Exam 4 - CCSA 156-215 v7

Question

QUESTION 1 Identify the ports to which the Client Authentication daemon listens by default.

Answer 1

A. 259, 900

Answer 2

B. 256, 600

Answer 3

C. 80, 256

Answer 4

D. 8080, 529

Answer 5

A. Client Authentication rule using the manual sign-on method, using HTTP on port 900

Answer 6

B. Client Authentication rule, using partially automatic sign on

Answer 7

C. Client Authentication for fully automatic sign on

Answer 8

D. Session Authentication rule

Answer 9

A. Client Authentication

Answer 10

B. Manual Authentication

Answer 11

C. User Authentication

Answer 12

D. Session Authentication

Answer 13

A. Manual Sign On

Answer 14

B. Agent Automatic Sign On

Answer 15

C. Partially Automatic Sign On

Answer 16

D. Standard Sign On

Answer 17

A. Time properties, adjusted on the user objects for each user, in the Client Authentication rule Source.

Answer 18

B. IPS > Application Intelligence > Client Authentication > Refresh User Timeout option enabled.

Answer 19

C. Refreshable Timeout setting, in Client Authentication Action Properties > Limits

Answer 20

D. Global Properties > Authentication parameters, adjusted to allow for Regular Client Refreshment.

Answer 21

A. Proxied, User, Dynamic, Session

Answer 22

B. Connection, User, Client

Answer 23

C. User, Client, Session

Answer 24

D. User, Proxied, Session

Answer 25

A. SMTP, FTP, TELNET

Answer 26

B. SMTP, FTP, HTTP, TELNET

Answer 27

C. FTP, HTTP, TELNET

Answer 28

D. FTP, TELNET

Answer 29

C. SecureID

Answer 30

D. NT Domain

Answer 31

A. RADIUS server

Answer 32

B. Account Management Client server

Answer 33

C. UserAuthority server

Answer 34

D. LDAP server

Answer 35

A. Connectivity between the R77 Gateway and LDAP server

Answer 36

B. Secure Internal Communications (SIC)

Answer 37

C. Overlapping VPN Domains

Answer 38

D. Domain name resolution

Answer 39

A. SMTP Security Server

Answer 40

B. HTTP Security Server

Answer 41

C. FTP Security Server

Answer 42

D. HTTPS Security Server

Answer 43

A. A group with generic user

Answer 44

B. All users

Answer 45

C. LDAP Account Unit Group

Answer 46

D. Internal user Group

Answer 47

A. Source setting in Source column always takes precedence

Answer 48

B. Source setting in User Properties always takes precedence

Answer 49

C. As location restrictions add up, he would be allowed from net_singapore and net_sydney.

Answer 50

D. It depends on how the User Auth object is configured; whether User Properties or Source Restriction takes precedence.

Answer 51

A. None of these things will happen

Answer 52

B. Eric will be authenticated and get access to the requested server.

Answer 53

C. Eric will be blocked because LDAP is not allowed in the Rule Base.

Answer 54

D. Eric will be dropped by the Stealth Rule

Answer 55

B. Captive Portal

Answer 56

A. Provide user and machine identity to a gateway

Answer 57

B. Manual entry of user credentials for LDAP authentication

Answer 58

C. Audit a user's access, and send that data to a log server

Answer 59

D. Disable Single Sign On

Answer 60

C. All of the above

Answer 61

A. Acquires identities from unidentified users.

Answer 62

B. Is only used for guest user authentication.

Answer 63

C. Allows access to users already identified.

Answer 64

D. Is deployed from the Identity Awareness page in the Global Properties settings

Answer 65

A. Pre-configured and customizable web-based tool

Answer 66

B. Transparent network inspection tool

Answer 67

C. LDAP server add-on

Answer 68

D. Separately licensed feature

Answer 69

A. Identity Awareness Agent

Answer 70

B. Full Endpoint Client

Answer 71

C. ICA Certificate

Answer 72

D. SecureClient

Answer 73

A. Key-logging

Answer 74

B. ICA Certificates

Answer 75

C. SecureClient

Answer 76

D. Single Sign-On

Answer 77

A. AD Query

Answer 78

B. Captive Portal

Answer 79

C. Identity Agent

Answer 80

A. Leveraging identity in the application control blade

Answer 81

B. Basic identity enforcement in the internal network

Answer 82

C. Identity-based auditing and logging

Answer 83

D. Identity-based enforcement for non-AD users (non-Windows and guest users)

Answer 84

A. When accuracy in detecting identity is crucial

Answer 85

B. Leveraging identity for Data Center protection

Answer 86

C. Protecting highly sensitive servers

Answer 87

D. Identity based enforcement for non-AD users (non-Windows and guest users)

Answer 88

A. From the Internet

Answer 89

B. Through internal interfaces

Answer 90

C. Through all interfaces

Answer 91

D. According to the Firewall Policy

Answer 92

A. Symmetric IPsec keys are generated.

Answer 93

B. Each Security Gateway generates a private Diffie-Hellman (DH) key from random pools.

Answer 94

C. The DH public keys are exchanged.

Answer 95

D. Peers authenticate using certificates or preshared secrets.

Answer 96

A. vpn debug ipsec

Answer 97

B. vpn ipsec

Answer 98

C. fw ipsec tu

Answer 99

A. Peers agree on encryption method.

Answer 100

B. Diffie-Hellman key is combined with the key material to produce the symmetrical IPsec key.

Answer 101

C. Peers agree on integrity method.

Answer 102

D. Each side generates a session key from its private key and the peer's public key.

Answer 103

A. (5) Delete all IPsec SAs for a given peer (GW)

Answer 104

B. (7) Delete all IPsec+IKE SAs for a given peer (GW)

Answer 105

C. (6) Delete all IPsec SAs for a given User (Client)

Answer 106

