CheckPoint Checkpoint Certifications 156-915.80 Questions & Answers

• Question 411:

  Your organization maintains several IKE VPN's. Executives in your organization want to know which mechanism Security Gateway R80 uses to guarantee the authenticity and integrity of messages. Which technology should you explain to the executives?

  A. Certificate Revocation Lists

  B. Application Intelligence

  C. Key-exchange protocols

  D. Digital signatures

  Correct Answer: D

• Question 412:

  You have three Gateways in a mesh community. Each gateway's VPN Domain is their internal network as defined on the Topology tab setting All IP Addresses behind Gateway based on Topology information. You want to test the route-based VPN, so you created VTIs among the Gateways and created static route entries for the VTIs. However, when you test the VPN, you find out the VPN still go through the regular domain IPsec tunnels instead of the routed VTI tunnels. What is the problem and how do you make the VPN use the VTI tunnels?

  A. Domain VPN takes precedence over the route-based VTI. To make the VPN go through VTI, remove the Gateways out of the mesh community and replace with a star community

  B. Domain VPN takes precedence over the route-based VTI. To make the VPN go through VTI, use an empty group object as each Gateway's VPN Domain

  C. Route-based VTI takes precedence over the Domain VPN. To make the VPN go through VTI, use dynamic-routing protocol like OSPF or BGP to route the VTI address to the peer instead of static routes

  D. Route-based VTI takes precedence over the Domain VPN. Troubleshoot the static route entries to insure that they are correctly pointing to the VTI gateway IP.

  Correct Answer: B

• Question 413:

  Match the ClusterXL modes with their configurations. Exhibit:

  

  A. A-2, B-3, C-4, D-1

  B. A-2, B-3, C-1, D-5

  C. A-3, B-5, C-1, D-4

  D. A-5, B-2, C-4, D-1

  Correct Answer: C

• Question 414:

  John is configuring a new R80 Gateway cluster but he can not configure the cluster as Third Party IP Clustering because this option is not available in Gateway Cluster Properties. What's happening?

  A. ClusterXL needs to be unselected to permit third party clustering configuration.

  B. Third Party Clustering is not available for R80 Security Gateways.

  C. John has an invalid ClusterXL license.

  D. John is not using third party hardware as IP Clustering is part of Check Point's IP Appliance.

  Correct Answer: A

• Question 415:

  Which of the following is the preferred method for adding static routes in GAiA?

  A. In the CLI with the command "route add"

  B. In Web Portal, under Network Management > IPv4 Static Routes

  C. In the CLI via sysconfig

  D. In SmartDashboard under Gateway Properties > Topology

  Correct Answer: B

• Question 416:

  MultiCorp has bought company OmniCorp and now has two active AD domains. How would you deploy Identity Awareness in this environment?

  A. You must run an ADquery for every domain.

  B. Identity Awareness can only manage one AD domain.

  C. Only one ADquery is necessary to ask for all domains.

  D. Only Captive Portal can be used.

  Correct Answer: A

• Question 417:

  Which command will only show the number of entries in the connection table?

  A. fw tab -t connections -s

  B. fw tab -t connections -u

  C. fw tab -t connections

  D. fw tab

  Correct Answer: A

• Question 418:

  Which statements about Management HA are correct? 1) Primary SmartCenter describes first installed SmartCenter 2) Active SmartCenter is always used to administrate with SmartConsole 3) Active SmartCenter describes first installed SmartCenter 4) Primary SmartCenter is always used to administrate with SmartConsole

  A. 1 and 4

  B. 2 and 3

  C. 1 and 2

  D. 3 and 4

  Correct Answer: C

• Question 419:

  Which process should you debug if SmartDashboard login fails?

  A. sdm

  B. cpd

  C. fwd

  D. fwm

  Correct Answer: D

• Question 420:

  Paul has just joined the MegaCorp security administration team. Natalie, the administrator, creates a new administrator account for Paul in SmartDashboard and installs the policy. When Paul tries to login it fails. How can Natalie verify whether Paul's IP address is predefined on the security management server?

  A. Login to Smart Dashboard, access Properties of the SMS, and verify whether Paul's IP address is listed.

  B. Type cpconfig on the Management Server and select the option "GUI client List" to see if Paul's IP address is listed.

  C. Login in to Smart Dashboard, access Global Properties, and select Security Management, to verify whether Paul's IP address is listed.

  D. Access the WEBUI on the Security Gateway, and verify whether Paul's IP address is listed as a GUI client.

  Correct Answer: B