9699334
Descripción
Test por Gustavo Gonçalves, actualizado hace más de 1 año
|
Creado por Gustavo Gonçalves
hace más de 7 años
|
|
Pregunta 1
Pregunta
QUESTION 1
When translation occurs using automatic Hide NAT, what also happens?
Respuesta
-
A. Nothing happens.
-
B. The destination is modified
-
C. The destination port is modified
-
D. The source port is modified.
Pregunta 2
Pregunta
QUESTION 2
The fw monitor utility is used to troubleshoot which of the following problems?
Respuesta
-
A. Phase two key negotiation
-
B. Address translation
-
C. Log Consolidation Engine
-
D. User data base corruption
Pregunta 3
Pregunta
QUESTION 3
Looking at the SYN packets in the Wireshark output, select the statement that is true about NAT.
Exhibit:
Image:
3 (binary/octet-stream)
Respuesta
-
A. This is an example of Hide NAT.
-
B. There is not enough information provided in the Wireshark capture to determine the NAT settings.
-
C. This is an example of Static NAT and Translate destination on client side unchecked in Global Properties
-
D. This is an example of Static NAT and Translate destination on client side checked in Global Properties.
Pregunta 4
Pregunta
QUESTION 4
In SmartDashboard, Translate destination on client side is checked in Global Properties. When Network
Address Translation is used:
Respuesta
-
A. It is not necessary to add a static route to the Gateway's routing table.
-
B. It is necessary to add a static route to the Gateway's routing table.
-
C. The Security Gateway's ARP file must be modified.
-
D. VLAN tagging cannot be defined for any hosts protected by the Gateway.
Pregunta 5
Pregunta
QUESTION 5
Secure Internal Communications (SIC) is completely NAT-tolerant because it is based on:
Respuesta
-
A. IP addresses.
-
B. SIC is not NAT-tolerant.
-
C. SIC names.
-
D. MAC addresses.
Pregunta 6
Pregunta
QUESTION 6
Static NAT connections, by default, translate on which firewall kernel inspection point?
Respuesta
-
A. Inbound
-
B. Outbound
-
C. Post-inbound
-
D. Eitherbound
Pregunta 7
Pregunta
QUESTION 7
You are MegaCorp's Security Administrator. There are various network objects which must be NATed.
Some of them use the Automatic Hide NAT method, while others use the Automatic Static NAT method.
What is the rule order if both methods are used together? Give the BEST answer.
Respuesta
-
A. The Administrator decides the rule order by shifting the corresponding rules up and down.
-
B. The Static NAT rules have priority over the Hide NAT rules and the NAT on a node has priority over the NAT on a network or an address range.
-
C. The Hide NAT rules have priority over the Static NAT rules and the NAT on a node has priority over the NAT on a network or an address range.
-
D. The rule position depends on the time of their creation. The rules created first are placed at the top; rules created later are placed successively below the others.
Pregunta 8
Pregunta
QUESTION 8
Which answers are TRUE? Automatic Static NAT CANNOT be used when:
1) NAT decision is based on the destination port.
2) Both Source and Destination IP's have to be translated.
3) The NAT rule should only be installed on a dedicated Gateway.
4) NAT should be performed on the server side.
Respuesta
-
A. 1 and 2
-
B. 2 and 4
-
C. 1, 3, and 4
-
D. 2 and 3
Pregunta 9
Pregunta
QUESTION 9
After filtering a fw monitor trace by port and IP, a packet is displayed three times; in the i, I, and o inspection
points, but not in the O inspection point. Which is the likely source of the issue?
Respuesta
-
A. The packet has been sent out through a VPN tunnel unencrypted.
-
B. An IPSO ACL has blocked the packet's outbound passage.
-
C. A SmartDefense module has blocked the packet.
-
D. It is due to NAT.
Pregunta 10
Pregunta
QUESTION 10
Your internal network is configured to be 10.1.1.0/24. This network is behind your perimeter R77 Gateway,
which connects to your ISP provider. How do you configure the Gateway to allow this network to go out to
the Internet?
Respuesta
-
A. Use Hide NAT for network 10.1.1.0/24 behind the external IP address of your perimeter Gateway.
-
B. Use Hide NAT for network 10.1.1.0/24 behind the internal interface of your perimeter Gateway.
-
C. Use automatic Static NAT for network 10.1.1.0/24.
-
D. Do nothing, as long as 10.1.1.0 network has the correct default Gateway.
Pregunta 11
Pregunta
QUESTION 11
You are a Security Administrator who has installed Security Gateway R77 on your network. You need to
allow a specific IP address range for a partner site to access your intranet Web server. To limit the partner's
access for HTTP and FTP only, you did the following:
1) Created manual Static NAT rules for the Web server.
2) Cleared the following settings in the Global Properties > Network Address Translation screen:
- Allow bi-directional NAT
- Translate destination on client side
Do the above settings limit the partner's access?
Respuesta
-
A. Yes. This will ensure that traffic only matches the specific rule configured for this traffic, and that the Gateway translates the traffic after accepting the packet.
