156-915.65 Practice Questions Preview

Question 1

Single choice

What must a public hospital Security Administrator do to comply with new health-care legislation requirements for logging all traffic accepted through the perimeter Security Gateway?

A
Define two log servers on the VPN-1 NGX R65 Gateway object. Enable "Log Implied Rules" on the first log server. Enable "Log Rule Base" on the second log server. Use Eventia Reporter to merge the two log server records into the same database for HIPPA log audits.
B
Install the "View Implicit Rules" package using SmartUpdate.
C
In Global Properties > Reporting Tools check the box "Enable tracking all rules (including rules marked
as 'None' in the Track column). Send these logs to a secondary log server for a complete logging history Use your normal log server for standard logging for troubleshooting.
D
Check the "Log Implied Rules Globally" box on the VPN-1 NGX R65 Gateway object.

Reveal answer details Close answer details

Correct answerC

Question 2

Single choice

Which utility allows you to configure the DHCP service on SecurePlatform from the command line?

A
WebUI
B
cpconfig
C
ifconfig
D
sysconfig

Reveal answer details Close answer details

Correct answerD

Question 3

Single choice

You are administering your company's Clientless VPN connections.

How many Security Servers should you be running to support 750 active users?

A
3
B
7
C
5
D
1

Reveal answer details Close answer details

Correct answerC

Question 4

Single choice

State Synchronization is enabled on both members in a cluster, and the Security Policy is successfully installed. No protocols or services have been deselected for "selective sync".
The following is the fw tab -t connections -s output from both members:Is State Synchronization working properly between the two members?

A
Members A and B are synchronized, because #SLINKS are identical in the connections table.
B
Members A and B are not synchronized, because #VALS in the connections table are not close.
C
Members A and B are not synchronized, because #PEAKfor both members is not close in the connections table.
D
Members A and B are synchronized, because ID for both members is identical in the connections table.

Reveal answer details Close answer details

Correct answerB

Question 5

Single choice

Where is it necessary to configure historical records in SmartView Monitor to generate Express reports in Eventia Reporter?

A
In SmartDashboard.the SmartView Monitor page in the VPN-1 Security Gateway object
B
In Eventia Reporter, under Express > Network Activity
C
In Eventia Reporter, under Standard > Custom
D
In SmartView Monitor, under Global Properties > Log and Masters

Reveal answer details Close answer details

Correct answerA

Question 6

Single choice

The Check Point ClusterXL mode must synchronize the physical interface IP and MAC addresses on all clustered interfaces

A
New Mode HA
B
Legacy Mode HA
C
Multicast Mode Load Sharing
D
Pivot Mode Load Sharing

Reveal answer details Close answer details

Correct answerB

Question 7

Single choice

Which of these components does NOT require a VPN-1 NGX R65 license?

A
Check Point Gateway
B
SmartCenterServer
C
SmartConsole
D
SmartUpdate upgrading/patching

Reveal answer details Close answer details

Correct answerC

Question 8

Single choice

What is a Consolidation Policy?

A
A global Policy used to share a common enforcement policy for multiple similar Security Gateways
B
The collective name of the logs generated by Eventia Reporter
C
The collective name of the Security Policy, Address Translation, and SmartDefense Policies
D
The specific Policy written in SmartDashboard to configure which log data is stored in the Eventia Reporter database

Reveal answer details Close answer details

Correct answerD

Question 9

Single choice

What must a public hospital Security Administrator do to comply with new health-care legislation requirements for logging all traffic accepted through the perimeter Security Gateway?

A
Define two log servers on the VPN-1 NGX R65 Gateway object. Enable "Log Implied Rules" on the first log server. Enable "Log Rule Base" on the second log server. Use Eventia Reporter to merge the two log server records into the same database for HIPPA log audits.
B
Install the "View Implicit Rules" package using SmartUpdate.
C
In Global Properties > Reporting Tools check the box "Enable tracking all rules (including rules marked
as 'None' in the Track column). Send these logs to a secondary log server for a complete logging history. Use your normal log server for standard logging for troubleshooting.
D
Check the "Log Implied Rules Globally" box on the VPN-1 NGX R65 Gateway object.

Reveal answer details Close answer details

Correct answerC

Question 10

Single choice

When configuring site-to-site VPN High Availability (HA) with MEP, which of the following is correct?

A
MEP Gateways cannot be geographically separated machines.
B
MEP Gateways must be managed by the same SmartCenter Server.
C
The decision on which MEP Gateway to use is made on the MEP Gateway's side of the tunnel.
D
If one MEP Security Gateway fails, the connection is lost and the backup Gateway picks up the next connection.

Reveal answer details Close answer details

Correct answerD

Question 11

Single choice

You are running the licensejjpgrade tool on your SecurePlatform Gateway.

