156-915.77 Practice Questions Preview

Question 1

Single choice

Your organization's disaster recovery plan needs an update to the backup and restore section to reap the new distributed R77 installation benefits. Your plan must meet the following required and desired objectives:

Required Objective: The Security Policy repository must be backed up no less frequently than every 24 hours.

Desired Objective: The R77 components that enforce the Security Policies should be backed up at least once a week.

Desired Objective: Back up R77 logs at least once a week.

Your disaster recovery plan is as follows:

- Use the cron utility to run the command upgrade_export each night on the Security Management Servers.

- Configure the organization's routine back up software to back up the files created by the command
upgrade_export.

- Configure the GAiA back up utility to back up the Security Gateways every Saturday night.

- Use the cron utility to run the command upgrade_export each Saturday night on the log servers.

- Configure an automatic, nightly logswitch.

- Configure the organization's routine back up software to back up the switched logs every night.

Upon evaluation, your plan:

A
Meets the required objective and only one desired objective.
B
Meets the required objective but does not meet either desired objective.
C
Does not meet the required objective.
D
Meets the required objective and both desired objectives.

Reveal answer details Close answer details

Correct answerD

Question 2

Single choice

Which command allows you to view the contents of an R77 table?

A
fw tab -a <tablename>
B
fw tab -t <tablename>
C
fw tab -s <tablename>
D
fw tab -x <tablename>

Reveal answer details Close answer details

Correct answerB

Question 3

Single choice

Which command will only show the number of entries in the connection table?

A
fw tab -t connections -s
B
fw tab -t connections -u
C
fw tab -t connections
D
fw tab

Reveal answer details Close answer details

Correct answerA

Question 4

Fill in the blank

Type the full cphaprob command and syntax that will show full synchronization status.

A. cphaprob -i list

Reveal answer details Close answer details

Accepted answerA

Question 5

Single choice

The process ________________ compiles $FWDIR/conf/*.W files into machine language.

A
fw gen
B
cpd
C
fwd
D
fwm

Reveal answer details Close answer details

Correct answerA

Question 6

Single choice

MultiCorp has bought company OmniCorp and now has two active AD domains.

How would you deploy Identity Awareness in this environment?

A
You must run an ADquery for every domain.
B
Identity Awareness can only manage one AD domain.
C
Only one ADquery is necessary to ask for all domains.
D
Only Captive Portal can be used.

Reveal answer details Close answer details

Correct answerA

Question 7

Single choice

Which of the following is a CLI command for Security Gateway R77?

A
fw tab -u
B
fw shutdown
C
fw merge
D
fwm policy_print <policyname>

Reveal answer details Close answer details

Correct answerA

Question 8

Single choice

Which of the following tools is used to generate a Security Gateway R77 configuration report?

A
fw cpinfo
B
infoCP
C
cpinfo
D
infoview

Reveal answer details Close answer details

Correct answerC

Question 9

Single choice

Which of the following is NOT a feature of Cluster XL?

A
Enhanced throughput in all Cluster XL modes (2 gateway cluster compared with 1 gateway)
B
Transparent failover in case of device failures
C
Zero downtime for mission-critical environments with State Synchronization
D
Transparent upgrades

Reveal answer details Close answer details

Correct answerC

Question 10

Single choice

Which command would provide the most comprehensive diagnostic information to Check Point Technical Support?

A
fw cpinfo
B
cpinfo -o date.cpinfo.txt
C
diag
D
cpstat - date.cpstat.txt

Reveal answer details Close answer details

Correct answerB

Question 11

Single choice

You configure a Check Point QoS Rule Base with two rules: an HTTP rule with a weight of 40, and the Default Rule with a weight of 10.
If the only traffic passing through your QoS Module is HTTP traffic, what percent of bandwidth will be allocated to the HTTP traffic?

A
80%
B
40%
C
100%
D
50%

Reveal answer details Close answer details

Correct answerC

Question 12

Single choice

After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by anti-spoofing protections.

Which of the following is the MOST LIKELY cause?

