156-315.75 questions and answers

As Expert user, type command snapshot - R to restore from a local file. Then, provide the correct file name.

As Expert user, type command snapshot -r MySnapshot.tgz.

Reboot the system and call the start menu. Select option Snapshot Management, provide the Expert password and select [L] for a restore from a local file. Then, provide the correct file name.

OK, Needs Attention, Uninitialized, Unknown

OK, Waiting, Unknown, Not Installed, Not Updated, May be out of date

OK, In Use. Out of date, not used

LDAP, Active Directory, SecurID

LDAP, RADIUS, Active Directory, SecurID

LDAP, RADIUS, TACACS, SecurID

Must be chosen/configured manually by the Administrator in the Policy > Global Properties

Must be chosen/configured manually by the Administrator in the VPN community object

Route-based

3, 2, 1, 4

2, 4, 3, 1

1, 3, 2, 4

1, 2, 3, 4

Another administrator pushed a SmartProvisioning profile to the firewall

Another administrator issued a new backup command through the command line

Another administrator logged in to the WebUI and changed the setting without your knowledge

Management Portal requires a license

Default Port for Management Portal access is 4433

Management Portal could be reconfigured for using HTTP instead of HTTPS

cpstop

spstop

sportalstop

The device that created it, after it has been upgraded

Individual members of a cluster configuration

Windows Server class systems

Yes, but by manually changing the parameter :IsPasswordWarning to true in the $FWDIR/conf/
objects_5_0.C file, to allow for LDAP password remediation; and through the use of multiple-challenge
login pages.

No, R71 only supports authentication by client certificates.

SSL VPN only supports server certificates.

Add events to the events database.

Assign a severity level to an event.

Analyze each IPS log entry as it enters the Log server.

NAT_dst_any_list

host_ip_addrs

NAT_src_any_list

fw install_mgmt

upgrade_mgmt

fwm upgrade_tool

The DLP Gateway can inspect internal e-mails (e-mails between two users on the internal network) if the organization's internal mail server is located in the internal network and users are configured to send e-mails to this mail server using SMTP.

User's HTTPS and FTP traffic can be inspected by the R71 DLP Gateway.

The DLP Gateway can inspect e-mails (e-mails between two users on an internal or external network) if
the organization's internal mail server is located on another network (not the internal network; for
instance the DMZ or a different internal network) and users are configured to send e- mails to this mail server using SMTP.

Configure the SMTP Security Server to perform MX resolving.

Configure the SMTP Security Server to perform filtering, based on IP address and SMTP protocols.

Configure the SMTP Security Server to work with an OPSEC based product, for content checking.

Configure the SMTP Security Server to apply a generic "from" address to all outgoing mail.

Analyze log entries, looking for Event Policy patterns.

Generate a threat analysis report from the Analyzer database.

Display received threats and tune the Events Policy.

ipconfig -a > [filename].txt

ifconfig > [filename].txt

cp /etc/sysconfig/network.C [location]

To block traffic from and to a specific person

To block traffic from and to a specific company

To block traffic from and to a specific city

cpstat os

fw ver

securexl stat

The session moves to status Awaiting Repair and must be resubmitted.

The session is continued with status Not approved and a new session must be started.

The session is discarded and a new session is automatically started.

R70

R71

R70.20

3rd party cluster

Load Sharing Unicast (Pivot) mode

HA (New mode)

The Security Server is not communicating with the CVP server.

The Security Server is not configured correctly.

The Security Server is communicating with the CVP server, but no restriction is defined in the CVP server.

Run cpconfig utility to enable ospf routing

ip route ospf
ospf network1
ospf network2

Use DBedit utility to either the objects_5_0.c file

1. Create a data base revision control back up using SmartDashboard.
2. Create a compressed archive of the directories %FWDIR%/conf and %FWDIR%/lib and copy them to another networked machine.
3. Uninstall all packages using Add/Remove Programs and reboot.
4. Install again as a primary Security Management Server using the R77 CD-ROM.
5. Reboot and restore the two archived directories over the top of the new installation, choosing to overwrite existing files.

