Exam 4 - CCSA 156-215 v7

Frage 1 von 49

1

QUESTION 1
Identify the ports to which the Client Authentication daemon listens by default.

Wähle eine oder mehr der folgenden:

A. 259, 900
B. 256, 600
C. 80, 256
D. 8080, 529

Erklärung

Frage 2 von 49

1

QUESTION 2
What is the Manual Client Authentication TELNET port?

Wähle eine oder mehr der folgenden:

A. 23
B. 264
C. 900
D. 259

Erklärung

Frage 3 von 49

1

QUESTION 3
Your company's Security Policy forces users to authenticate to the Gateway explicitly, before they can use
any services. The Gateway does not allow the Telnet service to itself from any location. How would you
configure authentication on the Gateway? With a:

Wähle eine oder mehr der folgenden:

A. Client Authentication rule using the manual sign-on method, using HTTP on port 900
B. Client Authentication rule, using partially automatic sign on
C. Client Authentication for fully automatic sign on
D. Session Authentication rule

Erklärung

Frage 4 von 49

1

QUESTION 4
Which authentication type permits five different sign-on methods in the authentication properties window?

Wähle eine oder mehr der folgenden:

A. Client Authentication
B. Manual Authentication
C. User Authentication
D. Session Authentication

Erklärung

Frage 5 von 49

1

QUESTION 5
Which Client Authentication sign-on method requires the user to first authenticate via the User
Authentication mechanism, when logging in to a remote server with Telnet?

Wähle eine oder mehr der folgenden:

A. Manual Sign On
B. Agent Automatic Sign On
C. Partially Automatic Sign On
D. Standard Sign On

Erklärung

Frage 6 von 49

1

QUESTION 6
Which Security Gateway R77 configuration setting forces the Client Authentication authorization time-out to
refresh, each time a new user is authenticated? The:

Wähle eine oder mehr der folgenden:

A. Time properties, adjusted on the user objects for each user, in the Client Authentication rule Source.
B. IPS > Application Intelligence > Client Authentication > Refresh User Timeout option enabled.
C. Refreshable Timeout setting, in Client Authentication Action Properties > Limits
D. Global Properties > Authentication parameters, adjusted to allow for Regular Client Refreshment.

Erklärung

Frage 7 von 49

1

QUESTION 7
All R77 Security Servers can perform authentication with the exception of one. Which of the Security
Servers can NOT perform authentication?

Wähle eine oder mehr der folgenden:

A. FTP
B. SMTP
C. HTTP
D. RLOGIN

Erklärung

Frage 8 von 49

1

QUESTION 8
Which of the following are authentication methods that Security Gateway R77 uses to validate connection
attempts? Select the response below that includes the MOST complete list of valid authentication methods.

Wähle eine oder mehr der folgenden:

A. Proxied, User, Dynamic, Session
B. Connection, User, Client
C. User, Client, Session
D. User, Proxied, Session

Erklärung

Frage 9 von 49

1

QUESTION 9
Security Gateway R77 supports User Authentication for which of the following services? Select the
response below that contains the MOST correct list of supported services.

Wähle eine oder mehr der folgenden:

A. SMTP, FTP, TELNET
B. SMTP, FTP, HTTP, TELNET
C. FTP, HTTP, TELNET
D. FTP, TELNET

Erklärung

Frage 10 von 49

1

QUESTION 10
With the User Directory Software Blade, you can create R77 user definitions on a(n) _________ Server.

Wähle eine oder mehr der folgenden:

A. LDAP
B. Radius
C. SecureID
D. NT Domain

Erklärung

Frage 11 von 49

1

QUESTION 11
The User Directory Software Blade is used to integrate which of the following with Security Gateway R77?

Wähle eine oder mehr der folgenden:

A. RADIUS server
B. Account Management Client server
C. UserAuthority server
D. LDAP server

Erklärung

Frage 12 von 49

1

QUESTION 12
If you are experiencing LDAP issues, which of the following should you check?

Wähle eine oder mehr der folgenden:

A. Connectivity between the R77 Gateway and LDAP server
B. Secure Internal Communications (SIC)
C. Overlapping VPN Domains
D. Domain name resolution

Erklärung

Frage 13 von 49

1

QUESTION 13
Which type of R77 Security Server does not provide User Authentication?

