CheckPoint CCSE Update 156-915.80 Questions & Answers

• Question 1:

  Which configuration file contains the structure of the Security Servers showing the port numbers, corresponding protocol name, and status?

  A. $FWDIR/database/fwauthd.conf

  B. $FWDIR/conf/fwauth.conf

  C. $FWDIR/conf/fwauthd.conf

  D. $FWDIR/state/fwauthd.conf

  Correct Answer: C

• Question 2:

  SmartEvent provides a convenient way to run common command line executables that can assist in investigating events. Right-clicking the IP address, source or destination, in a event provides a list of default and customized commands. They appear only on cells that refer to IP addresses because the IP address of the active cell is used as the destination of the command when run. The default commands are:

  A. ping, traceroute, netstat, and route

  B. ping, nslookup, Telnet, and route

  C. ping, whois, nslookup, and Telnet

  D. ping, traceroute, netstat, and nslookup

  Correct Answer: C

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_SmartEventIntro_AdminGuide/17468.htm

• Question 3:

  What are the available options for downloading Check Point hotfixes in Gaia WebUI (CPUSE)?

  A. Manually, Scheduled, Automatic

  B. Manually, Automatic, Disabled

  C. Manually, Scheduled, Disabled

  D. Manually, Scheduled, Enabled

  Correct Answer: A

• Question 4:

  Which statement is NOT TRUE about Delta synchronization?

  A. Using UDP Multicast or Broadcast on port 8161

  B. Using UDP Multicast or Broadcast on port 8116

  C. Quicker than Full Sync

  D. Transfers changes in the Kernel labels between cluster members

  Correct Answer: A

• Question 5:

  SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

  A. Analyzes this log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server.

  B. Correlates all the identified threats with the consolidation policy.

  C. Collects syslog data from third party devices and saves them to the database.

  D. Connects with the SmartEvent Client when generating threat reports.

  Correct Answer: A

• Question 6:

  The Check Point installation history feature in R80 provides the following:

  A. View install changes and install specific version.

  B. View install changes

  C. Policy Installation Date, view install changes and install specific version

  D. Policy Installation Date only

  Correct Answer: C

  Reference: https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_SecurityManagement_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/ CP_R80.10_SecurityManagement_AdminGuide/159917

• Question 7:

  What is not a component of Check Point SandBlast?

  A. Threat Emulation

  B. Threat Simulation

  C. Threat Extraction

  D. Threat Cloud

  Correct Answer: B

• Question 8:

  How can you see historical data with cpview?

  A. cpview -d

  B. cpview -t

  C. cpview -f

  D. cpview -e

  Correct Answer: B

  Reference: https://www.youtube.com/watch?v=OjsvuT2YxKs

• Question 9:

  Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane. Which is NOT an option to adjust or configure?

  A. Severity

  B. Automatic reactions

  C. Policy

  D. Threshold

  Correct Answer: C

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_SmartEvent_AdminGuide/17401.htm

• Question 10:

  Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?

  A. Enable DLP and select .exe and .bat file type

  B. enable .exe and .bat protection in IPS Policy

  C. create FW rule for particular protocol

  D. tecli advanced attributes set prohibited_file_types exe,bat

  Correct Answer: D