CheckPoint 156-215.75 Online Practice Questions and Exam Preparation

CheckPoint 156-215.75 Online Questions & Answers

• Question 501:

  In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. An internal host 10.4.8.108 successfully pings its Cluster and receives replies. Review the ARP table from the internal Windows host 10.4.8.108. Based on this information, what is the active cluster member's IP address?

  A. The active cluster member's IP address cannot be determined by this ARP cache.
  B. 10.4.8.3
  C. 10.4.8.1
  D. 10.4.8.2
  D. 10.4.8.2

• Question 502:

  In Load Sharing Unicast mode, the internal cluster IP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2. Internal host 10.4.8.108 Pings 10.4.8.3, and receives replies. The following is the ARP table from the internal Windows host 10.4.8.108.

  

  Review the exhibit and identify the member serving as the pivot machine.

  A. 10.4.8.3
  B. 10.4.8.2
  C. The pivot machine cannot be determined by this test.
  D. 10.4.8.1
  B. 10.4.8.2

• Question 503:

  Which of the following statements is FALSE about the DLP Software Blade and Active Directory (AD) or LDAP?

  A. When a user authenticates in the DLP Portal to view all his unhandled incidents, the portal authenticates the user using only AD/LDAP.
  B. Check Point UserCheck client authentication is based on AD.
  C. For SMTP traffic, each recipient e-mail address is translated using AD/LDAP to a user name and group that is checked vs. the destination column of the DLP rule base.
  D. For SMTP traffic, the sender e-mail address is translated using AD/LDAP to a user name and group that is checked vs. the source column of the DLP rule base.
  A. When a user authenticates in the DLP Portal to view all his unhandled incidents, the portal authenticates the user using only AD/LDAP.

• Question 504:

  Which of the following statements about the Port Scanning feature of IPS is TRUE?

  A. The default scan detection is when more than 500 open inactive ports are open for a period of 120 seconds.
  B. The Port Scanning feature actively blocks the scanning, and sends an alert to SmartView Monitor.
  C. Port Scanning does not block scanning; it detects port scans with one of three levels of detection sensitivity.
  D. When a port scan is detected, only a log is issued, never an alert.
  C. Port Scanning does not block scanning; it detects port scans with one of three levels of detection sensitivity.

• Question 505:

  Steve tries to configure Directional VPN Rule Match in the Rule Base. But the Match column does not have the option to see the Directional Match. Steve sees the following screen. What is the problem?

  

  A. Steve must enable directional_match(true) in the objects_5_0.C file on SmartCenter Server.
  B. Steve must enable Advanced Routing on each Security Gateway.
  C. Steve must enable VPN Directional Match on the VPN Advanced screen, in Global properties.
  D. Steve must enable a dynamic routing protocol, such as OSPF, on the Gateways.
  E. Steve must enable VPN Directional Match on the gateway object's VPN tab.
  C. Steve must enable VPN Directional Match on the VPN Advanced screen, in Global properties.

• Question 506:

  You receive an alert indicating a suspicious FTP connection is trying to connect to one of your internal hosts. How do you block the connection in real time and verify the connection is successfully blocked?

  A. Highlight the suspicious connection in SmartView Tracker > Active mode. Block the connection using the Tools > Block Intruder menu. Use the Active mode to confirm that the suspicious connection does not reappear.
  B. Highlight the suspicious connection in SmartView Tracker > Log mode. Block the connection using Tools > Block Intruder menu. Use Log mode to confirm that the suspicious connection does not reappear.
  C. Highlight the suspicious connection in SmartView Tracker > Active mode. Block the connection using Tools > Block Intruder menu. Use Active mode to confirm that the suspicious connection is dropped.
  D. Highlight the suspicious connection in SmartView Tracker > Log mode. Block the connection using Tools > Block Intruder menu. Use the Log mode to confirm that the suspicious connection is dropped.
  A. Highlight the suspicious connection in SmartView Tracker > Active mode. Block the connection using the Tools > Block Intruder menu. Use the Active mode to confirm that the suspicious connection does not reappear.

• Question 507:

  When selecting a backup target using SmartProvisioning, which target is NOT available?

  A. Locally on device
  B. FTP
  C. SCP
  D. TFTP
  B. FTP

• Question 508:

  You have to uninstall the Check Point SmartWorkflow Software Blade on a SecurePlatform system. How can you perform this procedure?

  A. To uninstall the SmartWorkflow Software Blade you can connect to the SecurePlatform WebUI ( ) and select: Device > Upgrade. You will be asked if you want uninstall the SmartWorkflow Software Blade.
  B. To uninstall the SmartWorkflow Software Blade you must first connect to your Security Management System on command line level. Then in the directory /opt/CPUninstall/Check_Point_Workflow, run the command ./UnixInstallScript -u. Afterwards, follow the screen instructions and change to the directory /opt/CPUninstall/R70_HFA_10 and repeat the previous command.
  C. To uninstall the SmartWorkflow Software Blade, you use SmartUpdate. Click on the symbol of the Security Management Server, right-click, select Get Gateway Data, select SmartWorkflow, right -click uninstall SmartWorkflow. You will see the progress in the Operaration Status windows.
  D. To uninstall the SmartWorkflow Software Blade, you must first connect to your Security Management System on the command line level. Then in the directory /opt/CPuninstall/Check_Point_Workflow, run the command ./UnixInstallScript u.
  B. To uninstall the SmartWorkflow Software Blade you must first connect to your Security Management System on command line level. Then in the directory /opt/CPUninstall/Check_Point_Workflow, run the command ./UnixInstallScript -u. Afterwards, follow the screen instructions and change to the directory /opt/CPUninstall/R70_HFA_10 and repeat the previous command.

• Question 509:

  What is a task of the SmartEvent Server?

  A. Assign a severity level to an event.
  B. Display the received events.
  C. Analyze each IPS log entry as it enters the Log server.
  D. Forward what is known as an event to the SmartEvent Server.
  A. Assign a severity level to an event.

• Question 510:

  VPN routing can also be configured by editing which file?

  A. $FWDIR\conf\vpn_route.c
  B. $FWDIR\bin\vpn_route.conf
  C. $FWDIR\conf\vpn_route.conf
  D. $FWDIR\VPN\route_conf.c
  C. $FWDIR\conf\vpn_route.conf