Question 1

Vanessa is a Firewall administrator. She wants to test a backup of her company's production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment. Which details she need to fill in System Restore window before she can click OK button and test the backup?

Accepted Answer

The System Restore window requires the following details: Server, Protocol, Username, Password, Path, Comment, and All Members.

Question 2

There are two R80.X0 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically?

Accepted Answer

What Happens When a Security Gateway Recovers? In a Load Sharing configuration, when the failed Security Gateway in a cluster recovers, all connections are redistributed among all active members. High Availability and Load Sharing in ClusterXL ClusterXL Administration Guide R77 Versions | 31 In a High Availability configuration, when the failed Security Gateway in a cluster recovers, the recovery method depends on the configured cluster setting. The options are: 
• Maintain Current Active Security Gateway means that if one member passes on control to a lower priority member, control will be returned to the higher priority member only if the lower priority member fails. This mode is recommended if all members are equally capable of processing traffic, in order to minimize the number of failover events. 
• Switch to Higher Priority Security Gateway means that if the lower priority member has control and the higher priority member is restored, then control will be returned to the higher priority member. This mode is recommended if one member is better equipped for handling connections, so it will be the default Security Gateway.

Question 3

In order to modify Security Policies the administrator can use which of the following tools?

Accepted Answer

SmartConsole or mgmt_cli can be used on any computer where SmartConsole is installed to modify Security Policies.

Question 4

RADIUS protocol uses ______ to communicate with the gateway.

Accepted Answer

Parameters : 11ec3b16_46cd_bbce_ab8d_653bd85a3b50_C1171_00

Question 5

What does it mean if Bob gets this result on an object search? Refer to the image below.

Accepted Answer

The answer of What does it mean if Bob gets...

Question 6

The Gaia operating system supports which routing protocols?

Accepted Answer

The Advanced Routing Suite The Advanced Routing Suite CLI is available as part of the  Advanced Networking Software Blade . For organizations looking to implement scalable, fault-tolerant, secure networks, the Advanced Networking blade enables them to run industry-standard dynamic routing protocols including BGP, OSPF, RIPv1, and RIPv2 on security gateways. OSPF, RIPv1, and RIPv2 enable dynamic routing over a single autonomous system-like a single department, company, or service provider-to avoid network failures. BGP provides dynamic routing support across more complex networks involving multiple autonomous systems-such as when a company uses two service providers or divides a network into multiple areas with different administrators responsible for the performance of each.

Question 7

What is the default method for destination NAT?

Accepted Answer

Client Side NAT   - destination is NAT`d by the inbound kernel

Question 8

The command __________ provides the most complete restoration of a R80 configuration.

Accepted Answer

(Should be "migrate import") "migrate import" Restores backed up configuration for R80 version, in previous versions the command was " upgrade_import ".

Question 9

Which command is used to add users to or from existing roles?

Accepted Answer

Configuring Roles - CLI (rba) 11ec3b16_46cd_6dac_ab8d_216442a60e01_C1171_00

Question 10

When LDAP is integrated with Check Point Security Management, it is then referred to as _______

Accepted Answer

Check Point User Directory integrates LDAP, and other external user management technologies, with the Check Point solution. If you have a large user count, we recommend that you use an external user management database such as LDAP for enhanced Security Management Server performance.

Question 11

Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?

Accepted Answer

The IPS Software Blade provides a complete Intrusion Prevention System security solution, providing comprehensive network protection against malicious and unwanted network traffic, including: Malware attacks Dos and DDoS attacks Application and server vulnerabilities Insider threats Unwanted application traffic, including IM and P2P

Question 12

A Check Point software license consists of a _______ and _______ .

Accepted Answer

Check Point's licensing is designed to be scalable and modular. To this end, Check Point offers both predefined packages as well as the ability to custom build a solution tailored to the needs of the Network Administrator. This is accomplished by the use of the following license components: Software Blades Container

Question 13

After the initial installation the First Time Configuration Wizard should be run.

Accepted Answer

Check Point Security Gateway and Check Point Security Management require running the First Time Configuration Wizard in order to be configured correctly. The First Time Configuration Wizard is available in Gaia Portal and also through CLI. To invoke the First Time Configuration Wizard through CLI, run the  config_system  command from the Expert shell.

Question 14

Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

Accepted Answer

Endpoint Identity Agents  - dedicated client agents installed on users' computers that acquire and report identities to the Security Gateway.

Question 15

What are the two types of address translation rules?

Accepted Answer

NAT Rule Base The NAT Rule Base has two sections that specify how the IP addresses are translated: Original Packet Translated Packet

Question 16

To enforce the Security Policy correctly, a Security Gateway requires:

Accepted Answer

The answer of To enforce the Security Policy correctly, a...

Question 17

When attempting to start a VPN tunnel, in the logs the error 'no proposal chosen' is seen numerous times. No other VPN-related log entries are present. Which phase of the VPN negotiations has failed?

Accepted Answer

The error 'no proposal chosen' typically indicates a failure in IKE Phase 1 negotiations, where the two VPN endpoints cannot agree on a set of security proposals or parameters.

Question 18

What is NOT an advantage of Packet Filtering?

Accepted Answer

Packet Filter Advantages and Disadvantages 11ec3b16_46cd_94bd_ab8d_310c36d326fa_C1171_00

Question 19

The R80 feature ________ permits blocking specific IP addresses for a specified time period.

Accepted Answer

Suspicious Activity Rules Solution Suspicious Activity Rules is a utility integrated into SmartView Monitor that is used to modify access privileges upon detection of any suspicious network activity (for example, several attempts to gain unauthorized access). The detection of suspicious activity is based on the creation of Suspicious Activity rules. Suspicious Activity rules are Firewall rules that enable the system administrator to instantly block suspicious connections that are not restricted by the currently enforced security policy. These rules, once set (usually with an expiration date), can be applied immediately without the need to perform an  Install Policy  operation

Question 20

In the Network policy layer, the default action for the Implied last rule is ________ all traffic. However, in the Application Control policy layer, the default action is ________ all traffic.

Accepted Answer

In the Network policy layer, the default action for the Implied last rule is to drop all traffic, while in the Application Control policy layer, the default action is to accept all traffic.

Exam 2: Check Point Certified Security Administrator (CCSA R80)