A
The Global Properties setting Translate destination on client side is unchecked. But the topology on the DMZ interface is set to Internal - Network defined by IP and Mask. Check the Global Properties setting Translate destination on client side.
B
The Global Properties setting Translate destination on client side is unchecked. But the topology on the external interface is set to Others +. Change topology to External.
C
The Global Properties setting Translate destination on client side is checked. But the topology on the external interface is set to External. Change topology to Others +.
D
The Global Properties setting Translate destination on client side is checked. But the topology on the DMZ interface is set to Internal - Network defined by IP and Mask. Uncheck the Global Properties setting Translate destination on client side.

Reveal answer details Close answer details

Correct answerA

Question 13

Single choice

Suppose the Security Gateway hard drive fails and you are forced to rebuild it. You have a snapshot file stored to a TFTP server and backups of your Security Management Server.

What is the correct procedure for rebuilding the Gateway quickly?

A
Reinstall the base operating system (i.e., GAiA). Configure the Gateway interface so that the Gateway can communicate with the TFTP server. Revert to the stored snapshot image, and install the Security Policy.
B
Run the command revert to restore the snapshot, establish SIC, and install the Policy.
C
Run the command revert to restore the snapshot. Reinstall any necessary Check Point products.
Establish SIC and install the Policy.
D
Reinstall the base operating system (i.e., GAia). Configure the Gateway interface so that the Gateway
can communicate with the TFTP server. Reinstall any necessary Check Point products and previously applied hotfixes. Revert to the stored snapshot image, and install the Policy.

Reveal answer details Close answer details

Correct answerA

Question 14

Single choice

You are responsible for the configuration of MegaCorp's Check Point Firewall. You need to allow two NAT rules to match a connection. Is it possible? Give the BEST answer.

A
No, it is not possible to have more than one NAT rule matching a connection. When the firewall receives a packet belonging to a connection, it compares it against the first rule in the Rule Base, then the second rule, and so on. When it finds a rule that matches, it stops checking and applies that rule.
B
Yes, it is possible to have two NAT rules which match a connection, but only in using Manual NAT (bidirectional NAT).
C
Yes, there are always as many active NAT rules as there are connections.
D
Yes, it is possible to have two NAT rules which match a connection, but only when using Automatic
NAT (bidirectional NAT).

Reveal answer details Close answer details

Correct answerD

Question 15

Single choice

The process ________ is responsible for Policy compilation.

A
FWM
B
Fwcmp
C
CPLMD
D
CPD

Reveal answer details Close answer details

Correct answerA

Question 16

Single choice

Your expanding network currently includes ClusterXL running Multicast mode on two members, as shown in this topology:

Exhibit:

You need to add interfaces: 10.10.10.1/24 on Member A, and 10.10.10.2/24 on Member B. The virtual IP address for these interfaces is 10.10.10.3/24. Both cluster gateways have a Quad card with an available eth3 interface.

What is the correct procedure to add these interfaces?

A
1. Disable "Cluster membership" from one Gateway via cpconfig.
2. Configure the new interface via sysconfig from the "non-member" Gateway.
3. Re-enable "Cluster membership" on the Gateway.
4. Perform the same steps on the other Gateway.
5. Update the topology in the cluster object.
6. Install the Security Policy.
B
1. Configure the new interface on both members using WebUI.
2. Update the new topology in the cluster object from SmartDashboard.
3. Define virtual IP in the Dashboard
4. Install the Security Policy.
C
1. Use WebUI to configure the new interfaces on both member.
2. Update the topology in the cluster object.
3. Reboot both gateways.
4. Install the Security Policy.
D
1. Use the command ifconfig to configure and enable the new interface on both members.
2. Update the topology in the cluster object for the cluster and both members.
3. Install the Security Policy.
4. Reboot the gateway.

Reveal answer details Close answer details

Correct answerB

Question 17

Single choice

You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate
destination on client site from Global Properties > NAT.
Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?

A
No extra configuration is needed.
B
A proxy ARP entry, to ensure packets destined for the public IP address will reach the Security Gateway's external interface.
C
The NAT IP address must be added to the external Gateway interface anti-spoofing group.
D
A static route, to ensure packets destined for the public NAT IP address will reach the Gateway's internal interface.

