Checkpoint 156-215.77 today updated questions - Verified by Checkpoint Experts

Check Point Certified Security Administrator Questions and Answers

Question 1

How many packets does the IKE exchange use for Phase 1 Main Mode?

Options:

Question 2

When using vpn tu, which option must you choose if you only want to clear phase 2 for a specific IP (gateway)?

Exhibit:

Options:

(5) Delete all IPsec SAs for a given peer (GW)

(7) Delete all IPsec+IKE SAs for a given peer (GW)

(6) Delete all IPsec SAs for a given User (Client)

(8) Delete all IPsec+IKE SAs for a given User (Client)

Question 3

Why are certificates preferred over pre-shared keys in an IPsec VPN?

Options:

Weak performancE. PSK takes more time to encrypt than Diffie-Hellman.

Weak Security: PSK are static and can be brute-forced.

Weak security: PSKs can only have 112 bit length.

Weak scalability: PSKs need to be set on each and every Gateway.

Question 4

Which of the following commands can be used to remove site-to-site IPsec Security Association (SA)?

Options:

vpn debug ipsec

vpn ipsec

fw ipsec tu

vpn tu

Question 5

Which of the following is an authentication method used by Identity Awareness?

Options:

SSL

Captive Portal

RSA

PKI

Question 6

Complete this statement from the options provided. Using Captive Portal, unidentified users may be either; blocked, allowed to enter required credentials, or required to download the _____________.

Options:

Identity Awareness Agent

Full Endpoint Client

ICA Certificate

SecureClient

Question 7

Which of the following actions take place in IKE Phase 2 with Perfect Forward Secrecy disabled?

Options:

Symmetric IPsec keys are generated.

Each Security Gateway generates a private Diffie-Hellman (DH) key from random pools.

The DH public keys are exchanged.

Peers authenticate using certificates or preshared secrets.

Question 8

A client has created a new Gateway object that will be managed at a remote location. When the client attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install On check box. What should you look for?

Options:

Secure Internal Communications (SIC) not configured for the object.

A Gateway object created using the Check Point > Externally Managed VPN Gateway option from the Network Objects dialog box.

Anti-spoofing not configured on the interfaces on the Gateway object.

A Gateway object created using the Check Point > Security Gateway option in the network objects, dialog box, but still needs to configure the interfaces for the Security Gateway object.

Question 9

Which SmartConsole component can Administrators use to track changes to the Rule Base?

Options:

WebUI

SmartView Tracker

SmartView Monitor

SmartReporter

Question 10

Which of the following are authentication methods that Security Gateway R77 uses to validate connection attempts? Select the response below that includes the MOST complete list of valid authentication methods.

Options:

Proxied, User, Dynamic, Session

Connection, User, Client

User, Client, Session

User, Proxied, Session

Question 11

The User Directory Software Blade is used to integrate which of the following with Security Gateway R77?

Options:

RADIUS server

Account Management Client server

UserAuthority server

LDAP server

Question 12

What is the Manual Client Authentication TELNET port?

Options:

264

900

259

Question 13

Security Gateway R77 supports User Authentication for which of the following services? Select the response below that contains the MOST correct list of supported services.

Options:

SMTP, FTP, TELNET

SMTP, FTP, HTTP, TELNET

FTP, HTTP, TELNET

FTP, TELNET

Question 14

In the Rule Base displayed, user authentication in Rule 4 is configured as fully automatic. Eric is a member of the LDAP group, MSD_Group.

What happens when Eric tries to connect to a server on the Internet?

Options:

None of these things will happen.

Eric will be authenticated and get access to the requested server.

Eric will be blocked because LDAP is not allowed in the Rule Base.

Eric will be dropped by the Stealth Rule.

Question 15

Match the terms with their definitions:

Exhibit:

Options:

A-3, B-2, C-4, D-1

A-2, B-3, C-4, D-1

A-3, B-2, C-1, D-4

A-3, B-4, C-1, D-2

Question 16

Which of these Security Policy changes optimize Security Gateway performance?

Options:

Using groups within groups in the manual NAT Rule Base.

