MegaCorp is running Smartcenter R70, some Gateways at R65 and some other Gateways with R60. Management wants to upgrade to the most comprehensive IPv6 support. What should theadministrator do first?
To run GAiA in 64bit mode, which of the following is true?
1) Run set edition default 64-bit.
2) Install more than 4 GB RAM.
3) Install more than 4 TB of Hard Disk.
Which Check Point tool allows you to open a debug file and see the VPN packet exchange details.
Fill in the blank. You can set Acceleration to ON or OFF using command syntax ___________ .
Which of the following items should be configured for the Security Management Server to authenticate via LDAP?
MultiCorp has bought company OmniCorp and now has two active AD domains. How would you deploy Identity Awareness inthis environment?
Which CLI tool helps on verifying proper ClusterXL sync?
SmartReporter reports can be used to analyze data from a penetration-testing regimen in all of the following examples, EXCEPT:
MegaCorps' disaster recovery plan is past due for an update to the backup and restore section to enjoy the benefits of the new distributed R80 installation. You must propose a plan that meets the following required and desired objectives:
Required: Security Policy repository must be backed up no less frequently than every 24 hours.
Desired: Back up R80 components enforcing the Security Policies at least once a week.
Desired: Back up R80 logs at least once a week.
You develop a disaster recovery plan proposing the following:
* Use the utility cron to run the command upgrade_export each night on the Security Management Servers.
* Configure the organization's routine backup software to back up files created by the command upgrade_export.
* Configure GAiA back up utility to back up Security Gateways every Saturday night.
* Use the utility cron to run the command upgrade_export each Saturday night on the log servers.
* Configure an automatic, nightly logswitch.
* Configure the organization's routine back up software to back up the switched logs every night.
The corporate IT change review committee decides your plan:
Fill in the blanks. To view the number of concurrent connections going through your firewall, you would use the command and syntax __ ___ __ __________ __ .
Fill in the blank. To verify the SecureXL status, you would enter command _____________ .
You run cphaprob -a if. When you review the output, you find the word DOWN. What does DOWN mean?
To qualify as an Identity Awareness enabled rule, which column MAY include an Access Role?
When do modifications to the Event Policy take effect?
Type the command and syntax you would use to verify that your Check Point cluster is functioning correctly.
How do you configure the Security Policy to provide user access to the Captive Portal through an external (Internet) interface?
What command syntax would you use to turn on PDP logging in a distributed environment?
Fill in the blank with a numeric value. The default port number for Secure Sockets Layer (SSL) connections with the LDAP Serveris
MultiCorp is running Smartcenter R71 on an IPSO platform and wants to upgrade to a new Appliance with R80. Which migration tool is recommended?
You have selected the event Port Scanfrom Internal Network in SmartEvent, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?
How could you compare the Fingerprint shown to the Fingerprint on the server? Run cpconfig and select:
Exhibit:
Match the ClusterXL modes with their configurations.
Exhibit:
MegaCorp is using SmartCenter Server with several gateways. Their requirements result in a heavy log load. Would it be feasible to add the SmartEvent Correlation Unit and SmartEvent Server to their SmartCenter Server?
How could you compare the Fingerprint shown to the Fingerprint on the server?
Exhibit:
Select the command set best used to verify proper failover function of a new ClusterXL configuration.
What is the valid range for VRID value in VRRP configuration?
The WebUIoffers several methods for downloading hotfixes via CPUSE except:
A Threat Prevention profile is aset of configurations based on the following. (Choose all that apply.)
What is the protocol and port used for Health Check and State Synchronization in ClusterXL?
You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores. How many cores can be used in a Cluster for Firewall-kernel on the new device?
What is not a component of Check Point SandBlast?
In SmartEvent, what are the different types of automatic reactions that the administrator can configure?
What CLI command compiles and installs a Security Policy on the target’s Security Gateways?
Check Point APIs allow system engineers and developers to make changes to their organization’s security policy with CLI tools and Web Services for all of the following except?
When synchronizing clusters, which of the following statements is FALSE?
True or False: SecureXL improves non-ecnrypted firewall traffic throughput and encrypted VPN traffic
throughput.
