CheckPoint 156-915.77 Online Practice Questions and Exam Preparation

CheckPoint 156-915.77 Online Questions & Answers

• Question 161:

  If you need strong protection for the encryption of user data, what option would be the BEST choice?

  A. Use Diffie-Hellman for key construction and pre-shared keys for Quick Mode. Choose SHA in Quick Mode and encrypt with AES. Use AH protocol. Switch to Aggressive Mode.
  B. When you need strong encryption, IPsec is not the best choice. SSL VPN's are a better choice.
  C. Use certificates for Phase 1, SHA for all hashes, AES for all encryption and PFS, and use ESP protocol.
  D. Disable Diffie-Hellman by using stronger certificate based key-derivation. Use AES-256 bit on all encrypted channels and add PFS to QuickMode. Use double encryption by implementing AH and ESP as protocols.
  C. Use certificates for Phase 1, SHA for all hashes, AES for all encryption and PFS, and use ESP protocol.

• Question 162:

  The process ___________ is responsible for all other security server processes run on the Gateway.

  A. FWD
  B. CPLMD
  C. FWM
  D. CPD
  A. FWD

• Question 163:

  You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate destination on client site from Global Properties > NAT. Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?

  A. No extra configuration is needed.
  B. A proxy ARP entry, to ensure packets destined for the public IP address will reach the Security Gateway's external interface.
  C. The NAT IP address must be added to the external Gateway interface anti-spoofing group.
  D. A static route, to ensure packets destined for the public NAT IP address will reach the Gateway's internal interface.
  D. A static route, to ensure packets destined for the public NAT IP address will reach the Gateway's internal interface.

• Question 164:

  The Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO). What is not a recommended usage of this method?

  A. When accuracy in detecting identity is crucial
  B. Leveraging identity for Data Center protection
  C. Protecting highly sensitive servers
  D. Identity based enforcement for non-AD users (non-Windows and guest users)
  D. Identity based enforcement for non-AD users (non-Windows and guest users)

• Question 165:

  Where is it necessary to configure historical records in SmartView Monitor to generate Express reports in SmartReporter?

  A. In SmartDashboard, the SmartView Monitor page in the R77 Security Gateway object
  B. In SmartReporter, under Express > Network Activity
  C. In SmartReporter, under Standard > Custom
  D. In SmartView Monitor, under Global Properties > Log and Masters
  A. In SmartDashboard, the SmartView Monitor page in the R77 Security Gateway object

• Question 166:

  When using migrate to upgrade a Secure Management Server, which of the following is included in the migration?

  A. Smart Event database
  B. Smart Reporter database
  C. classes. C file
  D. System interface configuration
  C. classes. C file

• Question 167:

  Jennifer McHanry is CEO of ACME. She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory domain, she cannot identify

  seamlessly with AD Query. However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R77 Firewall Rule Base.

  To make this scenario work, the IT administrator must:

  1) Enable Identity Awareness on a gateway and select Captive Portal as one of the Identity Sources.

  2) In the Portal Settings window in the User Access section, make sure that Name and password login is selected.

  3) Create a new rule in the Firewall Rule Base to let Jennifer McHanry access network destinations. Select accept as the Action.

  Ms. McHanry tries to access the resource but is unable. What should she do?

  A. Have the security administrator select the Action field of the Firewall Rule "Redirect HTTP connections to an authentication (captive) portal"
  B. Have the security administrator reboot the firewall
  C. Have the security administrator select Any for the Machines tab in the appropriate Access Role
  D. Install the Identity Awareness agent on her iPad
  A. Have the security administrator select the Action field of the Firewall Rule "Redirect HTTP connections to an authentication (captive) portal"

• Question 168:

  Anytime a client initiates a connection to a server, the firewall kernel signals the FWD process using a trap. FWD spawns the ________ child service, which runs the security server.

  A. FWD
  B. FWSD
  C. In.httpd
  D. FWSSD
  D. FWSSD

• Question 169:

  You enable Hide NAT on the network object, 10.1.1.0 behind the Security Gateway's external interface. You browse to the Google Website from host, 10.1.1.10 successfully. You enable a log on the rule that allows 10.1.1.0 to exit the network. How many log entries do you see for that connection in SmartView Tracker?

  A. Two, one for outbound, one for inbound
  B. Only one, outbound
  C. Two, both outbound, one for the real IP connection and one for the NAT IP connection
  D. Only one, inbound
  B. Only one, outbound

• Question 170:

  Which of the following is a CLI command for Security Gateway R77?

  A. fw tab -u
  B. fw shutdown
  C. fw merge
  D. fwm policy_print
  A. fw tab -u