Which of the following can you NOT do with the upgrade tool?

A
Simulate the license-upgrade process.
B
Perform the actual license-upgrade process.
C
View the status of currently installed licenses.
D
View the licenses in the SmartUpdate License Repository.

Reveal answer details Close answer details

Correct answerD

Question 12

Single choice

How should Check Point packages be uninstalled?

A
In the same order in which the installation wrapper initially installed them
B
In any order as long as all packages are removed
C
In the opposite order in which the installation wrapper initially installed them
D
In any order; CPsuite must be the last package uninstalled.

Reveal answer details Close answer details

Correct answerC

Question 13

Single choice

The customer has a small Check Point installation which includes one Window XP workstation working as SmartConsole ,, one Solaris server working as SmartCenter, and a third server running SecurePlatform working as Security Gateway. This is an example of:

A
Hybrid Installation
B
Unsupported configuration
C
Stand-Alone Installation
D
Distributed Installation

Reveal answer details Close answer details

Correct answerA

Question 14

Single choice

Which SmartView Tracker mode allows you to read the SMTP email body sent from the Chief Executive Officer (CEO)?

A
Log Tab
B
Display Capture Action
C
This is not a SmartView Tracker feature
D
Account Query

Reveal answer details Close answer details

Correct answerB

Question 15

Single choice

Which Check Point product is used to create and save changes to a Log Consolidation Policy?

A
Eventia Reporter Client
B
SmartDashboard Log Consolidator
C
SmartCenterServer
D
Eventia Reporter Server

Reveal answer details Close answer details

Correct answerB

Question 16

Single choice

What is a Consolidation Policy?

A
A global Policy used to share a common enforcement policy for multiple similar Security Gateways
B
The collective name of the logs generated by Eventia Reporter
C
The collective name of the Security Policy, Address Translation, and SmartDefense Policies
D
The specific Policy written in SmartDashboard to configure which log data is stored in the Eventia Reporter database

Reveal answer details Close answer details

Correct answerD

Question 17

Single choice

An NGXR65 HA cluster contains two members with external interfaces 172.28.108.1 and 172.28.108.2.
The internal interfaces are 10.4.8.1 and 10.4.8.2. The external cluster VIP address is 172.28.108.3 and the internal cluster VIP address is 10.4.8.3. The synchronization interfaces are 192.168.1.1 and 192.168.1.2.
The Security Administrator discovers State Synchronization is not working properly.

The cphaprob if command output displays shows:What is causing the State Synchronization problem?

A
The synchronization network has been defined as "Network Objective: Cluster + 1st sync" with an IP address 192.168.1.3 defined in the NGX cluster object's topology. This configuration is supported in NGX and therefore the above screenshot is not relevant to the sync problem.
B
The synchronization interface on the individual NGX cluster member object's Topology tab is enabled with "Cluster Interface". Disable this setting.
C
The synchronization network has a cluster VIP address (192.168.1.3) defined in the NGX cluster object's topology. Remove the 192.168.1.3 VIP interface from the cluster topology.
D
Another cluster is using 192.168.1.3 as one of the unprotected interfaces.

Reveal answer details Close answer details

Correct answerA

Question 18

Single choice

What is a Consolidation Policy?

A
A global Policy used to share a common enforcement policy for multiple similar Security Gateways
B
The collective name of the logs generated by Eventia Reporter
C
The collective name of the Security Policy, Address Translation, and SmartDefense Policies
D
The specific Policy written in SmartDashboard to configure which log data is stored in the Eventia Reporter database

Reveal answer details Close answer details

Correct answerD

Question 19

Single choice

Your VPN-1 NGX R65 primary SmartCenter Server is installed on SecurePlatform. You plan to schedule the SmartCenter Server to run fw logswitch automatically every 48 hours.

How do you create this schedule?

A
Create a time object, and add 48 hours as the interval. Select that time object's Global Properties >
Logs and Masters window, to schedule a logswitch.
B
Create a time object, and add 48 hours as the interval. Open the Security Gateway object's Logs and Masters window, enable "Schedule log switch", and select the time object.
C
Create a time object, and add 48 hours as the interval. Open the primary SmartCenter Server object's
Logs and Masters window, enable "Schedule log switch", and select the Time object.
D
On a SecurePlatform SmartCenter Server, this can only be accomplished by configuring the fw logswitch command via the cron utility.

Reveal answer details Close answer details

Correct answerC

Question 20

Single choice

Match the ClusterXL Modes with their configurations

A
A2.B3.C4.D 1
B
A2.B3.C 1.D4
C
A3,B2,C4,D 1
D
A3.B2.C 1.D4

Reveal answer details Close answer details

Correct answerD

Question 21

Single choice

Which command would provide the most comprehensive diagnostic information to Check Point Technical Support?