Use Automatic NAT rules instead of Manual NAT rules whenever possible.

Using domain objects in rules when possible.

Putting the least-used rule at the top of the Rule Base.

Question 17

Your R77 primary Security Management Server is installed on GAiA. You plan to schedule the Security Management Server to run fw logswitch automatically every 48 hours.

How do you create this schedule?

Options:

On a GAiA Security Management Server, this can only be accomplished by configuring the command fw logswitch via the cron utility.

Create a time object, and add 48 hours as the interval. Open the primary Security Management Server object’s Logs and Masters window, enable Schedule log switch, and select the Time object.

Create a time object, and add 48 hours as the interval. Open the Security Gateway object's Logs and Masters window, enable Schedule log switch, and select the Time object.

Create a time object, and add 48 hours as the interval. Select that time object’s Global Properties > Logs and Masters window, to schedule a logswitch.

Question 18

SmartView Tracker R77 consists of three different modes. They are:

Options:

Log, Active, and Audit

Log, Active, and Management

Network and Endpoint, Active, and Management

Log, Track, and Management

Question 19

Many companies have defined more than one administrator. To increase security, only one administrator should be able to install a Rule Base on a specific Firewall.

How do you configure this?

Options:

Define a permission profile in SmartDashboard with read/write privileges, but restrict it to all other firewalls by placing them in the Policy Targets field. Then, an administrator with this permission profile cannot install a policy on any Firewall not listed here.

Put the one administrator in an Administrator group and configure this group in the specific Firewall object in Advanced > Permission to Install.

In the object General Properties representing the specific Firewall, go to the Software Blades product list and select Firewall. Right-click in the menu, select Administrator to Install to define only this administrator.

Right-click on the object representing the specific administrator, and select that Firewall in Policy Targets.

Question 20

After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by anti-spoofing protections. Which of the following is the MOST LIKELY cause?

Options:

The Global Properties setting Translate destination on client side is unchecked. But the topology on the DMZ interface is set to Internal - Network defined by IP and Mask. Check the Global Properties setting Translate destination on client side.

The Global Properties setting Translate destination on client side is unchecked. But the topology on the external interface is set to Others +. Change topology to External.

The Global Properties setting Translate destination on client side is checked. But the topology on the external interface is set to External. Change topology to Others +.

The Global Properties setting Translate destination on client side is checked. But the topology on the DMZ interface is set to Internal - Network defined by IP and Mask. Uncheck the Global Properties setting Translate destination on client side.

Question 21

Which utility allows you to configure the DHCP service on GAiA from the command line?

Options:

ifconfig

sysconfig

cpconfig

dhcp_cfg

Question 22

In SmartDashboard, Translate destination on client side is checked in Global Properties. When Network Address Translation is used:

Options:

It is not necessary to add a static route to the Gateway’s routing table.

It is necessary to add a static route to the Gateway’s routing table.

The Security Gateway’s ARP file must be modified.

VLAN tagging cannot be defined for any hosts protected by the Gateway.

Question 23

You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate destination on client site from Global Properties > NAT. Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?

Options:

No extra configuration is needed.

A proxy ARP entry, to ensure packets destined for the public IP address will reach the Security Gateway's external interface.

The NAT IP address must be added to the external Gateway interface anti-spoofing group.

A static route, to ensure packets destined for the public NAT IP address will reach the Gateway's internal interface.

Question 24

Which R77 feature or command allows Security Administrators to revert to earlier Security Policy versions without changing object configurations?

Options:

upgrade_export/upgrade_import

fwm dbexport/fwm dbimport

Database Revision Control

Policy Package management

Question 25

Where can an administrator specify the notification action to be taken by the firewall in the event that available disk space drops below 15%?

Options:

SmartView Monitor > Gateway Status > Threshold Settings

SmartView Tracker > Audit Tab > Gateway Counters

SmartView Monitor > Gateway Status > System Information > Thresholds

This can only be monitored by a user-defined script.

Question 26

Which Check Point address translation method allows an administrator to use fewer ISP-assigned IP addresses than the number of internal hosts requiring Internet connectivity?

