CheckPoint CCSA 156-215.75 Questions & Answers

• Question 141:

  What statement is true regarding Visitor Mode?

  A. VPN authentication and encrypted traffic are tunneled through port TCP 443.

  B. All VPN traffic is tunneled through UDP port 4500.

  C. Only Main mode and Quick mode traffic are tunneled on TCP port 443.

  D. Only ESP traffic is tunneled through port TCP 443.

  Correct Answer: A

• Question 142:

  Phase 1 uses________.

  A. Conditional

  B. Sequential

  C. Asymmetric

  D. Symmetric

  Correct Answer: C

• Question 143:

  If you were NOT using IKE aggressive mode for your IPsec tunnel, how many packets would you see for normal Phase 1 exchange?

  A. 6

  B. 2

  C. 3

  D. 9

  Correct Answer: A

• Question 144:

  How many packets does the IKE exchange use for Phase 1 Main Mode?

  A. 6

  B. 1

  C. 3

  D. 12

  Correct Answer: A

• Question 145:

  How many packets does the IKE exchange use for Phase 1 Aggressive Mode?

  A. 12

  B. 3

  C. 1

  D. 6

  Correct Answer: B

• Question 146:

  Which of the following actions take place in IKE Phase 2 with Perfect Forward Secrecy disabled?

  A. The DH public keys are exchanged.

  B. Peers authenticate using certificates or preshared secrets.

  C. Symmetric IPsec keys are generated.

  D. Each Security Gateway generates a private Diffie-Hellman (DH) key from random pools.

  Correct Answer: C

• Question 147:

  What can NOT be selected for VPN tunnel sharing?

  A. One tunnel per subnet pair

  B. One tunnel per Gateway pair

  C. One tunnel per pair of hosts

  D. One tunnel per VPN domain pair

  Correct Answer: D

• Question 148:

  Marc is a Security Administrator configuring a VPN tunnel between his site and a partner site. He just created the partner city's firewall object and a community. While trying to add the firewalls to the community only his firewall could be chosen. The partner city's firewall does not appear. What is a possible reason for the problem?

  A. IPsec VPN Software Blade on the partner city's firewall object is not activated.

  B. The partner city's firewall object was created as an interoperable device.

  C. The partner city's Gateway is running VPN-1 NG AI.

  D. Only Check Point Gateways could be added to a community.

  Correct Answer: A

• Question 149:

  If Henry wanted to configure Perfect Forward Secrecy for his VPN tunnel, in which phase would he be configuring this?

  A. Aggressive Mode

  B. Diffie-Hellman

  C. Phase 2

  D. Phase 1

  Correct Answer: C

• Question 150:

  You install and deploy SecurePlatform with default settings. You allow Visitor Mode in the Remote Access properties of the Gateway object and install policy, but SecureClient refuses to connect. What is the cause of this?

  A. Set Visitor Mode in Policy > Global Properties / Remote-Access / VPN - Advanced.

  B. Office mode is not configured.

  C. The WebUI on SecurePlatform runs on port 443 (HTTPS). When you configure Visitor Mode it cannot bind to default port 443, because it's used by another program (WebUI). You need to change the WebUI port, or run Visitor Mode on a different port.

  D. You need to start SSL Network Extender first, than use Visitor Mode.

  Correct Answer: C