Question1: The process _____ executes the authentication for logging in to SmartDashboard.
Question2: What is Check Point's CoreXL?
Question3: To help organize events, SmartReporter uses filtered queries. Which of the following is NOT an SmartEvent event property you can query?
Question4: SIMULATION
Fill in the blank. To verify SecureXL statistics, you would use the command _____.
Question5: When using migrate to upgrade a Secure Management Server, which of the following is included in the migration?
Question6: In a Cluster, some features such as VPN only function properly when:
Question7: How frequently does CPSIZEME run by default?
Question8: SIMULATION
Fill in the blank. The command that typically generates the firewall application, operating system, and hardware specific drivers is _____.
Question9: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend anytime outside a maintenance window?
Question10: SIMULATION
Type the full fw command and syntax that allows you to disable only sync on a cluster firewall member.
_____
Question11: If both domain-based and route-based VPN's are configured, which will take precedence?
Question12: You are troubleshooting a HTTP connection problem. You've started fw monitor -o http.pcap. When you open http.pcap with Wireshark there is only one line. What is the most likely reason?
Question13: What process manages the dynamic routing protocols (OSPF, RIP, etc.) on GAiA?
Question14: What is the purpose of the pre-defined exclusions included with SmartEvent R77?
Question15: The process _____ is responsible for the authentication for Remote Access clients.
Question16: Your primary Security Management Server runs on GAiA. What is the fastest way to back up your Security Gateway R77 configuration, including routing and network configuration files?
Question17: Which of the following does NOT happen when using Pivot Mode in ClusterXL?
Question18: In ClusterXL, _____ is defined by default as a critical device.
Question19: Restoring a snapshot-created file on one machine that was created on another requires which of the following to be the same on both machines?
Question20: Does Check Point recommend generating an upgrade_export on standby SmartCenters?
Question21: SIMULATION
Fill in the blank. In Load Sharing Unicast mode, the internal cluster IP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2. Internal host 10.4.8.108 Pings 10.4.8.3, and receives replies. The following is the ARP table from the internal Windows host 10.4.8.108.
Review the exhibit and type the IP address of the member serving as the pivot machine in the space below.
_____
Question22: MegaCorp is running Smartcenter R70, some Gateways at R65 and some other Gateways with R60.
Management wants to upgrade to the most comprehensive IPv6 support. What should the administrator do first?
Question23: In Gaia, the operating system can be changed to 32-bit or 64-bit, provided the processor supports 64-bit.
What command toggles to 64-bit.
Question24: SIMULATION
Type the command and syntax that you would use to view the virtual cluster interfaces of a ClusterXL environment.
_____
Question25: The process _____ complies $FWDIR/CONF/*.W files into machine language.
Question26: The SmartEvent Correlation Unit:
Question27: If you are experiencing LDAP issues, which of the following should you check?
Question28: _____ generates a SmartEvent Report from its SQL database.
Question29: SIMULATION
Type the full fw command and syntax that will show full synchronization status.
_____
Question30: Which process should you debug if SmartDashboard login fails?
Question31: You find that Gateway fw2 can NOT be added to the cluster object.
What are possible reasons for that?
1) fw2 is a member in a VPN community.
2) ClusterXL software blade is not enabled on fw2.
3) fw2 is a DAIP Gateway.
Question32: Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?
Question33: What is the primary benefit of using upgrade_export over either backup or snapshot?
Question34: When using Captive Portal to send unidentified users to a Web portal for authentication, which of the following is NOT a recommended use for this method?
Question35: To run GAiA in 64bit mode, which of the following is true?
1) Run set edition default 64-bit.
2) Install more than 4 GB RAM.
3) Install more than 4 TB of Hard Disk.
Question36: Which components allow you to reset a VPN tunnel?
Question37: You want to upgrade a cluster with two members to R77. The Security Management Server and both members are version NGX R65, with the latest Hotfix Accumulator. What is the correct upgrade procedure?
1) Change the version in the General Properties of the Gateway-cluster object.
2) Upgrade the Security Management Server, and reboot.
3) Run cpstop on one member, while leaving the other member running. Upgrade one member at a time and reboot after upgrade.
4) Install the Security Policy.
Question38: Check Point Clustering protocol, works on:
Question39: The connection to the ClusterXL member 'A' breaks. The ClusterXL member 'A' status is now 'down'.
Afterwards the switch admin set a port to ClusterXL member 'B' to 'down'. What will happen?
Question40: How many pre-defined exclusions are included by default in SmartEvent R77 as part of the product installation?
Question41: Which of the following log files contains verbose information regarding the negotiation process and other encryption failures?
Question42: When upgrading a cluster in Full Connectivity Mode, the first thing you must do is see if all cluster members have the same products installed. Which command should you run?
Question43: Which of the following is a valid Active Directory designation for user Jane Doe in the MIS department of AcmeCorp.com?
