NEW
Font size
WorksheetsDUMSA-2.1
Total questions: 55
Worksheet time: 28mins
What is the Transport layer of the TCP/IP model responsible for?
It transports packets as datagrams along different routes to reach their destination.
It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.
It defines the protocols that are used to exchange data between networks and how host programs interact with the Application layer.
It deals with all aspects of the physical components of network connectivity and connects with different network types.
What needs to be configured if the NAT property ‘Translate destination on client side’ is not enabled in Global properties?
A host route to route to the destination IP
Use the file local.arp to add the ARP entries for NAT to work
Nothing, the Gateway takes care of all details necessary
Enabling ‘Allow bi-directional NAT’ for NAT to work correctly
In the Check Point Security Management Architecture, which component(s) can store logs?
SmartConsole
Security Management Server and Security Gateway
Security Management Server
SmartConsole and Security Management Server
Fill in the blank: In order to install a license, it must first be added to the _____________.
User Center
Package repository
Download Center Web site
License and Contract repository
When logging in for the first time to a Security management Server through SmartConsole, a fingerprint is saved to the:
Security Management Server’s /home/.fgpt file and is available for future SmartConsole authentications.
Windows registry is available for future Security Management Server authentications.
There is no memory used for saving a fingerprint anyway.
SmartConsole cache is available for future Security Management Server authentications.
Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the ____________ algorithm.
SHA-256
SHA-200
MD5
SHA-128
Which message indicates IKE Phase 2 has completed successfully?
Quick Mode Complete
Aggressive Mode Complete
Main Mode Complete
IKE Mode Complete
Administrator Dave logs into R80 Management Server to review and makes some rule changes. He notices that there is a padlock sign next to the DNS rule in the Rule Base. What is the possible explanation for this?
DNS Rule is using one of the new feature of R80 where an administrator can mark a rule with the padlock icon to let other administrators know it is important.
Another administrator is logged into the Management and currently editing the DNS Rule.
DNS Rule is a placeholder rule for a rule that existed in the past but was deleted.
This is normal behavior in R80 when there are duplicate rules in the Rule Base.
Fill in the blank: When tunnel test packets no longer invoke a response, SmartView Monitor displays ________ for the given VPN tunnel.
Down
No Response
Inactive
Failed
Which of the following is the most secure means of authentication?
Password
Certificate
Token
Pre-shared secret
What is the BEST command to view configuration details of all interfaces in Gaia CLISH?
ifconfig -a
show interfaces
show interfaces detail
show configuration interface
Fill in the blank: Authentication rules are defined for ____________.
User groups
Users using UserCheck
Individual users
All users in the database
Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?
ThreatWiki
Whitelist Files
AppWiki
IPS Protections
Which of the following is an authentication method used for Identity Awareness?
SSL
Captive Portal
PKI
RSA
The SIC Status “Unknown” means
There is connection between the gateway and Security Management Server but it is not trusted.
The secure communication is established.
There is no connection between the gateway and Security Management Server.
The Security Management Server can contact the gateway, but cannot establish SIC.
What is a reason for manual creation of a NAT rule?
In R80 all Network Address Translation is done automatically and there is no need for manually defined NAT-rules.
Network Address Translation of RFC1918-compliant networks is needed to access the Internet.
Network Address Translation is desired for some services, but not for others.
The public IP-address is different from the gateway’s external IP
Which of the following commands is used to verify license installation?
Cplic verify license
Cplic print
Cplic show
Cplic license
To enforce the Security Policy correctly, a Security Gateway requires:
a routing table
awareness of the network topology
a Demilitarized Zone
a Security Policy install
Which configuration element determines which traffic should be encrypted into a VPN tunnel vs. sent in the clear?
The firewall topologies
NAT Rules
The Rule Base
The VPN Domains
You have discovered suspicious activity in your network. What is the BEST immediate action to take?
Isolate the affected systems from the network to contain the activity.
Perform a full network-wide scan before taking any containment steps.
Notify users and continue to monitor without changes until more data is available.
Disable Internet connectivity for the entire organization as a precaution.
Tom has connected to the Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward. What will happen to the changes already made?
Tom will have to reboot his SmartConsole computer, clear the cache, and restore changes.
Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.
Tom’s changes will be lost since he lost connectivity and he will have to start again.
Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.