D. (8) Delete all IPsec+IKE SAs for a given User (Client)

Answer 107

A. (6) Delete all IPsec SAs for a given User (Client)

Answer 108

B. (5) Delete all IPsec SAs for a given peer (GW)

Answer 109

C. (8) Delete all IPsec+IKE SAs for a given User (Client)

Answer 110

D. (7) Delete all IPsec+IKE SAs for a given peer (GW)

Answer 111

B. SmartView Tracker

Answer 112

C. SmartView Monitor

Answer 113

D. SmartReporter

Answer 114

A. a stateful ACK to a valid SYN-SYN/ACK on the inverse UDP ports and IP

Answer 115

B. a valid response to an allowed request on the inverse UDP ports and IP

Answer 116

C. bypassing the kernel by the forwarding layer of ClusterXL

Answer 117

D. referenced in the SAM related dynamic tables

Answer 118

A. Session and Transport

Answer 119

B. Physical and Data

Answer 120

C. Presentation and Application

Answer 121

D. Datalink and Network

Answer 122

A. One star Community with the option to mesh the center of the star: New York and London Gateways added to the center of the star with the mesh center Gateways option checked; all London branch offices defined in one satellite window, but, all New York branch offices defined in another satellite window.

Answer 123

B. Two mesh and one star Community: One mesh Community is set up for each of the headquarters and its branch offices. The star Community is configured with London as the center of the Community and New York is the satellite.

Answer 124

C. Two star and one mesh Community: One star Community is set up for each site, with headquarters as the Community center, and its branches as satellites. The mesh Community includes only New York and London Gateways.

Answer 125

D. Three mesh Communities: One for London headquarters and its branches, one for New York headquarters and its branches, and one for London and New York headquarters.

Answer 126

A. Three mesh Communities: one for London headquarters and its branches; one for New York headquarters and its branches; and one for London and New York headquarters.

Answer 127

B. Two mesh and one star Community: Each mesh Community is set up for each site between headquarters their branches. The star Community has New York as the center and London as its satellite.

Answer 128

C. Two star communities and one mesh: A star community for each city with headquarters as center, and branches as satellites. Then one mesh community for the two headquarters.

Answer 129

D. One star Community with the option to mesh the center of the star: New York and London Gateways added to the center of the star with the "mesh center Gateways? option checked; all London branch offices defined in one satellite window; but, all New York branch offices defined in another satellite window.

Answer 130

A. A-3, B-2, C-4, D-1

Answer 131

B. A-2, B-3, C-4, D-1

Answer 132

C. A-3, B-2, C-1, D-4

Answer 133

D. A-3, B-4, C-1, D-2

Answer 134

A. Scalability to accommodate user groups

Answer 135

B. Centralized management

Answer 136

C. Strong authentication

Answer 137

D. Strong data encryption

Answer 138

A. The Gateway can enforce the use of strong encryption.

Answer 139

B. The Gateway accepts any encryption method that is proposed by the client and supported in the VPN.

Answer 140

C. Secure communication is provided between clients and servers that support HTTP.

Answer 141

D. User Authentication is supported.

Answer 142

A. Create a new logical-server object to represent your partner's CA.

Answer 143

B. Exchange exported CA keys and use them to create a new server object to represent your partner's Certificate Authority (CA).

Answer 144

C. Manually import your partner's Certificate Revocation List.

Answer 145

D. Manually import your partner's Access Control List.

Answer 146

A. This cannot be done without downtime as a VPN between a traditional mode Gateway and a simplified mode Gateway does not work.

Answer 147

B. This can not be done as it requires a SIC- reset on the Gateways first forcing an outage.

Answer 148

C. You first need to completely rewrite all policies in simplified mode and then push this new policy to all Gateways at the same time.

Answer 149

D. Convert the required Gateway policies using the simplified VPN wizard, check their logic and then migrate Gateway per Gateway.

Answer 150

A. The two algorithms do not have the same key length and so don't work together. You will get the error .... No proposal chosen....

Answer 151

B. All is fine as the longest key length has been chosen for encrypting the data and a shorter key length for higher performance for setting up the tunnel.

Answer 152

C. Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in phase 2 only costs performance and does not add security due to a shorter key in phase 1.

Answer 153

D. All is fine and can be used as is.

Answer 154

A. Weak performancE. PSK takes more time to encrypt than Diffie-Hellman.

Answer 155

B. Weak Security: PSK are static and can be brute-forced.

Answer 156

C. Weak security: PSKs can only have 112 bit length.

Answer 157

D. Weak scalability: PSKs need to be set on each and every Gateway.

	Created by Gustavo Gonçalves over 7 years ago

Next up

Exam 4 - CCSA 156-215 v7

Description

Resource summary

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Question 31

Question 32

Question 33

Question 34

Question 35

Question 36

Question 37

Question 38

Question 39

Question 40

Question 41

Question 42

Question 43

Question 44

Question 45

Question 46

Question 47

Question 48

Question 49

Similar