156-215.81.20 questions and answers

First two; Internet

First two; Transport

Upper; Application

"Edit layers by Software Blades" is unselected in the Permission Profile

All permission profiles are in use.

"Edit layers by selected profiles in a layer editor" is unselected in the Permission profile.

On the firewall object, Legacy Authentication screen, check "Enable Identity Captive Portal"

In the Captive Portal screen of Global Properties, check "Enable Identity Captive Portal"

On the Security Management Server object, check the box "Identity Logging"

1, 2, and 3

2 and 3

1 and 3

Create a policy rule to block the traffic.

Wait until traffic has been identified before making any changes.

Contact ISP to block the traffic.

Shared Secret Passwords

Unique Passwords

Shared User Certificates

A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if implicit Drop Rule drops the packet, it comes next to IPS layer and then after accepting the packet it passes to Threat Prevention layer.

A packet arrives at the gateway, it is checked against the rules in the networks policy layer and then if there is any rule which accepts the packet, it comes next to Threat Prevention layer and then after accepting the packet it passes to IPS layer.

A packet arrives at the gateway, it is checked against the rules in IPS policy layer and then it comes next to the Network policy layer and then after accepting the packet it passes to Threat Prevention layer.

AdminB sees a pencil icon next the rule that AdminB is currently editing.

AdminA, AdminB and AdminC are editing three different rules at the same time.

AdminC sees a lock icon which indicates that the rule is locked for editing by another administrator.

License Management file

License Contract file

Security Gateway Contract file

Firewall, NAT, Content Awareness and Mobile Access

Firewall, URLF, Content Awareness and Mobile Access

Firewall (Network Access Control), Application & URL Filtering and Content Awareness

Dynamic NAT with Port Address Translation can offer more flexibility than Network Address Translation (NAT) Overloading.

Automatic NAT can offer more flexibility than Manual NAT.

Dynamic Network Address Translation (NAT) Overloading can offer more flexibility than Port Address Translation.

Object Navigator

Object Editor

Object Browser

Using cpconfig, update the Dynamic Dispatcher value to "full" under the CoreXL menu

Edit /proc/interrupts to include multik set_mode 1 at the bottom of the file, save, and reboot

run fw ctl multik set_mode 1 in Expert mode and then reboot

User server

UserCheck

User index

Configure rules to limit the available network bandwidth for specified users or groups.

Use UserCheck to help users understand that certain websites are against the company's security policy.

Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.

Source

Hide

Destination

Save Policy

Install Database

Save session

License Management file

Security Gateway Contract file

License Contract file

Application Control

Anti-Virus

Advanced Networking Blade

The setting Log does not capture this level of detail for GRE. Set the rule tracking action to Audit since certain types of traffic can only be tracked this way.

The log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt. Because it is encrypted, the R77 Security Gateway cannot distinguish between GRE sessions.
This is a known issue with GRE.
Use IPSEC instead of the non-standard GRE protocol for encapsulation.

The Log Server is failing to log GRE traffic properly because it is VPN traffic. Disable all VPN configuration to the partner site to enable proper logging.

The SMS can contact the Security Gateway but cannot establish Secure Internal Communication.

SIC activation key requires a reset.

The SIC activation key is not known by any administrator.

Read-only

Expert

Bash

SmartView Monitor

There is no Web application for SmartEvent

SmartView

Detect threats and provides a detailed report of discovered threats

Delivers file with original content

Delivers PDF versions of original files with active content removed

Logout of the session

File > Save

Install database

License and Update

Package Repository and Licenses

Update and License & Contract

Targeted

Bridge Mode

Standalone

Formal

Corporate

Local

No, Certificate based VPNs are only possible between Check Point devices

No, they cannot share certificate authorities

Yes, but they have to have a pre-shared secret key

show configuration all

show confd configuration

show confd configuration all

You achieve a faster access time by placing LDAP servers containing the database at remote sites

You achieve compartmentalization by allowing a large number of users to be distributed across several servers

You gain High Availability by replicating the same information on several servers

Capsule Workspace can provide access to any application

Capsule Connect provides Business data isolation

Capsule Connect does not require an installed application at client

Threat Emulation

Anti-Virus

Application Control

All-in-one (stand-alone)

Log server

SmartEvent

Rule 7 was created by the 'admin' administrator in the current session

8 changes have been made by administrators since the last policy installation

Te rules 1, 5 and 6 cannot be edited by the 'admin' administrator

Install the View Implicit Rules package using SmartUpdate.

