Question 1

What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

Accepted Answer

ClusterXL uses the Cluster Control Protocol (CCP) on port 8116 for health check and state synchronization.

Question 2

Which of these is an implicit MEP option?

Accepted Answer

Primary-backup is an implicit MEP option because it does not require any configuration on the switch. The switch automatically creates a primary and backup MEP for each VLAN.

Question 3

An administrator would like to troubleshoot why templating is not working for some traffic. How can he determine at which rule templating is disabled?

Accepted Answer

The "fwaccel stat" command on the gateway provides information about SecureXL status, including whether templating is enabled or disabled for specific rules.

Question 4

Which GUI client is supported in R80?

Accepted Answer

SmartView Monitor is the only GUI client supported in R80.

Question 5

In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Wire Mode configuration, chain modules marked with __________________ will not apply.

Accepted Answer

The answer of In the Check Point Firewall Kernel Module,...

Question 6

VPN Link Selection will perform the following when the primary VPN link goes down?

Accepted Answer

When the primary VPN link goes down, the Firewall can update the Link Selection entries to start using a different link for the same tunnel, ensuring continued connectivity.

Question 7

Which one of the following is true about Threat Emulation?

Accepted Answer

Threat Emulation typically takes a few minutes to complete, often less than 3 minutes, as it involves analyzing files in a virtualized environment to detect potential threats.

Question 8

SmartEvent does NOT use which of the following procedures to identify events:

Accepted Answer

Events are detected by the SmartEvent Correlation Unit. The Correlation Unit task is to scan logs for criteria that match an Event Definition. SmartEvent uses these procedures to identify events: 
• Matching a Log Against Global Exclusions 
• Matching a Log Against Each Event Definition 
• Creating an Event Candidate 
• When a Candidate Becomes an Event

Question 9

Which of the following links will take you to the SmartView web application?

Accepted Answer

The answer of Which of the following links will take...

Question 10

Which command is used to display status information for various components?

Accepted Answer

The command "show sysenv all" is typically used to display status information for various system components, such as environmental sensors, power supplies, and fans.

Question 11

To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:

Accepted Answer

The command "fw ctl multik set_mode 4" is used to enable Dynamic Dispatch on a Security Gateway without using Firewall Priority Queues.

Question 12

For Management High Availability, which of the following is NOT a valid synchronization status?

Accepted Answer

"Down" is not a valid synchronization status for Management High Availability. The valid statuses typically include "Collision," "Lagging," and "Never been synchronized."

Question 13

You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the FWD daemon to do a Full Synchronization?

Accepted Answer

The FWD daemon uses TCP port 256 for Full Synchronization in a Check Point cluster environment.

Question 14

What is a best practice before starting to troubleshoot using the "fw monitor" tool?

Accepted Answer

Disabling SecureXL is a best practice before using "fw monitor" because SecureXL can offload traffic from the inspection path, potentially causing "fw monitor" to miss capturing some packets.

Question 15

What is the benefit of "tw monitor" over "tcpdump"?

Accepted Answer

"fw monitor" allows users to see inspection points within the firewall, providing more detailed packet flow information than "tcpdump", which does not show these inspection points.

Question 16

Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R80.10 SmartConsole application?

Accepted Answer

Threat Prevention profiles in Check Point R80.10 can enforce IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction blades.

Question 17

Which command shows the current connections distributed by CoreXL FW instances?

Accepted Answer

The command "fw ctl multik stat" displays the current connections distributed by CoreXL FW instances.

Question 18

You need to see which hotfixes are installed on your gateway, which command would you use?

Accepted Answer

The answer of You need to see which hotfixes are...

Question 19

What is the most recommended way to install patches and hotfixes?

Accepted Answer

CPUSE (Check Point Update Service Engine) is the recommended tool for installing patches and hotfixes on Check Point systems, as it is specifically designed for this purpose.

Question 20

When setting up an externally managed log server, what is one item that will not be configured on the R80 Security Management Server?

Accepted Answer

NAT (Network Address Translation) is not configured on the R80 Security Management Server for an externally managed log server. NAT is typically configured on network devices like routers or firewalls to translate IP addresses, not on a management server for logging purposes.

Exam 3: Check Point Certified Security Expert - R80