-
B. No. The first setting is not applicable. The second setting will reduce performance.
-
C. Yes. Both of these settings are only applicable to automatic NAT rules.
-
D. No. The first setting is only applicable to automatic NAT rules. The second setting will force translation by the kernel on the interface nearest to the client.
Pregunta 12
Pregunta
QUESTION 12
You enable Automatic Static NAT on an internal host node object with a private IP address of 10.10.10.5,
which is NATed into 216.216.216.5. (You use the default settings in Global Properties / NAT.)
When you run fw monitor on the R77 Security Gateway and then start a new HTTP connection from host
10.10.10.5 to browse the Internet, at what point in the monitor output will you observe the HTTP SYN-ACK
packet translated from 216.216.216.5 back into 10.10.10.5?
Respuesta
-
A. o=outbound kernel, before the virtual machine
-
B. I=inbound kernel, after the virtual machine
-
C. O=outbound kernel, after the virtual machine
-
D. i=inbound kernel, before the virtual machine
Pregunta 13
Pregunta
QUESTION 13
You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate
destination on client site from Global Properties > NAT. Assuming all other NAT settings in Global
Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound
connection to this host?
Respuesta
-
A. No extra configuration is needed.
-
B. A proxy ARP entry, to ensure packets destined for the public IP address will reach the Security Gateway's external interface
-
C. The NAT IP address must be added to the external Gateway interface anti-spoofing group.
-
D. A static route, to ensure packets destined for the public NAT IP address will reach the Gateway's internal interface.
Pregunta 14
Pregunta
QUESTION 14
You just installed a new Web server in the DMZ that must be reachable from the Internet. You create a
manual Static NAT rule as follows:
"web_public_IP" is the node object that represents the new Web server's public IP address.
"web_private_IP? is the node object that represents the new Web site's private IP address. You enable all
settings from Global Properties > NAT.
When you try to browse the Web server from the Internet you see the error "page cannot be displayed?.
Which of the following is NOT a possible reason?
Image:
14 (binary/octet-stream)
Respuesta
-
A. There is no Security Policy defined that allows HTTP traffic to the protected Web server.
-
B. There is no ARP table entry for the protected Web server's public IP address.
-
C. There is no route defined on the Security Gateway for the public IP address to the Web server's private IP address.
-
D. There is no NAT rule translating the source IP address of packets coming from the protected Web server.
Pregunta 15
Pregunta
QUESTION 15
You are responsible for the configuration of MegaCorp's Check Point Firewall. You need to allow two NAT
rules to match a connection. Is it possible? Give the BEST answer.
Respuesta
-
A. No, it is not possible to have more than one NAT rule matching a connection. When the firewall receives a packet belonging to a connection, it compares it against the first rule in the Rule Base, then the second rule, and so on. When it finds a rule that matches, it stops checking and applies that rule.
-
B. Yes, it is possible to have two NAT rules which match a connection, but only in using Manual NAT (bidirectional NAT).
-
C. Yes, there are always as many active NAT rules as there are connections
-
D. Yes, it is possible to have two NAT rules which match a connection, but only when using Automatic NAT (bidirectional NAT).
Pregunta 16
Pregunta
QUESTION 16
What is the default setting when you use NAT?
Respuesta
-
A. Destination Translated on Server side
-
B. Destination Translated on Client side
-
C. Source Translated on both sides
-
D. Source Translated on Client side
Pregunta 17
Pregunta
QUESTION 17
Select the TRUE statements about the Rule Base shown?
Exhibit:
1) HTTP traffic from webrome to websingapore will be encrypted.
2) HTTP traffic from websingapore to webrome will be encrypted.
3) HTTP traffic from webrome to websingapore will be authenticated.
4) HTTP traffic from websingapore to webrome will be blocked.
Image:
17 (binary/octet-stream)
Respuesta
-
A. 1, 2, and 3
-
B. 3 only
-
C. 2 and 3
-
D. 3 and 4
Pregunta 18
Pregunta
QUESTION 18
You receive a notification that long-lasting Telnet connections to a mainframe are dropped after an hour of
inactivity. Reviewing SmartView Tracker shows the packet is dropped with the error:
Unknown established connection
How do you resolve this problem without causing other security issues? Choose the BEST answer.
Respuesta
-
A. Increase the service-based session timeout of the default Telnet service to 24-hours.
-
B. Ask the mainframe users to reconnect every time this error occurs.
-
C. Increase the TCP session timeout under Global Properties > Stateful Inspection.
-
D. Create a new TCP service object on port 23 called Telnet-mainframe. Define a service-based session timeout of 24-hours. Use this new object only in the rule that allows the Telnet connections to the mainframe.
Pregunta 19
Pregunta
QUESTION 19
Which SmartConsole tool would you use to see the last policy pushed in the audit log?