Question44: Which command would you use to save the routing information before upgrading a Windows Gateway?
Question45: How do you check the version of "CPSIZEME" on GAiA?
Question46: There are several SmartDirectory (LDAP) features that can be applied to further enhance SmartDirectory (LDAP) functionality, which of the following is NOT one of those features?
Question47: Which of the following statements accurately describes the migrate command?
Question48: When synchronizing clusters, which of the following statements is NOT true?
Question49: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question50: MEP VPN's use the Proprietary Probing Protocol to send special UDP RDP packets to port ____ to discover if an IP is accessible.
Question51: SIMULATION
Fill in the blank. To verify that a VPN Tunnel is properly established, use the command _____.
Question52: Which of the following is NOT an advantage of SmartLog?
Question53: You have pushed a policy to your firewall and you are not able to access the firewall. What command will allow you to remove the current policy from the machine?
Question54: In a Check Point gateway cluster, are VRRP and ClusterXL mutually exclusive?
Question55: You can NOT use SmartDashboard's SmartDirectory features to connect to the LDAP server.
What should you investigate?
1) Verify you have read-only permissions as administrator for the operating system.
2) Verify there are no restrictions blocking SmartDashboard's User Manager from connecting to the LDAP server.
3) Check that the login Distinguished Name configured has at least write permission in the access control configuration of the LDAP server.
Question56: In which case is a Sticky Decision Function relevant?
Question57: A Minimal Effort Upgrade of a cluster:
Question58: Which of the following is NOT a LDAP server option in SmartDirectory?
Question59: When troubleshooting user authentication, you may see the following entries in a debug of the user authentication process. In which order are these messages likely to appear?
Question60: Which file defines the fields for each object used in the file objects.C (color, num/string, default value...)?
Question61: SIMULATION
Fill in the blank. To save your OSPF configuration in GAiA, enter the command _____.
Question62: In a UNIX environment, SmartReporter Data Base settings could be modified in:
Question63: Check Point New Mode HA is a(n) _____ solution.
Question64: Which command would you use to save the interface information before upgrading a GAiA Gateway?
Question65: Lilly has generated an IKE debug on her Security Gateway. She has asked Jack to transfer the file to Support. Where is the file located?
Question66: What is the correct policy installation process order?
1) Verification
2) Code generation and compilation
3) Initiation
4) Commit
5) Conversion
6) CPTA
Question67: What are the 3 main components of the SmartEvent Software Blade?
1) Correlation Unit
2) Correlation Client
3) Correlation Server
4) Analyzer Server
5) Analyzer Client
6) Analyzer Unit
Question68: Which command would you use to save the IP address and routing information before upgrading a GAiA Gateway?
Question69: How would you set the debug buffer size to 1024?
Question70: Which is NOT a method through which Identity Awareness receives its identities?
Question71: What GUI client would you use to view an IPS packet capture?
Question72: When distributing IPSec packets to gateways in a Load Sharing Multicast mode cluster, which valid Load Sharing method will consider VPN information?
Question73: How do you run "CPSIZEME" on SPLAT?
Question74: Which describes the function of the account unit?
Question75: MicroCorp experienced a security appliance failure. (LEDs of all NICs are off.) The age of the unit required that the RMA-unit be a different model. Will a revert to an existing snapshot bring the new unit up and running?
Question76: Which of the following statements is TRUE concerning MEP VPN's?
Question77: What is the benefit to running SmartEvent in Learning Mode?
Question78: Paul has just joined the MegaCorp security administration team. Natalie, the administrator, creates a new administrator account for Paul in SmartDashboard and installs the policy. When Paul tries to login it fails.
How can Natalie verify whether Paul's IP address is predefined on the security management server?
Question79: The "MAC Magic" value must be modified under the following condition:
Question80: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question81: Which process is responsible for kernel table information sharing across all cluster members?
Question82: The User Directory Software Blade is used to integrate which of the following with a R77 Security Gateway?
Question83: Your R7x-series Enterprise Security Management Server is running abnormally on Windows Server 2008 R2. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings intact (i.e., all Security Policies, databases, SIC, licensing etc.) What is the BEST method to reinstall the Server and keep its critical configuration?
Question84: Which type of VPN routing relies on a VPN Tunnel Interface (VTI) to route traffic?
Question85: By default, what happens to the existing connections on a firewall when a new policy is installed?
Question86: For Management High Availability synchronization, what does the Advance status mean?
Question87: Katie has enabled User Directory and applied the license to Security Management Server, Green. Her supervisor has asked her to configure the Password Strength options of the least one digit, one symbol, 8 characters long and include an uppercase character. How should she accomplish this?
Question88: Which of the following is NOT a SmartEvent Permission Profile type?
Question89: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend every couple of months, depending on how frequently you make changes to the network or policy?