Which file is not in the $FWDIR directory collected by the CPInfo utility from the server?
Full synchronization between cluster members is handled by Firewall Kernel. Which port is used for this?
In a Client to Server scenario, which represents that the packet has already been checked against the tables and the Rule Base?
What processes does CPM control?
Which is a suitable command to check whether Drop Templates are activated or not?
What are the steps to configure the HTTPS Inspection Policy?
What is true of the API server on R80.10?
How do you enable virtual mac (VMAC) on-the-fly on a cluster member?
What are the main stages of a policy installation?
The essential means by which state synchronization works to provide failover in the event an active member goes down, ___________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.
Which command collects diagnostic data for analyzing customer setup remotely?
There are 4 ways to use the Management API for creating host object with R80 Management API. Which one is NOT correct?
Fill in the blank: The tool___________ generates a R80 Security Gateway configuration report.
After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?
What happens if the identity of a user is known?
John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimizemalware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19.
John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop with a static IP (10.0.0.19). He wants tomove around the organization and continue to have access to the HR Web Server.
To make this scenario work, the IT administrator:
1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources installs the policy.
2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.
What should John do when he cannot access the web server from a different personal computer?
What is the syntax foruninstalling a package using newpkg?
What is the primary benefit of using the command upgrade_export over either backup or snapshot?
Users with Identity Awareness Agent installed on their machines login with __________, so that when the user logs into thedomain, that information is also used to meet Identity Awareness credential requests.
Which Check Point address translation method is necessary if you want to connect from a host on the Internet via HTTP to a server with a reserved (RFC 1918) IP address on your DMZ?
How do you recover communications between your Security Management Server and Security Gateway if you lock yourself out through a rule or policy mis-configuration?
Which command line interface utility allows the administrator to verify the Security Policy name and timestamp currentlyinstalled on a firewall module?
Which of the following statements accurately describes the command snapshot?
Your users are defined in a Windows 2008 R2 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R80?
Your company is running Security Management Server R80 on GAiA, which has been migrated through each version starting from CheckPoint 4.1. How do you add a new administrator account?
The Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO). What is nota recommended usage of this method?
Which of the following is NOTdefined by an Access Role object?
You enable Automatic Static NAT on an internal host node object with a private IP address of 10.10.10.5, which is NATed into 216.216.216.5. (You use the default settings in Global Properties / NAT.)
When you run fw monitor on the R80 Security Gateway and then start a new HTTP connection from host 10.10.10.5 to browse the Internet, at what point in the monitor output will you observe the HTTP SYN-ACK packet translated from 216.216.216.5 back into 10.10.10.5?
What happens if the identity of a user is known?
Many companies have defined more than one administrator. To increase security, only one administrator should be able to install a Rule Base on a specificFirewall. How do you configure this?
You are MegaCorp’s Security Administrator. There are various network objects which must be NATed. Some ofthem use the Automatic Hide NAT method, while others use the Automatic Static NAT method. What is the rule order if both methods are used together? Give the BEST answer.
You are a Security Administrator who has installed Security Gateway R80 on your network. You need to allow a specific IP address range for a partner site to access your intranet Web server. To limit the partner’s access for HTTP and FTP only, you did the following:
1)Created manual Static NAT rules for the Web server.
2) Cleared the following settings in the Global Properties > Network Address Translation screen:
- Allow bi-directional NAT
- Translate destination on client side
Do the above settings limit the partner’s access?
Looking at the SYN packets in the Wireshark output, select the statement that is true about NAT.
How can you check whether IP forwarding is enabled on an IP Security Appliance?
An internal host initiates a session to the Google.com website and is set for Hide NAT behind the Security Gateway. The initiating traffic is an example of __________.
Match the followingcommands to their correct function.
Each command has one function only listed.
Where can you find the Check Point’s SNMP MIB file?
How are cached usernames and passwords cleared from the memory of a R80 Security Gateway?
Assume you are a Security Administrator for ABCTech. You have allowed authenticated access to users from Mkting_net to Finance_net. But in the user’s properties, connections are only permitted within Mkting_net. What is the BEST way to resolve this conflict?