1. Download the latest utility upgrade_export and run from a local directory c:/temp to export the configuration into a *.tgz file.
2. Skip any upgrade_verification warnings since you are not upgrading.
3. Transfer the file *.tgz to another networked machine.
4. Download and run the utility cpclean and reboot.
5. Use the R77 CD-ROM to select option upgrade_import to import the configuration.

1. Download the latest utility upgrade_export and run from directory c:/temp to export the configuration into a *.tgz file.
2. Follow steps suggested by upgrade_verification.
3. Uninstall all packages using Add/Remove Programs and reboot.
4. Use SmartUpdate to reinstall the Security Management Server and reboot.
5. Transfer file *.tgz back to local directory /temp.
6. Run upgrade_import to import the configuration.

Global properties

Licenses

SIC Certificates

Log into SmartDashboard, Create a new rule with the source and destination addresses of the needed remote network, set the action to Encrypt and push the policy to that gateway.

Log into SmartDashboard, Select the VPN Communities tab and add the gateway to the appropriate community.

Log into WebUI on the gateway and check the SSL VPN Blade check box.

cpvpnd

fwm

fwd

Select the option Auto-detect client capabilities.

Select the option Turn off all SSL tunneling clients.

Select the option Enable SSL Network Extender Network Mode only.

edit the Gateway Properties and increase the kernel instances.

run cpconfig to increase the number of CPU cores.

edit the Gateway Properties and increase the number of CPU cores.

No, the Security Gateway cannot be installed on the Security Management Pro Server.

No, Cluster Member 3 does not have the required memory.

No, the Security Management Server is not running the same operating system as the cluster members.

The active cluster member's IP address cannot be determined by this ARP cache.

10.4.8.3

10.4.8.1

The customer can check compliance. This function compares the logs with the compliance requirements and automatically reports which part of the selected compliance is fulfilled and which is not.

The customer can use the Check Point's SmartView Tracker to view the required information. He selects the log category Changed Objects.

The customer can use the Check Point's SmartView Tracker directly to receive the required information. He selects the log category SmartWorkflow.

Domain VPN takes precedence over the route-based VTI. To make the VPN go through VTI, remove the Gateways out of the mesh community and replace with a star community

Route-based VTI takes precedence over the Domain VPN. Troubleshoot the static route entries to insure that they are correctly pointing to the VTI gateway IP.

Route-based VTI takes precedence over the Domain VPN. To make the VPN go through VTI, use dynamic-routing protocol like OSPF or BGP to route the VTI address to the peer instead of static routes

localhost.localdomain(config)#

localhost.localdomain(config-if)#

localhost.localdomain(config-router-ospf)#

Members A and B are not synchronized, because #PEAK for both members is not close in the connections table.

Members A and B are synchronized, because #SLINKS are identical in the connections table.

Members A and B are synchronized, because ID for both members is identical in the connections table.

A third-party cluster solution is implemented.

Objects.C does not contain a cluster object.

Device Name contains non-ASCII characters.

MEP Gateways cannot be geographically separated machines.

The decision on which MEP Gateway to use is made on the MEP Gateway's side of the tunnel.

MEP Gateways must be managed by the same SmartCenter Server.

Guarantees

Low Latency Queuing

Differentiated Services

Broadcast storm

iflist -renew

Ping the sync interface

The Smartview Monitor

The standalone SmartProvisioning server

They are fetched locally from the individual device

Configure a workstation object for the LDAP server, configure a server object for the LDAP Account Unit, and enable LDAP in Global Properties.

Configure a server object for the LDAP Account Unit, and create an LDAP resource object.

Configure a server object for the LDAP Account Unit, enable LDAP in Global Properties, and create an LDAP resource object.

Nothing; snapshot is not supported in Connectra SSL VPN.

The management configuration of the current product, on a management or stand-alone machine

Specified directories of the local file system.

