Question 1

Which command shows actual allowed connections in state table?

Accepted Answer

The command "fw tab -t connections" is used to display the actual allowed connections in the state table.

Question 2

Which Mobile Access Application allows a secure container on Mobile devices to give users access to internal website, file share and emails?

Accepted Answer

The answer of Which Mobile Access Application allows a secure...

Question 3

What happen when IPS profile is set in Detect Only Mode for troubleshooting?

Accepted Answer

It is recommended to enable Detect-Only for Troubleshooting on the profile during the initial installation of IPS. This option overrides any protections that are set to Prevent so that they will not block any traffic. During this time you can analyze the alerts that IPS generates to see how IPS will handle network traffic, while avoiding any impact on the flow of traffic.

Question 4

What are the attributes that SecureXL will check after the connection is allowed by Security Policy?

Accepted Answer

SecureXL checks the 5-tuple attributes: Source address, Destination address, Source port, Destination port, and Protocol after the connection is allowed by the Security Policy.

Question 5

When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or _______.

Accepted Answer

SecurID is a widely used authentication method that can be used alongside Username and Password or RADIUS for mobile device certificates.

Question 6

Which command collects diagnostic data for analyzing customer setup remotely?

Accepted Answer

CPInfo is an auto-updatable utility that collects diagnostics data on a customer's machine at the time of execution and uploads it to Check Point servers (it replaces the standalone cp_uploader utility for uploading files to Check Point servers). The CPInfo output file allows analyzing customer setups from a remote location. Check Point support engineers can open the CPInfo file in a demo mode, while viewing actual customer Security Policies and Objects. This allows the in-depth analysis of customer's configuration and environment settings.

Question 7

You have successfully backed up Check Point configurations without the OS information. What command would you use to restore this backup?

Accepted Answer

The "migrate import" command is used to restore Check Point configurations without the OS information.

Question 8

How many images are included with Check Point TE appliance in Recommended Mode?

Accepted Answer

The Check Point TE appliance in Recommended Mode includes 2 (OS) images by default.

Question 9

Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?

Accepted Answer

The answer of Which of the following Check Point processes...

Question 10

In a Client to Server scenario, which represents that the packet has already checked against the tables and the Rule Base?

Accepted Answer

In a Client to Server scenario, "Big O" indicates that the packet has already been checked against the tables and the Rule Base.

Question 11

What command verifies that the API server is responding?

Accepted Answer

The "api status" command verifies that the API server is responding.

Question 12

Which statement is true regarding redundancy?

Accepted Answer

The answer of Which statement is true regarding redundancy?
...

Question 13

As a valid Mobile Access Method, what feature provides Capsule Connect/VPN?

Accepted Answer

Capsule Connect/VPN provides a Full Layer3 VPN using IPSec, which allows users to have network access to all mobile applications.

Question 14

Fill in the blank: The R80 utility fw monitor is used to troubleshoot ________.

Accepted Answer

The R80 utility fw monitor is a tool used to capture and analyze network traffic passing through a Check Point firewall, making it useful for troubleshooting traffic issues.

Question 15

What is the difference between an event and a log?

Accepted Answer

A log entry becomes an event when it matches any rule defined in the Event Policy, distinguishing it from regular log entries.

Question 16

You want to gather and analyze threats to your mobile device. It has to be a lightweight app. Which application would you use?

Accepted Answer

Check Point Protect is designed to provide lightweight threat analysis and protection for mobile devices.

Question 17

R80.10 management server can manage gateways with which versions installed?

Accepted Answer

The answer of R80.10 management server can manage gateways with...

Question 18

You find one of your cluster gateways showing "Down" when you run the "cphaprob stat" command. You then run the "clusterXL_admin up" on the down member but unfortunately the member continues to show down. What command do you run to determine the cause?

Accepted Answer

The command "cphaprob -a list" provides a detailed status of the cluster members and can help identify the reason why a member is down.

Question 19

You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or ______ action for the file types.

Accepted Answer

Inspect/Bypass is the correct answer because Threat Prevention profiles define an Inspect or Bypass action for the file types.

Question 20

What is the name of the secure application for Mail/Calendar for mobile devices?

Accepted Answer

Capsule Workspace is the secure application designed for Mail/Calendar on mobile devices.

Exam 3: Check Point Certified Security Expert - R80