Define two log servers on the R77 Gateway object. Lof Implied Rules on the first log server. Enable Log Rule Base on the second log server. Use SmartReporter to merge the two log server records into the same database for HIPPA log audits.

Check the Log Implied Rules Globally box on the R77 Gateway object.

Run cpconfig, and click Reset.

Run cpconfig, and select Secure Internal Communication > Change One Time Password.

Click Communication > Reset on the Gateway object, and type a new activation key.

Connections to the specified target are blocked without the need to change the Security Policy.

Connections to and from the specified target are blocked without the need to change the Security Policy.

Connections to and from the specified target are blocked with the need to change the Security Policy.

Only when there is Multicast solution set up

There is Load Sharing solution set up

Only when there is Unicast solution set up

SNMP

Mail

User defined alert

Upper; Application

First two; Internet

First two; Transport

Central

Corporate

Formal

The firewall topologies

NAT Rules

The VPN Domains

Threat Emulation

Access Control

Threat Prevention

SmartManager

SmartConsole

Security Gateway

IPSec VPN does not require installation of a resident VPN client

SSL VPN requires installation of a resident VPN client

SSL VPN and IPSec VPN are the same

SmartView Tracker, SmartDashboard, CPINFO, SmartUpdate, SmartView Status

SmartView Tracker, SmartDashboard, SmartLSM, SmartView Monitor

Security Policy Editor, Log Viewer, Real Time Monitor GUI

Sessions ends when policy is pushed to the Security Gateway.

Sessions locks the policy package for editing.

Starts when an Administrator publishes all the changes made on SmartConsole.

Specific ?derived from a selected object

Network defined by the interface IP and Net Mask

Not-defined

Bridge Mode, Remote, and Standalone

Remote, Standalone, and Distributed

Standalone, Distributed, and Bridge Mode

Using UDP Multicast or Broadcast on port 8116

Quicker than Full sync

Transfers changes in the Kernel tables between cluster members

Smart Event

Gateways & Servers Tab

Logs & Monitoring

Accounting

Suppression

Accounting/Extended

A rule used to hide a server's IP address from the outside world.

A rule that allows administrators to access SmartDashboard from any device.

A rule at the end of your policy to drop any traffic that is not explicitly allowed.

drops packets without logging connections that would otherwise be dropped and logged by default.

logs connections that would otherwise be accepted without logging by default.

drops packets without logging connections that would otherwise be accepted and logged by default.

Application Control, DLP

ACL, SandBlast, MPT

IPS, Mobile Threat Protection

SND is a feature to accelerate multiple SSL VPN connections

SND is an alternative to IPSec Main Mode, using only 3 packets

SND is a feature of fw monitor to capture accelerated packets

Go to clash-Run cpstop | Run cpstart

Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores

Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig |
Reboot Security Gateway | Install Security Policy

Security Gateway API, Management API, Threat Prevention API and Identity Awareness Web Services
API

OSE API, OPSEC SDK API, Threat Prevention API and Policy Editor API

CPMI API, Management API, Threat Prevention API and Identity Awareness Web Services API

If the user credentials do not match an Access Role, the traffic is automatically dropped.

If the user credentials do not match an Access Role, the system displays a sandbox.

If the user credentials do not match an Access Role, the system displays the Captive Portal.

Two

Three

Infinite

Rule is locked by AdminA, because the save bottom has not been press.

