Deck 3: Check Point Certified Security Expert - R80

Question 1

If you needed the Multicast MAC address of a cluster, what command would you run?

A) cphaprob -a if
B) cphaconf ccp multicast
C) cphaconf debug data
D) cphaprob igmp

Answer 1

D

Question 2

What are the different command sources that allow you to communicate with the API server?

A) SmartView Monitor, API_cli Tool, Gaia CLI, Web Services
B) SmartConsole GUI Console, mgmt._cli Tool, Gaia CLI, Web Services
C) SmartConsole GUI Console, API_cli Tool, Gaia CLI, Web Services
D) API_cli Tool, Gaia CLI, Web Services

Answer 2

B

Question 3

Connections to the Check Point R80 Web API use what protocol?

A) HTTPS
B) RPC
C) VPN
D) SIC

Answer 3

A

Question 4

The Firewall Administrator is required to create 100 new host objects with different IP addresses. What API command can he use in the script to achieve the requirement?

A) add host name ip-address
B) add hostname ip-address
C) set host name ip-address
D) set hostname ip-address

Question 5

Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.

A) TCP port 19009
B) TCP Port 18190
C) TCP Port 18191
D) TCP Port 18209

Question 6

The fwd process on the Security Gateway sends logs to the fwd process on the Management Server via which 2 processes?

A) fwd via cpm
B) fwm via fwd
C) cpm via cpd
D) fwd via cpd

Question 7

Which two of these Check Point Protocols are used by SmartEvent Processes?

A) ELA and CPD
B) FWD and LEA
C) FWD and CPLOG
D) ELA and CPLOG

Question 8

Automatic affinity means that if SecureXL is running, the affinity for each interface is automatically reset every

A) 15 sec
B) 60 sec
C) 5 sec
D) 30 sec

Question 9

The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?

A) Secure Internal Communication (SIC)
B) Restart Daemons if they fail
C) Transfers messages between Firewall processes
D) Pulls application monitoring status

Question 10

When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?

A) None, Security Management Server would be installed by itself.
B) SmartConsole
C) SecureClient
D) Security Gateway
E) SmartEvent

Question 11

Which TCP-port does CPM process listen to?

A) 18191
B) 18190
C) 8983
D) 19009

Question 12

Which is NOT an example of a Check Point API?

A) Gateway API
B) Management API
C) OPSC SDK
D) Threat Prevention API

Question 13

Which method below is NOT one of the ways to communicate using the Management API's?

A) Typing API commands using the "mgmt_cli" command
B) Typing API commands from a dialog box inside the SmartConsole GUI application
C) Typing API commands using Gaia's secure shell(clish)19+
D) Sending API commands over an http connection using web-services

Question 14

During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

A) Host having a Critical event found by Threat Emulation
B) Host having a Critical event found by IPS
C) Host having a Critical event found by Antivirus
D) Host having a Critical event found by Anti-Bot

Question 15

CPM process stores objects, policies, users, administrators, licenses and management data in a database. The database is:

A) MySQL
B) Postgres SQL
C) MarisDB
D) SOLR

Question 16

SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user's machine via the web browser. What are the two modes of SNX?

A) Application and Client Service
B) Network and Application
C) Network and Layers
D) Virtual Adapter and Mobile App

Question 17

Which command would disable a Cluster Member permanently?

A) clusterXL_admin down
B) cphaprob_admin down
C) clusterXL_admin down-p
D) set clusterXL down-p

Question 18

Which view is NOT a valid CPVIEW view?

A) IDA
B) RAD
C) PDP
D) VPN

Question 19

What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?

A) Stateful Mode
B) VPN Routing Mode
C) Wire Mode
D) Stateless Mode

Question 20

What is the mechanism behind Threat Extraction?

A) This a new mechanism which extracts malicious files from a document to use it as a counter-attack against its sender.
B) This is a new mechanism which is able to collect malicious files out of any kind of file types to destroy it prior to sending it to the intended recipient.
C) This is a new mechanism to identify the IP address of the sender of malicious codes and put it into the SAM database (Suspicious Activity Monitoring).
D) Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.

Question 21

In SmartEvent, what are different types of automatic reactions that the administrator can configure?

A) Mail, Block Source, Block Event Activity, External Script, SNMP Trap
B) Mail, Block Source, Block Destination, Block Services, SNMP Trap
C) Mail, Block Source, Block Destination, External Script, SNMP Trap
D) Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap

Question 22

Where do you create and modify the Mobile Access policy in R80?

A) SmartConsole
B) SmartMonitor
C) SmartEndpoint
D) SmartDashboard

Question 23

How do Capsule Connect and Capsule Workspace differ?

A) Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications.
B) Capsule Workspace can provide access to any application.
C) Capsule Connect provides Business data isolation.
D) Capsule Connect does not require an installed application at client.

Question 24

What API command below creates a new host with the name "New Host" and IP address of "192.168.0.10"?

A) new host name "New Host" ip-address "192.168.0.10"
B) set host name "New Host" ip-address "192.168.0.10"
C) create host name "New Host" ip-address "192.168.0.10"
D) add host name "New Host" ip-address "192.168.0.10"

Question 25

What is the limitation of employing Sticky Decision Function?

A) With SDF enabled, the involved VPN Gateways only supports IKEv1
B) Acceleration technologies, such as SecureXL and CoreXL are disabled when activating SDF
C) With SDF enabled, only ClusterXL in legacy mode is supported
D) With SDF enabled, you can only have three Sync interfaces at most

Question 26

Which of the following process pulls application monitoring status?

A) fwd
B) fwm
C) cpwd
D) cpd

Question 27

When simulating a problem on ClusterXL cluster with cphaprob -d STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?

A) cphaprob -d STOP unregister
B) cphaprob STOP unregister
C) cphaprob unregister STOP
D) cphaprob -d unregister STOP

Question 28

NAT rules are prioritized in which order? 1. Automatic Static NAT 2. Automatic Hide NAT 3. Manual/Pre-Automatic NAT 4. Post-Automatic/Manual NAT rules

A) 1, 2, 3, 4
B) 1, 4, 2, 3
C) 3, 1, 2, 4
D) 4, 3, 1, 2

Question 29

SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

A) Analyzes each log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server.
B) Correlates all the identified threats with the consolidation policy.
C) Collects syslog data from third party devices and saves them to the database.
D) Connects with the SmartEvent Client when generating threat reports.

Question 30

What is the purpose of Priority Delta in VRRP?

A) When a box up, Effective Priority = Priority + Priority Delta
B) When an Interface is up, Effective Priority = Priority + Priority Delta
C) When an Interface fail, Effective Priority = Priority - Priority Delta
D) When a box fail, Effective Priority = Priority - Priority Delta

Question 31

Which command can you use to verify the number of active concurrent connections?

A) fw conn all
B) fw ctl pstat
C) show all connections
D) show connections

Question 32

What is the correct command to observe the Sync traffic in a VRRP environment?

A) fw monitor -e "accept[12:4,b]=224.0.0.18;"
B) fw monitor -e "accept(6118;"
C) fw monitor -e "accept proto=mcVRRP;"
D) fw monitor -e "accept dst=224.0.0.18;"

Question 33

Which statements below are CORRECT regarding Threat Prevention profiles in SmartDashboard?

A) You can assign only one profile per gateway and a profile can be assigned to one rule Only.
B) You can assign multiple profiles per gateway and a profile can be assigned to one rule only.
C) You can assign multiple profiles per gateway and a profile can be assigned to one or more rules.
D) You can assign only one profile per gateway and a profile can be assigned to one or more rules.

Question 34

SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

A) 19090,22
B) 19190,22
C) 18190,80
D) 19009,443

Question 35

When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:

A) Threat Emulation
B) HTTPS
C) QOS
D) VoIP

Question 36

What is the least amount of CPU cores required to enable CoreXL?

A) 2
B) 1
C) 4
D) 6

Question 37

Which command gives us a perspective of the number of kernel tables?

A) fw tab -t
B) fw tab -s
C) fw tab -n
D) fw tab -k

Question 38

SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.

A) This statement is true because SecureXL does improve all traffic.
B) This statement is false because SecureXL does not improve this traffic but CoreXL does.
C) This statement is true because SecureXL does improve this traffic.
D) This statement is false because encrypted traffic cannot be inspected.

Question 39

Which statement is true regarding redundancy?

A) System Administrators know their cluster has failed over and can also see why it failed over by using the cphaprob -f if command.
B) ClusterXL offers three different Load Sharing solutions: Unicast, Broadcast, and Multicast.
C) Machines in a ClusterXL High Availability configuration must be synchronized.
D) Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.

Question 40

How many images are included with Check Point TE appliance in Recommended Mode?

A) 2(OS) images
B) images are chosen by administrator during installation
C) as many as licensed for
D) the most new image

Question 41

To add a file to the Threat Prevention Whitelist, what two items are needed?

A) File name and Gateway
B) Object Name and MD5 signature
C) MD5 signature and Gateway
D) IP address of Management Server and Gateway

Question 42

What scenario indicates that SecureXL is enabled?