Question90: You are trying to configure Directional VPN Rule Match in the Rule Base. But the Match column does not have the option to see the Directional Match. You see the following window. What must you enable to see the Directional Match?
Exhibit:
Question91: Fred is troubleshooting a NAT issue and wants to check to see if the inbound connection from this internal network is being translated across the interface in the firewall correctly. He decides to use the fw monitorto capture the traffic from the source 192.168.3.5 or the destination of 10.1.1.25 on his Security Gateway. Green that has an IP of 192.168.4.5. What command captures this traffic in a file that he can download and review with WireShark?
Question92: In GAiA, if one is unsure about a possible command, what command lists all possible commands.
Question93: Review the cphaprob state command output from one New Mode High Availability ClusterXL member.
Which member will be active after member 192.168.1.2 fails over and is rebooted?
Question94: Your company has the requirement that SmartEvent reports should show a detailed and accurate view of network activity but also performance should be guaranteed. Which actions should be taken to achieve that?
1) Use same hard drive for database directory, log files, and temporary directory.
2) Use Consolidation Rules.
3) Limit logging to blocked traffic only.
4) Use Multiple Database Tables.
Question95: An Account Unit is the interface between the _____ and the _____.
Question96: Review the Rule Base displayed.
For which rules will the connection templates be generated in SecureXL?
Question97: In SmartDirectory, what is each LDAP server called?
Question98: Which of the following is NOT a valid way to view interface's IP address settings in GAiA?
Question99: Which statements about Management HA are correct?
1) Primary SmartCenter describes first installed SmartCenter
2) Active SmartCenter is always used to administrate with SmartConsole
3) Active SmartCenter describes first installed SmartCenter
4) Primary SmartCenter is always used to administrate with SmartConsole
Question100: CPD is a core Check Point process that does all of the following EXCEPT:
Question101: You are the MegaCorp Security Administrator. This company uses a firewall cluster, consisting of two cluster members. The cluster generally works well but one day you find that the cluster is behaving strangely. You assume that there is a connectivity problem with the cluster synchronization link (cross-over cable). Which of the following commands is the BEST for testing the connectivity of the crossover cable?
Question102: What is the reason for the following error?
Exhibit:
Question103: Anytime a client initiates a connection to a server, the firewall kernel signals the FWD process using a trap.
FWD spawns the _____ child service, which runs the security server.
Question104: If Jack was concerned about the number of log entries he would receive in the SmartReporter system, which policy would he need to modify?
Question105: Exhibit:
What cluster mode is represented in this case?
Question106: While authorization for users managed by SmartDirectory is performed by the gateway, the authentication mostly occurs in _____.
Question107: When an Endpoint user is able to authenticate but receives a message from the client that it is unable to enforce the desktop policy, what is the most likely scenario?
Question108: Which SmartReporter report type is generated from the SmartView Monitor history file?
Question109: A connection is said to be Sticky when:
Question110: Which three of the following are ClusterXL member requirements?
1) same operating systems
2) same Check Point version
3) same appliance model
4) same policy
Question111: _____ is a proprietary Check Point protocol. It is the basis for Check Point ClusterXL inter-module communication.
Question112: What access level cannot be assigned to an Administrator in SmartEvent?
Question113: When using SmartDashboard to manage existing users in SmartDirectory, when are the changes applied?
Question114: A customer called to report one cluster member's status as Down. What command should you use to identify the possible cause?
Question115: SIMULATION
The command useful for debugging by capturing packet information, including verifying LDAP authentication on all Check Point platforms is
_____
Question116: Security server configuration settings are stored in _____.
Question117: Jon is explaining how the inspection module works to a colleague. If a new connection passes through the inspection module and the packet matches the rule, what is the next step in the process?
Question118: When configuring a Permanent Tunnel between two gateways in a Meshed VPN community, in what object is the tunnel managed?
Question119: Select the command set best used to verify proper failover function of a new ClusterXL configuration.
Question120: Which command will only show the number of entries in the connection table?
Question121: To back up all events stored in the SmartEvent Server, you should back up the contents of which folder(s)?
Question122: When using a template to define a user in SmartDirectory, the user's password should be defined in the
_____ object.
Question123: _____ is NOT a ClusterXL mode.
Question124: To clean the system of all SmartEvent events, you should delete the files in which folder(s)?
Question125: SIMULATION
Write the full fw command and syntax that you would use to troubleshoot ClusterXL sync issues.
_____
Question126: When migrating the SmartEvent data base from one server to another, the last step is to save the files on the new server. Which of the following commands should you run to save the SmartEvent data base files on the new server?
Question127: SIMULATION
Fill in the blank with a numeric value. The default port number for standard TCP connections with the LDAP server is
_____
Question128: SIMULATION
Type the command and syntax you would use to verify that your Check Point cluster is functioning correctly.
_____
Question129: If you need strong protection for the encryption of user data, what option would be the BEST choice?
