CheckPoint Checkpoint Certifications 156-215.75 Questions & Answers

• Question 371:

  Which statement below describes the most correct strategy for implementing a Rule Base?

  A. Add the Stealth Rule before the last rule.

  B. Umit grouping to rules regarding specific access.

  C. Place the most frequently used rules at the top of the Policy and the ones that are not frequently used further down.

  D. Place a network-traffic rule above the administrator access rule.

  Correct Answer: C

• Question 372:

  A marketing firm's networking team is trying to troubleshoot user complaints regarding access to audio-streaming material from the Internet. The networking team asks you to check the object and rule configuration settings for the perimeter Security Gateway. Which SmartConsole application should you use to check these objects and rules?

  A. SmartView Tracker

  B. SmartView Status

  C. SmartView Monitor

  D. SmartDashboard

  Correct Answer: D

• Question 373:

  After filtering a fw monitor trace by port and IP, a packet is displayed three times; in the i, I, and o inspection points, but not in the O inspection point. Which is the likely source of the issue?

  A. The packet has been sent out through a VPN tunnel unencrypted.

  B. An IPSO ACL has blocked the outbound passage of the packet.

  C. A SmartDefense module has blocked the packet

  D. It is an issue with NAT

  Correct Answer: D

• Question 374:

  Which answers are TRUE? Automatic Static NAT CANNOT be used when:

  i) NAT decision is based on the destination port ii) Source and Destination IP both have to be translated iii) The NAT rule should only be installed on a dedicated Gateway only iv) NAT should be performed on the server side

  A. (i), (ii), and (iii)

  B. (i), and (ii)

  C. (ii) and (iv)

  D. only (i)

  Correct Answer: D

• Question 375:

  In order to have full control, you decide to use Manual NAT entries instead of Automatic NAT rules. Which of the following is NOT true?

  A. When using Static NAT, you must enter ARP entries for the Gateway on all hosts that are using the NAT Gateway with that Gateway's internal interface IP address.

  B. When using Static NAT, you must add proxy ARP entries to the Gateway for all hiding addresses.

  C. If you chose Automatic NAT instead, all necessary entries are done for you.

  D. When using Dynamic Hide NAT with an address that is not configured on a Gateway interface, you need to add a proxy ARP entry for that address.

  Correct Answer: A

• Question 376:

  Static NAT connections, by default, translate on which firewall kernel inspection point?

  A. Post-inbound

  B. Eitherbound

  C. Inbound

  D. Outbound

  Correct Answer: C

• Question 377:

  In a Hide NAT connection outbound, which portion of the packet is modified?

  A. Source IP address and destination port

  B. Destination IP address and destination port

  C. Source IP address and source port

  D. Destination IP address and destination port

  Correct Answer: C

• Question 378:

  You are MegaCorp's Security Administrator. There are various network objects which must be NATed. Some of them use the Automatic Hide NAT method, while others use the Automatic Static NAT method. What is the order of the rules if both methods are used together? Give the best answer.

  A. The Administrator decides on the order of the rules by shifting the corresponding rules up and down.

  B. The Static NAT rules have priority over the Hide NAT rules and the NAT on a node has priority over the NAT on a network or an address range

  C. The Hide NAT rules have priority over the Static NAT rules and the NAT on a node has priority over the NAT on a network or an address range

  D. The position of the rules depends on the time of their creation. The rules created first are placed at the top; rules created later are placed successively below the others.

  Correct Answer: B

• Question 379:

  Secure Internal Communications (SIC) is completely NAT-tolerant because it is based on:

  A. MAC addresses.

  B. SIC names.

  C. SIC is not NAT-tolerant.

  D. IP addresses.

  Correct Answer: B

• Question 380:

  In SmartDashboard, Translate destination on client side is checked in Global Properties. When Network Address Translation is used:

  A. It is necessary to add a static route to the Gateway's routing table.

  B. The Security Gateway's ARP file must be modified.

  C. It is not necessary to add a static route to the Gateway's routing table.

  D. VLAN tagging cannot be defined for any hosts protected by the Gateway.

  Correct Answer: C