156-215.75 questions and answers

Users are not prompted for authentication when they access their Web servers, even though you have created an HTTP rule via User Authentication.

Why?

The SIC certificate is stored in the directory _______________.

In SmartDashboard, Translate destination on client side is checked in Global Properties. When Network Address Translation is used:

A Web server behind the Security Gateway is set to Automatic Static NAT. Client side NAT is not checked in the Global Properties. A client on the Internet initiates a session to the Web Server.
Assuming there is a rule allowing this traffic, what other configuration must be done to allow the traffic to reach the Web server?

When you change an implicit rule's order from last to first in global properties, how do you make the change take effect?

Marc is a Security Administrator configuring a VPN tunnel between his site and a partner site. He just created the partner city's firewall object and a community. While trying to add the firewalls to the community only his firewall could be chosen. The partner city's firewall does not appear.

What is a possible reason for the problem?

A security audit has determined that your unpatched Web application server is accessing a SQL server.
You believe that you have enabled the proper IPS setting but would like to verify this using SmartView Tracker.

Which of the following entries confirms that this information is being blocked against attack?

What information is found in the SmartView Tracker Management log?

Match each of the following command to their correct function. Each command has one function only listed.

Anti-Spoofing is typically set up on which object type?

A ____________ rule is designed to log and drop all other communication that does not match another

rule.

When you run the fw monitor -e "accept;" command, what type of traffic is captured?

You need to plan the company's new security system. The company needs a very high level of security and also high performance and high throughput for their applications. You need to turn on most of the integrated IPS checks while maintaining high throughput.

What would be the BEST solution for this scenario?

Once an Access Role is configured, in which Rule Bases can it be implemented?

Your bank's distributed R75 installation has Security Gateways up for renewal.

Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

For information to pass securely between a Security Management Server and another Check Point component, what would NOT be required?

What are the results of the commanD.
fw sam [Target IP Address]?

There are three options available for configuring a firewall policy on the SecureClient Mobile device.

Which of the following is NOT an option?

An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R70 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG.
Although the keep-alive packets are being sent every 1 minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).

Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.

If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-
alive packet every minute.

Which of the following is the BEST explanation for this behavior?

What happens to evaluation licenses during the license-upgrade process?

Before upgrading SecurePlatform, you should create a backup. To save time, many administrators use the command backup. This creates a backup of the Check Point configuration as well as the system configuration.
An administrator has installed the latest HFA on the system for fixing traffic problem after creating a backup file. There is a mistake in the very complex static routing configuration. The Check Point configuration has not been changed.
Can the administrator use a restore to fix the errors in static routing?

The third-shift Administrator was updating Security Management Server Access settings in Global Properties and testing. He managed to lock himself out of his account.

How can you unlock this account?

You wish to view the current state of the customer's VPN tunnels, including those that are down and destroyed.

Which SmartConsole application will provide you with this information?

Which set of objects have an Authentication tab?

What statement is true regarding Visitor Mode?

Which R75 feature or command allows Security Administrators to revert to earlier versions of the Security Policy without changing object configurations?

You have three servers located in a DMZ, using private IP addresses. You want internal users from 10.10.10.x to access the DMZ servers by public IP addresses. Internal_net 10.10.10.x is configured for Hide NAT behind the Security Gateway's external interface. What is the best configuration for 10.10.10.
x users to access the DMZ servers, using the DMZ servers' public IP addresses?

Which OPSEC server can be used to prevent users from accessing certain Web sites?

Which of the following methods will provide the most complete backup of an R75 configuration?

Which authentication type requires specifying a contact agent in the Rule Base?

Which statement below describes the most correct strategy for implementing a Rule Base?

How can you reset the password of the Security Administrator that was created during initial installation of the Security Management Server on SecurePlatform?

From the output below, where is this fingerprint generated?

You enable Hide NAT on the network object, 10.1.1.0 behind the Security Gateway's external interface.
You browse to from host, 10.1.1.10 successfully. You enable a log on the rule that allows 10.1.1.0 to exit the network.

How many log entries do you see for that connection in SmartView Tracker?

What CANNOT be configured for existing connections during a policy install?

You want to configure a mail alert for every time the policy is installed to a specific Gateway.

Where would you configure this alert?

Which of these security policy changes optimize Security Gateway performance?

John currently administers a network using NGX R65.4 on the Security Management Server and NGX R65.2.100 (the VOIP release with the VOIP plug-ins enabled). He wants to upgrade to R75 to get the benefits of Check Point's Software Blades.

What would be the best way of doing this?

How can you view cpinfo on a SecurePlatform machine?

You are a security architect and need to design a secure firewall, VPN and IPS solution.

Where would be the best place to install IPS in the topology if the internal network is already protected?

Certificates for Security Gateways are created during a simple initialization from______.

If you were NOT using IKE aggressive mode for your IPsec tunnel, how many packets would you see for normal Phase 1 exchange?

Which command gives an overview of your installed licenses?

What mechanism does a gateway configured with Identity Awareness and LDAP initially use to communicate with a Windows 2003 or 2008 server?

How do you use SmartView Monitor to compile traffic statistics for your company's Internet activity during production hours?

Which of the following statements accurately describes the snapshot command?

What are the two basic rules which should be used by all Security Administrators?

Where can an administrator specify the notification action to be taken by the firewall in the event that available disk space drops below 15%?

For VPN routing to succeed, what must be configured?

You install and deploy SecurePlatform with default settings. You allow Visitor Mode in the Remote Access properties of the Gateway object and install policy, but SecureClient refuses to connect.

What is the cause of this?

Which rule is responsible for the installation failure?

Which Check Point address translation method allows an administrator to use fewer ISP-assigned IP addresses than the number of internal hosts requiring Internet connectivity?

Which command displays the installed Security Gateway version?

Nancy has lost SIC communication with her Security Gateway and she needs to re-establish SIC. What would be the correct order of steps needed to perform this task?

1. Create a new activation key on the Security Gateway, then exit cpconfig.
2. Click the Communication tab on the Security Gateway object, and then click Reset.
3. Run the cpconfig tool, and then select Secure Internal Communication to reset.
4. Input the new activation key in the Security Gateway object, and then click initialize
5. Run the cpconfig tool, then select source Internal Communication to reset.

When using vpn tu, which option must you choose if you only want to clear phase 2 for a specific IP (gateway)?

A client has created a new Gateway object that will be managed at a remote location. When the client attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install On check box.

What should you look for?

Your company's Security Policy forces users to authenticate to the Gateway explicitly, before they can use any services. The Gateway does not allow the Telnet service to itself from any location. How would you configure authentication on the Gateway? With a:

Which of the following methods is NOT used by Identity Awareness to catalog identities?

Users with Identity Awareness Agent installed on their machines login with __________, so that when the user logs into the domain, that information is also used to meet Identity Awareness credential requests.

When translation occurs using automatic Hide NAT, what also happens?

Which of the following statements regarding SecureXL and CoreXL is TRUE?

You are responsible for the configuration of MegaCorp's Check Point Firewall. You need to allow two NAT rules to match a connection. Is it possible? Give the BEST answer.

Select the correct statement about Secure Internal Communications (SIC) Certificates. SIC Certificates:

The R75 fw monitor utility is used to troubleshoot which of the following problems?

How do you recover communications between your Security Management Server and Security Gateway if you lock yourself out via a rule or policy mis-configuration?

You are consulting with an Administrator who has locked himself out of SmartDashboard installed on a standalone SecurePlatform Security Gateway. Now, he cannot access the Security Management Server via SmartDashboard or any other SmartConsole tools.

How can you get him reconnected to SmartDashboard?

To monitor all traffic between a network and the Internet on a SecurePlatform Gateway, what is the BEST utility to use?

How can you access the Certificate Revocation List (CRL) on the firewall, if you have configured a Stealth Rule as the first explicit rule?

How do you configure the Security Policy to provide user access to the Captive Portal through an external (Internet) interface?

Which Check Point address translation method is necessary if you want to connect from a host on the Internet via HTTP to a server with a reserved (RFC 1918) IP address on your DMZ?

You are installing your R75Security Gateway.

Which is NOT a valid option for the hardware platform?

Which antivirus scanning method does not work if the Gateway is connected as a node in proxy mode?

You installed Security Management Server on a computer using SecurePlatform in the MegaCorp home office. You use IP address 10.1.1.1. You also installed the Security Gateway on a second SecurePlatform computer, which you plan to ship to another Administrator at a MegaCorp hub office. What is the correct order for pushing SIC certificates to the Gateway before shipping it?

1. Run cpconfig on the gateway, set secure internal communication, enter the activation key and reconfirm.
2. Initialize internal certificate authority (ICA) on the security Management server.
3. Confirm the gateway object with the host name and IP address for the remote site.
4. Click the communication button in the gateway object's general screen, enter the activation key, and
click initialize and ok.
5. Install the security policy.

When you hide a rule in a Rule Base, how can you then disable the rule?

Which type of resource could a Security Administrator use to control access to specific file shares on target machines?

Identify the correct step performed by SmartUpdate to upgrade a remote Security Gateway. After selecting Packages / Distribute Only and choosing the target Gateway, the:

When using AD Query to authenticate users for Identity Awareness, identity data is received seamlessly from the Microsoft Active Directory (AD).

What is NOT a recommended usage of this method?

You plan to upgrade from R65 to R75 Software Blades.
Do you need new licenses and license strings for this scenario?

Static NAT connections, by default, translate on which firewall kernel inspection point?

Which of these components does NOT require a Security Gateway R75 license?

A security audit has determined that your unpatched Web application server is accessing a SQL server.

Which IPS setting will allow the Security Gateway to prevent this error page from displaying information about the SQL server in your DMZ?

Which port must be allowed to pass through enforcement points in order to allow packet logging to operate correctly?