1256 MB

1 GB

512 MB

An Account Unit is the Check Point account that SmartDirectory uses to access an (LDAP) server

An Account Unit is a system account on the Check Point gateway that SmartDirectory uses to access an (LDAP) server

An Account Unit is the administration account on the LDAP server that SmartDirectory uses to access to (LDAP) server

Send a Certified Security Engineer to each site to perform the update

Use a SSH connection to SCP the HFA to each Security Gateway. Once copied locally, initiate a remote installation command and monitor the installation progress with SmartView Monitor.

Send a CDROM with the HFA to each location and have local personnel install it

Only IPSO 3.9 supports VTI feature, so you have to replace your Security Gateway with Nokia appliances.

In SmartDashboard click on the OS drop down menu and choose SecurePlatform Pro. You have to reboot the Security Gateway in order for the change to take effect.

You have to re-install your Security Gateway with SecurePlatform Pro R75, as SecurePlatform R75
does not support VTIs.

CPHA using an encrypted TCP connection

fw kernel using an encrypted TCP connection

cpd using an encrypted TCP connection

256

264

201

NGX R60

NGXR65HFA_50

NGX R71

TELNET

HTTPS

LDAP

HTTPS traffic is not scanned by DLP

Only one proxy can be configured for DLP

You must configure the DLP gateway to allow HTTP/HTTPS traffic through the proxy if you have a web proxy between the DLP gateway and the internet.

Log Consolidator Policy

Log Sequence Policy

Report Policy

(i) and (ii)

(i), (ii) and (iv)

(i), (iii) and (iv)

1. Synchronize the two SmartCenter Servers.
2. Upgrade the secondary SmartCenter Server.
3. Upgrade the primary SmartCenter Server.
4. Configure both SmartCenter Server host objects version to VPN-1 NGX.
5. Synchronize the Servers again.

1. Perform an advanced upgrade on the primary SmartCenter Server.

2. Configure the primary SmartCenter Server host object to version VPN-1 NGX.
3. Synchronize the primary with the secondary SmartCenter Server.
4. Upgrade the secondary SmartCenter Server.
5. Configure the secondary SmartCenter Server host object to version VPN-1 NGX.
6. Synchronize the Servers again.

1. Synchronize the two SmartCenter Servers.
2. Perform an advanced upgrade on the primary SmartCenter Server.
3. Configure the primary SmartCenter Server host object to version VPN-1 NGX.
4. Synchronize the two Servers again.
5. Upgrade the secondary SmartCenter Server.
6. Configure the secondary SmartCenter Server host object to version VPN-1 NGX.
7. Synchronize the Servers again.

Edit affinity.conf and change the settings.

Run fw affinity and change the settings.

Run sim affinity and change the settings.

1. Add a new interface on each Gateway.
2. Remove the newly added network from the current VPN Domain for each Gateway.
3. Create VTIs on each Gateway, to point to the other two peers
4. Enable advanced routing on all three Gateways.

1. Add a new interface on each Gateway.
2. Add the newly added network into the existing VPN Domain for each Gateway.
3. Create VTIs on each gateway object, to point to the other two peers.
4. Enable advanced routing on all three Gateways.

1. Add a new interface on each Gateway.
2. Add the newly added network into the existing VPN Domain for each gateway object.
3. Create VTIs on each gateway object, to point to the other two peers.
4. Add static routes on three Gateways, to route the new networks to each peer's VTI interface.

Availability

Check Point UserCheck client authentication is based on AD.

For SMTP traffic, each recipient e-mail address is translated using AD/LDAP to a user name and group that is checked vs. the destination column of the DLP rule base.

For SMTP traffic, the sender e-mail address is translated using AD/LDAP to a user name and group that is checked vs. the source column of the DLP rule base.

Inside the SmartLSM Security Gateway object in the SmartDashboard GUI

Inside the SmartLSM Security Gateway object in the SmartProvisioning GUI

Inside the SmartLSM Security Gateway profile in the SmartDashboard GUI

There were some Hardware/Software issues at Security Management server on the first day.

Peter was no logged on to system for a longer time

The specific SmartWorkflow read/Write permission were assigned to David only.