Wähle eine oder mehr der folgenden:

A. SMTP Security Server
B. HTTP Security Server
C. FTP Security Server
D. HTTPS Security Server

Erklärung

Frage 14 von 49

1

QUESTION 14
You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to
be defined via SmartDashboard?

Wähle eine oder mehr der folgenden:

A. A group with generic user
B. All users
C. LDAP Account Unit Group
D. Internal user Group

Erklärung

Frage 15 von 49

1

QUESTION 15
For which service is it NOT possible to configure user authentication?

Wähle eine oder mehr der folgenden:

A. Telnet
B. SSH
C. FTP
D. HTTPS

Erklärung

Frage 16 von 49

1

QUESTION 16
Charles requests a Website while using a computer not in the net_singapore network. What is TRUE about
his location restriction?

Exhibit:

Wähle eine oder mehr der folgenden:

A. Source setting in Source column always takes precedence
B. Source setting in User Properties always takes precedence
C. As location restrictions add up, he would be allowed from net_singapore and net_sydney.
D. It depends on how the User Auth object is configured; whether User Properties or Source Restriction
takes precedence.

Erklärung

Frage 17 von 49

1

QUESTION 17
In the Rule Base displayed, user authentication in Rule 4 is configured as fully automatic. Eric is a member
of the LDAP group, MSD_Group.
What happens when Eric tries to connect to a server on the Internet?

Wähle eine oder mehr der folgenden:

A. None of these things will happen
B. Eric will be authenticated and get access to the requested server.
C. Eric will be blocked because LDAP is not allowed in the Rule Base.
D. Eric will be dropped by the Stealth Rule

Erklärung

Frage 18 von 49

1

QUESTION 18
Which of the following is an authentication method used by Identity Awareness?

Wähle eine oder mehr der folgenden:

A. SSL
B. Captive Portal
C. RSA
D. PKI

Erklärung

Frage 19 von 49

1

QUESTION 19
What is the purpose of an Identity Agent?

Wähle eine oder mehr der folgenden:

A. Provide user and machine identity to a gateway
B. Manual entry of user credentials for LDAP authentication
C. Audit a user's access, and send that data to a log server
D. Disable Single Sign On

Erklärung

Frage 20 von 49

1

QUESTION 20
What type of traffic can be re-directed to the Captive Portal?

Wähle eine oder mehr der folgenden:

A. SMTP
B. HTTP
C. All of the above
D. FTP

Erklärung

Frage 21 von 49

1

QUESTION 21
The Captive Portal tool:

Wähle eine oder mehr der folgenden:

A. Acquires identities from unidentified users.
B. Is only used for guest user authentication.
C. Allows access to users already identified.
D. Is deployed from the Identity Awareness page in the Global Properties settings

Erklärung

Frage 22 von 49

1

QUESTION 22
Captive Portal is a __________ that allows the gateway to request login information from the user.

Wähle eine oder mehr der folgenden:

A. Pre-configured and customizable web-based tool
B. Transparent network inspection tool
C. LDAP server add-on
D. Separately licensed feature

Erklärung

Frage 23 von 49

1

QUESTION 23
Complete this statement from the options provided. Using Captive Portal, unidentified users may be either;
blocked, allowed to enter required credentials, or required to download the _____________.

Wähle eine oder mehr der folgenden:

A. Identity Awareness Agent
B. Full Endpoint Client
C. ICA Certificate
D. SecureClient

Erklärung

Frage 24 von 49

1

QUESTION 24
Users with Identity Awareness Agent installed on their machines login with __________, so that when the
user logs into the domain, that information is also used to meet Identity Awareness credential requests.

Wähle eine oder mehr der folgenden:

A. Key-logging
B. ICA Certificates
C. SecureClient
D. Single Sign-On

Erklärung

Frage 25 von 49

1

QUESTION 25
Which of the following methods is NOT used by Identity Awareness to catalog identities?

Wähle eine oder mehr der folgenden:

A. AD Query
B. Captive Portal
C. Identity Agent
D. GPO

Erklärung

Frage 26 von 49

1

QUESTION 26
When using AD Query to authenticate users for Identity Awareness, identity data is received seamlessly
from the Microsoft Active Directory (AD). What is NOT a recommended usage of this method?

Wähle eine oder mehr der folgenden:

A. Leveraging identity in the application control blade
B. Basic identity enforcement in the internal network
C. Identity-based auditing and logging
D. Identity-based enforcement for non-AD users (non-Windows and guest users)

Erklärung

Frage 27 von 49

1

QUESTION 27
The Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
What is not a recommended usage of this method?