Options:

Hide

Static Destination

Static Source

Dynamic Destination

Question 27

An internal host initiates a session to the Google.com website and is set for Hide NAT behind the Security Gateway. The initiating traffic is an example of __________.

Options:

client side NAT

source NAT

destination NAT

None of these

Question 28

The third-shift Administrator was updating Security Management Server access settings in Global Properties. He managed to lock all administrators out of their accounts.

How should you unlock these accounts?

Options:

Delete the file admin.lock in the Security Management Server directory $FWDIR/tmp/.

Reinstall the Security Management Server and restore using upgrade_import.

Type fwm lock_admin -ua from the Security Management Server command line.

Login to SmartDashboard as the special cpconfig_admin user account; right-click on each administrator object and select unlock.

Question 29

Which of the following methods will provide the most complete backup of an R77 configuration?

Options:

Policy Package Management

Copying the directories $FWDIR\conf and $CPDIR\conf to another server

Execute command upgrade_export

Database Revision Control

Question 30

The third-shift Administrator was updating Security Management Server access settings in Global Properties and testing. He managed to lock himself out of his account.

How can you unlock this account?

Options:

Type fwm unlock_admin from the Security Management Server command line.

Type fwm unlock_admin -u from the Security Gateway command line.

Type fwm lock_admin -u from the Security Management Server command line.

Delete the file admin.lock in the Security Management Server directory $FWDIR/tmp/.

Question 31

You install and deploy GAiA with default settings. You allow Visitor Mode in the Gateway object’s Remote Access properties and install policy. What additional steps are required for this to function correctly?

Options:

You need to start SSL Network Extender first, then use Visitor Mode.

Set Visitor Mode in Policy > Global Properties > Remote-Access > VPN - Advanced.

Office mode is not configured.

The WebUI on GAiA runs on port 443 (HTTPS). When you configure Visitor Mode it cannot bind to default port 443, because it's used by another program (WebUI). With multi-port no additional changes are necessary.

Question 32

What does SmartUpdate allow you to do?

Options:

SmartUpdate only allows you to update Check Point and OPSEC certified products.

SmartUpdate only allows you to manage product licenses.

SmartUpdate allows you to update Check Point and OPSEC certified products and to manage product licenses.

SmartUpdate is not a Check Point product.

Question 33

You find a suspicious FTP site trying to connect to one of your internal hosts. How do you block it in real time and verify it is successfully blocked? Highlight the suspicious connection in SmartView Tracker:

Options:

Log mode. Block it using Tools > Block Intruder menu. Observe in the Log mode that the suspicious connection does not appear again in this SmartView Tracker view.

Log mode. Block it using Tools > Block Intruder menu. Observe in the Log mode that the suspicious connection is listed in this SmartView Tracker view as “dropped.”

Active mode. Block it using Tools > Block Intruder menu. Observe in the Active mode that the suspicious connection does not appear again in this SmartView Tracker view.

Active mode. Block it using Tools > Block Intruder menu. Observe in the Active mode that the suspicious connection is listed in this SmartView Tracker view as “dropped.”

Question 34

For remote user authentication, which authentication scheme is NOT supported?

Options:

Check Point Password

RADIUS

TACACS

SecurID

Question 35

What CLI utility allows an administrator to capture traffic along the firewall inspection chain?

Options:

show interface (interface) - chain

tcpdump

tcpdump/ snoop

fw monitor

Question 36

Assume you are a Security Administrator for ABCTech. You have allowed authenticated access to users from Mkting_net to Finance_net. But in the user’s properties, connections are only permitted within Mkting_net. What is the BEST way to resolve this conflict?

Options:

Select Ignore Database in the Action Properties window.

Permit access to Finance_net.

Select Intersect with user database in the Action Properties window.

Select Intersect with user database or Ignore Database in the Action Properties window.

Question 37

Which of the following are available SmartConsole clients which can be installed from the R77 Windows CD? Read all answers and select the most complete and valid list.