Respuesta
-
A. SmartView Tracker
-
B. None, SmartConsole applications only communicate with the Security Management Server.
-
C. SmartView Status
-
D. SmartView Server
Pregunta 20
Pregunta
QUESTION 20
SmartView Tracker logs the following Security Administrator activities, EXCEPT:
Respuesta
-
A. Object creation, deletion, and editing
-
B. Tracking SLA compliance
-
C. Administrator login and logout
-
D. Rule Base changes
Pregunta 21
Pregunta
QUESTION 21
What happens when you select File > Export from the SmartView Tracker menu?
Respuesta
-
A. Current logs are exported to a new *.log file.
-
B. Exported log entries are not viewable in SmartView Tracker.
-
C. Logs in fw.log are exported to a file that can be opened by Microsoft Excel.
-
D. Exported log entries are deleted from fw.log.
Pregunta 22
Pregunta
QUESTION 22
By default, when you click File > Switch Active File in SmartView Tracker, the Security Management Server:
Respuesta
-
A. Saves the current log file, names the log file by date and time, and starts a new log file.
-
B. Purges the current log file, and starts a new log file.
-
C. Prompts you to enter a filename, and then saves the log file.
-
D. Purges the current log file, and prompts you for the new log's mode.
Pregunta 23
Pregunta
QUESTION 23
You are working with three other Security Administrators. Which SmartConsole component can be used to
monitor changes to rules or object properties made by the other administrators?
Respuesta
-
A. Eventia Tracker
-
B. SmartView Monitor
-
C. Eventia Monitor
-
D. SmartView Tracker
Pregunta 24
Pregunta
QUESTION 24
Which SmartView Tracker mode allows you to read the SMTP e-mail body sent from the Chief Executive
Officer (CEO) of a company?
Respuesta
-
A. This is not a SmartView Tracker feature.
-
B. Display Capture Action
-
C. Network and Endpoint Tab
-
D. Display Payload View
Pregunta 25
Pregunta
QUESTION 25
You can include External commands in SmartView Tracker by the menu Tools > Custom Commands.
The Security Management Server is running under GAiA, and the GUI is on a system running Microsoft
Windows. How do you run the command traceroute on an IP address?
Respuesta
-
A. There is no possibility to expand the three pre-defined options Ping, Whois, and Nslookup.
-
B. Go to the menu Tools > Custom Commands and configure the Windows command tracert.exe to the list.
-
C. Use the program GUIdbedit to add the command traceroute to the Security Management Server properties.
-
D. Go to the menu, Tools > Custom Commands and configure the Linux command traceroute to the list.
Pregunta 26
Pregunta
QUESTION 26
Where is the easiest and BEST place to find information about connections between two machines?
Respuesta
-
A. All options are valid.
-
B. On a Security Gateway using the command fw log.
-
C. On a Security Management Server, using SmartView Tracker.
-
D. On a Security Gateway Console interface; it gives you detailed access to log files and state table information.
Pregunta 27
Pregunta
QUESTION 27
Which of the following can be found in cpinfo from an enforcement point?
Respuesta
-
A. Everything NOT contained in the file r2info
-
B. VPN keys for all established connections to all enforcement points
-
C. The complete file objects_5_0.c
-
D. Policy file information specific to this enforcement point
Pregunta 28
Pregunta
QUESTION 28
Which R77 SmartConsole tool would you use to verify the installed Security Policy name on a Security
Gateway?
Respuesta
-
A. SmartView Tracker
-
B. None, SmartConsole applications only communicate with the Security Management Server.
-
C. SmartView Server
-
D. SmartUpdate
Pregunta 29
Pregunta
QUESTION 29
You have detected a possible intruder listed in SmartView Tracker's active pane. What is the fastest
method to block this intruder from accessing your network indefinitely?
Respuesta
-
A. Modify the Rule Base to drop these connections from the network.
-
B. In SmartView Tracker, select Tools > Block Intruder
-
C. In SmartView Monitor, select Tools > Suspicious Activity Rules
-
D. In SmartDashboard, select IPS > Network Security > Denial of Service.
Pregunta 30
Pregunta
QUESTION 30
Where can an administrator specify the notification action to be taken by the firewall in the event that
available disk space drops below 15%?
Respuesta
-
A. SmartView Monitor > Gateway Status > Threshold Settings
-
B. SmartView Tracker > Audit Tab > Gateway Counters
-
C. SmartView Monitor > Gateway Status > System Information > Thresholds
-
D. This can only be monitored by a user-defined script.
Pregunta 31
Pregunta
QUESTION 31
Where can an administrator configure the notification action in the event of a policy install time change?
Respuesta
-
A. SmartView Monitor > Gateways > Thresholds Settings
-
B. SmartView Monitor > Gateway Status > System Information > Thresholds
-
C. SmartDashboard > Policy Package Manager
-
D. SmartDashboard > Security Gateway Object > Advanced Properties
Pregunta 32
Pregunta
QUESTION 32
Where are custom queries stored in R77 SmartView Tracker?
Respuesta
-
A. On the SmartView Tracker PC local file system under the user's profile.
-
B. On the Security Management Server tied to the GUI client IP.
-
C. On the Security Management Server tied to the Administrator User Database login name.
-
D. On the SmartView Tracker PC local file system shared by all users of that local PC.
Pregunta 33
Pregunta
QUESTION 33
How do you view a Security Administrator's activities with SmartConsole?
