CheckPoint Checkpoint Certifications 156-915.80 Questions & Answers

• Question 391:

  Where is it necessary to configure historical records in SmartView Monitor to generate Express reports in SmartReporter?

  A. In SmartDashboard, the SmartView Monitor page in the R80 Security Gateway object

  B. In SmartReporter, under Express > Network Activity

  C. In SmartReporter, under Standard > Custom

  D. In SmartView Monitor, under Global Properties > Log and Masters

  Correct Answer: A

• Question 392:

  When do modifications to the Event Policy take effect?

  A. As soon as the Policy Tab window is closed.

  B. When saved on the SmartEvent Server and installed to the Correlation Units.

  C. When saved on the Correlation Units, and pushed as a policy.

  D. When saved on the SmartEvent Client, and installed on the SmartEvent Server.

  Correct Answer: B

• Question 393:

  What is the purpose of the pre-defined exclusions included with SmartEvent R80?

  A. To allow SmartEvent R80 to function properly with all other R71 devices.

  B. To avoid incorrect event generation by the default IPS event definition; a scenario that may occur in deployments that include Security Gateways of versions prior to R71.

  C. As a base for starting and building exclusions.

  D. To give samples of how to write your own exclusion.

  Correct Answer: B

• Question 394:

  You have selected the event Port Scan from Internal Network in SmartEvent, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?

  A. Define the two port-scan detections as an exception.

  B. You cannot set SmartEvent to detect two port scans from a host within 10 seconds of each other.

  C. Select the two port-scan detections as a sub-event.

  D. Select the two port-scan detections as a new event.

  Correct Answer: A

• Question 395:

  How many pre-defined exclusions are included by default in SmartEvent R80 as part of the product installation?

  A. 5

  B. 0

  C. 10

  D. 3

  Correct Answer: D

• Question 396:

  In the following cluster configuration; if you reboot sglondon_1 which device will be active when sglondon_1 is back up and running? Why?

  A. sglondon_1 because it the first configured object with the lowest IP.

  B. sglondon_2 because sglondon_1 has highest IP.

  C. sglondon_1, because it is up again, sglondon_2 took over during reboot.

  D. sglondon_2 because it has highest priority.

  Correct Answer: D

• Question 397:

  Select the command set best used to verify proper failover function of a new ClusterXL configuration.

  A. reboot

  B. cphaprob -d failDevice -s problem -t 0 register / cphaprob -d failDevice unregister

  C. clusterXL_admin down / clusterXL_admin up

  D. cpstop/cpstart

  Correct Answer: C

• Question 398:

  Which three of the following are ClusterXL member requirements? 1) same operating systems 2) same Check Point version 3) same appliance model 4) same policy

  A. 1, 3, and 4

  B. 1, 2, and 4

  C. 2, 3, and 4

  D. 1, 2, and 3

  Correct Answer: B

• Question 399:

  Use the table to match the BEST Management High Availability synchronication-status descriptions for your Security Management Server (SMS). Exhibit:

  

  A. A-5, B-3, C-1, D-2

  B. A-3, B-1, C-4, D-2

  C. A-3, B-5, C-2, D-4

  D. A-3, B-1, C-5, D-4

  Correct Answer: D

• Question 400:

  Review the Rule Base displayed.

  

  For which rules will the connection templates be generated in SecureXL?

  A. Rules 2 and 5

  B. Rules 2 through 5

  C. Rule 2 only

  D. All rules except Rule 3

  Correct Answer: D