Options:

SmartView Tracker, SmartDashboard, CPINFO, SmartUpdate, SmartView Status

SmartView Tracker, SmartDashboard, SmartLSM, SmartView Monitor

SmartView Tracker, CPINFO, SmartUpdate

Security Policy Editor, Log Viewer, Real Time Monitor GUI

Question 38

Lilly needs to review VPN History counters for the last week.

Where would she do this?

Options:

SmartView Monitor > Tunnels > VPN History

SmartView Monitor > System Counters > VPN History

SmartView Monitor > System Counters > Firewall Security History

SmartView Monitor > System Counters > VPN

Question 39

Your company enforces a strict change control policy. Which of the following would be MOST effective for quickly dropping an attacker’s specific active connection?

Options:

Change the Rule Base and install the Policy to all Security Gateways

Block Intruder feature of SmartView Tracker

Intrusion Detection System (IDS) Policy install

SAM - Suspicious Activity Rules feature of SmartView Monitor

Question 40

Is it possible to see user activity in SmartView Tracker?

Options:

Yes, seeing user activity is enabled when using the Identity Awareness blade.

No, a Check Point Gateway can only see IP addresses.

Yes, but you have to enable the option: See user information in SmartView Tracker.

Yes, but you need to use the SPLAT operating system.

Question 41

Which authentication type requires specifying a contact agent in the Rule Base?

Options:

Client Authentication with Partially Automatic Sign On

Client Authentication with Manual Sign On

User Authentication

Session Authentication

Question 42

What is the difference between Standard and Specific Sign On methods?

Options:

Standard Sign On allows the user to be automatically authorized for all services that the rule allows. Specific Sign On requires that the user re-authenticate for each service specifically defined in the window Specific Action Properties.

Standard Sign On allows the user to be automatically authorized for all services that the rule allows, but re-authenticate for each host to which he is trying to connect. Specific Sign On requires that the user re-authenticate for each service.

Standard Sign On allows the user to be automatically authorized for all services that the rule allows. Specific Sign On requires that the user re-authenticate for each service and each host to which he is trying to connect.

Standard Sign On requires the user to re-authenticate for each service and each host to which he is trying to connect. Specific Sign On allows the user to sign on only to a specific IP address.

Question 43

Choose the correct statement regarding Implied Rules:

Options:

To edit Implied rules you go to: Launch Button > Policy > Global Properties > Firewall.

Implied rules are fixed rules that you cannot change.

You can directly edit the Implied rules by double-clicking on a specific Implicit rule.

You can edit the Implied rules but only if requested by Check Point support personnel.

Question 44

What information is found in the SmartView Tracker Management log?

Options:

SIC revoke certificate event

Destination IP address

Most accessed Rule Base rule

Number of concurrent IKE negotiations

Question 45

Which answer below best describes the Administrator Auditing options available in SmartView Tracker?

Options:

Compliance information compiled from network activity is recorded in logs

Administrator network activity observed and logged by gateways

Accounting information gathered on network activity as recorded in logs

Administrator login and logout, object manipulation, and rule base changes

Question 46

You are working with multiple Security Gateways that enforce an extensive number of rules. To simplify security administration, which one of the following would you choose to do?

Options:

Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.

Run separate SmartConsole instances to login and configure each Security Gateway directly.

Create network objects that restrict all applicable rules to only certain networks.

Create a separate Security Policy package for each remote Security Gateway.

Question 47

Which of the following options is available with the GAiA cpconfig utility on a Management Server?

Options:

Export setup

DHCP Server configuration

GUI Clients

Time & Date

Question 48

You intend to upgrade a Check Point Gateway from R71 to R77. Prior to upgrading, you want to back up the Gateway should there be any problems with the upgrade. Which of the following allows for the Gateway configuration to be completely backed up into a manageable size in the least amount of time?

Options:

database revision

snapshot

upgrade_export

backup

Question 49

Which command enables IP forwarding on IPSO?

Options:

ipsofwd on admin

echo 0 > /proc/sys/net/ipv4/ip_forward

clish -c set routing active enable

echo 1 > /proc/sys/net/ipv4/ip_forward

Question 50

Which of these components does NOT require a Security Gateway R77 license?