Respuesta
-
A. Eventia Suite
-
B. SmartView Monitor using the Administrator Activity filter
-
C. SmartView Tracker in the Management tab
-
D. SmartView Tracker in the Network and Endpoint tabs
Pregunta 34
Pregunta
QUESTION 34
Which SmartView Tracker selection would most effectively show who installed a Security Policy blocking all
traffic from the corporate network?
Respuesta
-
A. Management tab
-
B. Custom filter
-
C. Network and Endpoint tab
-
D. Active tab
Pregunta 35
Pregunta
QUESTION 35
You are reviewing the Security Administrator activity for a bank and comparing it to the change log. How do
you view Security Administrator activity?
Respuesta
-
A. SmartView Tracker cannot display Security Administrator activity; instead, view the system logs on the Security Management Server's Operating System.
-
B. SmartView Tracker in Network and Endpoint Mode
-
C. SmartView Tracker in Active Mode
-
D. SmartView Tracker in Management Mode
Pregunta 36
Pregunta
QUESTION 36
Which of the following R77 SmartView Tracker views will display a popup warning about performance
implications on the Security Gateway?
Respuesta
-
A. All Records Query
-
B. Account Query
-
C. Active Tab
-
D. Audit Tab
Pregunta 37
Pregunta
QUESTION 37
While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an
intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the
correct order of steps needed to set up the block?
1) Select Active Mode tab in SmartView Tracker.
2) Select Tools > Block Intruder.
3) Select Log Viewing tab in SmartView Tracker.
4) Set Blocking Timeout value to 60 minutes.
5) Highlight connection that should be blocked.
Respuesta
-
A. 1, 2, 5, 4
-
B. 3, 2, 5, 4
-
C. 1, 5, 2, 4
-
D. 3, 5, 2, 4
Pregunta 38
Pregunta
QUESTION 38
SmartView Tracker R77 consists of three different modes. They are:
Respuesta
-
A. Log, Active, and Audit
-
B. Log, Active, and Management
-
C. Network and Endpoint, Active, and Management
-
D. Log, Track, and Management
Pregunta 39
Pregunta
QUESTION 39
You are troubleshooting NAT entries in SmartView Tracker. Which column do you check to view the new
source IP?
Exhibit:
Respuesta
-
A. XlateDPort
-
B. XlateDst
-
C. XlateSPort
-
D. XlateSrc
Pregunta 40
Pregunta
QUESTION 40
You are using SmartView Tracker to troubleshoot NAT entries. Which column do you check to view the
NAT'd source port if you are using Source NAT?
Respuesta
-
A. XlateDst
-
B. XlateSPort
-
C. XlateDPort
-
D. XlateSrc
Pregunta 41
Pregunta
QUESTION 41
When you change an implicit rule's order from Last to First in Global Properties, how do you make the
change take effect?
Respuesta
-
A. Run fw fetch from the Security Gateway.
-
B. Select Install Database from the Policy menu
-
C. Select Save from the File menu.
-
D. Reinstall the Security Policy
Pregunta 42
Pregunta
QUESTION 42
How does the button Get Address, found on the Host Node Object > General Properties page retrieve the
address?
Respuesta
-
A. Route Table
-
B. SNMP Get
-
C. Address resolution (ARP, RARP)
-
D. Name resolution (hosts file, DNS, cache)
Pregunta 43
Pregunta
QUESTION 43
Anti-Spoofing is typically set up on which object type?
Respuesta
-
A. Security Gateway
-
B. Host
-
C. Security Management object
-
D. Network
Pregunta 44
Pregunta
QUESTION 44
Spoofing is a method of:
Respuesta
-
A. Making packets appear as if they come from an authorized IP address.
-
B. Detecting people using false or wrong authentication logins
-
C. Disguising an illegal IP address behind an authorized IP address through Port Address Translation.
-
D. Hiding your firewall from unauthorized users
Pregunta 45
Pregunta
QUESTION 45
How can you activate the SNMP daemon on a Check Point Security Management Server?
Respuesta
-
A. Using the command line, enter snmp_install.
-
B. From cpconfig, select SNMP extension.
-
C. Any of these options will work.
-
D. In SmartDashboard, right-click a Check Point object and select Activate SNMP.
Pregunta 46
Pregunta
QUESTION 46
Which of the following describes the default behavior of an R77 Security Gateway?
Respuesta
-
A. Traffic not explicitly permitted is dropped
-
B. Traffic is filtered using controlled port scanning.
-
C. All traffic is expressly permitted via explicit rules
-
D. IP protocol types listed as secure are allowed by default, i.e. ICMP, TCP, UDP sessions are inspected
Pregunta 47
Pregunta
QUESTION 47
When you use the Global Properties' default settings on R77, which type of traffic will be dropped if NO
explicit rule allows the traffic?
