March Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

Checkpoint 156-315.80 Check Point Certified Security Expert (CCSE) R80 Exam Practice Test

Demo: 69 questions
Total 462 questions

Check Point Certified Security Expert (CCSE) R80 Questions and Answers

Question 1

What is the command to see cluster status in cli expert mode?

Options:

A.

fw ctl stat

B.

clusterXL stat

C.

clusterXL status

D.

cphaprob stat

Question 2

Which firewall daemon is responsible for the FW CLI commands?

Options:

A.

fwd

B.

fwm

C.

cpm

D.

cpd

Question 3

Which of the following will NOT affect acceleration?

Options:

A.

Connections destined to or originated from the Security gateway

B.

A 5-tuple match

C.

Multicast packets

D.

Connections that have a Handler (ICMP, FTP, H.323, etc.)

Question 4

SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Options:

A.

Analyzes each log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server.

B.

Correlates all the identified threats with the consolidation policy.

C.

Collects syslog data from third party devices and saves them to the database.

D.

Connects with the SmartEvent Client when generating threat reports.

Question 5

Tom has connected to the R80 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.

What will happen to the changes already made?

Options:

A.

Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.

B.

Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.

C.

Tom’s changes will be lost since he lost connectivity and he will have to start again.

D.

Tom will have to reboot his SmartConsole computer, clear to cache, and restore changes.

Question 6

Office mode means that:

Options:

A.

SecurID client assigns a routable MAC address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

B.

Users authenticate with an Internet browser and use secure HTTPS connection.

C.

Local ISP (Internet service Provider) assigns a non-routable IP address to the remote user.

D.

Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.

Question 7

Which VPN routing option uses VPN routing for every connection a satellite gateway handles?

Options:

A.

To satellites through center only

B.

To center only

C.

To center and to other satellites through center

D.

To center, or through the center to other satellites, to Internet and other VPN targets

Question 8

In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

Options:

A.

Security Policies

B.

Logs and Monitor

C.

Manage and Settings

D.

Gateways and Servers

Question 9

John detected high load on sync interface. Which is most recommended solution?

Options:

A.

For FTP connections – do not sync

B.

Add a second interface to handle sync traffic

C.

For short connections like http service – do not sync

D.

For short connections like icmp service – delay sync for 2 seconds

Question 10

SmartEvent does NOT use which of the following procedures to identify events:

Options:

A.

Matching a log against each event definition

B.

Create an event candidate

C.

Matching a log against local exclusions

D.

Matching a log against global exclusions

Question 11

With SecureXL enabled, accelerated packets will pass through the following:

Options:

A.

Network Interface Card, OSI Network Layer, OS IP Stack, and the Acceleration Device

B.

Network Interface Card, Check Point Firewall Kernal, and the Acceleration Device

C.

Network Interface Card and the Acceleration Device

D.

Network Interface Card, OSI Network Layer, and the Acceleration Device

Question 12

NO: 219

What cloud-based SandBlast Mobile application is used to register new devices and users?

Options:

A.

Check Point Protect Application

B.

Management Dashboard

C.

Behavior Risk Engine

D.

Check Point Gateway

Question 13

Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?

Options:

A.

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

B.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

C.

Time object to a rule to make the rule active only during specified times.

D.

Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.

Question 14

What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

Options:

A.

Lagging

B.

Synchronized

C.

Never been synchronized

D.

Collision

Question 15

SmartEvent uses it's event policy to identify events. How can this be customized?

Options:

A.

By modifying the firewall rulebase

B.

By creating event candidates

C.

By matching logs against exclusions

D.

By matching logs against event rules

Question 16

In the Check Point Security Management Architecture, which component(s) can store logs?

Options:

A.

SmartConsole

B.

Security Management Server and Security Gateway

C.

Security Management Server

D.

SmartConsole and Security Management Server

Question 17

What ports are used for SmartConsole to connect to the Security Management Server?

Options:

A.

CPMl (18190)

B.

CPM (19009), CPMl (18190) https (443)

C.

CPM (19009). CPMl (18190) CPD (18191)

D.

ICA_Pull (18210), CPMl (18190) https (443)

Question 18

Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ________ .

Options:

A.

User Directory

B.

Captive Portal and Transparent Kerberos Authentication

C.

Captive Portal

D.

UserCheck

Question 19

Fill in the blanks: Gaia can be configured using the ______ or _____ .

Options:

A.

GaiaUI; command line interface

B.

WebUI; Gaia Interface

C.

Command line interface; WebUI

D.

Gaia Interface; GaiaUI

Question 20

You want to verify if your management server is ready to upgrade to R80.10. What tool could you use in this process?