Which GUI tool can be used to view and apply Check Point licenses?
cpconfig
Management Command Line
SmartConsole
SmartUpdate
How would you determine the software version from the CLI?
fw ver
fw stat
fw monitor
cpinfo
In R80 Management, apart from using SmartConsole, objects or rules can also be modified using:
3rd Party integration of CLI and API for Gateways prior to R80.
A complete CLI and API interface using SSH and custom CPCode integration.
3rd Party integration of CLI and API for Management prior to R80.
A complete CLI and API interface for Management with 3rd Party integration.
When connected to the Check Point R80 Management Server using the SmartConsole the first administrator to connect has a lock on:
Only the objects being modified in the Management Database and other administrators can connect to make changes using a special session as long as they all connect from the same LAN network.
The entire Management Database and other administrators can connect to make changes only if the first administrator switches to Read-only.
The entire Management Database and all sessions and other administrators can connect only as Read-only.
Only the objects being modified in his session of the Management Database and other administrators can connect to make changes using different sessions.
Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?
AES-GCM-256
AES-CBC-256
AES-GCM-128
To create policy for traffic to or from a particular location, use the __________.
DLP shared policy
Geo policy shared policy
Mobile Access software blade
HTTPS inspection
After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?
Security Gateway IP-address cannot be changed without re-establishing the trust
The Security Gateway name cannot be changed in command line without re-establishing trust
The Security Management Server name cannot be changed in SmartConsole without re-establishing trust
The Security Management Server IP-address cannot be changed without re-establishing the trust
Which two Identity Awareness commands are used to support identity sharing?
Policy Decision Point (PDP) and Policy Enforcement Point (PEP)
Policy Enforcement Point (PEP) and Policy Manipulation Point (PMP)
Policy Manipulation Point (PMP) and Policy Activation Point (PAP)
Policy Activation Point (PAP) and Policy Decision Point (PDP)
True or False: In R80, more than one administrator can login to the Security Management Server with write permission at the same time.
False, this feature has to be enabled in the Global Properties.
True, every administrator works in a session that is independent of the other administrators.
True, every administrator works on a different database that is independent of the other administrators.
False, only one administrator can login with write permission.
Which one of the following is TRUE?
Ordered policy is a sub-policy within another policy
One policy can be either inline or ordered, but not both
Inline layer can be defined as a rule action
Pre-R80 Gateways do not support ordered layers
Which deployment adds a Security Gateway to an existing environment without changing IP routing?
Distributed
Bridge Mode
Remote
Standalone
Fill in the blank: An identity server uses a ____________ for user authentication.
Shared secret
Certificate
One-time password
Token
You can see the following graphic. What is presented on it?
Properties of personal .p12 certificate file issued for user John.
Shared secret properties of John’s password.
VPN certificate properties of the John’s gateway.
Expired .p12 certificate properties for user John.
When configuring LDAP User Directory integration, Changes applied to a User Directory template are:
Reflected immediately for all users who are using template.
Not reflected for any users unless the local user template is changed.
Reflected for all users who are using that template and if the local user template is changed as well.
Not reflected for any users who are using that template.
Choose what BEST describes the reason why querying logs now is very fast.
New Smart-1 appliances double the physical memory install
Indexing Engine indexes logs for faster search results
SmartConsole now queries results directly from the Security Gateway
The amount of logs been store is less than the usual in older versions
Check Point ClusterXL Active/Active deployment is used when:
Only when there is Multicast solution set up
There is Load Sharing solution set up
Only when there is Unicast solution set up
There is High Availability solution set up
Which of the following methods can be used to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server?
Save Policy
Install Database
Save session
Install Policy
From the Gaia web interface, which operation cannot be performed on a Security Management Server?
Verify a Security Policy
Open a terminal shell
Add a static route
View Security Management GUI Clients
Which of the following are types of VPN communities?
Pentagon, star, and combination
Star, octagon, and combination
Combined and star
Meshed, star, and combination
What are the three types of UserCheck messages?
inform, ask, and block
block, action, and warn
action, inform, and ask
ask, block, and notify
What two ordered layers make up the Access Control Policy Layer?
URL Filtering and Network
Network and Threat Prevention
Application Control and URL Filtering
Network and Application Control
Which statement is true of anti-spoofing?