Respuesta
-
A. SmartUpdate connections
-
B. Outgoing traffic originating from the Security Gateway
-
C. Firewall logging and ICA key-exchange information
-
D. RIP traffic
Pregunta 48
Pregunta
QUESTION 48
You have installed a R77 Security Gateway on GAiA. To manage the Gateway from the enterprise Security
Management Server, you create a new Gateway object and Security Policy. When you install the new Policy
from the Policy menu, the Gateway object does not appear in the Install Policy window as a target. What is
the problem?
Respuesta
-
A. The object was created with Node > Gateway.
-
B. No Masters file is created for the new Gateway.
-
C. The Gateway object is not specified in the first policy rule column Install On.
-
D. The new Gateway's temporary license has expired.
Pregunta 49
Pregunta
QUESTION 49
What happens if you select Web Server in the dialog box?
Exhibit:
Image:
49 (binary/octet-stream)
Respuesta
-
A. An implied rule will be added allowing HTTP requests to the host.
-
B. Anti-virus settings will be applied to the host.
-
C. Web Intelligence will be applied to the host.
-
D. An implied rule will be added allowing HTTP request from and to the host.
Pregunta 50
Pregunta
QUESTION 50
When configuring the Check Point Gateway network interfaces, you can define the direction as Internal or
External. What does the option Interface leads to DMZ mean?
Exhibit:
Respuesta
-
A. Using restricted Gateways, this option automatically turns off the counting of IP Addresses originating from this interface.
-
B. Activating this option automatically turns this interface to External.
-
C. It defines the DMZ Interface since this information is necessary for Content Control
-
D. Select this option to automatically configure Anti-Spoofing to this net.
Pregunta 51
Pregunta
QUESTION 51
A marketing firm's networking team is trying to troubleshoot user complaints regarding access to audiostreaming
material from the Internet. The networking team asks you to check the object and rule
configuration settings for the perimeter Security Gateway. Which SmartConsole application should you use
to check these objects and rules?
Respuesta
-
A. SmartView Tracker
-
B. SmartView Monitor
-
C. SmartView Status
-
D. SmartDashboard
Pregunta 52
Pregunta
QUESTION 52
Which statement below describes the most correct strategy for implementing a Rule Base?
Respuesta
-
A. Limit grouping to rules regarding specific access.
-
B. Place the most frequently used rules at the top of the Policy and the ones that are not frequently used further down.
-
C. Place a network-traffic rule above the administrator access rule.
-
D. Add the Stealth Rule before the last rule.
Pregunta 53
Pregunta
QUESTION 53
Which of the following is a viable consideration when determining Rule Base order?
Respuesta
-
A. Grouping rules by date of creation
-
B. Grouping reject and drop rules after the Cleanup Rule
-
C. Grouping authentication rules with address-translation rules
-
D. Grouping functionally related rules together
Pregunta 54
Pregunta
QUESTION 54
Which of the following is a viable consideration when determining Rule Base order?
Respuesta
-
A. Placing frequently accessed rules before less frequently accessed rules
-
B. Grouping IPS rules with dynamic drop rules
-
C. Adding SAM rules at the top of the Rule Base
-
D. Grouping rules by date of creation
Pregunta 55
Pregunta
QUESTION 55
Which of the following is a viable consideration when determining Rule Base order?
Respuesta
-
A. Grouping IPS rules with dynamic drop rules
-
B. Placing more restrictive rules before more permissive rules
-
C. Grouping authentication rules with QOS rules
-
D. Grouping reject and drop rules after the Cleanup Rule
Pregunta 56
Pregunta
QUESTION 56
You would use the Hide Rule feature to:
Respuesta
-
A. View only a few rules without the distraction of others.
-
B. Hide rules from read-only administrators.
-
C. Hide rules from a SYN/ACK attack.
-
D. Make rules invisible to incoming packets.
Pregunta 57
Pregunta
QUESTION 57
You are a Security Administrator using one Security Management Server managing three different firewalls.
One firewall does NOT show up in the dialog box when attempting to install a Security Policy. Which of the
following is a possible cause?
Respuesta
-
A. The firewall has failed to sync with the Security Management Server for 60 minutes.
-
B. The firewall object has been created but SIC has not yet been established.
-
C. The firewall is not listed in the Policy Installation Targets screen for this policy package.
-
D. The license for this specific firewall has expired.
Pregunta 58
Pregunta
QUESTION 58
Your shipping company uses a custom application to update the shipping distribution database. The custom
application includes a service used only to notify remote sites that the distribution database is
malfunctioning. The perimeter Security Gateway's Rule Base includes a rule to accept this traffic. Since you
are responsible for multiple sites, you want notification by a text message to your cellular phone, whenever
traffic is accepted on this rule. Which of the following would work BEST for your purpose?
Respuesta
-
A. Logging implied rules
-
B. User-defined alert script
-
C. SNMP trap
-
D. SmartView Monitor Threshold
Pregunta 59
Pregunta
QUESTION 59
In a distributed management environment, the administrator has removed all default check boxes from the
Policy > Global Properties > Firewall tab. In order for the Security Gateway to send logs to the Security
Management Server, an explicit rule must be created to allow the Security Gateway to communicate to the
Security Management Server on port ______.