VPN-1 Secure Client users attempting to connect to the object defined in the Destination column of the rule will receive a new Desktop Policy from the resource.

All packets that match the resource in the rule will be dropped.

Users attempting to connect to the destination of the rule will be required to authenticate.

All packets matching that rule are either encrypted or decrypted by the defined resource.

A PDF file that contains the following text Yarkon1 can be the code name for the new product. Yardens list of protected sites

A word file that contains the following text will match: Ayalon ayalon AYALON

A password protected MS Excel file that contains the following text Ayalon Yarkon Yarden

SmartEvent Analysis DataServer

SmartEvent Client

SmartEvent Correlation Unit

To implement Integrity Clientless Security

To force the user to re-authenticate at login

Without a special setting. Secure Workspace is automatically configured.

This is not a valid selection in R71

Starts a packet capture at the time of policy install to capture all of the traffic until this protection is hit.

Collects all of the logs for packets that have matched this protection within the last 30 days

Defining the e-mail address of the SMTP relay server.

FTP traffic sent from a user where his e-mail is part of this definition scanned by DLP, by default.

HTTP traffic sent from a user where his e-mail is part of this definition scanned by DLP, by default.

i

i, ii, iv

i, ii, iii, iv

cphaprob off

fw ctl accel off

securexl off

$FWDIR/conf/fwmuser

$FWDIR/conf/users.NDB

$FWDIR/conf/fwusers.conf

LEA

URI

AMON

CVP

displays the received events

adds events to the events database

analyzes each IPS log entry as it enters the Log server

Multicast

Legacy

New

The state of connections using resources is maintained by a Security Server, so these connections cannot be synchronized.

In the case of a failover, accounting information on the failed member may be lost despite a properly working synchronization.

Only cluster members running on the same OS platform can be synchronized.

PROT_SRV.EXE

fw.d

protect.exe

Phase 3 Key Revocation

MD5 Hash Completion

SHA1 Hash Completion

DES Key Reset

Edit the masters. conf file on the Portal server.

Run sysconfig and change the management interface.

Re-initialize SIC.

Rule Weight needs to be changed to 10

The Source and Destination columns need to be reversed

Encrypted traffic needs to be added to the Action field

All members receive all packets. The Security Management Server decides which member will process the packets. Other members delete the packets from memory.

All cluster members process all packets and members synchronize with each other.

Only one member at a time is active. The active cluster member processes all packets.

When accuracy in detecting identity is crucial

Protecting highly sensitive servers

Leveraging identity for Data Center protection

SmartEvent DataServer

SmartEvent Correlation Unit

SmartEvent Client

analyzes each IPS log entry as it enters the Log server.

displays the received events.

forwards what is known as an event to the SmartEvent Server.

You did not activate synchronization within Global Properties.

You are using different time zones.

You have installed both Security Management Servers on different server systems (e. g. one machine on HP hardware and the other one on DELL).

VPN Directional Match on the Gateway object's VPN tab

Advanced Routing on each Security Gateway

directional_match(true) in the objects_5_0.C file on Security Management Server

iked.elg

ike.elg

vpn.elg

Zones

Groups

Regions

fw ctl syncstat stop

fw ctl setsync 0

fw ctl syncstat off

Analyze log entries, looking for Event Policy patterns.

Display received threats and tune the Events Policy.

Generate a threat analysis report from the Analyzer database.

SmartDashboard, SmartView Tracker and SmartView Monitor logins and logouts

Security Policies and the Rule Base, Network Objects, Network Services, VPN Communities.

Users, Administrators, Groups and VPN Communities

5%

20%

8%

save memory

write config

save

Run fw monitor -e "accept;" -f monitor.out

Run fw monitor -e "accept;" -c monitor.out

Run fw monitor -e "accept;" -m monitor.out

In parallel to the firewall

In a DMZ

On the Primary cluster member

Run fw ctl set buf 1024

Run fw ctl kdebug 1024

Run fw ctl set int print_cons 1024