Wähle eine oder mehr der folgenden:

A. When accuracy in detecting identity is crucial
B. Leveraging identity for Data Center protection
C. Protecting highly sensitive servers
D. Identity based enforcement for non-AD users (non-Windows and guest users)

Erklärung

Frage 28 von 49

1

QUESTION 28
Which of the following is NOT a valid option when configuring access for Captive Portal?

Wähle eine oder mehr der folgenden:

A. From the Internet
B. Through internal interfaces
C. Through all interfaces
D. According to the Firewall Policy

Erklärung

Frage 29 von 49

1

QUESTION 29
If you were NOT using IKE aggressive mode for your IPsec tunnel, how many packets would you see for
normal Phase 1 exchange?

Wähle eine oder mehr der folgenden:

A. 9
B. 2
C. 3
D. 6

Erklärung

Frage 30 von 49

1

QUESTION 30
How many packets does the IKE exchange use for Phase 1 Main Mode?

Wähle eine oder mehr der folgenden:

A. 12
B. 1
C. 3
D. 6

Erklärung

Frage 31 von 49

1

QUESTION 31
How many packets does the IKE exchange use for Phase 1 Aggressive Mode?

Wähle eine oder mehr der folgenden:

A. 12
B. 6
C. 3
D. 1

Erklärung

Frage 32 von 49

1

QUESTION 32
Which of the following actions take place in IKE Phase 2 with Perfect Forward Secrecy disabled?

Wähle eine oder mehr der folgenden:

A. Symmetric IPsec keys are generated.
B. Each Security Gateway generates a private Diffie-Hellman (DH) key from random pools.
C. The DH public keys are exchanged.
D. Peers authenticate using certificates or preshared secrets.

Erklärung

Frage 33 von 49

1

QUESTION 33
Which of the following commands can be used to remove site-to-site IPsec Security Association (SA)?

Wähle eine oder mehr der folgenden:

A. vpn debug ipsec
B. vpn ipsec
C. fw ipsec tu
D. vpn tu

Erklärung

Frage 34 von 49

1

QUESTION 34
How many packets are required for IKE Phase 2?

Wähle eine oder mehr der folgenden:

A. 12
B. 2
C. 6
D. 3

Erklärung

Frage 35 von 49

1

QUESTION 35
Which of the following actions do NOT take place in IKE Phase 1?

Wähle eine oder mehr der folgenden:

A. Peers agree on encryption method.
B. Diffie-Hellman key is combined with the key material to produce the symmetrical IPsec key.
C. Peers agree on integrity method.
D. Each side generates a session key from its private key and the peer's public key.

Erklärung

Frage 36 von 49

1

QUESTION 36
When using vpn tu, which option must you choose if you only want to clear phase 2 for a specific IP
(gateway)?
Exhibit:

Wähle eine oder mehr der folgenden:

A. (5) Delete all IPsec SAs for a given peer (GW)
B. (7) Delete all IPsec+IKE SAs for a given peer (GW)
C. (6) Delete all IPsec SAs for a given User (Client)
D. (8) Delete all IPsec+IKE SAs for a given User (Client)

Erklärung

Frage 37 von 49

1

QUESTION 37
When using vpn tu, which option must you choose if you want to rebuild your VPN for a specific IP
(gateway)?
Exhibit:

Wähle eine oder mehr der folgenden:

A. (6) Delete all IPsec SAs for a given User (Client)
B. (5) Delete all IPsec SAs for a given peer (GW)
C. (8) Delete all IPsec+IKE SAs for a given User (Client)
D. (7) Delete all IPsec+IKE SAs for a given peer (GW)

Erklärung

Frage 38 von 49

1

QUESTION 38
Which SmartConsole component can Administrators use to track changes to the Rule Base?

Wähle eine oder mehr der folgenden:

A. WebUI
B. SmartView Tracker
C. SmartView Monitor
D. SmartReporter

Erklärung

Frage 39 von 49

1

QUESTION 39
UDP packets are delivered if they are ___________.