Anti-spoofing is not needed when IPS software blade is enabled
It is more secure to create anti-spoofing groups manually
It is best practice to have anti-spoofing groups in sync with the routing table
With dynamic routing enabled, anti-spoofing groups are updated automatically whenever there is a routing change
The position of an implied rule is manipulated in which window?
NAT
Firewall
Global Properties
Object Explorer
How can the changes made by an administrator before publishing the session be seen by a superuser administrator?
By impersonating the administrator with the 'Login as…' option
They cannot be seen
From the SmartView Tracker audit log
From Manage and Settings > Sessions, right click on the session and click 'View Changes…'
Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance?
Application Control
Threat Emulation
Logging and Status
Monitoring
Your internal networks 10.1.1.0/24, 10.2.2.0/24 and 192.168.0.0/16 are behind the Internet Security Gateway. Considering that Layer 2 and Layer 3 setup is correct, what are the steps you will need to do in SmartConsole in order to get the connection working?
1. Define an accept rule in Security Policy. 2. Define Security Gateway to hide all internal networks behind the gateway's external IP. 3. Publish and install the policy.
1. Define an accept rule in Security Policy. 2. Define automatic NAT for each network to NAT the networks behind a public IP. 3. Publish the policy.
1. Define an accept rule in Security Policy. 2. Define automatic NAT for each network to NAT the networks behind a public IP. 3. Publish and install the policy.
1. Define an accept rule in Security Policy. 2. Define Security Gateway to hide all internal networks behind the gateway's external IP. 3. Publish the policy.
True or False: The destination server for Security Gateway logs depends on a Security Management Server configuration.
False, log servers are configured on the Log Server General Properties
True, all Security Gateways will only forward logs with a SmartCenter Server configuration
True, all Security Gateways forward logs automatically to the Security Management Server
False, log servers are enabled on the Security Gateway General Properties
Consider the Global Properties settings shown in the referenced image. The selected option "Accept Domain Name over UDP (Queries)" means:
UDP queries are accepted only through interfaces with external anti‑spoofing topology, and this is applied before the first explicit rule in the Security Policy.
All UDP queries are accepted through all interfaces, and this is applied before the first explicit rule in the Security Policy.
No UDP queries are accepted through any interface, and this is applied before the first explicit rule in the Security Policy.
All UDP queries are accepted only when allowed by the first explicit rule written in the Security Policy.
How is communication between different Check Point components secured in R80? Select the best answer.
By using IPSEC
By using SIC
By using ICA
By using 3DES
Identify the ports to which the Client Authentication daemon listens by default.
259, 900
256, 257
8080, 529
80, 256
What is the purpose of the CPCA process?
Monitoring the status of processes
Sending and receiving logs
Communication between GUI clients and the SmartCenter server
Generating and modifying certificates
The Network Operations Center administrator needs access to Check Point Security devices mostly for troubleshooting purposes. You do not want to give expert‑mode access, but the administrator should still be able to run tcpdump. How can you achieve this requirement?
Add tcpdump to CLISH using the add command; create a new access role; add tcpdump to the role; create a new user with any UID and assign the role to the user.
Add tcpdump to CLISH using the add command; create a new access role; add tcpdump to the role; create a new user with UID 0 and assign the role to the user.
Create a new access role; add expert‑mode access to the role; create a new user with UID 0 and assign the role to the user.
Create a new access role; add expert‑mode access to the role; create a new user with any UID and assign the role to the user.
After initial installation on a Check Point appliance, the Management interface IP address and default gateway are incorrect. Which commands set the IP to 192.168.80.200/24 and the default gateway to 192.168.80.1?
set interface Mgmt ipv4-address 192.168.80.200 mask-length 24; set static-route default nexthop gateway address 192.168.80.1 on; save config
add interface Mgmt ipv4-address 192.168.80.200 255.255.255.0; add static-route 0.0.0.0 0.0.0.0 gw 192.168.80.1 on; save config
set interface Mgmt ipv4-address 192.168.80.200 255.255.255.0; add static-route 0.0.0.0 0.0.0.0 gw 192.168.80.1 on; save config
add interface Mgmt ipv4-address 192.168.80.200 mask-length 24; add static-route default nexthop gateway address 192.168.80.1 on; save config
What Check Point tool is used to automatically update Check Point products for the Gaia OS?
Check Point INSPECT Engine
Check Point Upgrade Service Engine
Check Point Update Engine
Check Point Upgrade Installation Service
