different centrally managed gateways.

What is considered part of the zone?

A
Security Zones are not supported by Check Point firewalls.
B
The firewall rule can be configured to include one or more subnets in a zone.
C
The zone is based on the network topology and determined according to where the interface leads to.
D
The local directly connected subnet defined by the subnet IP and subnet mask.

Reveal answer details Close answer details

Correct answerC

Question 68

Single choice

Which of the following is NOT an option to calculate the traffic direction?

A
Incoming
B
Internal
C
External
D
Outgoing

Reveal answer details Close answer details

Correct answerD

Question 69

Single choice

What are two basic rules Check Point recommends for building an effective security policy?

A
Accept Rule and Drop Rule
B
Explicit Rule and Implied Rule
C
Cleanup Rule and Stealth Rule
D
NAT Rule and Reject Rule

Reveal answer details Close answer details

Correct answerC

Question 70

Single choice

When a Security Gateways sends its logs to an IP address other than its own, which deployment option is installed?

A
Distributed
B
Standalone
C
Bridge

Reveal answer details Close answer details

Correct answerA

Question 71

Single choice

On the following picture an administrator configures Identity Awareness:

After clicking "Next" the above configuration is supported by:

A
Kerberos SSO which will be working for Active Directory integration
B
Based on Active Directory integration which allows the Security Gateway to correlate Active Directory users and machines to IP addresses in a method that is completely transparent to the user
C
Obligatory usage of Captive Portal
D
The ports 443 or 80 what will be used by Browser-Based and configured Authentication

Reveal answer details Close answer details

Correct answerB

Explanation

To enable Identity Awareness:
1. Log in to R80 SmartConsole.
2. From the Gateways & Servers view, double-click the Security Gateway on which to enable Identity
Awareness.
3. On the Network Security tab, select Identity Awareness.
The Identity Awareness Configuration wizard opens.
4. Select one or more options. These options set the methods for acquiring identities of managed and unmanaged assets.
AD Query - Lets the Security Gateway seamlessly identify Active Directory users and computers.

Browser-Based Authentication - Sends users to a Web page to acquire identities from unidentified users. If Transparent Kerberos Authentication is configured, AD users may be identified transparently.

Terminal Servers - Identify users in a Terminal Server environment (originating from one IP address).

References:
https://sc1.checkpoint.com/documents/R80/CP_R80BC_IdentityAwareness/html_frameset.htm?topic=documents/R80/CP_R80BC_IdentityAwareness/62050

Question 72

Single choice

Why is a Central License the preferred and recommended method of licensing?

A
Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.
B
Central Licensing actually not supported with Gaia.
C
Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed.
D
Central Licensing is the only option when deploying Gaia.

Reveal answer details Close answer details

Correct answerA

Question 73

Single choice

Which of the following is a valid deployment option?

A
CloudSec deployment
B
Disliked deployment
C
Router only deployment
D
Standalone deployment

Reveal answer details Close answer details

Correct answerD

Question 74

Single choice

Fill in the blanks: A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.

A
Standby/standby; active/active
B
Active/active; standby/standby
C
Active/active; active/standby;
D
Active/standby; active/active

Reveal answer details Close answer details

Correct answerD

Explanation

In a High Availability cluster, only one member is active (Active/Standby operation).
ClusterXL Load Sharing distributes traffic within a cluster so that the total throughput of multiple members is increased. In Load Sharing configurations, all functioning members in the cluster are active, and handle network traffic (Active/Active operation).

References:
https://sc1.checkpoint.com/documents/R77/CP_R77_ClusterXL_WebAdminGuide/7292.htm

Question 75

Single choice

An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server. While configuring the VPN community to specify the pre-shared secret the administrator found that the check box to enable pre-shared secret is shared and cannot be enabled.

Why does it not allow him to specify the pre-shared secret?

A
IPsec VPN blade should be enabled on both Security Gateway.
B
Pre-shared can only be used while creating a VPN between a third party vendor and Check Point Security Gateway.
C
Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS.
D
The Security Gateways are pre-R75.40.

Reveal answer details Close answer details

Correct answerC

Question 76

Single choice

The organization's security manager wishes to back up just the Gaia operating system parameters.

Which command can be used to back up only Gaia operating system parameters like interface details, Static routes and Proxy ARP entries?

A
show configuration
B
backup
C
migrate export
D
upgrade export

Reveal answer details Close answer details

Correct answerB

Explanation

System Backup (and System Restore)
System Backup can be used to backup current system configuration. A backup creates a compressed file that contains the Check Point configuration including the networking and operating system parameters, such as routing and interface configuration etc., but unlike a snapshot, it does not include the operating system, product binaries, and hotfixes.
References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902

Question 77

Single choice

In large organizations where there are a number of managed Check Point firewalls that generate a lot of logs it is recommended to install the Log Server on a dedicated computer.

