CheckPoint Checkpoint Certifications 156-215.75 Questions & Answers

• Question 381:

  Looking at the SYN packets in the Wireshark output, select the statement that is true about NAT.

  

  A. There is not enough information provided in the Wireshark capture to determine NAT settings.

  B. This is an example hide NAT.

  C. There is an example of Static NAT and translate destination on client side unchecked in Global Properties.

  D. This is an example of Static NAT and Translate destination on client side checked in Global Properties.

  Correct Answer: D

• Question 382:

  When translation occurs using automatic Hide NAT, what also happens?

  A. Nothing happens.

  B. The source port is modified.

  C. The destination port is modified.

  D. The destination is modified.

  Correct Answer: B

• Question 383:

  The fw monitor utility is used to troubleshoot which of the following problems?

  A. Phase two key negotiation

  B. User data base corruption

  C. Address translation

  D. Log Consolidation Engine

  Correct Answer: C

• Question 384:

  The fw monitor utility would be best to troubleshoot which of the following problems?

  A. An error occurs when editing a network object in SmartDashboard

  B. A statically NATed Web server behind a Security Gateway cannot be reached from the Internet.

  C. You get an invalid ID error in SmartView Tracker for phase 2 IKE key negotiations.

  D. A user in the user database is corrupt.

  Correct Answer: B

• Question 385:

  A Web server behind the Security Gateway is set to Automatic Static NAT. Client side NAT is not checked in the Global Properties. A client on the Internet initiates a session to the Web Server. Assuming there is a rule allowing this traffic, what other configuration must be done to allow the traffic to reach the Web server?

  A. Automatic ARP must be unchecked in the Global Properties.

  B. A static route must be added on the Security Gateway to the internal host.

  C. Nothing else must be configured.

  D. A static route for the NAT IP must be added to the Gateway's upstream router.

  Correct Answer: B

• Question 386:

  An internal host initiates a session to and is set for Hide NAT behind the Security Gateway. The initiating traffic is an example of __________.

  A. None of these

  B. source NAT

  C. destination NAT

  D. client side NAT

  Correct Answer: B

• Question 387:

  A host on the Internet initiates traffic to the Static NAT IP of your Web server behind the Security Gateway. With the default settings in place for NAT, the initiating packet will translate the_________.

  A. source on client side

  B. destination on server side

  C. destination on client side

  D. source on server side

  Correct Answer: C

• Question 388:

  You have three servers located in a DMZ, using private IP addresses. You want internal users from

  10.10.10.x

  to access the DMZ servers by public IP addresses. Internal_net 10.10.10.x is configured for Hide NAT behind the Security Gateway's external interface. What is the best configuration for 10.10.10.x users to access the DMZ servers, using the DMZ servers' public IP addresses?

  A.

  When connecting to the Internet, configure manual Static NAT rules to translate the DMZ servers

  B.

  When the source is the internal network 10.10.10.x, configure manual static NAT rules to translate the DMZ servers.

  C.

  When connecting to internal network 10 10.10 x. configure Hide NAT for the DMZ servers.

  D.

  When connecting to the internal network 10.10.10x, configure Hide Nat for the DMZ network behind the DMZ interface of the Security Gateway

  

  Correct Answer: B

• Question 389:

  Your main internal network 10.10.10.0/24 allows all traffic to the Internet using Hide NAT. You also have a small network 10.10.20.0/24 behind the internal router. You want to configure the kernel to translate the source address only when network 10.10.20.0 tries to access the Internet for HTTP, SMTP, and FTP services. Which of the following configurations will allow this network to access the Internet?

  A. Configure three Manual Static NAT rules for network 10.10.20.0/24, one for each service

  B. Configure one Manual Hide NAT rule for HTTP, FTP, and SMTP services for network 10.10.20.0/24

  C. Configure Automatic Hide NAT on network 10.10.20.0/24 and then edit the Service column in the NAT Rule Base on the automatic rule

  D. Configure Automatic Static NAT on network 10.10.20.0/24

  Correct Answer: B

• Question 390:

  Which NAT option applicable for Automatic NAT applies to Manual NAT as well?

  A. Allow bi-directional NAT

  B. Automatic ARP configuration

  C. Enable IP Pool NAT

  D. Translate destination on client-side

  Correct Answer: D