Question 1

To fully enable Dynamic Dispatcher on a Security Gateway:

Accepted Answer

Dynamic Dispatcher can be fully enabled by running the command "fw ctl multik set_mode 9" in Expert mode and then rebooting the Security Gateway.

Question 2

What component of R80 Management is used for indexing?

Accepted Answer

SOLR is used for indexing in R80 Management.

Question 3

During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

Accepted Answer

Packets that do not pass the inspection are dropped, and logs are generated for these events, but no negative acknowledgment is sent.

Question 4

The Firewall kernel is replicated multiple times, therefore:

Accepted Answer

The replication of the Firewall kernel allows it to run the same policy on all cores, ensuring consistent enforcement of security rules across the system.

Question 5

In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

Accepted Answer

Mail, Block Source, Block Event Activity, External Script, SNMP Trap are all types of automatic reactions that the administrator can configure in SmartEvent.

Question 6

What is the mechanism behind Threat Extraction?

Accepted Answer

Threat Extraction works by removing active content like JavaScripts, macros, and links from documents, making them safe before forwarding to the recipient.

Question 7

Which of these statements describes the Check Point ThreatCloud?

Accepted Answer

ThreatCloud is a collaborative security network that provides threat intelligence and updates to Check Point security products.

Question 8

If the first packet of an UDP session is rejected by a security policy, what does the firewall send to the client?

Accepted Answer

UDP is a connectionless protocol, so if a packet is rejected, the firewall typically does not send any response back to the client.

Question 9

Which limitation of CoreXL is overcome by using (mitigated by) Multi-Queue?

Accepted Answer

Each NIC has several traffic queues that are handled by multiple CPU cores.

Question 10

The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic method. How many times per day will CPUSE agent check for hotfixes and automatically download them?

Accepted Answer

The Automatic method in CPUSE checks for hotfixes every three hours, which means it checks eight times per day.

Question 11

What are types of Check Point APIs available currently as part of R80.10 code?

Accepted Answer

The types of Check Point APIs available in R80.10 include the Management API, Threat Prevention API, Identity Awareness Web Services API, and OPSEC SDK API.

Question 12

What is the command to see cluster status in cli expert mode?

Accepted Answer

The answer of What is the command to see cluster...

Question 13

Which the following type of authentication on Mobile Access can NOT be used as the first authentication method?

Accepted Answer

Dynamic ID is typically used as a second factor in multi-factor authentication, not as the first authentication method.

Question 14

Identify the API that is not supported by Check Point currently.

Accepted Answer

Check Point does not currently support an Open REST API. The other options are supported APIs by Check Point.

Question 15

Which command can you use to verify the number of active concurrent connections?

Accepted Answer

The command "fw ctl pst pstat" is used to display statistics about the current state of connections, including the number of active concurrent connections.

Question 16

How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

Accepted Answer

The answer of How would you deploy TE250X Check Point...

Question 17

Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Accepted Answer

The TCP Acknowledgment Number is not used for identifying a connection in SecureXL. Connections are typically identified by attributes like source address, destination address, and source port.

Question 18

Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?

Accepted Answer

The correct syntax to import a host object called Server_1 from the CLI using mgmt_cli is:mgmt_cli add-host "Server_1" ip_address "10.15.123.10" --format txt

Question 19

When defining QoS global properties, which option below is not valid?

Accepted Answer

Schedule is not a valid QoS global property.

Question 20

What is the difference between an event and a log?

Accepted Answer

A log entry becomes an event when it matches any rule defined in the Event Policy, distinguishing it from regular log entries.

Exam 2: Check Point Certified Security Administrator (CCSA R80)