CCSE-2

What is the purpose of the command "ps aux | grep fwd"?

• You can check the Process ID and the processing time of the fwd process.

• You can convert the log file into Post Script format.

• You can list all Process IDs for all running services.

• You can check whether the IPS default setting is set to Detect or Prevent mode.

What is the command switch to specify the Gaia API context?

• You have to specify it in the YAML file api.yml which is located underneath the /etc directory of the security management server

• You have to change to the zsh-Shell which defaults to the Gaia API context.

• No need to specify a context, since it defaults to the Gaia API context.

• mgmt_cli --context gaia_api <Command>

What are the two types of tests when using the Compliance blade?

• Policy-based tests and Global properties

• Global tests and Object-based tests

• Access Control policy analysis and Threat Prevention policy analysis

• Tests conducted based on the IoC XML file and analysis of SOLR documents

Besides fw monitor, what is another command that can be used to capture packets?

• arp

• traceroute

• tcpdump

• ping

When performing a minimal effort upgrade, what will happen to the network traffic?

• All connections that were initiated before the upgrade will be dropped, causing network downtime.

• All connections that were initiated before the upgrade will be handled by the active gateway

• All connections that were initiated before the upgrade will be handled normally

• All connections that were initiated before the upgrade will be handled by the standby gateway

Using fw monitor you see the following inspection point notion E and i what does that mean?

• E shows the packet before the VPN encryption, i after the inbound firewall VM

• E shows the packet reaching the external interface, i leaving the internal interface

• E shows the packet after the VPN encryption, i before the inbound firewall VM

• E shows the packet leaving the external interface, i reaching the internal interface

You have used the SmartEvent GUI to create a custom Event policy. What is the best way to display the correlated Events generated by SmartEvent Policies?

• Open SmartView Monitor and select the SmartEvent Window from the main menu.

• In the SmartConsole / Logs & Monitor --> open the Logs View and use type: Correlated as query filter.

• In the SmartConsole / Logs & Monitor -> open a new Tab and select External Apps / SmartEvent.

• Select the Events tab in the SmartEvent GUI or use the Events tab in the SmartView web interface.

What is the biggest benefit of policy layers?

• To break one policy into several virtual policies

• Policy Layers and Sub-Policies enable flexible control over the security policy

• They improve the performance on OS kernel version 3.0

• To include Threat Prevention as a sub policy for the firewall policy

Which packet info is masked with Session Rate Acceleration?

• same info from Packet Acceleration is used

• source port ranges

• source port

• source ip

What does Backward Compatibility mean upgrading the Management Server and how can you check it?

• The Management Server is able to manage older Gateways. The lowest supported version is documented in the Installation and Upgrade Guide

• The Management Server is able to manage older Gateways. The lowest supported version is documented in the Release Notes

• You will be able to connect to older Management Server with the SmartConsole. The lowest supported version is documented in the Installation and Upgrade Guide

• You will be able to connect to older Management Server with the SmartConsole. The lowest supported version is documented in the Release Notes