Question130: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question131: By default, a standby Security Management Server is automatically synchronized by an active Security Management Server, when:
Question132: If using AD Query for seamless identity data reception from Microsoft Active Directory (AD), which of the following methods is NOT Check Point recommended?
Question133: In which ClusterXL Load Sharing mode, does the pivot machine get chosen automatically by ClusterXL?
Question134: When restoring a Security Management Server from a backup file, the restore package can be retrieved from which source?
Question135: You want VPN traffic to match packets from internal interfaces. You also want the traffic to exit the Security Gateway bound for all site-to-site VPN Communities, including Remote Access Communities. How should you configure the VPN match rule?
Question136: The _____ Check Point ClusterXL mode must synchronize the virtual IP and MAC addresses on all clustered interfaces.
Question137: Match the ClusterXL modes with their configurations.
Exhibit:
Question138: Check Point support has asked Tony for a firewall capture of accepted packets. What would be the correct syntax to create a capture file to a filename called monitor.out?
Question139: What is the behavior of ClusterXL in a High Availability environment?
Question140: What is the most common cause for a Quick mode packet 1 failing with the error "No Proposal Chosen" error?
Question141: You are preparing computers for a new ClusterXL deployment. For your cluster, you plan to use four machines with the following configurations:
Cluster Member 1: OS - GAiA; NICs - QuadCard; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 2: OS - GAiA; NICs - 4 Intel 3Com; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 3: OS - GAiA; NICs - 4 other manufacturers; Memory: 512 MB; Security Gateway only, version: R77
Security Management Server: MS Windows 2008; NIC - Intel NIC (1); Security Gateway and primary Security Management Server installed, version: R77
Are these machines correctly configured for a ClusterXL deployment?
Question142: SIMULATION
Fill in the blank. To verify the SecureXL status, you would enter command _____.
Question143: If the number of kernel instances for CoreXL shown is 6, how many cores are in the physical machine?
Question144: Exhibit:
What cluster mode is represented in this case?
Question145: MegaCorps' disaster recovery plan is past due for an update to the backup and restore section to enjoy the benefits of the new distributed R77 installation. You must propose a plan that meets the following required and desired objectives:
Required: Security Policy repository must be backed up no less frequently than every 24 hours.
Desired: Back up R77 components enforcing the Security Policies at least once a week.
Desired: Back up R77 logs at least once a week.
You develop a disaster recovery plan proposing the following:
Use the utility cron to run the command upgrade_export each night on the Security Management
Servers.
Configure the organization's routine backup software to back up files created by the command
upgrade_export.
Configure GAiA back up utility to back up Security Gateways every Saturday night.
Use the utility cron to run the command upgrade_export each Saturday night on the log servers.
Configure an automatic, nightly logswitch.
Configure the organization's routine back up software to back up the switched logs every night.
The corporate IT change review committee decides your plan:
Question146: What SmartConsole application allows you to change the SmartReporter Policy?
Question147: Control connections between the Security Management Server and the Gateway are not encrypted by the VPN Community. How are these connections secured?
Question148: _____ is the called process that starts when opening SmartView Tracker application.
Question149: Included in the customer's network are some firewall systems with the Performance Pack in use. The customer wishes to use these firewall systems in a cluster (Load Sharing mode). He is not sure if he can use the Sticky Decision Function in this cluster. Explain the situation to him.
Question150: What is used to validate a digital certificate?
Question151: SIMULATION
Complete this statement. To save interface information before upgrading a Windows Gateway, use command
_____
Question152: For Management High Availability, if an Active SMS goes down, does the Standby SMS automatically take over?
Question153: A Zero Downtime Upgrade of a cluster:
Question154: The SmartEvent Client:
Question155: Which protocol can be used to provide logs to third-party reporting?
Question156: Where multiple SmartDirectory servers exist in an organization, a query from one of the clients for user information is made to the servers based on a priority. By what category can this priority be defined?
Question157: Which two processes are responsible on handling Identity Awareness?
Question158: Which of the following is the preferred method for adding static routes in GAiA?
Question159: SIMULATION
Fill in the blank. To remove site-to-site IKE and IPSEC keys you would enter command _____ _____ and select the option to delete all IKE and IPSec SA's.
Question160: Which of the following is NOT a valid way to view interface's IP address settings in GAiA?
Question161: How do you verify the Check Point kernel running on a firewall?
Question162: The SmartEvent Server:
Question163: By default Check Point High Availability components send updates about their state every:
Question164: The customer wishes to install a cluster. In his network, there is a switch which is incapable of forwarding multicast. Is it possible to install a cluster in this situation?
Question165: You have configured a site to site VPN but the tunnel in not coming up. Review the following screen shots.
What is a likely cause?
Question166: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question167: The process that performs the authentication for legacy session authentication is:
Question168: If ClusterXL Load Sharing is enabled with state synchronization enabled, what will happen if one member goes down?