Wähle eine oder mehr der folgenden:

A. a stateful ACK to a valid SYN-SYN/ACK on the inverse UDP ports and IP
B. a valid response to an allowed request on the inverse UDP ports and IP
C. bypassing the kernel by the forwarding layer of ClusterXL
D. referenced in the SAM related dynamic tables

Erklärung

Frage 40 von 49

1

QUESTION 40
The INSPECT engine inserts itself into the kernel between which two OSI model layers?

Wähle eine oder mehr der folgenden:

A. Session and Transport
B. Physical and Data
C. Presentation and Application
D. Datalink and Network

Erklärung

Frage 41 von 49

1

QUESTION 41
Your company has two headquarters, one in London, and one in New York. Each office includes several
branch offices. The branch offices need to communicate with the headquarters in their country, not with
each other, and only the headquarters need to communicate directly. What is the BEST configuration for
establishing VPN Communities for this company? VPN Communities comprised of:

Wähle eine oder mehr der folgenden:

A. One star Community with the option to mesh the center of the star: New York and London
Gateways added to the center of the star with the mesh center Gateways option checked; all London
branch offices defined in one satellite window, but, all New York branch offices defined in another
satellite window.
B. Two mesh and one star Community: One mesh Community is set up for each of the headquarters and
its branch offices. The star Community is configured with London as the center of the Community and
New York is the satellite.
C. Two star and one mesh Community: One star Community is set up for each site, with headquarters as
the Community center, and its branches as satellites. The mesh Community includes only New York
and London Gateways.
D. Three mesh Communities: One for London headquarters and its branches, one for New York
headquarters and its branches, and one for London and New York headquarters.

Erklärung

Frage 42 von 49

1

QUESTION 42
Your company has two headquarters, one in London, one in New York. Each of the headquarters includes
several branch offices. The branch offices only need to communicate with the headquarters in their country,
not with each other, and the headquarters need to communicate directly. What is the BEST configuration
for establishing VPN Communities among the branch offices and their headquarters, and between the two
headquarters? VPN Communities comprised of:

Wähle eine oder mehr der folgenden:

A. Three mesh Communities: one for London headquarters and its branches; one for New York
headquarters and its branches; and one for London and New York headquarters.
B. Two mesh and one star Community: Each mesh Community is set up for each site between
headquarters their branches. The star Community has New York as the center and London as its
satellite.
C. Two star communities and one mesh: A star community for each city with headquarters as center, and
branches as satellites. Then one mesh community for the two headquarters.
D. One star Community with the option to mesh the center of the star: New York and London Gateways
added to the center of the star with the "mesh center Gateways? option checked; all London branch
offices defined in one satellite window; but, all New York branch offices defined in another satellite
window.

Erklärung

Frage 43 von 49

1

QUESTION 43
Match the terms with their definitions:
Exhibit:

Wähle eine oder mehr der folgenden:

A. A-3, B-2, C-4, D-1
B. A-2, B-3, C-4, D-1
C. A-3, B-2, C-1, D-4
D. A-3, B-4, C-1, D-2

Erklärung

Frage 44 von 49

1

QUESTION 44
Which of these attributes would be critical for a site-to-site VPN?

Wähle eine oder mehr der folgenden:

A. Scalability to accommodate user groups
B. Centralized management
C. Strong authentication
D. Strong data encryption

Erklärung

Frage 45 von 49

1

QUESTION 45
Which of the following is NOT true for Clientless VPN?

Wähle eine oder mehr der folgenden:

A. The Gateway can enforce the use of strong encryption.
B. The Gateway accepts any encryption method that is proposed by the client and supported in the VPN.
C. Secure communication is provided between clients and servers that support HTTP.
D. User Authentication is supported.

Erklärung

Frage 46 von 49

1

QUESTION 46
You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external
partner. Which of the following activities should you do first?

Wähle eine oder mehr der folgenden:

A. Create a new logical-server object to represent your partner's CA.
B. Exchange exported CA keys and use them to create a new server object to represent your partner's
Certificate Authority (CA).
C. Manually import your partner's Certificate Revocation List.
D. Manually import your partner's Access Control List.

Erklärung

Frage 47 von 49

1

QUESTION 47
Your company is still using traditional mode VPN configuration on all Gateways and policies. Your manager
now requires you to migrate to a simplified VPN policy to benefit from the new features. This needs to be
done with no downtime due to critical applications which must run constantly.
How would you start such a migration?