Which statement is FALSE?

A
The dedicated Log Server must be the same version as the Security Management Server.
B
A Log Server has a SIC certificate which allows secure communication with the SMS and Security Gateways.
C
More than one Log Server can be installed.
D
A dedicated SmartEvent server is required for a separate Log Server to be deployed in the SmartEvent server.

Reveal answer details Close answer details

Correct answerD

Question 78

Single choice

Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the
____________ algorithm.

A
SHA-256
B
SHA-200
C
MD5
D
SHA-128

Reveal answer details Close answer details

Correct answerA

Question 79

Single choice

If there are two administrators logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available to other administrators? Choose the BEST answer.

A
Delete older versions of database.
B
Publish or discard the session.
C
Revert the session.
D
Save and install the Policy.

Reveal answer details Close answer details

Correct answerB

Question 80

Single choice

Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.

What will happen to the changes already made?

A
Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.
B
Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes.
C
Tom's changes will have been stored on the Management when he reconnects and he will not lose any of his work.
D
Tom's changes will be lost since he lost connectivity and he will have to start again.

Reveal answer details Close answer details

Correct answerC

Question 81

Single choice

You have enabled "Full Log" as a tracking option to a security rule. However, you are still not seeing any data type information.

What is the MOST likely reason?

A
Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database.
B
Data Awareness is not enabled.
C
Identity Awareness is not enabled.
D
Logs are arriving from Pre-R80 gateways.

Reveal answer details Close answer details

Correct answerA

Explanation

The most likely reason for the logs data to stop is the low disk space on the logging device, which can be the Management Server or the Gateway Server.

Question 82

Single choice

When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times.
No other VPN-related log entries are present.

Which phase of the VPN negotiations has failed?

A
IKE Phase 1
B
IPSEC Phase 2
C
IPSEC Phase 1
D
IKE Phase 2

Reveal answer details Close answer details

Correct answerA

Question 83

Single choice

Full synchronization between cluster members is handled by Firewall Kernel.

Which port is used for this?

A
UDP port 265
B
TCP port 265
C
UDP port 256
D
TCP port 256

Reveal answer details Close answer details

Correct answerB

Question 84

Single choice

The technical-support department has a requirement to access an intranet server.

When configuring a User Authentication rule to achieve this, which of the following should you remember?

A
You can only use the rule for Telnet, FTP, SMPT, and rlogin services.
B
The Security Gateway first checks if there is any rule that does not require authentication for this type of connection before invoking the Authentication Security Server.
C
Once a user is first authenticated, the user will not be prompted for authentication again until logging out.
D
You can limit the authentication attempts in the User Properties' Authentication tab.

Reveal answer details Close answer details

Correct answerB

Question 85

Single choice

By default, which port does the WebUI listen on?

A
80
B
4434
C
443
D
8080

Reveal answer details Close answer details

Correct answerC

Explanation

To configure Security Management Server on Gaia: Open a browser to the WebUI: https://<Gaia management IP address>

References:
https://sc1.checkpoint.com/documents/R80/CP_R80_Gaia_IUG/html_frameset.htm?topic=documents/R80/CP_R80_Gaia_IUG/132120

Question 86

Single choice

Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .

A
The license is attached to the wrong Security Gateway
B
The existing license expires
C
The license is upgraded
D
The IP address of the Security Management or Security Gateway has changed

Reveal answer details Close answer details

Correct answerA

Explanation

There is no need to generate new license in this situation, just need to detach license from wrong Security Gateway and attach it to the right one.

Question 87

Single choice

You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner.

Which of the following activities sh you do first?

A
Create a new logical-server object to represent your partner's CA
B
Exchange exported CA keys and use them to create a new server object to represent your partner's
Certificate Authority (CA)
C
Manually import your partner's Certificate Revocation List.
D
Manually import your partner's Access Control List.

Reveal answer details Close answer details

Correct answerB

Question 88

Single choice

What is NOT an advantage of Stateful Inspection?

A
High Performance
B
Good Security
C
No Screening above Network layer
D
Transparency

Reveal answer details Close answer details

Correct answerA

Question 89

Single choice

As you review this Security Policy, what changes could you make to accommodate Rule 4?

A
Remove the service HTTP from the column Service in Rule 4.
B
Modify the column VPN in Rule 2 to limit access to specific traffic.
C
Nothing at all
D
Modify the columns Source or Destination in Rule 4

Reveal answer details Close answer details

Correct answerB

Question 90

Single choice

Look at the following screenshot and select the BEST answer.