Question169: When Load Sharing Multicast mode is defined in a ClusterXL cluster object, how are packets being handled by cluster members?
Question170: A Full Connectivity Upgrade of a cluster:
Question171: John is upgrading a cluster from NGX R65 to R77. John knows that you can verify the upgrade process using the pre-upgrade verifier tool. When John is running Pre-Upgrade Verification, he sees the warning message:
Title: Incompatible pattern.
What is happening?
Question172: Which of the following is NOT a feature of ClusterXL?
Question173: When using ClusterXL in Load Sharing, what is the default sharing method based on?
Question174: Which Check Point ClusterXL mode is used to synchronize the physical interface IP and MAC addresses on all clustered interfaces.
Question175: SIMULATION
Fill in the blank with a numeric value. The default port number for Secure Sockets Layer (SSL) connections with the LDAP Server is
_____
Question176: SIMULATION
In a zero downtime scenario, which command do you run manually after all cluster members are upgraded?
_____
Question177: Which command will erase all CRL's?
Question178: Which of the following commands do you run on the AD server to identify the DN name before configuring LDAP integration with the Security Gateway?
Question179: A tracked SmartEvent Candidate in a Candidate Pool becomes an Event. What does NOT happen in the Analyzer Server?
Question180: Which of the following is NOT an internal/native Check Point command?
Question181: With the User Directory Software Blade, you can create R77 user definitions on a(n) _____ Server.
Question182: Remote clients are using SSL VPN to authenticate via LDAP server to connect to the organization. Which gateway process is responsible for the authentication?
Question183: Choose the ClusterXL process that is defined be default as a critical device?
Question184: When do modifications to the Event Policy take effect?
Question185: When synchronizing clusters, which of the following statements is NOT true?
Question186: If no flags are defined during a back up on the Security Management Server, where does the system store the *.tgz file?
Question187: Which method of load balancing describes "Round Robin"?
Question188: What is NOT a valid LDAP use in Check Point SmartDirectory?
Question189: Check Point recommends that you back up systems running Check Point products. Run your back ups during maintenance windows to limit disruptions to services, improve CPU usage, and simplify time allotment. Which back up method does Check Point recommend before major changes, such as upgrades?
Question190: What type of object may be explicitly defined as a MEP VPN?
Question191: A ClusterXL configuration is limited to _____ members.
Question192: The file snapshot generates is very large, and can only be restored to:
Question193: Where do you define NAT properties so that NAT is performed either client side or server side? In SmartDashboard under:
Question194: Use the table to match the BEST Management High Availability synchronication-status descriptions for your Security Management Server (SMS).
Question195: SmartReporter reports can be used to analyze data from a penetration-testing regimen in all of the following examples, EXCEPT:
Question196: Review the cphaprob state command output from a New Mode High Availability cluster member. Which machine has the highest priority?
Exhibit:
Question197: SIMULATION
Fill in the blank. In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. The internal interfaces on two members are 10.4.8.1 and 10.4.8.2 Internal host 10.4.8.108 pings 10.4.8.3, and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. According to the output, which member is the standby machine?
_____
Question198: You have a High Availability ClusterXL configuration. Machines are not synchronized. What happens to connections on failover?
Question199: SIMULATION
Fill in the blank. What is the correct command and syntax used to view a connection table summary on a Check Point Firewall?
_____
Question200: Which statement defines Public Key Infrastructure? Security is provided:
Question201: Included in the client's network are some switches, which rely on IGMP snooping. You must find a solution to work with these switches. Which of the following answers does NOT lead to a successful solution?
Question202: Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
Which of the following is NOT a recommended use for this method?
Question203: SIMULATION
Fill in the blank. To enter the router shell, use command _____.
Question204: Remote clients are using IPSec VPN to authenticate via LDAP server to connect to the organization.
Which gateway process is responsible for the authentication?
Question205: Which load-balancing method below is NOT valid?
Question206: Select the right answer to export IPS profiles to copy to another management server?
Question207: SIMULATION
Type the full cphaprob command and syntax that will show full synchronization status.
_____
Question208: You need to back up the routing, interface, and DNS configuration information from your R77 GAiA Security Gateway. Which backup-and-restore solution do you use?
Question209: Which command would you use to save the interface information before upgrading a GAiA Gateway?
Question210: When defining SmartDirectory for High Availability (HA), which of the following should you do?
Question211: At what router prompt would you save your OSPF configuration?
Question212: Check Point New Mode HA is a(n) _____ solution.
Question213: What is the supported ClusterXL configuration when configuring a cluster synchronization network on a VLAN interface?
Question214: A snapshot delivers a complete backup of GAiA. How do you restore a local snapshot named MySnapshot.tgz?
Question215: What can you do to see the current number of kernel instances in a system with CoreXL enabled?