A
cpinfo date.cpinfo.txt
B
cpstat> date.cpstat.txt
C
netstat > date.netstat.txt
D
diag

Reveal answer details Close answer details

Correct answerA

Question 22

Single choice

Your online bookstore has customers connecting to a variety of Web servers to place or change orders, and check order status. You ran penetration tests through the Security Gateway, to determine if the Web servers were protected from a recent series of cross-site scripting attacks. The penetration testing indicated the Web servers were still vulnerable. You have checked every box in the Web Intelligence tab, and installed the Security Policy.

What else might you do to reduce the vulnerability?

A
Configure the Security Gateway protecting the Web servers as a Web server.
B
The penetration software you are using is malfunctioning and is reporting a false-positive.
C
Check the "Web Intelligence" box in the SmartDefense > HTTP Protocol Inspection.
D
Check the "Products > Web Server" box on the host node objects representing your Web servers.

Reveal answer details Close answer details

Correct answerC

Question 23

Single choice

How do you block some seldom-used FTP commands, such as CWD, and FIND from passing through the Gateway?

A
Use FTP Security Server settings in SmartDefense.
B
Add the restricted commands to the aftpd.conf file in the SmartCenter Server.
C
Configure the restricted FTP commands in the Security Servers screen of the Global properties.
D
Enable FTP Bounce checking in SmartDefense.

Reveal answer details Close answer details

Correct answerA

Question 24

Single choice

The following is cphaprob state command output from one New Mode High Availability ClusterXL cluster member:

Which member will be active after member 192.168.1.2 fails over and is rebooted?

A
Both members' state will be collision.
B
192.168.1.1
C
192.168.1.2
D
Both members' state will be active.

Reveal answer details Close answer details

Correct answerB

Question 25

Single choice

How do you block some seldom-used FTP commands, such as CWD, and FIND from passing through the Gateway?

A
Use FTP Security Server settings in SmartDefense
B
Add the restricted commands to the aftpd.conf file in the SmartCenter Server.
C
Configure the restricted FTP commands in the Security Servers screen of the Global properties.
D
Enable FTP Bounce checking in SmartDefense.

Reveal answer details Close answer details

Correct answerA

Question 26

Single choice

Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?

A
VTIs are supported on SecurePlatform
B
VTIS cannot share IP addresses
C
VTIs can use an already existing physical-interface IP address
D
VTIS are assigned only local addresses, not remote addresses

Reveal answer details Close answer details

Correct answerA

Question 27

Single choice

If you are experiencing LDAP issues, which of the following should you check?

A
Connectivity between the NGX gateway and LDAP server
B
Secure Internal Communications (SIC)
C
VPN Load Balancing
D
Overlapping VPN Domains

Reveal answer details Close answer details

Correct answerA

Question 28

Single choice

A security audit has determined that your unpatched web application server is revealing the fact that it accesses a SQL server. You believe that you have enabled the proper SmartDefense setting but would like to verily this fact using SmartView Tracker.

Which of the following entries confirms the proper blocking of this leaked information to an attacker?

A
"Fingerprint Scrambling: Changed [SQL] to [Perl]"
B
"HTTP response spoofing: remove signature [SQL Server]"
C
"Concealed HTTP response [SQL Server]. (Error Code WSE0160003)"
D
"ASCII Only Response Header detected: SQL"

Reveal answer details Close answer details

Correct answerC

Question 29

Single choice

When configuring VPN High Availability (HA) with MEP, which of the following is correct?

A
The decision on which MEP Security Gateway to use is made on the remote gateway's side (non-MEP side).
B
MEP Gateways must be managed by the same SmartCenter Server.
C
MEP VPN Gateways cannot be geographically separated machines.
D
If one Gateway fails, the synchronized connection fails over to another Gateway and the connection continues

Reveal answer details Close answer details

Correct answerA

Question 30

Single choice

Which of the following is the most critical step in a SmartCenter Server NGX R65 backup strategy?

Perform a full system tape backup of both the SmartCenter and Security Gateway machines.

A
Run the cpstop command prior to running the upgrade_export command
B
Using the upgradejmport command, attempt to restore the SmartCenter Server to a non-production system
C
Move the *.tgz upgrade_export file to an off site location via ftp.

Reveal answer details Close answer details

Correct answerC

Question 31

Single choice

An internal host 10.4.8.108 successfully pings its Legacy Mode Cluster and receives replies. The following is the ARP table from the internal Windows host 10.4.8.108. Based on this information, what is the active cluster member's IP address?
According to the output, which member is the standby machine?

A
10.4.8.2
B
10.4.8.3
C
The active cluster member's IP address cannot be determined by this arp cache
D
10.4.8.1

Reveal answer details Close answer details

Correct answerC