Respuesta
-
A. 259
-
B. 900
-
C. 256
-
D. 257
Pregunta 60
Pregunta
QUESTION 60
A Security Policy has several database versions. What configuration remains the same no matter which
version is used?
Respuesta
-
A. Objects_5_0.C
-
B. Internal Certificate Authority (ICA) certificate
-
C. Rule Bases_5_0.fws
-
D. fwauth.NDB
Pregunta 61
Pregunta
QUESTION 61
You are working with multiple Security Gateways that enforce an extensive number of rules. To simplify
security administration, which one of the following would you choose to do?
Respuesta
-
A. Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.
-
B. Run separate SmartConsole instances to login and configure each Security Gateway directly.
-
C. Create network objects that restrict all applicable rules to only certain networks.
-
D. Create a separate Security Policy package for each remote Security Gateway.
Pregunta 62
Pregunta
QUESTION 62
Which rules are not applied on a first-match basis?
Respuesta
-
A. User Authentication
-
B. Client Authentication
-
C. Session Authentication
-
D. Cleanup
Pregunta 63
Pregunta
QUESTION 63
Installing a policy usually has no impact on currently existing connections. Which statement is TRUE?
Respuesta
-
A. Users being authenticated by Client Authentication have to re-authenticate.
-
B. All connections are reset, so a policy install is recommended during announced downtime only
-
C. All FTP downloads are reset; users have to start their downloads again.
-
D. Site-to-Site VPNs need to re-authenticate, so Phase 1 is passed again after installing the Security Policy
Pregunta 64
Pregunta
QUESTION 64
Several Security Policies can be used for different installation targets. The firewall protecting Human
Resources' servers should have a unique Policy Package. These rules may only be installed on this
machine and not accidentally on the Internet firewall. How can this be configured?
Respuesta
-
A. When selecting the correct firewall in each line of the row Install On of the Rule Base, only this firewall is shown in the list of possible installation targets after selecting Policy > Install.
-
B. A Rule Base can always be installed on any Check Point firewall object. It is necessary to select the appropriate target directly after selecting Policy > Install.
-
C. In the SmartDashboard policy, select the correct firewall to be the Specific Target of the rule.
-
D. A Rule Base is always installed on all possible targets. The rules to be installed on a firewall are defined by the selection in the row Install On of the Rule Base.
Pregunta 65
Pregunta
QUESTION 65
A _______ rule is used to prevent all traffic going to the R77 Security Gateway
Respuesta
-
A. IPS
-
B. Cleanup
-
C. Reject
-
D. Stealth
Pregunta 66
Pregunta
QUESTION 66
In a distributed management environment, the administrator has removed the default check from Accept
Control Connections under the Policy > Global Properties > FireWall tab. In order for the Security
Management Server to install a policy to the Firewall, an explicit rule must be created to allow the server to
communicate to the Security Gateway on port ______.
Respuesta
-
A. 259
-
B. 900
-
C. 256
-
D. 80
Pregunta 67
Pregunta
QUESTION 67
To check the Rule Base, some rules can be hidden so they do not distract the administrator from the
unhidden rules. Assume that only rules accepting HTTP or SSH will be shown. How do you accomplish
this?
Respuesta
-
A. Ask your reseller to get a ticket for Check Point SmartUse and deliver him the Security Management Server cpinfo file.
-
B. In SmartDashboard, right-click in the column field Service > Query Column. Then, put the services HTTP and SSH in the list. Do the same in the field Action and select Accept here.
-
C. In SmartDashboard menu, select Search > Rule Base Queries. In the window that opens, create a new Query, give it a name (e.g. "HTTP_SSH?) and define a clause regarding the two services HTTP and SSH. When having applied this, define a second clause for the action Accept and combine them with the Boolean operator AND.
-
D. This cannot be configured since two selections (Service, Action) are not possible.
Pregunta 68
Pregunta
QUESTION 68
What CANNOT be configured for existing connections during a policy install?
Respuesta
-
A. Keep all connections
-
B. Keep data connections
-
C. Re-match connections
-
D. Reset all connections
Pregunta 69
Pregunta
QUESTION 69
What is the purpose of a Stealth Rule?
Respuesta
-
A. To prevent users from connecting directly to the gateway.
-
B. To permit management traffic.
-
C. To drop all traffic to the management server that is not explicitly permitted.
-
D. To permit implied rules.
Pregunta 70
Pregunta
QUESTION 70
You review this Security Policy because Rule 4 is inhibited. Which Rule is responsible?
Exhibit:
Image:
70 (binary/octet-stream)
Respuesta
-
A. No rule inhibits Rule 4.
-
B. Rule 1
-
C. Rule 2
-
D. Rule 3
Pregunta 71
Pregunta
QUESTION 71
MegaCorp's security infrastructure separates Security Gateways geographically. You must request a central
license for one remote Security Gateway. How do you apply the license?