Question216: Which specific R77 GUI would you use to view the length of time a TCP connection was open?
Question217: Which of the following is NOT accelerated by SecureXL?
Question218: After Travis added new processing cores on his server, CoreXL did not use them. What would be the most plausible reason why? Travis did not:
Question219: MegaCorp plans to upgrade all of its firewalls. Currently the corporation is a mixture of SecurePlatform and IPSO machines running R71, to the latest code level of GAiA. Many of the firewalls are using VTIs to allow advanced routing configuration to propagate through all the networks. What will the Acme company need to do to make sure VTIs will work once moved to GAiA?
Question220: MultiCorp is running Smartcenter R71 on an IPSO platform and wants to upgrade to a new Appliance with R77. Which migration tool is recommended?
Question221: A customer calls saying that a Load Sharing cluster shows drops with the error First packet is not SYN.
Complete the following sentence. You will recommend:
Question222: How does Check Point recommend that you secure the sync interface between gateways?
Question223: Which of the following statements is TRUE concerning MEP VPN's?
Question224: If Bob wanted to create a Management High Availability configuration, what is the minimum number of Security Management servers required in order to achieve his goal?
Question225: Which CLI tool helps on verifying proper ClusterXL sync?
Question226: Which statement is TRUE for route-based VPN's?
Question227: Which of the following is a valid Active Directory designation for user John Doe in the Sales department of AcmeCorp.com?
Question228: Choose the BEST sequence for configuring user management in SmartDashboard, using an LDAP server.
Question229: Review the R77 configuration. Is it correct for Management High Availability?
Exhibit:
Question230: Which three of the following components are required to get a SmartEvent up and running?
1) SmartEvent SIC
2) SmartEvent Correlation Unit
3) SmartEvent Server
4) SmartEvent Analyzer
5) SmartEvent Client
Question231: Which component receives events and assigns severity levels to the events; invokes any defined automatic reactions, and adds the events to the Events Data Base?
Question232: A Threat Prevention profile is a set of configurations based on the following. Select the right answer.
Question233: By default, the Cluster Control Protocol (CCP) uses this to send delta sync messages to other cluster members.
Question234: The process _____ is responsible for Policy compilation.
Question235: What is a requirement for setting up R77 Management High Availability?
Question236: John is configuring a new R77 Gateway cluster but he can not configure the cluster as Third Party IP Clustering because this option is not available in Gateway Cluster Properties. What's happening?
Exhibit:
Question237: Organizations are sometimes faced with the need to locate cluster members in different geographic locations that are distant from each other. A typical example is replicated data centers whose location is widely separated for disaster recovery purposes. What are the restrictions of this solution?
Question238: User definitions are stored in _____.
Question239: Which Check Point tool allows you to open a debug file and see the VPN packet exchange details.
Question240: Which of the following is NOT part of the policy installation process?
Question241: You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities should you do first?
Question242: How do you enable SecureXL (command line) on GAiA?
Question243: Which of the following is a supported Sticky Decision Function of Sticky Connections for Load Sharing?
Question244: Exhibit:
From the following output of cphaprob state, which ClusterXL mode is this?
Question245: What is the SmartEvent Analyzer's function?
Question246: When, during policy installation, does the atomic load task run?
Question247: Which of the following access options would you NOT use when configuring Captive Portal?
Question248: SIMULATION
Fill in the blanks. To view the number of concurrent connections going through core 0 on the firewall, you would use the command and syntax _____ _____ _____ _____ _____ _____ _____.
Question249: You are establishing a ClusterXL environment, with the following topology:
VIP internal cluster IP = 172.16.10.3; VIP external cluster IP = 192.168.10.3 Cluster Member 1: 4 NICs, 3 enableD. hme0: 192.168.10.1/24, hme1: 10.10.10.1/24, qfe2: 172.16.10.1/24 Cluster Member 2: 5 NICs, 3 enabled; hme3: 192.168.10.2/24, hme1: 10.10.10.2/24, hme2:
172.16.10.2/24
External interfaces 192.168.10.1 and 192.168.10.2 connect to a VLAN switch. The upstream router connects to the same VLAN switch. Internal interfaces 172.16.10.1 and 172.16.10.2 connect to a hub.
10.10.10.0 is the synchronization network. The Security Management Server is located on the internal network with IP 172.16.10.3. What is the problem with this configuration?
Question250: Typically, when you upgrade the Security Management Server, you install and configure a fresh R77 installation on a new computer and then migrate the database from the original machine.
What is the correct order of the steps below to successfully complete this procedure?
1) Export databases from source.
2) Connect target to network.
3) Prepare the source machine for export.
4) Import databases to target.
5) Install new version on target.
6) Test target deployment.
Question251: What step should you take before running migrate_export?
Question252: Which of the following is TRUE concerning unnumbered VPN Tunnel Interfaces (VTIs)?