Options:

A.

migrate export

B.

upgrade_tools verify

C.

pre_upgrade_verifier

D.

migrate import

Question 21

What CLI command compiles and installs a Security Policy on the target’s Security Gateways?

Options:

A.

fwm compile

B.

fwm load

C.

fwm fetch

D.

fwm install

Question 22

At what point is the Internal Certificate Authority (ICA) created?

Options:

A.

Upon creation of a certificate.

B.

During the primary Security Management Server installation process.

C.

When an administrator decides to create one.

D.

When an administrator initially logs into SmartConsole.

Question 23

SandBlast agent extends 0 day prevention to what part of the network?

Options:

A.

Web Browsers and user devices

B.

DMZ server

C.

Cloud

D.

Email servers

Question 24

What will be the effect of running the following command on the Security Management Server?

Options:

A.

Remove the installed Security Policy.

B.

Remove the local ACL lists.

C.

No effect.

D.

Reset SIC on all gateways.

Question 25

The Correlation Unit performs all but the following actions:

Options:

A.

Marks logs that individually are not events, but may be part of a larger pattern to be identified later.

B.

Generates an event based on the Event policy.

C.

Assigns a severity level to the event.

D.

Takes a new log entry that is part of a group of items that together make up an event, and adds it to an ongoing event.

Question 26

What is the mechanism behind Threat Extraction?

Options:

A.

This a new mechanism which extracts malicious files from a document to use it as a counter-attack against its sender.

B.

This is a new mechanism which is able to collect malicious files out of any kind of file types to destroy it prior to sending it to the intended recipient.

C.

This is a new mechanism to identify the IP address of the sender of malicious codes and put it into the SAM database (Suspicious Activity Monitoring).

D.

Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.

Question 27

What is the best sync method in the ClusterXL deployment?

Options:

A.

Use 1 cluster + 1st sync

B.

Use 1 dedicated sync interface

C.

Use 3 clusters + 1st sync + 2nd sync + 3rd sync

D.

Use 2 clusters +1st sync + 2nd sync

Question 28

When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.

Options:

A.

SecureID

B.

SecurID

C.

Complexity

D.

TacAcs

Question 29

What has to be taken into consideration when configuring Management HA?

Options:

A.

The Database revisions will not be synchronized between the management servers

B.

SmartConsole must be closed prior to synchronized changes in the objects database

C.

If you wanted to use Full Connectivity Upgrade, you must change the Implied Rules to allow FW1_cpredundant to pass before the Firewall Control Connections.

D.

For Management Server synchronization, only External Virtual Switches are supported. So, if you wanted to employ Virtual Routers instead, you have to reconsider your design.

Question 30

Which feature is NOT provided by all Check Point Mobile Access solutions?

Options:

A.

Support for IPv6

B.

Granular access control

C.

Strong user authentication

D.

Secure connectivity

Question 31

SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

Options:

A.

19090,22

B.

19190,22

C.

18190,80

D.

19009,443

Question 32

When attempting to start a VPN tunnel, in the logs the error “no proposal chosen” is seen numerous times. No other VPN-related entries are present.

Which phase of the VPN negotiations has failed?

Options:

A.

IKE Phase 1

B.

IPSEC Phase 2

C.

IPSEC Phase 1

D.

IKE Phase 2

Question 33

NO: 155

You need to see which hotfixes are installed on your gateway, which command would you use?

Options:

A.

cpinfo –h all

B.

cpinfo –o hotfix

C.

cpinfo –l hotfix

D.

cpinfo –y all

Question 34

Firewall polices must be configured to accept VRRP packets on the GAiA platform if it Firewall software. The Multicast destination assigned by the internet Assigned Number Authority (IANA) for VRRP is:

Options:

A.

224.0.0.18

B.

224 00 5

C.

224.0.0.102

D.

224.0.0.22

Question 35

Which encryption algorithm is the least secured?

Options:

A.

AES-128

B.

AES-256

C.

DES

D.

3DES

Question 36

To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Options:

A.

fw ctl set int fwha vmac global param enabled

B.

fw ctl get int vmac global param enabled; result of command should return value 1

C.

cphaprob-a if

D.

fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1

Question 37

Fill in the blank: The R80 utility fw monitor is used to troubleshoot ______________________.

Options:

A.

User data base corruption

B.

LDAP conflicts

C.

Traffic issues

D.

Phase two key negotiations

Question 38

What is UserCheck?

Options:

A.

Messaging tool used to verify a user’s credentials.

B.

Communication tool used to inform a user about a website or application they are trying to access.

C.

Administrator tool used to monitor users on their network.

D.

Communication tool used to notify an administrator when a new user is created.