Respuesta
-
A. Using the remote Gateway's IP address, and attaching the license to the remote Gateway via SmartUpdate.
-
B. Using your Security Management Server's IP address, and attaching the license to the remote Gateway via SmartUpdate.
-
C. Using the remote Gateway's IP address, and applying the license locally with the command cplic put.
-
D. Using each of the Gateways' IP addresses, and applying the licenses on the Security Management Server with the command cprlic put.
Pregunta 72
Pregunta
QUESTION 72
Identify the correct step performed by SmartUpdate to upgrade a remote Security Gateway. After selecting
Packages > Distribute Only and choosing the target Gateway, the:
Respuesta
-
A. selected package is copied from the CD-ROM of the SmartUpdate PC directly to the Security Gateway and the installation IS performed.
-
B. selected package is copied from the Package Repository on the Security Management Server to the Security Gateway and the installation IS performed.
-
C. SmartUpdate wizard walks the Administrator through a distributed installation.
-
D. selected package is copied from the Package Repository on the Security Management Server to the Security Gateway but the installation IS NOT performed.
Pregunta 73
Pregunta
QUESTION 73
Identify the correct step performed by SmartUpdate to upgrade a remote Security Gateway. After selecting
Packages > Distribute and Install Selected Package and choosing the target Gateway, the:
Respuesta
-
A. selected package is copied from the Package Repository on the Security Management Server to the Security Gateway and the installation IS performed.
-
B. SmartUpdate wizard walks the Administrator through a distributed installation.
-
C. selected package is copied from the Package Repository on the Security Management Server to the Security Gateway but the installation IS NOT performed.
-
D. selected package is copied from the SmartUpdate PC CD-ROM directly to the Security Gateway and the installation IS performed.
Pregunta 74
Pregunta
QUESTION 74
What physical machine must have access to the User Center public IP address when checking for new
packages with SmartUpdate?
Respuesta
-
A. A Security Gateway retrieving the new upgrade package
-
B. SmartUpdate installed Security Management Server PC
-
C. SmartUpdate GUI PC
-
D. SmartUpdate Repository SQL database Server
Pregunta 75
Pregunta
QUESTION 75
What action CANNOT be run from SmartUpdate R77?
Respuesta
-
A. Fetch sync status
-
B. Reboot Gateway
-
C. Preinstall verifier
-
D. Get all Gateway Data
Pregunta 76
Pregunta
QUESTION 76
What mechanism does a gateway configured with Identity Awareness and LDAP initially use to
communicate with a Windows 2003 or 2008 server?
Respuesta
-
A. WMI
-
B. CIFS
-
C. RCP
-
D. LDAP
Pregunta 77
Pregunta
QUESTION 77
Which of the following items should be configured for the Security Management Server to authenticate via
LDAP?
Respuesta
-
A. Check Point Password
-
B. Active Directory Server object
-
C. Windows logon password
-
D. WMI object
Pregunta 78
Pregunta
QUESTION 78
Which of the following items should be configured for the Security Management Server to authenticate
using LDAP?
Respuesta
-
A. Login Distinguished Name and password
-
B. Windows logon password
-
C. Check Point Password
-
D. WMI object
Pregunta 79
Pregunta
QUESTION 79
Which of the following items should be configured for the Security Management Server to authenticate
using LDAP?
Respuesta
-
A. Check Point Password
-
B. WMI object
-
C. Domain Admin username
-
D. Windows logon password
Pregunta 80
Pregunta
QUESTION 80
Where does the security administrator activate Identity Awareness within SmartDashboard?
Respuesta
-
A. Gateway Object > General Properties
-
B. Security Management Server > Identity Awareness
-
C. Policy > Global Properties > Identity Awareness
-
D. LDAP Server Object > General Properties
Pregunta 81
Pregunta
QUESTION 81
How do you configure the Security Policy to provide user access to the Captive Portal through an external
(Internet) interface?
Respuesta
-
A. Change the gateway settings to allow Captive Portal access via an external interface.
-
B. No action is necessary. This access is available by default.
-
C. Change the Identity Awareness settings under Global Properties to allow Captive Portal access on all interfaces.
-
D. Change the Identity Awareness settings under Global Properties to allow Captive Portal access for an external interface.
Pregunta 82
Pregunta
QUESTION 82
To qualify as an Identity Awareness enabled rule, which column MAY include an Access Role?
Respuesta
-
A. Action
-
B. Source
-
C. User
-
D. Track
Pregunta 83
Pregunta
QUESTION 83
To qualify as an Identity Awareness enabled rule, which column MAY include an Access Role?
Respuesta
-
A. Source
-
B. Track
-
C. User
-
D. Action
Pregunta 84
Pregunta
QUESTION 84
What command with appropriate switches would you use to test Identity Awareness connectivity?
Respuesta
-
A. test_ldap
-
B. test_ad_connectivity
-
C. test_ldap_connectivity
-
D. test_ad
Pregunta 85
Pregunta
QUESTION 85
What command syntax would you use to see accounts the gateway suspects are service accounts?
Respuesta
-
A. pdp check_log
-
B. pdp show service
-
C. adlog check_accounts
-
D. adlog a service_accounts
Pregunta 86
Pregunta
QUESTION 86
What command syntax would you use to turn on PDP logging in a distributed environment?