Question253: Which of the following log files contains only information about the negotiation process for encryption?
Question254: By default, what happens to the existing connections on a firewall when a new policy is installed?
Question255: Your users are defined in a Windows 2008 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R77?
Question256: Which Check Point product is used to create and save changes to a Log Consolidation Policy?
Question257: SIMULATION
Type the command and syntax to view critical devices on a cluster member in a ClusterXL environment.
_____
Question258: Which of the following is TRUE concerning numbered VPN Tunnel Interfaces (VTIs)?
Question259: An organization may be distributed across several SmartDirectory (LDAP) servers. What provision do you make to enable a Gateway to use all available resources?
Each SmartDirectory (LDAP) server must be:
Question260: What process is responsible for transferring the policy file from SmartCenter to the Gateway?
Question261: A VPN Tunnel Interface (VTI) is defined on GAiA as:
vpn shell interface add numbered 10.10.0.1 10.10.0.2 madrid.cp
What do you know about this VTI?
Question262: You run cphaprob -a if. When you review the output, you find the word DOWN. What does DOWN mean?
Question263: Which of the following services will cause SecureXL templates to be disabled?
Question264: What is the SmartEvent Client's function?
Question265: During a Security Management Server migrate export, the system:
Question266: Which of the following CLISH commands would you use to set the admin user's shell to bash?
Question267: You have just upgraded your Load Sharing gateway cluster (both members) from NGX R65 to R77.
cphaprob stat shows:
Cluster Mode: New High Availability (Active Up)
Member Unique Address Assigned Load State
1 (local) 172.16.185.21 100% Active
2 172.16.185.22 0% Ready
Which of the following is NOT a possible cause of this?
Question268: The process _____ is responsible for all other security server processes run on the Gateway.
Question269: How many Events can be shown at one time in the Event preview pane?
Question270: If your firewall is performing a lot of IPS inspection and the CPUs assigned to fw_worker_thread are at or near 100%, which of the following could you do to improve performance?
Question271: An administrator has installed the latest HFA on the system for fixing traffic problems after creating a backup file. A large number of routes were added or modified, causing network problems. The Check Point configuration has not been changed. What would be the most efficient way to revert to a working configuration?
Question272: SIMULATION
To provide full connectivity upgrade status, use command _____
Question273: Frank is concerned with performance and wants to configure the affinities settings. His gateway does not have the |Performance pack running. What would Frank need to perform in order configure those settings?
Question274: A SmartProvisioning Gateway could be a member of which VPN communities?
1) Center in Star Topology
2) Satellite in Star Topology
3) Center in Remote Access Community
4) Meshed Community
Question275: Steve is troubleshooting a connection problem with an internal application. If he knows the source IP address is 192.168.4.125, how could he filter this traffic?
Question276: Each entry in SmartDirectory has a unique _____.
Question277: The SmartEvent Correlation Unit:
Question278: In a Windows environment, SmartReporter Data Base settings could be modified in:
Question279: MegaCorp has two different types of hardware with Check Point GAiA installed and set up as gateways.
The Administrator wants to provide redundancy in case one of them fails. Choose the best approach.
Question280: Where is it necessary to configure historical records in SmartView Monitor to generate Express reports in SmartReporter?
Question281: The process _____ is responsible for Management High Availability synchronization.
Question282: How can you disable SecureXL via the command line (it does not need to survive a reboot)?
Question283: VPN routing can also be configured by editing which file?
Question284: You are preparing computers for a new ClusterXL deployment. For your cluster, you plan to use three machines with the following configurations:
Cluster Member 1: OS - GAiA; NICs - QuadCard; Memory - 1 GB; Security Gateway - version: R71 and primary Security Management Server installed, version: R77
Cluster Member 2: OS - GAiA; NICs - 4 Intel 3Com; Memory - 1 GB; Security Gateway only, version: R77 Cluster Member 3: OS - GAiA; NICs - 4 other manufacturers; Memory - 512 MB; Security Gateway only, version: R77
Are these machines correctly configured for a ClusterXL deployment?
Question285: What is the proper CLISH syntax to configure a default route via 192.168.255.1 in GAiA?
Question286: Can the smallest appliance handle all Blades simultaneously?
Question287: The process _____ is responsible for GUIClient communication with the SmartCenter.
Question288: SIMULATION
Fill in the blank. You can set Acceleration to ON or OFF using command syntax _____.
Question289: The SmartEvent Server:
Question290: The set of rules that governs the types of objects in the directory and their associated attributes is called the:
Question291: What utility would you use to configure route-based VPNs?
Question292: You are reviewing computer information collected in ClientInfo. You can NOT:
Question293: What firewall kernel table stores information about port allocations for Hide NAT connections?
Question294: When a packet is flowing through the security gateway, which one of the following is a valid inspection path?