Reveal answer details Close answer details

Correct answerD

Question 18

Single choice

If you need strong protection for the encryption of user data, what option would be the BEST choice?

A
Use Diffie-Hellman for key construction and pre-shared keys for Quick Mode. Choose SHA in Quick Mode and encrypt with AES. Use AH protocol. Switch to Aggressive Mode.
B
When you need strong encryption, IPsec is not the best choice. SSL VPN's are a better choice.
C
Use certificates for Phase 1, SHA for all hashes, AES for all encryption and PFS, and use ESP protocol.
D
Disable Diffie-Hellman by using stronger certificate based key-derivation. Use AES-256 bit on all encrypted channels and add PFS to QuickMode. Use double encryption by implementing AH and ESP as protocols.

Reveal answer details Close answer details

Correct answerC

Question 19

Fill in the blank

Fill in the blank. To remove site-to-site IKE and IPSEC keys you would enter command ____ ___ and select the option to delete all IKE and IPSec SA's.

A. vpn tu

Reveal answer details Close answer details

Accepted answerA

Question 20

Single choice

In SmartDashboard, Translate destination on client side is checked in Global Properties.
When Network Address Translation is used:

A
It is not necessary to add a static route to the Gateway's routing table.
B
It is necessary to add a static route to the Gateway's routing table.
C
The Security Gateway's ARP file must be modified.
D
VLAN tagging cannot be defined for any hosts protected by the Gateway.

Reveal answer details Close answer details

Correct answerA

Question 21

Single choice

Which of the following CLISH commands would you use to set the admin user's shell to bash?

A
set user admin shell bash
B
set user admin shell /bin/bash
C
set user admin shell = /bin/bash
D
set user admin /bin/bash

Reveal answer details Close answer details

Correct answerB

Question 22

Single choice

In the following cluster configuration; if you reboot sglondon_1 which device will be active when
sglondon_1 is back up and running?

Why?

A
sglondon_1 because it the first configured object with the lowest IP.
B
sglondon_2 because sglondon_1 has highest IP.
C
sglondon_1, because it is up again, sglondon_2 took over during reboot.
D
sglondon_2 because it has highest priority.

Reveal answer details Close answer details

Correct answerD

Question 23

Single choice

Many companies have defined more than one administrator. To increase security, only one administrator should be able to install a Rule Base on a specific Firewall.

How do you configure this?

A
Define a permission profile in SmartDashboard with read/write privileges, but restrict it to all other firewalls by placing them in the Policy Targets field. Then, an administrator with this permission profile cannot install a policy on any Firewall not listed here.
B
Put the one administrator in an Administrator group and configure this group in the specific Firewall
object in Advanced > Permission to Install.
C
In the object General Properties representing the specific Firewall, go to the Software Blades product list and select Firewall. Right-click in the menu, select Administrator to Install to define only this administrator.
D
Right-click on the object representing the specific administrator, and select that Firewall in Policy Targets.

Reveal answer details Close answer details

Correct answerB

Question 24

Single choice

Your perimeter Security Gateway's external IP is 200.200.200.3. Your network diagram shows:

Required: Allow only network 192.168.10.0 and 192.168.20.0 to go out to the Internet, using
200.200.200.5.
The local network 192.168.1.0/24 needs to use 200.200.200.3 to go out to the Internet.

Assuming you enable all the settings in the NAT page of Global Properties, how could you achieve these requirements?

A
Create network objects for 192.168.10.0/24 and 192.168.20.0/24. Enable Hide NAT on both network objects, using 200.200.200.5 as hiding IP address. Add an ARP entry for 200.200.200.3 for the MAC address of 200.200.200.5.
B
Create an Address Range object, starting from 192.168.10.1 to 192.168.20.254. Enable Hide NAT on the NAT page of the address range object. Enter Hiding IP address 200.200.200.5. Add an ARP entry for 200.200.200.5 for the MAC address of 200.200.200.3.
C
Create a network object 192.168.0.0/16. Enable Hide NAT on the NAT page. Enter 200.200.200.5 as the hiding IP address. Add an ARP entry for 200.200.200.5 for the MAC address of 200.200.200.3.
D
Create two network objects: 192.168.10.0/24 and 192.168.20.0/24. Add the two network objects to a
group object. Create a manual NAT rule like the following: Original source - group object; Destination -
any; Service - any; Translated source - 200.200.200.5; Destination - original; Service - original.