Wähle eine oder mehr der folgenden:

A. This cannot be done without downtime as a VPN between a traditional mode Gateway and a simplified
mode Gateway does not work.
B. This can not be done as it requires a SIC- reset on the Gateways first forcing an outage.
C. You first need to completely rewrite all policies in simplified mode and then push this new policy to all
Gateways at the same time.
D. Convert the required Gateway policies using the simplified VPN wizard, check their logic and then
migrate Gateway per Gateway.

Erklärung

Frage 48 von 49

1

QUESTION 48
Your manager requires you to setup a VPN to a new business partner site. The administrator from the
partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256
for IKE phase 2. Why is this a problematic setup?

Wähle eine oder mehr der folgenden:

A. The two algorithms do not have the same key length and so don't work together. You will get the error
.... No proposal chosen....
B. All is fine as the longest key length has been chosen for encrypting the data and a shorter key length for
higher performance for setting up the tunnel.
C. Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in
phase 2 only costs performance and does not add security due to a shorter key in phase 1.
D. All is fine and can be used as is.

Erklärung

Frage 49 von 49

1

QUESTION 49
Why are certificates preferred over pre-shared keys in an IPsec VPN?

Wähle eine oder mehr der folgenden:

A. Weak performancE. PSK takes more time to encrypt than Diffie-Hellman.
B. Weak Security: PSK are static and can be brute-forced.
C. Weak security: PSKs can only have 112 bit length.
D. Weak scalability: PSKs need to be set on each and every Gateway.

	Erstellt von Gustavo Gonçalves vor etwa 9 Jahre

Exam 4 - CCSA 156-215 v7

Exam 4 - CCSA 156-215 v7

Frage 1 von 49

QUESTION 1 Identify the ports to which the Client Authentication daemon listens by default.

Wähle eine oder mehr der folgenden:

Erklärung

Frage 2 von 49

QUESTION 2 What is the Manual Client Authentication TELNET port?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 3 von 49

QUESTION 3 Your company's Security Policy forces users to authenticate to the Gateway explicitly, before they can use any services. The Gateway does not allow the Telnet service to itself from any location. How would you configure authentication on the Gateway? With a:

Wähle eine oder mehr der folgenden:

Erklärung

Frage 4 von 49

QUESTION 4 Which authentication type permits five different sign-on methods in the authentication properties window?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 5 von 49

QUESTION 5 Which Client Authentication sign-on method requires the user to first authenticate via the User Authentication mechanism, when logging in to a remote server with Telnet?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 6 von 49

QUESTION 6 Which Security Gateway R77 configuration setting forces the Client Authentication authorization time-out to refresh, each time a new user is authenticated? The:

Wähle eine oder mehr der folgenden:

Erklärung

Frage 7 von 49

QUESTION 7 All R77 Security Servers can perform authentication with the exception of one. Which of the Security Servers can NOT perform authentication?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 8 von 49

QUESTION 8 Which of the following are authentication methods that Security Gateway R77 uses to validate connection attempts? Select the response below that includes the MOST complete list of valid authentication methods.

Wähle eine oder mehr der folgenden:

Erklärung

Frage 9 von 49

QUESTION 9 Security Gateway R77 supports User Authentication for which of the following services? Select the response below that contains the MOST correct list of supported services.

Wähle eine oder mehr der folgenden:

Erklärung

Frage 10 von 49

QUESTION 10 With the User Directory Software Blade, you can create R77 user definitions on a(n) _________ Server.

Wähle eine oder mehr der folgenden:

Erklärung

Frage 11 von 49

QUESTION 11 The User Directory Software Blade is used to integrate which of the following with Security Gateway R77?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 12 von 49

QUESTION 12 If you are experiencing LDAP issues, which of the following should you check?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 13 von 49

QUESTION 13 Which type of R77 Security Server does not provide User Authentication?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 14 von 49

QUESTION 14 You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 15 von 49

QUESTION 15 For which service is it NOT possible to configure user authentication?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 16 von 49

QUESTION 16 Charles requests a Website while using a computer not in the net_singapore network. What is TRUE about his location restriction? Exhibit:

Wähle eine oder mehr der folgenden:

Erklärung

Frage 17 von 49

QUESTION 17 In the Rule Base displayed, user authentication in Rule 4 is configured as fully automatic. Eric is a member of the LDAP group, MSD_Group. What happens when Eric tries to connect to a server on the Internet?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 18 von 49

QUESTION 18 Which of the following is an authentication method used by Identity Awareness?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 19 von 49

QUESTION 19 What is the purpose of an Identity Agent?