A) Dynamic objects are available in the Object Explorer
B) SecureXL can be disabled in cpconfig
C) fwaccel commands can be used in clish
D) Only one packet in a stream is seen in a fw monitor packet capture

Question 43

John detected high load on sync interface. Which is most recommended solution?

A) For short connections like http service - delay sync for 2 seconds
B) Add a second interface to handle sync traffic
C) For short connections like http service - do not sync
D) For short connections like icmp service - delay sync for 2 seconds

Question 44

What is the command to check the status of the SmartEvent Correlation Unit?

A) fw ctl get int cpsead_stat
B) cpstat cpsead
C) fw ctl stat cpsemd
D) cp_conf get_stat cpsemd

Question 45

What information is NOT collected from a Security Gateway in a Cpinfo?

A) Firewall logs
B) Configuration and database files
C) System message logs
D) OS and network statistics

Question 46

SandBlast appliances can be deployed in the following modes:

A) using a SPAN port to receive a copy of the traffic only
B) detect only
C) inline/prevent or detect
D) as a Mail Transfer Agent and as part of the traffic flow only

Question 47

Which directory below contains log files?

A) /opt/CPSmartlog-R80/log
B) /opt/CPshrd-R80/log
C) /opt/CPsuite-R80/fw1/log
D) /opt/CPsuite-R80/log

Question 48

John is using Management HA. Which Smartcenter should be connected to for making changes?

A) secondary Smartcenter
B) active Smartenter
C) connect virtual IP of Smartcenter HA
D) primary Smartcenter

Question 49

Which Check Point daemon monitors the other daemons?

A) fwm
B) cpd
C) cpwd
D) fwssd

Question 50

You have existing dbedit scripts from R77. Can you use them with R80.10?

A) dbedit is not supported in R80.10
B) dbedit is fully supported in R80.10
C) You can use dbedit to modify threat prevention or access policies, but not create or modify layers
D) dbedit scripts are being replaced by mgmt_cli in R80.10

Question 51

Which of the following is NOT a type of Check Point API available in R80.10?

A) Identity Awareness Web Services
B) OPSEC SDK
C) Mobile Access
D) Management

Question 52

How often does Threat Emulation download packages by default?

A) Once a week
B) Once an hour
C) Twice per day
D) Once per day

Question 53

What are the blades of Threat Prevention?

A) IPS, DLP, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction
B) DLP, AntiVirus, QoS, AntiBot, Sandblast Threat Emulation/Extraction
C) IPS, AntiVirus, AntiBot
D) IPS, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction

Question 54

The Correlation Unit performs all but the following actions:

A) Marks logs that individually are not events, but may be part of a larger pattern to be identified later.
B) Generates an event based on the Event policy.
C) Assigns a severity level to the event.
D) Takes a new log entry that is part of a group of items that together make up an event, and adds it to an ongoing event.

Question 55

What is the difference between SSL VPN and IPSec VPN?

A) IPSec VPN does not require installation of a resilient VPN client.
B) SSL VPN requires installation of a resident VPN client.
C) SSL VPN and IPSec VPN are the same.
D) IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser.

Question 56

To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection. Which of the these is NOT a SecureXL template?

A) Accept Template
B) Deny Template
C) Drop Template
D) NAT Template

Question 57

Which one of the following is true about Capsule Connect?

A) It is a full layer 3 VPN client
B) It offers full enterprise mobility management
C) It is supported only on iOS phones and Windows PCs
D) It does not support all VPN authentication methods

Question 58

How do you enable virtual mac (VMAC) on-the-fly on a cluster member?

A) cphaprob set int fwha_vmac_global_param_enabled 1
B) clusterXL set int fwha_vmac_global_param_enabled 1
C) fw ctl set int fwha_vmac_global_param_enabled 1
D) cphaconf set int fwha_vmac_global_param_enabled 1

Question 59

Which encryption algorithm is the least secured?

A) AES-128
B) AES-256
C) DES
D) 3DES

Question 60

Which of the following will NOT affect acceleration?

A) Connections destined to or originated from the Security gateway
B) A 5-tuple match
C) Multicast packets
D) Connections that have a Handler (ICMP, FTP, H.323, etc.)

Question 61

With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments. What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?

A) Threat Cloud Intelligence
B) Threat Prevention Software Blade Package
C) Endpoint Total Protection
D) Traffic on port 25

Question 62

What kind of information would you expect to see using the sim affinity command?

A) The VMACs used in a Security Gateway cluster
B) The involved firewall kernel modules in inbound and outbound packet chain
C) Overview over SecureXL templated connections
D) Network interfaces and core distribution used for CoreXL

Question 63

Which file gives you a list of all security servers in use, including port number?