Question295: SIMULATION
In a zero downtime firewall cluster environment, what command syntax do you run to avoid switching problems around the cluster for command cphaconf?
_____
Question296: What could be a reason why synchronization between primary and secondary Security Management Servers does not occur?
Question297: What is the proper command for importing users into the R77 User Database?
Question298: You have selected the event Port Scan from Internal Network in SmartEvent, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?
Question299: The CoreXL SND (Secure Network Distributor) is responsible for:
Question300: Can you implement a complete R77 IPv6 deployment without IPv4 addresses?
Question301: Where do you verify that SmartDirectory is enabled?
Question302: How do new connections get established through a Security Gateway with SecureXL enabled?
Question303: Which is the lowest Gateway version manageable by SmartCenter R77?
Question304: SIMULATION
Fill in the blanks. To view the number of concurrent connections going through your firewall, you would use the command and syntax _____ _____ _____ _____ _____.
Question305: When a failed cluster member recovers, which of the following actions is NOT taken by the recovering member?
Question306: MegaCorp is using SmartCenter Server with several gateways. Their requirements result in a heavy log load. Would it be feasible to add the SmartEvent Correlation Unit and SmartEvent Server to their SmartCenter Server?
Question307: SIMULATION
MultiCorp is located in Atlanta. It has a branch office in Europe, Asia, and Africa. Each location has its own AD controller for local user login. How many ADqueries have to be configured?
Question308: When configuring an LDAP Group object, select the option _____ if you want the gateway to reference all groups defined on the LDAP server for authentication purposes.
Question309: What does the command vpn crl_zap do?
Question310: Which of the following statements is TRUE concerning MEP VPN's?
Question311: The challenges to IT involve deployment, security, management, and what else?
Question312: SIMULATION
Fill in the blank. In New Mode HA, the internal cluster IP VIP address is 10.4.8.3. An internal host
10.4.8.108 successfully pings its Cluster and receives replies.
Review the ARP table from the internal Windows host 10.4.8.108. Based on this information, what is the active cluster member's IP address?
_____
Question313: The process _____ provides service to access the GAIA configuration database.
Question314: Which of the following methods will provide the most complete backup of an R77 configuration?
Question315: Which process is responsible for delta synchronization in ClusterXL?
Question316: How do you verify a VPN Tunnel Interface (VTI) is configured properly?
Question317: The process that performs the authentication for SSL VPN Users is:
Question318: In Management High Availability, what is an Active SMS?
Question319: Which process is responsible for full synchronization in ClusterXL?
Question320: MultiCorp has bought company OmniCorp and now has two active AD domains. How would you deploy Identity Awareness in this environment?
Question321: Match the VPN-related terms with their definitions. Each correct term is only used once.
Exhibit:
Question322: How do you upload the results of "CPSIZEME" to Check Point when using a PROXY server with authentication?
Question323: What is the SmartEvent Correlation Unit's function?
Question324: _____ is NOT an SmartEvent event-triggered Automatic Reaction.
Question325: What process manages the dynamic routing protocols (OSPF, RIP, etc.) on GAiA?
Question326: The SmartEvent Correlation Unit:
Question327: After you add new interfaces to a cluster, how can you check if the new interfaces and the associated virtual IP address are recognized by ClusterXL?
Exhibit:
Question328: When restoring R77 using the command upgrade_import, which of the following items are NOT restored?
Question329: The following graphic illustrates which command being issued on GaiA?
Exhibit:
Question330: Which Check Point product implements a Consolidation Policy?
Question331: Which of the following would be a result of having more than one active Security Management Server in a Management High Availability (HA) configuration?
Question332: There are times when you want to use Link Selection to manage high-traffic VPN connections. With Link Selection you can:
Question333: When configuring an LDAP Group object, select option _____ if you want the gateway to reference a specific group defined on the LDAP server for authentication purposes.
Question334: How could you compare the Fingerprint shown to the Fingerprint on the server? Run cpconfig and select:
Exhibit:
Question335: What is a Sticky Connection?
Question336: SIMULATION
To stop acceleration on a GAiA Security Gateway, enter command:
_____
Question337: What configuration change must you make to change an existing ClusterXL cluster object from Multicast to Unicast mode?
Question338: _____ manages Standard Reports and allows the administrator to specify automatic uploads of reports to a central FTP server.
Question339: SIMULATION
To bind a NIC to a single processor when using CoreXL on GAiA, you would use the command
_____
Question340: What is the offline CPSIZEME upload procedure?
Question341: You configure a Check Point QoS Rule Base with two rules: an HTTP rule with a weight of 40, and the Default Rule with a weight of 10. If the only traffic passing through your QoS Module is HTTP traffic, what percent of bandwidth will be allocated to the HTTP traffic?
Question342: Which of the following statements is TRUE concerning MEP VPN's?
Question343: What is the best tool to produce a report which represents historical system information?