CheckPoint 156-727.77 Online Practice Questions and Exam Preparation

CheckPoint 156-727.77 Online Questions & Answers

• Question 11:

  A customer does not own Check Point Gateways, but he wants to use Threat Emulation Service to detect SMTP Zero-Day vulnerabilities. What is his option?

  A. Use MTA plug-in on his exchange server.
  B. Needs to buy a Check Point security gateway.
  C. Needs to install Mail Transfer Agent on his firewall.
  D. Purchase SMTE cloud service.
  A. Use MTA plug-in on his exchange server.

• Question 12:

  This graphic shows traffic being blocked from certain countries.

  

  What is the deciding factor for this?

  A. The traffic from selected countries is being blocked because of an IPS traffic-type rule in the rulebase
  B. The traffic from selected countries is being blocked because it is overloading the Gateway
  C. The traffic from selected countries is being blocked due to the GeoProtection ruleset
  D. The traffic from selected countries is being blocked due to IPS-detected specific attacks originating there
  C. The traffic from selected countries is being blocked due to the GeoProtection ruleset

• Question 13:

  Which blades can support HTTPS inspection?

  A. Threat Prevention, Application Control, and IPS
  B. IPS, Advanced Networking, and Threat Prevention
  C. IPS, Application Control, DLP, Threat Prevention
  D. Application Control, Advanced Networking, Threat Prevention, IPS
  C. IPS, Application Control, DLP, Threat Prevention

• Question 14:

  SmartEvent has several components that work together to help track down security threats. What is the function of the Correlation Unit as one of those components in the architecture? The Correlation Unit:

  A. connects with the SmartEvent Client when generating reports.
  B. analyzes each log entry as it enters a log server, according to the Event Policy; when a threat pattern is identified, an event is forwarded to the SmartEvent Server.
  C. collects syslog data from third party devices and saves them to the database.
  D. correlates all the identified threats with the consolidation policy.
  B. analyzes each log entry as it enters a log server, according to the Event Policy; when a threat pattern is identified, an event is forwarded to the SmartEvent Server.

• Question 15:

  Joey is the MegaCorp Firewall administrator. Which options does he have for the configuration of the Threat Emulation Analysis Location on his gateway?

  A. Only Check Point Threat Cloud
  B. Upload the Files to the Check Point SFTP-Server
  C. It depends on the operating systems that need to be supported
  D. Either Check Point Threat Cloud or locally (dedicated or existing gateway)
  D. Either Check Point Threat Cloud or locally (dedicated or existing gateway)

• Question 16:

  Looking at these logs, what happened at 10:55?

  

  A. An IPS rule was installed, causing IPS to temporarily stop working
  B. The Gateway was rebooted, causing IPS to temporarily stop working
  C. A new IPS policy was installed, causing IPS to temporarily stop working
  D. IPD Inspections were temporarily suspended, due to high load on the gateway
  D. IPD Inspections were temporarily suspended, due to high load on the gateway

• Question 17:

  What is the main purpose of the ThreatCloud?

  A. It is used in conjunction with IPS.
  B. This is the place where ThreatWiki fetches the actual information.
  C. It feeds security gateway software blades (i.e. Anti-Virus and Anti-Bot) with real-time security intelligence.
  D. It is a database used by SANS institute (formerly known as StormCenter).
  C. It feeds security gateway software blades (i.e. Anti-Virus and Anti-Bot) with real-time security intelligence.

• Question 18:

  When is the default Threat Prevention profile enforced?

  A. At the first Security Policy installation.
  B. Only after SensorNET participation is enabled.
  C. When the profile is assigned to a gateway.
  D. When the administrator installs the profile on Security Gateway.
  D. When the administrator installs the profile on Security Gateway.

• Question 19:

  The Threat Prevention software blade:

  A. Is configured in one unified policy for Anti-Bot and Anti-virus functions and uses the same threat repository.
  B. Can only be deployed as part of SensorNET.
  C. Is a free function that does not require additional licensing.
  D. Can only be deployed on a Security Gateway running GAiA.
  A. Is configured in one unified policy for Anti-Bot and Anti-virus functions and uses the same threat repository.

• Question 20:

  An end-user calls the helpdesk, complaining that he cannot access a web site. You check the log and see that an IPS signature is dropping his connections. What can you do? Change the signature action to:

  A. Bypass
  B. Detect
  C. Inactive
  D. Prevent
  B. Detect