CheckPoint CCSA 156-215.75 Questions & Answers

• Question 401:

  Which of these security policy changes optimize Security Gateway performance?

  A. Use Automatic NAT rules instead of Manual NAT rules whenever possible

  B. Putting the least-used rule at the top of the Rule Base

  C. Using groups within groups in the manual NAT Rule Base

  D. Using domain objects in rules when possible

  Correct Answer: A

• Question 402:

  Several Security Policies can be used for different installation targets. The firewall protecting Human Resources' servers should have a unique Policy Package. These rules may only be installed on this machine and not accidentally on the Internet firewall. How can this be configured?

  A. A Rule Base is always installed on all possible targets. The rules to be installed on a firewall are defined by the selection in the row Install On of the Rule Base.

  B. When selecting the correct firewall in each line of the row Install On of the Rule Base, only this firewall is shown in the list of possible installation targets after selecting Policy > Install.

  C. In the SmartDashboard main menu go to Policy / Policy Installation / Targets and select the correct firewall to be put into the list via Specific Targets.

  D. A Rule Base can always be installed on any Check Point firewall object It is necessary to select the appropriate target directly after selecting Policy > Install.

  Correct Answer: C

• Question 403:

  Installing a policy usually has no impact on currently existing connections. Which statement is TRUE?

  A. Users being authenticated by Client Authentication have to re-authenticate.

  B. Site-to-Site VPNs need to re-authenticate, so Phase 1 is passed again after installing the Security Policy.

  C. All FTP downloads are reset; users have to start their downloads again.

  D. All connections are reset, so a policy install is recommended during announced downtime only.

  Correct Answer: A

• Question 404:

  You are working with multiple Security Gateways that enforce a common set of rules. To minimize the number of policy packages, which one of the following would you choose to do?

  A. Install a separate local Security Management Server and SmartConsole for each remote Security Gateway.

  B. Create a separate Security Policy package for each remote Security Gateway and specify Install On / Gateways.

  C. Create a single Security Policy package with Install On / Target defined whenever a unique rule is required for a specific Gateway.

  D. Run separate SmartDashbord instance to login and configure each Security Gateway directly.

  Correct Answer: C

• Question 405:

  Which rules are not applied on a first-match basis?

  A. Cleanup

  B. User Authentication

  C. Session Authentication

  D. Client Authentication

  Correct Answer: B

• Question 406:

  You are working with multiple Security Gateways that enforce an extensive number of rules. To simplify Security administration, which one of the following would you choose to do?

  A. Create a separate Security Policy package for each remote Security Gateway

  B. Run separate SmartConsole instances to login and configure each Security Gateway directly

  C. Eliminate all possible contradictory rules such as the Stealth or Cleanup rules

  D. Create network objects that restrict all applicable rules to only certain networks

  Correct Answer: A

• Question 407:

  A Security Policy has several database versions. What configuration remains the same no matter which version is used?

  A. Rule Bases_5_0.fws

  B. Internal Certificate Authority (ICA) certificate

  C. Fwauth.NDB

  D. Objects_5_0.C

  Correct Answer: B

• Question 408:

  In a distributed management environment, the administrator has removed all default check boxes from the Policy / Global Properties / Firewall tab. In order for the Security Gateway to send logs to the Security Management Server, an explicit rule must be created to allow the Security Gateway to communicate to the Security Management Server on port ______.

  A. 259

  B. 257

  C. 900

  D. 256

  Correct Answer: B

• Question 409:

  Examine the following Security Policy. What, if any, changes could be made to accommodate Rule 4?

  

  A. Nothing at all

  B. Modify the Source or Destination columns in Rule 4

  C. Remove the service HTTPS from the Service column in Rule A

  D. Modify the VPN column in Rule 2 to limit access to specific traffic

  Correct Answer: D

• Question 410:

  All of the following are Security Gateway control connections defined by default implied rules, EXCEPT:

  A. Acceptance of IKE and RDP traffic for communication and encryption purposes.

  B. Exclusion of specific services for reporting purposes.

  C. Communication with server types, such as RADIUS, CVP, UFP, TACACS, and LDAP.

  D. Specific traffic that facilitates functionality, such as logging, management, and key exchange.

  Correct Answer: B