CheckPoint Checkpoint Certifications 156-115.77 Questions & Answers

• Question 81:

  You would like to import SNORT rules but to comply with corporate policy you need to test the conversion prior to import. How can you do this?

  A. You must manually review each signature.

  B. SnortConvertor update -f --dry-run

  C. Check Point does not support third party signatures.

  D. Under the IPS tree Protections > By Protocol > IPS Software Blade > Application Intelligence > SNORT import and select the SNORT import option.

  Correct Answer: B

• Question 82:

  You are adding a new gateway into your network. You must make sure that it is running the latest Corporate approved IPS profile. How can you get this information to your new gateway?

  A. From the command line, run: ips_import -f [-p ].

  B. IPS profiles must be manually configured on each gateway.

  C. From the command line, run: ips_export_import import -f [-p ].

  D. From the Smart Dashboard IPS tab select import IPS profiles and select the gateway to get the profile from.

  Correct Answer: C

• Question 83:

  SNORT is a popular open source IDS, you would like to import SNORT rules from plain text into Check Point Smart Center. How can you accomplish this?

  A. Under the IPS tree Protections > By Protocol > IPS Software Blade > Application Intelligence > SNORT import and select the SNORT import option.

  B. IPS profiles must be manually configured on each gateway.

  C. Check Point does not support third party signatures.

  D. From the command line, run: ips_export_import import -f [-p ].

  Correct Answer: A

• Question 84:

  You have configured IPS on your network; you find you are being overwhelmed with what you believe are false positives. You investigated this traffic and confirmed they are false positives. What can you do to stop these IPS alerts?

  A. Right click the alert and "ignore"

  B. Disable the IPS protection for this network

  C. Use a SAM rule to categorize this traffic

  D. Add an exception for this traffic under the IPS protection

  Correct Answer: D

• Question 85:

  You have spent time configuring the IPS profile on your primary gateway firewall. You want to ensure that this profile can be applied to all gateway firewalls in your environment. How can you share this information between firewalls?

  A. From the command line, run: ips_export [-o ] [-p ].

  B. IPS profiles must be manually configured on each gateway.

  C. From the Smart Dashboard IPS tab select export IPS profiles and select the gateway to send this export to.

  D. From the command line, run: ips_export_import export [-o ] [-p ].

  Correct Answer: D

• Question 86:

  How would one enable `INSPECT debugging' if one suspects IPS false positives?

  A. Run command fw ctl set int enable_inspect_debug 1 from the command line.

  B. Toggle the checkbox in Global Properties > Firewalls > Inspection section.

  C. WebUI

  D. Set the following parameter to true using GuiDBedit: enable_inspect_debug_compilation.

  Correct Answer: D

• Question 87:

  Which of the following CANNOT be used as a source/destination for an IPS network exception?

  A. Network Group

  B. Identity Awareness Access Role

  C. Any

  D. IP Address

  Correct Answer: B

• Question 88:

  When using Geo Protections, you find there are logs for a country that you believe is incorrect. What file do you review to verify what country Geo Protections should identify the traffic as?

  A. asm.C

  B. objects.C

  C. objects_5_0.C

  D. IpToCountry.csv

  Correct Answer: D

• Question 89:

  When performing a Clean IPS procedure to resolve a corrupt IPS files issue, what file is modified in order for the SDUU process to automatically update the IPS files after completing the procedure?

  A. asm.C

  B. inspect.C

  C. objects_5_0.C

  D. profiles.C

  Correct Answer: A

• Question 90:

  In IPS what does a high confidence rating mean?

  A. This is a rating for how confident Check Point is with catching this attack

  B. This is a rating for how likely this attack is to penetrate most systems

  C. There is a high likelihood of false positives

  D. There is a low likelihood of false positives

  Correct Answer: D