A
Clients external to the Security Gateway can download archive files from FTP_Ext server using FTP.
B
Internal clients can upload and download any-files to FTP_Ext-server using FTP.
C
Internal clients can upload and download archive-files to FTP_Ext server using FTP.
D
Clients external to the Security Gateway can upload any files to the FTP_Ext-server using FTP.

Reveal answer details Close answer details

Correct answerA

Question 91

Single choice

Fill in the blank: Once a certificate is revoked from the Security GateWay by the Security Management Server, the certificate information is _______.

A
Sent to the Internal Certificate Authority.
B
Sent to the Security Administrator.
C
Stored on the Security Management Server.
D
Stored on the Certificate Revocation List.

Reveal answer details Close answer details

Correct answerD

Question 92

Single choice

Fill in the blank: The IPS policy for pre-R80 gateways is installed during the _______ .

A
Firewall policy install
B
Threat Prevention policy install
C
Anti-bot policy install
D
Access Control policy install

Reveal answer details Close answer details

Correct answerB

Explanation

https://sc1.checkpoint.com/documents/R80/CP_R80BC_ThreatPrevention/html_frameset.htm?topic=documents/R80/CP_R80BC_ThreatPrevention/136486

Question 93

Single choice

According to Check Point Best Practice, when adding a 3rd party gateway to a Check Point security solution what object SHOULD be added? A(n):

A
Interoperable Device
B
Network Node
C
Externally managed gateway
D
Gateway

Reveal answer details Close answer details

Correct answerA

Question 94

Single choice

Fill in the blank: Service blades must be attached to a ______________.

A
Security Gateway
B
Management container
C
Management server
D
Security Gateway container

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk80840

Question 95

Single choice

The SIC Status "Unknown" means

A
There is connection between the gateway and Security Management Server but it is not trusted.
B
The secure communication is established.
C
There is no connection between the gateway and Security Management Server.
D
The Security Management Server can contact the gateway, but cannot establish SIC.

Reveal answer details Close answer details

Correct answerC

Explanation

SIC Status
After the gateway receives the certificate issued by the ICA, the SIC status shows if the Security Management Server can communicate securely with this gateway: Communicating - The secure communication is established.
Unknown - There is no connection between the gateway and Security Management Server.
Not Communicating - The Security Management Server can contact the gateway, but cannot establish SIC. A message shows more information.
References:
https://sc1.checkpoint.com/documents/R80/CP_R80_SecMGMT/html_frameset.htm?topic=documents/R80/CP_R80_SecMGMT/125443

Question 96

Single choice

Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI. Choose what BEST describes the following scenario, where Bob and Joe are both logged in:

A
When Joe logs in, Bob will be log out automatically.
B
Since they both are log in on different interfaces, they both will be able to make changes.
C
If Joe tries to make changes, he won't, database will be locked.
D
Bob will be prompt that Joe logged in.

Reveal answer details Close answer details

Correct answerC

Question 97

Single choice

Which of the following is NOT an alert option?

A
SNMP
B
User defined alert
C
High alert
D
Mail

Reveal answer details Close answer details

Correct answerC

Question 98

Single choice

What are the two types of address translation rules?

A
Translated packet and untranslated packet
B
Untranslated packet and manipulated packet
C
Manipulated packet and original packet
D
Original packet and translated packet

Reveal answer details Close answer details

Correct answerD

Explanation

NAT Rule Base
The NAT Rule Base has two sections that specify how the IP addresses are translated:
1. Original Packet
References:
https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/6724.htm

Question 99

Single choice

Fill in the blank: The tool _______ generates a R80 Security Gateway configuration report.

A
infoCP
B
infoview
C
cpinfo
D
fw cpinfo

Reveal answer details Close answer details

Correct answerC

Explanation

CPInfo is an auto-updatable utility that collects diagnostics data on a customer's machine at the time of execution and uploads it to Check Point servers (it replaces the standalone cp_uploader utility for uploading files to Check Point servers). The CPinfo output file allows analyzing customer setups from a remote location. Check Point support engineers can open the CPinfo file in a demo mode, while viewing actual customer Security Policies and Objects. This allows the in-depth analysis of customer's configuration and environment settings.
When contacting Check Point Support, collect the cpinfo files from the Security Management server and Security Gateways involved in your case.
References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739

Question 100

Single choice

What is UserCheck?

A
Messaging tool used to verify a user's credentials.
B
Communication tool used to inform a user about a website or application they are trying to access.
C
Communication tool used to notify an administrator when a new user is created.
D
Administrator tool used to monitor users on their network.

Reveal answer details Close answer details

Correct answerB