156-915.80 questions and answers

Which command shows the connection table in human readable format?

The system administrator of a company is trying to find out why acceleration is not working for the traffic.
The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.

What is the most likely reason that the traffic is not accelerated?

What command verifies that the API server is responding?

Your perimeter Security Gateway's external IP is 200.200.200.3. Your network diagram shows:

Required: Allow only network 192.168.10.0 and 192.168.20.0 to go out to the Internet, using
200.200.200.5.
The local network 192.168.1.0/24 needs to use 200.200.200.3 to go out to the Internet.
Assuming you enable all the settings in the NAT page of Global Properties, how could you achieve these requirements?

You plan to automate creating new objects using new R80 Management API. You decide to use GAIA CLI for this task.

What is the first step to run management API commands on GAIA's shell?

Which statements about Management HA are correct?
1. Primary SmartCenter describes first installed SmartCenter
2. Active SmartCenter is always used to administrate with SmartConsole
3. Active SmartCenter describes first installed SmartCenter
4. Primary SmartCenter is always used to administrate with SmartConsole

Which of the following is the preferred method for adding static routes in GAiA?

GAiA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:

An internal host initiates a session to the Google.com website and is set for Hide NAT behind the Security Gateway. The initiating traffic is an example of __________.

In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with
___________ will not apply.

SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in a event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

Which command shows the current connections distributed by CoreXL FW instances?

Fill in the blank.

What is the correct command and syntax used to view a connection table summary on a Check Point Firewall?

What is the difference between an event and a log?

A snapshot delivers a complete GAiA backup. The resulting file can be stored on servers or as a local file in /var/CPsnapshot/snapshots.

How do you restore a local snapshot named MySnapshot.tgz?

Which of the following tools is used to generate a Security Gateway R80 configuration report?

You need to change the MAC-address on eth2 interface of the gateway.

What command and what mode will you use to achieve this goal?

After verifying that API Server is not running, how can you start the API Server?

Which of the following allows administrators to allow or deny traffic to or from a specific network based on the user's credentials?

What is the mechanism behind Threat Extraction?

How could you compare the Fingerprint shown to the Fingerprint on the server? Run cpconfig and select: Exhibit:

When using GAiA, it might be necessary to temporarily change the MAC address of the interface eth 0 to 00:0C:29:12:34:56. After restarting the network the old MAC address should be active.

How do you configure this change?

If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsive, which of these steps should NOT be performed:

Which of the following options is available with the GAiA cpconfig utility on a Management Server?

Both ClusterXL and VRRP are fully supported by Gaia R80.10 and available to all Check Point appliances.

Which of the following command is NOT related to redundancy and functions?

Your organization maintains several IKE VPN's. Executives in your organization want to know which mechanism Security Gateway R80 uses to guarantee the authenticity and integrity of messages.

Which technology should you explain to the executives?

Before upgrading SecurePlatform to GAiA, you should create a backup. To save time, many administrators use the command backup. This creates a backup of the Check Point configuration as well as the system configuration. An administrator has installed the latest HFA on the system for fixing traffic problem after creating a backup file. There is a mistake in the very complex static routing configuration. The Check Point configuration has not been changed.
Can the administrator use a restore to fix the errors in static routing?

MegaCorp is using SmartCenter Server with several gateways. Their requirements result in a heavy log load.
Would it be feasible to add the SmartEvent Correlation Unit and SmartEvent Server to their SmartCenter Server?

Which is the correct order of a log flow processed by SmartEvents components:

Which is NOT an example of a Check Point API?

Jack is using SmartEvent and does not see the identities of the users on the events.
As an administrator with full access, what does he need to do to fix his issue?

Captive Portal is a __________ that allows the gateway to request login information from the user.

Your expanding network currently includes ClusterXL running Multicast mode on two members, as shown in this topology: Exhibit: You need to add interfaces: 10.10.10.1/24 on Member A, and 10.10.10.2/24 on Member B. The virtual IP address for these interfaces is 10.10.10.3/24. Both cluster gateways have a Quad card with an available eth3 interface.

What is the correct procedure to add these interfaces?

Fill in the blank. To save your OSPF configuration in GAiA, enter the command ___________ .

Which process should you debug if SmartDashboard login fails?

Type the command and syntax to view critical devices on a cluster member in a ClusterXL environment.

What are the minimum open server hardware requirements for a Security Management Server/Standalone in R80.10?

When do modifications to the Event Policy take effect?

What Shell is required in Gaia to use WinSCP?

Why would you not see a CoreXL configuration option in cpconfig?

MultiCorp has bought company OmniCorp and now has two active AD domains.

How would you deploy Identity Awareness in this environment?

Which directory below contains log files?

What has to be taken into consideration when configuring Management HA?

Type the command and syntax that you would use to view the virtual cluster interfaces of a ClusterXL environment.

You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate
destination on client site from Global Properties > NAT.
Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?

What is the purpose of a SmartEvent Correlation Unit?

FILL BLANK

To bind a NIC to a single processor when using CoreXL on GAiA, you would use the command

Session unique identifiers are passed to the web api using which http header option?

What are the main stages of a policy installation?

Fill in the blank. To verify the SecureXL status, you would enter command _____________ .

If the first packet of an UDP session is rejected by a security policy, what does the firewall send to the client?

What is the responsibility of SOLR process on R80.10 management server?

Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.
After installation, is the administrator required to perform any additional tasks?

You need to change the number of firewall instances used by CoreXL.

How can you achieve this goal?

Which of these options is an implicit MEP option?

What gives administrators more flexibility when configuring Captive Portal instead of LDAP query for Identity Awareness authentication?

By default, the R80 web API uses which content-type in its response?

Type the full cphaprob command and syntax that will show full synchronization status.

Review the Rule Base displayed.

For which rules will the connection templates be generated in SecureXL?

Which Check Point address translation method is necessary if you want to connect from a host on the Internet via HTTP to a server with a reserved (RFC 1918) IP address on your DMZ?

Match the following commands to their correct function.

Each command has one function only listed.

Which statements below are CORRECT regarding Threat Prevention profiles in SmartConsole?

Which file defines the fields for each object used in the file objects.C (color, num/string, default value...
)?

What are the methods of SandBlast Threat Emulation deployment?

Check Point Management (cpm) is the main management process in that it provides the architecture for the consolidated management console. It empowers the migration from legacy Client side logic to Server side-logic. The cpm process:

What API command below creates a new host with the name "New Host" and IP address of "192.168.0.10"?

When configuring numbered VPN Tunnel Interfaces (VTIs) in a clustered environment, what issues need to be considered?
1. Each member must have a unique source IP address.
2. Every interface on each member requires a unique IP address.
3. All VTI's going to the same remote peer must have the same name.
4. Cluster IP addresses are required.

If your firewall is performing a lot of IPS inspection and the CPUs assigned to fw_worker_thread are at or near 100%, which of the following could you do to improve performance?

When deploying multiple clustered firewalls on the same subnet, what does the firewall administrator need to configure to prevent CCP broadcasts being sent to the wrong cluster?

After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by anti-spoofing protections.

Which of the following is the MOST LIKELY cause?

Your R80 primary Security Management Server is installed on GAiA;
You plan to schedule the Security Management Server to run fw logswitch automatically every 48 hours.

How do you create this schedule?

If Jack was concerned about the number of log entries he would receive in the SmartReporter system, which policy would he need to modify?

John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned an IP address 10.0.0.19 via DHCP.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop. He wants to move around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1. Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources installs the
policy.
2. Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web
Server from any machine and from any location. John plugged in his laptop to the network on a different network segment and he is not able to connect.

How does he solve this problem?

You have three Gateways in a mesh community. Each gateway's VPN Domain is their internal network as defined on the Topology tab setting All IP Addresses behind Gateway based on Topology information. You want to test the route-based VPN, so you created VTIs among the Gateways and created static route entries for the VTIs. However, when you test the VPN, you find out the VPN still go through the regular domain IPsec tunnels instead of the routed VTI tunnels.

What is the problem and how do you make the VPN use the VTI tunnels?

Which of the following is NOT an internal/native Check Point command?