Question 39

If you needed the Multicast MAC address of a cluster, what command would you run?

Options:

A.

cphaprob –a if

B.

cphaconf ccp multicast

C.

cphaconf debug data

D.

cphaprob igmp

Question 40

What scenario indicates that SecureXL is enabled?

Options:

A.

Dynamic objects are available in the Object Explorer

B.

SecureXL can be disabled in cpconfig

C.

fwaccel commands can be used in clish

D.

Only one packet in a stream is seen in a fw monitor packet capture

Question 41

What is the command to check the status of the SmartEvent Correlation Unit?

Options:

A.

fw ctl get int cpsead_stat

B.

cpstat cpsead

C.

fw ctl stat cpsemd

D.

cp_conf get_stat cpsemd

Question 42

Fill in the blank: The command ___________________ provides the most complete restoration of a R80 configuration.

Options:

A.

upgrade_import

B.

cpconfig

C.

fwm dbimport -p

D.

cpinfo –recover

Question 43

In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Options:

A.

Mail, Block Source, Block Event Activity, External Script, SNMP Trap

B.

Mail, Block Source, Block Destination, Block Services, SNMP Trap

C.

Mail, Block Source, Block Destination, External Script, SNMP Trap

D.

Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap

Question 44

When deploying SandBlast, how would a Threat Emulation appliance benefit from the integration of ThreatCloud?

Options:

A.

ThreatCloud is a database-related application which is located on-premise to preserve privacy of company-related data

B.

ThreatCloud is a collaboration platform for all the CheckPoint customers to form a virtual cloud consisting of a combination of all on-premise private cloud environments

C.

ThreatCloud is a collaboration platform for Check Point customers to benefit from VMWare ESXi infrastructure which supports the Threat Emulation Appliances as virtual machines in the EMC Cloud

D.

ThreatCloud is a collaboration platform for all the Check Point customers to share information about malicious and benign files that all of the customers can benefit from as it makes emulation of known files unnecessary

Question 45

Which 3 types of tracking are available for Threat Prevention Policy?

Options:

A.

SMS Alert, Log, SNMP alert

B.

Syslog, None, User-defined scripts

C.

None, Log, Syslog

D.

Alert, SNMP trap, Mail

Question 46

What is the base level encryption key used by Capsule Docs?

Options:

A.

RSA 2048

B.

RSA 1024

C.

SHA-256

D.

AES

Question 47

SmartEvent Security Checkups can be run from the following Logs and Monitor activity:

Options:

A.

Reports

B.

Advanced

C.

Checkups

D.

Views

Question 48

What are the different command sources that allow you to communicate with the API server?

Options:

A.

SmartView Monitor, API_cli Tool, Gaia CLI, Web Services

B.

SmartConsole GUI Console, mgmt_cli Tool, Gaia CLI, Web Services

C.

SmartConsole GUI Console, API_cli Tool, Gaia CLI, Web Services

D.

API_cli Tool, Gaia CLI, Web Services

Question 49

: 131

Which command is used to display status information for various components?

Options:

A.

show all systems

B.

show system messages

C.

sysmess all

D.

show sysenv all

Question 50

Please choose correct command to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI?

Options:

A.

host name myHost12 ip-address 10.50.23.90

B.

mgmt: add host name ip-address 10.50.23.90

C.

add host name emailserver1 ip-address 10.50.23.90

D.

mgmt: add host name emailserver1 ip-address 10.50.23.90

Question 51

Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the

inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire

mode configuration, chain modules marked with _______ will not apply.

Options:

A.

ffffffff

B.

00000001

C.

00000002

D.

00000003

Question 52

Which file gives you a list of all security servers in use, including port number?

Options:

A.

$FWDIR/conf/conf.conf

B.

$FWDIR/conf/servers.conf

C.

$FWDIR/conf/fwauthd.conf

D.

$FWDIR/conf/serversd.conf

Question 53

What is the main difference between Threat Extraction and Threat Emulation?

Options:

A.

Threat Emulation never delivers a file and takes more than 3 minutes to complete.

B.

Threat Extraction always delivers a file and takes less than a second to complete.

C.

Threat Emulation never delivers a file that takes less than a second to complete.

D.

Threat Extraction never delivers a file and takes more than 3 minutes to complete.

Question 54

Which tool is used to enable ClusterXL?

Options:

A.

SmartUpdate

B.

cpconfig

C.

SmartConsole

D.

sysconfig

Question 55

What are the steps to configure the HTTPS Inspection Policy?

Options:

A.

Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard

B.

Go to Application&url filtering blade > Advanced > Https Inspection > Policy

C.

Go to Manage&Settings > Blades > HTTPS Inspection > Policy

D.