Rule is locked by AdminA, because an object on that rule is been edited.

Rule is locked by AdminA, and if the session is saved, rule will be available

Open SmartLog and connect remotely to the wireless controller

Open SmartEvent to see why they are being blocked

Open SmartDashboard and review the logs tab

ELA and CPD

FWD and CPLOG

ELA and CPLOG

Users

Networks

Machines

Server, SCP, Username, Password, Path, Comment, Member

Server, TFTP, Username, Password, Path, Comment, All Members

Server, Protocol, Username, Password, Path, Comment, Member

Security Zones are not supported by Check Point firewalls.

The firewall rule can be configured to include one or more subnets in a zone.

The local directly connected subnet defined by the subnet IP and subnet mask.

Incoming

Internal

External

Accept Rule and Drop Rule

Explicit Rule and Implied Rule

NAT Rule and Reject Rule

Standalone

Bridge

Kerberos SSO which will be working for Active Directory integration

Obligatory usage of Captive Portal

The ports 443 or 80 what will be used by Browser-Based and configured Authentication

Central Licensing actually not supported with Gaia.

Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed.

Central Licensing is the only option when deploying Gaia.

CloudSec deployment

Disliked deployment

Router only deployment

Standby/standby; active/active

Active/active; standby/standby

Active/active; active/standby;

IPsec VPN blade should be enabled on both Security Gateway.

Pre-shared can only be used while creating a VPN between a third party vendor and Check Point Security Gateway.

The Security Gateways are pre-R75.40.

show configuration

migrate export

upgrade export

The dedicated Log Server must be the same version as the Security Management Server.

A Log Server has a SIC certificate which allows secure communication with the SMS and Security Gateways.

More than one Log Server can be installed.

SHA-200

MD5

SHA-128

Delete older versions of database.

Revert the session.

Save and install the Policy.

Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.

Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes.

Tom's changes will be lost since he lost connectivity and he will have to start again.

Data Awareness is not enabled.

Identity Awareness is not enabled.

Logs are arriving from Pre-R80 gateways.

IPSEC Phase 2

IPSEC Phase 1

IKE Phase 2

UDP port 265

UDP port 256

TCP port 256

You can only use the rule for Telnet, FTP, SMPT, and rlogin services.

Once a user is first authenticated, the user will not be prompted for authentication again until logging out.

You can limit the authentication attempts in the User Properties' Authentication tab.

80

4434

8080

The existing license expires

The license is upgraded

The IP address of the Security Management or Security Gateway has changed

Create a new logical-server object to represent your partner's CA

Manually import your partner's Certificate Revocation List.

Manually import your partner's Access Control List.

Good Security

No Screening above Network layer

Transparency

Remove the service HTTP from the column Service in Rule 4.

Nothing at all

Modify the columns Source or Destination in Rule 4

Internal clients can upload and download any-files to FTP_Ext-server using FTP.

Internal clients can upload and download archive-files to FTP_Ext server using FTP.

Clients external to the Security Gateway can upload any files to the FTP_Ext-server using FTP.

Sent to the Internal Certificate Authority.

Sent to the Security Administrator.

Stored on the Security Management Server.

Firewall policy install

Anti-bot policy install

Access Control policy install

Network Node

Externally managed gateway

Gateway

Management container

Management server

Security Gateway container

There is connection between the gateway and Security Management Server but it is not trusted.

The secure communication is established.

The Security Management Server can contact the gateway, but cannot establish SIC.

When Joe logs in, Bob will be log out automatically.

Since they both are log in on different interfaces, they both will be able to make changes.

Bob will be prompt that Joe logged in.

SNMP

User defined alert

Mail

Translated packet and untranslated packet

Untranslated packet and manipulated packet

Manipulated packet and original packet

infoCP

infoview

fw cpinfo

Messaging tool used to verify a user's credentials.

Communication tool used to notify an administrator when a new user is created.

Administrator tool used to monitor users on their network.