CheckPoint 156-215.75 Online Practice Questions and Exam Preparation

CheckPoint 156-215.75 Online Questions & Answers

• Question 1:

  Which of the following statements about the Port Scanning feature of IPS is TRUE?

  A. The default scan detection is when more than 500 open inactive ports are open for a period of 120 seconds.
  B. The Port Scanning feature actively blocks the scanning, and sends an alert to SmartView Monitor.
  C. Port Scanning does not block scanning; it detects port scans with one of three levels of detection sensitivity.
  D. When a port scan is detected, only a log is issued, never an alert.
  C. Port Scanning does not block scanning; it detects port scans with one of three levels of detection sensitivity.

• Question 2:

  Which of the following generates a SmartEvent Report from its SQL database?

  A. Security Management Server
  B. SmartEvent Client
  C. SmartReporter
  D. SmartDashboard Log Consolidator
  C. SmartReporter

• Question 3:

  To backup all events stored in the SmartEvent Server, you should back up the contents of which folder(s)?

  A. $FWDIR/distrib_db and $FWDIR/events
  B. $FWDIR/events_db
  C. $FWDIR/distrib and $FWDIR/events_db
  D. $FWDIR/distrib
  C. $FWDIR/distrib and $FWDIR/events_db

• Question 4:

  What is the benefit to running SmartEvent in Learning Mode?

  A. To run SmartEvent, with a step-by-step online configuration guide for training/setup purposes
  B. There is no SmartEvent Learning Mode
  C. To run SmartEvent with preloaded sample data in a test environment
  D. To generate a report with system Event Policy modification suggestions
  D. To generate a report with system Event Policy modification suggestions

• Question 5:

  You have selected the event Port Scan from Internal Network in SmartEvent, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?

  A. Select the two port-scan detections as a sub-event.
  B. Define the two port-scan detections as an exception.
  C. You cannot set SmartEvent to detect two port scans from a host within 10 seconds of each other.
  D. Select the two port-scan detections as a new event.
  B. Define the two port-scan detections as an exception.

• Question 6:

  What is the purpose of the pre-defined exclusions included with SmartEvent R71?

  A. To give samples of how to write your own exclusion.
  B. To avoid incorrect event generation by the default IPS event definition; a scenario that may occur in deployments that include Security Gateways of versions prior to R71.
  C. To allow SmartEvent R71 to function properly with all other R71 release devices.
  D. As a base for starting and building exclusions.
  B. To avoid incorrect event generation by the default IPS event definition; a scenario that may occur in deployments that include Security Gateways of versions prior to R71.

• Question 7:

  How many pre-defined exclusions are included by default in SmartEvent R71 as part of the product installation?

  A. 3
  C. 10
  D. 5
  A. 3

• Question 8:

  What is the SmartEvent Analyzer's function?

  A. Analyze log entries, looking for Event Policy patterns.
  B. Generate a threat analysis report from the Analyzer database.
  C. Display received threats and tune the Events Policy.
  D. Assign severity levels to events.
  D. Assign severity levels to events.

• Question 9:

  Which of the following functions CANNOT be performed in ClientInfo on computer information collected?

  A. Copy the contents of the selected cells.
  B. Save the information in the active tab to an .exe file.
  C. Enter new credential for accessing the computer information.
  D. Run Google.com search using the contents of the selected cell.
  B. Save the information in the active tab to an .exe file.

• Question 10:

  What is a task of the SmartEvent Client?

  A. Add events to the events database.
  B. Display the received events.
  C. Assign a severity level to an event.
  D. Analyze each IPS log entry as it enters the Log server.
  B. Display the received events.