Question 1

Which is NOT an example of a Check Point API?

Accepted Answer

The answer of Which is NOT an example of a...

Question 2

Fill in the blank: Identity Awareness AD-Query is using the Microsoft _______________ API to learn users from AD.

Accepted Answer

Identity Awareness AD-Query uses the Microsoft WMI (Windows Management Instrumentation) API to query and learn about users from Active Directory (AD).

Question 3

Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic. Assuming acceleration is enabled which path is handling the traffic?

Accepted Answer

The answer of Traffic from source 192.168.1.1 is going to...

Question 4

From SecureXL perspective, what are the three paths of traffic flow:

Accepted Answer

The answer of From SecureXL perspective, what are the three...

Question 5

You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores. How many cores can be used in a Cluster for Firewall-kernel on the new device?

Accepted Answer

The number of cores available for Firewall-kernel on a cluster device is equal to the number of cores on the device with the fewest cores. In this case, the device with the fewest cores is the Gateway with 2 cores. Therefore, the number of cores available for Firewall-kernel on the cluster is 2.

Question 6

The back end database for Check Point R80 Management uses:

Accepted Answer

Check Point R80 Management uses PostgreSQL as its back end database.

Question 7

If an administrator wants to add manual NAT for addresses now owned by the Check Point firewall, what else is necessary to be completed for it to function properly?

Accepted Answer

In Check Point, when manual NAT is configured, proxy ARP entries need to be added to the $FWDIR/conf/local.arp file to ensure proper address resolution.

Question 8

Which view is NOT a valid CPVIEW view?

Accepted Answer

The answer of Which view is NOT a valid CPVIEW...

Question 9

Which process is available on any management product and on products that require direct GUI access, such as SmartEvent and provides GUI client communications, database manipulation, policy compilation and Management HA synchronization?

Accepted Answer

Firewall Management (fwm) is available on any management product, including Multi-Domain and on products that requite direct GUI access, such as SmartEvent, It provides the following: - GUI Client communication - Database manipulation - Policy Compilation - Management HA sync

Question 10

Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?

Accepted Answer

After upgrading to a multicore CPU, the administrator needs to increase the number of kernel instances using cpconfig to utilize the additional cores effectively.

Question 11

Which statement is correct about the Sticky Decision Function?

Accepted Answer

The Sticky Decision Function is not supported with either the Performance pack or a hardware-based accelerator card.

Question 12

Which of the following authentication methods ARE NOT used for Mobile Access?

Accepted Answer

TACACS+ is primarily used for network devices and not typically for mobile access authentication.

Question 13

Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Accepted Answer

Connections are identified by the 5 tuple attributes: source address, destination address, source port, destination port, protocol. When the packets in a connection match all the 5 tuple attributes, the traffic flow can be processed on the accelerated path.

Question 14

What is the most ideal Synchronization Status for Security Management Server High Availability deployment?

Accepted Answer

Synchronized is the most ideal Synchronization Status for Security Management Server High Availability deployment because it ensures that both servers have the same data and are up to date.

Question 15

What is the purpose of extended master key extension/session hash?

Accepted Answer

The extended master key extension/session hash is used in TLS to prevent Man-in-the-Middle attacks by ensuring that the session keys are not disclosed, thus securing client-server communication.

Question 16

You need to change the number of firewall Instances used by CoreXL. How can you achieve this goal?

Accepted Answer

To change the number of firewall instances used by CoreXL, you use the 'cpconfig' command, which requires a reboot for the changes to take effect.

Question 17

You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the tight protections in place. Check Point has been selected for the security vendor. Which Check Point product protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?

Accepted Answer

SandBlast is Check Point's advanced threat prevention solution that provides protection against malware and zero-day attacks by using sandboxing and other advanced techniques to ensure safe content delivery.

Question 18

Check Point security components are divided into the following components:

Accepted Answer

GUI Client is used to manage the Security Gateway, Security Management is used to manage the Security Gateway and WebUI Interface, and Consolidated Security Logs are used to store logs from the Security Gateway.

Question 19

Which command shows detailed information about VPN tunnels?

Accepted Answer

The command "vpn tu tlist" is used to show detailed information about VPN tunnels, including their status and configuration.

Question 20

With SecureXL enabled, accelerated packets will pass through the following:

Accepted Answer

With SecureXL enabled, accelerated packets bypass the OS IP Stack and Check Point Firewall Kernel, passing directly from the Network Interface Card to the Acceleration Device.

Exam 3: Check Point Certified Security Expert - R80