Go to Application&url filtering blade > Https Inspection > Policy

Question 56

What destination versions are supported for a Multi-Version Cluster Upgrade?

Options:

A.

R80.40 and later

B.

R76 and later

C.

R70 and Later

D.

R80.10 and Later

Question 57

What is the best method to upgrade a Security Management Server to R80.x when it is not connected to the Internet?

Options:

A.

CPUSE offline upgrade only

B.

Advanced upgrade or CPUSE offline upgrade

C.

Advanced Upgrade only

D.

SmartUpdate offline upgrade

Question 58

What is correct statement about Security Gateway and Security Management Server failover in Check Point R80.X in terms of Check Point Redundancy driven solution?

Options:

A.

Security Gateway failover is an automatic procedure but Security Management Server failover is a manual procedure.

B.

Security Gateway failover as well as Security Management Server failover is a manual procedure.

C.

Security Gateway failover is a manual procedure but Security Management Server failover is an automatic procedure.

D.

Security Gateway failover as well as Security Management Server failover is an automatic procedure.

Question 59

Which features are only supported with R80.10 Gateways but not R77.x?

Options:

A.

Access Control policy unifies the Firewall, Application Control & URL Filtering, Data Awareness, and Mobile Access Software Blade policies.

B.

Limits the upload and download throughput for streaming media in the company to 1 Gbps.

C.

The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.

D.

Time object to a rule to make the rule active only during specified times.

Question 60

You are the administrator for ABC Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.

What does this mean?

Options:

A.

This rule No. 6 has been marked for deletion in your Management session.

B.

This rule No. 6 has been marked for deletion in another Management session.

C.

This rule No. 6 has been marked for editing in your Management session.

D.

This rule No. 6 has been marked for editing in another Management session.

Question 61

Which statement is most correct regarding about “CoreXL Dynamic Dispatcher”?

Options:

A.

The CoreXL FW instanxces assignment mechanism is based on Source MAC addresses, Destination MAC addresses

B.

The CoreXL FW instances assignment mechanism is based on the utilization of CPU cores

C.

The CoreXL FW instances assignment mechanism is based on IP Protocol type

D.

The CoreXl FW instances assignment mechanism is based on Source IP addresses, Destination IP addresses, and the IP ‘Protocol’ type

Question 62

Which NAT rules are prioritized first?

Options:

A.

Post-Automatic/Manual NAT rules

B.

Manual/Pre-Automatic NAT

C.

Automatic Hide NAT

D.

Automatic Static NAT

Question 63

CoreXL is supported when one of the following features is enabled:

Options:

A.

Route-based VPN

B.

IPS

C.

IPv6

D.

Overlapping NAT

Question 64

Which of the following is NOT a VPN routing option available in a star community?

Options:

A.

To satellites through center only.

B.

To center, or through the center to other satellites, to Internet and other VPN targets.

C.

To center and to other satellites through center.

D.

To center only.

Question 65

How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

Options:

A.

By dropping traffic from websites identified through ThreatCloud Verification and URL Caching

B.

By dropping traffic that is not proven to be from clean websites in the URL Filtering blade

C.

By allowing traffic from websites that are known to run Antivirus Software on servers regularly

D.

By matching logs against ThreatCloud information about the reputation of the website

Question 66

GAiA Software update packages can be imported and installed offline in situation where:

Options:

A.

Security Gateway with GAiA does NOT have SFTP access to Internet

B.

Security Gateway with GAiA does NOT have access to Internet.

C.

Security Gateway with GAiA does NOT have SSH access to Internet.

D.

The desired CPUSE package is ONLY available in the Check Point CLOUD.

Question 67

The Firewall kernel is replicated multiple times, therefore:

Options:

A.

The Firewall kernel only touches the packet if the connection is accelerated

B.

The Firewall can run different policies per core

C.

The Firewall kernel is replicated only with new connections and deletes itself once the connection times out

D.

The Firewall can run the same policy on all cores.

Question 68

After finishing installation admin John likes to use top command in expert mode. John has to set the expert-password and was able to use top command. A week later John has to use the top command again, He detected that the expert password is no longer valid. What is the most probable reason for this behavior?

Options:

A.

“write memory” was not issued on clish

B.

changes are only possible via SmartConsole

C.

“save config” was not issued in expert mode

D.

“save config” was not issued on clish

Question 69

If a “ping”-packet is dropped by FW1 Policy –on how many inspection Points do you see this packet in “fw monitor”?

Options:

A.

“i", “l” and “o”

B.

I don’t see it in fw monitor

C.

“i" only

D.

“i" and “l”

Demo: 69 questions
Total 462 questions