CheckPoint Checkpoint Certifications 156-915.80 Questions & Answers

• Question 461:

  How granular may an administrator filter an Access Role with identity awareness? Per:

  A. Specific ICA Certificate

  B. AD User

  C. Radius Group

  D. Windows Domain

  Correct Answer: B

• Question 462:

  Which of the following is NOT defined by an Access Role object?

  A. Source Network

  B. Source Machine

  C. Source User

  D. Source Server

  Correct Answer: D

• Question 463:

  Access Role objects define users, machines, and network locations as:

  A. Credentialed objects

  B. Linked objects

  C. One object

  D. Separate objects

  Correct Answer: C

• Question 464:

  Where do you verify that UserDirectory is enabled?

  A. Verify that Security Gateway > General Properties > Authentication > Use UserDirectory (LDAP) for Security Gateways is checked

  B. Verify that Global Properties > Authentication > Use UserDirectory (LDAP) for Security Gateways is checked

  C. Verify that Security Gateway > General Properties > UserDirectory (LDAP) > Use UserDirectory (LDAP) for Security Gateways is checked

  D. Verify that Global Properties > UserDirectory (LDAP) > Use UserDirectory (LDAP) for Security Gateways is checked

  Correct Answer: D

• Question 465:

  What mechanism does a gateway configured with Identity Awareness and LDAP initially use to communicate with a Windows 2003 or 2008 server?

  A. WMI

  B. CIFS

  C. RCP

  D. LDAP

  Correct Answer: A

• Question 466:

  Which of the following items should be configured for the Security Management Server to authenticate via LDAP?

  A. Check Point Password

  B. Active Directory Server object

  C. Windows logon password

  D. WMI object

  Correct Answer: B

• Question 467:

  Jennifer McHanry is CEO of ACME; She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory domain, she cannot identify

  seamlessly with AD Query. However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R80 Firewall Rule Base.

  To make this scenario work, the IT administrator must:

  1) Enable Identity Awareness on a gateway and select Captive Portal as one of the Identity Sources.

  2) In the Portal Settings window in the User Access section, make sure that Name and password login is selected.

  3) Create a new rule in the Firewall Rule Base to let Jennifer McHanry access network destinations.

  Select accept as the Action.

  Ms. McHanry tries to access the resource but is unable. What should she do?

  A. Have the security administrator select the Action field of the Firewall Rule "Redirect HTTP connections to an authentication (captive) portal"

  B. Have the security administrator reboot the firewall

  C. Have the security administrator select Any for the Machines tab in the appropriate Access Role

  D. Install the Identity Awareness agent on her iPad

  Correct Answer: A

• Question 468:

  Which of the following allows administrators to allow or deny traffic to or from a specific network based on the user's credentials?

  A. Access Policy

  B. Access Role

  C. Access Rule

  D. Access Certificate

  Correct Answer: B

• Question 469:

  John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to a set of designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits

  access only from John's desktop which is assigned a static IP address 10.0.0.19.

  He has received a new laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base

  contains a rule that lets John Adams access the HR Web Server from his laptop with a static IP (10.0.0.19).

  He wants to move around the organization and continue to have access to the HR Web Server. To make this scenario work, the IT administrator:

  1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources, and installs the policy.

  2) Adds an access role object to the Firewall Rule Base that lets John Adams access the HR Web Server from any machine and from any location and installs policy. John plugged in his laptop to the network on a different network segment

  and was not able to connect to the HR Web server. What is the next BEST troubleshooting step?

  A. Investigate this as a network connectivity issue

  B. Install the Identity Awareness Agent

  C. Set static IP to DHCP

  D. After enabling Identity Awareness, reboot the gateway

  Correct Answer: C

• Question 470:

  John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only

  from John's desktop which is assigned an IP address 10.0.0.19 via DHCP.

  John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a

  rule that lets John Adams access the HR Web Server from his laptop. He wants to move around the organization and continue to have access to the HR Web Server.

  To make this scenario work, the IT administrator:

  1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources installs the policy.

  2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location. John plugged in his laptop to the network on a different network segment and he is not

  able to connect. How does he solve this problem?

  A. John should install the Identity Awareness Agent

  B. The firewall admin should install the Security Policy

  C. John should lock and unlock the computer

  D. Investigate this as a network connectivity issue

  Correct Answer: B