Options:

Security Management Server

Check Point Gateway

SmartConsole

SmartUpdate upgrading/patching

Question 51

Can you use Captive Portal with HTTPS?

Options:

No, it only works with FTP

No, it only works with FTP and HTTP

Yes

No, it only works with HTTP

Question 52

A Cleanup rule:

Options:

logs connections that would otherwise be dropped without logging by default.

drops packets without logging connections that would otherwise be dropped and logged by default.

logs connections that would otherwise be accepted without logging by default.

drops packets without logging connections that would otherwise be accepted and logged by default.

Question 53

Installing a policy usually has no impact on currently existing connections. Which statement is TRUE?

Options:

Users being authenticated by Client Authentication have to re-authenticate.

All connections are reset, so a policy install is recommended during announced downtime only.

All FTP downloads are reset; users have to start their downloads again.

Site-to-Site VPNs need to re-authenticate, so Phase 1 is passed again after installing the Security Policy.

Question 54

The London Security Gateway Administrator has just installed the Security Gateway and Management Server. He has not changed any default settings. As he tries to configure the Gateway, he is unable to connect.

Which troubleshooting suggestion will NOT help him?

Options:

Check if some intermediate network device has a wrong routing table entry, VLAN assignment, duplex-mismatch, or trunk issue.

Test the IP address assignment and routing settings of the Security Management Server, Gateway, and console client.

Verify the SIC initialization.

Verify that the Rule Base explicitly allows management connections.

Question 55

The Security Gateway is installed on GAiA R77 The default port for the Web User Interface is _______.

Options:

TCP 18211

TCP 443

TCP 4433

TCP 257

Question 56

Where do you verify that UserDirectory is enabled?

Options:

Verify that Security Gateway > General Properties > Authentication > Use UserDirectory (LDAP) for Security Gateways is checked

Verify that Global Properties > Authentication > Use UserDirectory (LDAP) for Security Gateways is checked

Verify that Security Gateway > General Properties > UserDirectory (LDAP) > Use UserDirectory (LDAP) for Security Gateways is checked

Verify that Global Properties > UserDirectory (LDAP) > Use UserDirectory (LDAP) for Security Gateways is checked

Question 57

The Tokyo Security Management Server Administrator cannot connect from his workstation in Osaka.

Which of the following lists the BEST sequence of steps to troubleshoot this issue?

Options:

Check for matching OS and product versions of the Security Management Server and the client. Then, ping the Gateways to verify connectivity. If successful, scan the log files for any denied management packets.

Verify basic network connectivity to the local Gateway, service provider, remote Gateway, remote network and target machine. Then, test for firewall rules that deny management access to the target. If successful, verify that pcosaka is a valid client IP address.

Check the allowed clients and users on the Security Management Server. If pcosaka and your user account are valid, check for network problems. If there are no network related issues, this is likely to be a problem with the server itself. Check for any patches and upgrades. If still unsuccessful, open a case with Technical Support.

Call Tokyo to check if they can ping the Security Management Server locally. If so, login to sgtokyo, verify management connectivity and Rule Base. If this looks okay, ask your provider if they have some firewall rules that filters out your management traffic.

Question 58

How can you most quickly reset Secure Internal Communications (SIC) between a Security Management Server and Security Gateway?

Options:

From cpconfig on the Gateway, choose the Secure Internal Communication option and retype the activation key. Next, retype the same key in the Gateway object in SmartDashboard and reinitialize Secure Internal Communications (SIC).

Use SmartUpdate to retype the Security Gateway activation key. This will automatically sync SIC to both the Security Management Server and Gateway.

From the Security Management Server’s command line, type fw putkey -p .

Run the command fwm sic_reset to reinitialize the Security Management Server Internal Certificate Authority (ICA). Then retype the activation key on the Security Gateway from SmartDashboard.

Load More 156-215.77 Questions

Labour Day Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

Checkpoint 156-215.77 Check Point Certified Security Administrator Exam Practice Test

Check Point Certified Security Administrator Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Options:

Answer:

Options:

Answer: