CheckPoint Checkpoint Certifications 156-115.77 Questions & Answers

• Question 251:

  Which FW-1 kernel flags should be used to properly debug and troubleshoot NAT issues?

  A. nat, route, conn, fwd, zeco, err

  B. nat, xlate, fwd, vm, ld, chain

  C. nat, xltrc, xlate, drop, conn, vm

  D. nat, drop, conn, xlate, filter, ioctl

  Correct Answer: C

• Question 252:

  Tom has a Web server for which he has created a manual NAT rule. The rule is not working. He tries to initiate a connection from the external network to a DMZ server using the public IP which the firewall translates to the actual IP of the server. He analyzes the captured packets using Wireshark and observes that the destination IP is being changed as required by the firewall but does not see the packet leave the internal interface. Which box in Global Properties should be checked?

  

  A. Automatic NAT rules > Allow bi-directional NAT

  B. Automatic NAT rules > Automatic ARP Configuration

  C. Automatic NAT rules > Translate destination on client side

  D. Manual NAT rules > Translate destination on client side

  Correct Answer: D

• Question 253:

  Since R76 GAiA, what is the method for configuring proxy ARP entries for manual NAT rules?

  A. WebUI or add proxy ARP ... commands via CLISH

  B. SmartView Tracker

  C. local.arp file

  D. SmartDashboard

  Correct Answer: A

• Question 254:

  Tom is troubleshooting NAT issues using fw monitor and Wireshark. He tries to initiate a connection from the external network to a DMZ server using the public IP which the firewall translates to the actual IP of the server. He analyzes the captured packets using Wireshark and observes that the destination IP is being changed as required by the firewall but does not see the packet leave the external interface. What could be the reason?

  A. The translation might be happening on the client side and the packet is being routed by the OS back to the external interface.

  B. The translation might be happening on the server side and the packet is being routed by OS back to the external interface.

  C. Packet is dropped by the firewall.

  D. After the translation, the packet is dropped by the Anti-Spoofing Protection.

  Correct Answer: B

• Question 255:

  You have set up a manual NAT rule, however fw monitor shows you that the device still uses the automatic Hide NAT rule. How should you correct this?

  A. Move your manual NAT rule above the automatic NAT rule.

  B. In Global Properties > NAT ensure that server side NAT is enabled.

  C. Set the following fwx_alloc_man kernel parameter to 1.

  D. In Global Properties > NAT ensure that Merge Automatic to Manual NAT is selected.

  Correct Answer: A

• Question 256:

  In your SecurePlatform configuration you need to set up a manual static NAT entry. After creating the proper NAT rule what step needs to be completed?

  A. Edit or create the file local.arp.

  B. No further actions are required.

  C. Edit or create the file discntd.if.

  D. Edit the file netconf.conf.

  Correct Answer: A

• Question 257:

  How do you set up Port Address Translation?

  A. Since Hide NAT changes to random high ports it is by definition PAT (Port Address Translation).

  B. Create a manual NAT rule and specify the source and destination ports.

  C. Edit the service in SmartDashboard, click on the NAT tab and specify the translated port.

  D. Port Address Translation is not support in Check Point environment

  Correct Answer: B

• Question 258:

  Which flag in the fw monitor command is used to print the position of the kernel chain?

  A. -all

  B. -k

  C. -c

  D. -p

  Correct Answer: D

• Question 259:

  Server A is subject to automatically static NAT and also resides on a network which is subject to automatic Hide NAT. With regards to address translation what will happen when Server A initiates outbound communication?

  A. This will cause a policy verification error.

  B. This is called hairpin NAT, the traffic will return to the server.

  C. The static NAT will take precedence.

  D. The Hide NAT will take precedence.

  Correct Answer: C

• Question 260:

  Where in a fw monitor output would you see source address translation occur in cases of automatic Hide NAT?

  A. Between the "I" and "o"

  B. Hide NAT does not adjust the source IP

  C. Between the "o" and "O"

  D. Between the "i" and "I"

  Correct Answer: C