Respuesta
-
A. pdp track=1
-
B. pdp tracker on
-
C. pdp logging on
-
D. pdp log=1
Pregunta 87
Pregunta
QUESTION 87
A client has created a new Gateway object that will be managed at a remote location. When the client
attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install
On check box. What should you look for?
Respuesta
-
A. Secure Internal Communications (SIC) not configured for the object.
-
B. A Gateway object created using the Check Point > Externally Managed VPN Gateway option from the Network Objects dialog box.
-
C. Anti-spoofing not configured on the interfaces on the Gateway object.
-
D. A Gateway object created using the Check Point > Security Gateway option in the network objects, dialog box, but still needs to configure the interfaces for the Security Gateway object.
Pregunta 88
Pregunta
QUESTION 88
A Security Policy installed by another Security Administrator has blocked all SmartDashboard connections
to the stand-alone installation of R77. After running the command fw unloadlocal, you are able to reconnect
with SmartDashboard and view all changes. Which of the following change is the most likely cause of the
block?
Respuesta
-
A. The Allow Control Connections setting in Policy > Global Properties has been unchecked.
-
B. A Stealth Rule has been configured for the R77 Gateway.
-
C. The Security Policy installed to the Gateway had no rules in it.
-
D. The Gateway Object representing your Gateway was configured as an Externally Managed VPN Gateway.
Pregunta 89
Pregunta
QUESTION 89
When configuring anti-spoofing on the Security Gateway object interfaces, which of the following is NOT a
valid R77 topology configuration?
Respuesta
-
A. External
-
B. Any
-
C. Specific
-
D. Not Defined
Pregunta 90
Pregunta
QUESTION 90
You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting
POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the
most likely cause?
Respuesta
-
A. The POP3 rule is disabled.
-
B. POP3 is accepted in Global Properties.
-
C. The POP3 rule is hidden.
-
D. POP3 is one of 3 services (POP3, IMAP, and SMTP) accepted by the default mail object in R77.
Pregunta 91
Pregunta
QUESTION 91
Which rule is responsible for the installation failure?
Exhibit:
Image:
91 (binary/octet-stream)
Respuesta
-
A. Rule 3
-
B. Rule 4
-
C. Rule 6
-
D. Rule 5
Pregunta 92
Pregunta
QUESTION 92
Reviewing the Rule Base, you see that ________ is responsible for the client authentication failure.
Image:
92 (binary/octet-stream)
Respuesta
-
A. Rule 4
-
B. Rule 7
-
C. Rule 8
-
D. Rule 5
Pregunta 93
Pregunta
QUESTION 93
Which rule is responsible for the installation failure?
Exhibit:
Respuesta
-
A. Rule 5
-
B. Rule 4
-
C. Rule 3
-
D. Rule 6
Pregunta 94
Pregunta
QUESTION 94
As a Security Administrator, you must refresh the Client Authentication authorization time-out every time a
new user connection is authorized. How do you do this? Enable the Refreshable Timeout setting:
Respuesta
-
A. in the user object's Authentication screen.
-
B. in the Gateway object's Authentication screen.
-
C. in the Limit tab of the Client Authentication Action Properties screen.
-
D. in the Global Properties Authentication screen.
Pregunta 95
Pregunta
QUESTION 95
The technical-support department has a requirement to access an intranet server. When configuring a User
Authentication rule to achieve this, which of the following should you remember?
Respuesta
-
A. You can only use the rule for Telnet, FTP, SMTP, and rlogin services.
-
B. The Security Gateway first checks if there is any rule that does not require authentication for this type of connection before invoking the Authentication Security Server.
-
C. Once a user is first authenticated, the user will not be prompted for authentication again until logging out.
-
D. You can limit the authentication attempts in the User Properties' Authentication tab.
Pregunta 96
Pregunta
QUESTION 96
Choose the BEST sequence for configuring user management in SmartDashboard, using an LDAP server.
Respuesta
-
A. Configure a server object for the LDAP Account Unit, enable LDAP in Global Properties, and create an LDAP resource object.
-
B. Configure a workstation object for the LDAP server, configure a server object for the LDAP Account Unit, and enable LDAP in Global Properties.
-
C. Enable User Directory in Global Properties, configure a host-node object for the LDAP server, and configure a server object for the LDAP Account Unit.
-
D. Configure a server object for the LDAP Account Unit, and create an LDAP resource object.
Pregunta 97
Pregunta
QUESTION 97
You cannot use SmartDashboard's User Directory features to connect to the LDAP server. What should
you investigate?
1) Verify you have read-only permissions as administrator for the operating system.
2) Verify there are no restrictions blocking SmartDashboard's User Manager from connecting to the LDAP
server.
3) Check that the login Distinguished Name configured has root permission (or at least write permission
Administrative access) in the LDAP Server's access control configuration.
Respuesta
-
A. 1, 2, and 3
-
B. 2 and 3
-
C. 1 and 2
-
D. 1 and 3
¿Quieres crear tus propios Tests gratis con GoConqr? Más información.