A) $FWDIR/conf/conf.conf
B) $FWDIR/conf/servers.conf
C) $FWDIR/conf/fwauthd.conf
D) $FWDIR/conf/serversd.conf

Question 64

Both ClusterXL and VRRP are fully supported by Gaia R80.10 and available to all Check Point appliances. Which the following command is NOT related to redundancy and functions?

A) cphaprob stat
B) cphaprob -a if
C) cphaprob -l list
D) cphaprob all show stat

Question 65

In the Firewall chain mode FFF refers to:

A) Stateful Packets
B) No Match
C) All Packets
D) Stateless Packets

Question 66

What are the main stages of a policy installations?

A) Verification & Compilation, Transfer and Commit
B) Verification & Compilation, Transfer and Installation
C) Verification, Commit, Installation
D) Verification, Compilation & Transfer, Installation

Question 67

Which web services protocol is used to communicate to the Check Point R80 Identity Awareness Web API?

A) SOAP
B) REST
C) XLANG
D) XML-RPC

Question 68

What is the responsibility of SOLR process on R80.10 management server?

A) Validating all data before it's written into the database
B) It generates indexes of data written to the database
C) Communication between SmartConsole applications and the Security Management Server
D) Writing all information into the database

Question 69

Fill in the blank: The "fw monitor" tool can be best used to troubleshoot ____________________.

A) AV issues
B) VPN errors
C) Network issues
D) Authentication issues

Question 70

You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the PWO daemon to do a Full Synchronization?

A) TCP port 443
B) TCP port 257
C) TCP port 256
D) UDP port 8116

Question 71

Customer's R80 management server needs to be upgraded to R80.10. What is the best upgrade method when the management server is not connected to the Internet?

A) Export R80 configuration, clean install R80.10 and import the configuration
B) CPUSE offline upgrade
C) CPUSE online upgrade
D) SmartUpdate upgrade

Question 72

Which statement is most correct regarding about "CoreXL Dynamic Dispatcher"?

A) The CoreXL FW instances assignment mechanism is based on Source MAC addresses, Destination MAC addresses
B) The CoreXL FW instances assignment mechanism is based on the utilization of CPU cores
C) The CoreXL FW instances assignment mechanism is based on IP Protocol type
D) The CoreXl FW instances assignment mechanism is based on Source IP addresses, Destination IP addresses, and the IP 'Protocol' type

Question 73

Automation and Orchestration differ in that:

A) Automation relates to codifying tasks, whereas orchestration relates to codifying processes.
B) Automation involves the process of coordinating an exchange of information through web service interactions such as XML and JSON, but orchestration does not involve processes.
C) Orchestration is concerned with executing a single task, whereas automation takes a series of tasks and puts them all together into a process workflow.
D) Orchestration relates to codifying tasks, whereas automation relates to codifying processes.

Question 74

What is considered Hybrid Emulation Mode?

A) Manual configuration of file types on emulation location.
B) Load sharing of emulation between an on premise appliance and the cloud.
C) Load sharing between OS behavior and CPU Level emulation.
D) High availability between the local SandBlast appliance and the cloud.

Question 75

Security Checkup Summary can be easily conducted within:

A) Summary
B) Views
C) Reports
D) Checkups

Question 76

With Mobile Access enabled, administrators select the web-based and native applications that can be accessed by remote users and define the actions that users can perform the applications. Mobile Access encrypts all traffic using:

A) HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, they need to install the SSL. Network Extender.
B) HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, they need to install the SSL. Network Extender.
C) HTTPS for web-based applications and 3DES or RC4 algorithm for native applications. For end users to access the native applications, no additional software is required.
D) HTTPS for web-based applications and AES or RSA algorithm for native applications. For end users to access the native application, no additional software is required.

Question 77

What cloud-based SandBlast Mobile application is used to register new devices and users?

A) Check Point Protect Application
B) Management Dashboard
C) Behavior Risk Engine
D) Check Point Gateway

Question 78

Which is not a blade option when configuring SmartEvent?

A) Correlation Unit
B) SmartEvent Unit
C) SmartEvent Server
D) Log Server

Question 79

What command can you use to have cpinfo display all installed hotfixes?

A) cpinfo -hf
B) cpinfo -y all
C) cpinfo -get hf
D) cpinfo installed_jumbo

Question 80

When gathering information about a gateway using CPINFO, what information is included or excluded when using the "-x" parameter?

A) Includes the registry
B) Gets information about the specified Virtual System
C) Does not resolve network addresses
D) Output excludes connection table