Reveal answer details Close answer details

Correct answerB

Question 25

Single choice

What is the purpose of the pre-defined exclusions included with SmartEvent R77?

A
To allow SmartEvent R77 to function properly with all other R71 devices.
B
To avoid incorrect event generation by the default IPS event definition; a scenario that may occur in
deployments that include Security Gateways of versions prior to R71.
C
As a base for starting and building exclusions.
D
To give samples of how to write your own exclusion.

Reveal answer details Close answer details

Correct answerB

Question 26

Single choice

When using migrate to upgrade a Secure Management Server, which of the following is included in the migration?

A
Smart Event database
B
Smart Reporter database
C
classes. C file
D
System interface configuration

Reveal answer details Close answer details

Correct answerC

Question 27

Single choice

How could you compare the Fingerprint shown to the Fingerprint on the server? Run cpconfig and select:

Exhibit:

A
the Certificate Authority option and view the fingerprint.
B
the GUI Clients option and view the fingerprint.
C
the Certificate's Fingerprint option and view the fingerprint.
D
the Server Fingerprint option and view the fingerprint.

Reveal answer details Close answer details

Correct answerC

Question 28

Single choice

You have pushed a policy to your firewall and you are not able to access the firewall.

What command will allow you to remove the current policy from the machine?

A
fw purge policy
B
fw fetch policy
C
fw purge active
D
fw unload local

Reveal answer details Close answer details

Correct answerD

Question 29

Single choice

The process ________ is responsible for Management High Availability synchronization.

A
CPLMD
B
FWM
C
Fwsync
D
CPD

Reveal answer details Close answer details

Correct answerB

Question 30

Single choice

Which command displays the installed Security Gateway version?

A
fw printver
B
fw ver
C
fw stat
D
cpstat -gw

Reveal answer details Close answer details

Correct answerB

Question 31

Single choice

Your primary Security Gateway runs on GAiA.

What is the easiest way to back up your Security Gateway R77 configuration, including routing and network configuration files?

A
Copying the directories $FWDIR/conf and $FWDIR/lib to another location.
B
Using the native GAiA backup utility from command line or in the Web based user interface.
C
Using the command upgrade_export.
D
Run the pre_upgrade_verifier and save the .tgz file to the directory /temp.

Reveal answer details Close answer details

Correct answerB

Question 32

Single choice

You need to back up the routing, interface, and DNS configuration information from your R77 GAiA Security Gateway.

Which backup-and-restore solution do you use?

A
Manual copies of the directory $FWDIR/conf
B
GAiA back up utilities
C
upgrade_export and upgrade_import commands
D
Database Revision Control

Reveal answer details Close answer details

Correct answerB

Question 33

Single choice

When using GAiA, it might be necessary to temporarily change the MAC address of the interface eth 0 to 00:0C:29:12:34:56. After restarting the network the old MAC address should be active.

How do you configure this change?

A
Option A
B
Option B
C
Option C
D
Option D

Reveal answer details Close answer details

Correct answerA

Question 34

Single choice

Charles requests a Website while using a computer not in the net_singapore network.

What is TRUE about his location restriction?

A
Source setting in Source column always takes precedence.
B
Source setting in User Properties always takes precedence.
C
As location restrictions add up, he would be allowed from net_singapore and net_sydney.
D
It depends on how the User Auth object is configured; whether User Properties or Source Restriction
takes precedence.

Reveal answer details Close answer details

Correct answerD

Question 35

Fill in the blank

Fill in the blanks. To view the number of concurrent connections going through your firewall, you would use the command and syntax __ ___ __ __________ __ .

A. fw tab -t connections -s

Reveal answer details Close answer details

Accepted answerA