Wähle eine oder mehr der folgenden:

Erklärung

Frage 20 von 49

QUESTION 20 What type of traffic can be re-directed to the Captive Portal?

QUESTION 1
Identify the ports to which the Client Authentication daemon listens by default.

QUESTION 2
What is the Manual Client Authentication TELNET port?

QUESTION 3
Your company's Security Policy forces users to authenticate to the Gateway explicitly, before they can use
any services. The Gateway does not allow the Telnet service to itself from any location. How would you
configure authentication on the Gateway? With a:

QUESTION 4
Which authentication type permits five different sign-on methods in the authentication properties window?

QUESTION 5
Which Client Authentication sign-on method requires the user to first authenticate via the User
Authentication mechanism, when logging in to a remote server with Telnet?

QUESTION 6
Which Security Gateway R77 configuration setting forces the Client Authentication authorization time-out to
refresh, each time a new user is authenticated? The:

QUESTION 7
All R77 Security Servers can perform authentication with the exception of one. Which of the Security
Servers can NOT perform authentication?

QUESTION 8
Which of the following are authentication methods that Security Gateway R77 uses to validate connection
attempts? Select the response below that includes the MOST complete list of valid authentication methods.

QUESTION 9
Security Gateway R77 supports User Authentication for which of the following services? Select the
response below that contains the MOST correct list of supported services.

QUESTION 10
With the User Directory Software Blade, you can create R77 user definitions on a(n) _________ Server.

QUESTION 11
The User Directory Software Blade is used to integrate which of the following with Security Gateway R77?

QUESTION 12
If you are experiencing LDAP issues, which of the following should you check?

QUESTION 13
Which type of R77 Security Server does not provide User Authentication?

QUESTION 14
You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to
be defined via SmartDashboard?

QUESTION 15
For which service is it NOT possible to configure user authentication?

QUESTION 16
Charles requests a Website while using a computer not in the net_singapore network. What is TRUE about
his location restriction?

Exhibit:

QUESTION 17
In the Rule Base displayed, user authentication in Rule 4 is configured as fully automatic. Eric is a member
of the LDAP group, MSD_Group.
What happens when Eric tries to connect to a server on the Internet?

QUESTION 18
Which of the following is an authentication method used by Identity Awareness?

QUESTION 19
What is the purpose of an Identity Agent?

QUESTION 20
What type of traffic can be re-directed to the Captive Portal?

QUESTION 21
The Captive Portal tool:

QUESTION 22
Captive Portal is a __________ that allows the gateway to request login information from the user.

QUESTION 23
Complete this statement from the options provided. Using Captive Portal, unidentified users may be either;
blocked, allowed to enter required credentials, or required to download the _____________.

QUESTION 24
Users with Identity Awareness Agent installed on their machines login with __________, so that when the
user logs into the domain, that information is also used to meet Identity Awareness credential requests.

QUESTION 25
Which of the following methods is NOT used by Identity Awareness to catalog identities?

QUESTION 26
When using AD Query to authenticate users for Identity Awareness, identity data is received seamlessly
from the Microsoft Active Directory (AD). What is NOT a recommended usage of this method?

QUESTION 27
The Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
What is not a recommended usage of this method?

QUESTION 28
Which of the following is NOT a valid option when configuring access for Captive Portal?

QUESTION 29
If you were NOT using IKE aggressive mode for your IPsec tunnel, how many packets would you see for
normal Phase 1 exchange?

QUESTION 30
How many packets does the IKE exchange use for Phase 1 Main Mode?

QUESTION 31
How many packets does the IKE exchange use for Phase 1 Aggressive Mode?

QUESTION 32
Which of the following actions take place in IKE Phase 2 with Perfect Forward Secrecy disabled?

QUESTION 33
Which of the following commands can be used to remove site-to-site IPsec Security Association (SA)?

QUESTION 34
How many packets are required for IKE Phase 2?

QUESTION 35
Which of the following actions do NOT take place in IKE Phase 1?

QUESTION 36
When using vpn tu, which option must you choose if you only want to clear phase 2 for a specific IP
(gateway)?
Exhibit:

QUESTION 37
When using vpn tu, which option must you choose if you want to rebuild your VPN for a specific IP
(gateway)?
Exhibit: