Quiz
Untitled
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (100)
1How granular may an administrator filter an Access Role with identity awareness? Per:
- ASpecific ICA Certificate
- BAD User
- CRadius Group
- DWindows Domain
2Which of the following authentication methods can be configured in the Identity Awareness setup wizard?
- ATACACS
- BCaptive Portal
- CCheck Point Password
- DWindows password
3Which of the following authentication methods can be configured in the Identity Awareness setup wizard?
- ACheck Point Password
- BTACACS
- CLDAP
- DWindows password
4What gives administrators more flexibility when configuring Captive Portal instead of LDAP query for Identity Awareness authentication?
- ACaptive Portal is more secure than standard LDAP
- BNothing, LDAP query is required when configuring Captive Portal
- CCaptive Portal works with both configured users and guests
- DCaptive Portal is more transparent to the user
5Can you use Captive Portal with HTTPS?
- ANo, it only works with FTP
- BNo, it only works with FTP and HTTP
- CYes
- DNo, it only works with HTTP
6Which of the following is NOT defined by an Access Role object?
- ASource Network
- BSource Machine
- CSource User
- DSource Server
7In which Rule Base can you implement an Access Role?
- ADLP
- BMobile Access
- CIPS
- DFirewall
8Access Role objects define users, machines, and network locations as:
- ACredentialed objects
- BLinked objects
- COne object
- DSeparate objects
9Where do you verify that UserDirectory is enabled?
- AVerify that Security Gateway > General Properties > Authentication > Use UserDirectory (LDAP) for Security Gateways is checked
- BVerify that Global Properties > Authentication > Use UserDirectory (LDAP) for Security Gateways is checked
- CVerify that Security Gateway > General Properties > UserDirectory (LDAP) > Use UserDirectory (LDAP) for Security Gateways is checked
- DVerify that Global Properties > UserDirectory (LDAP) > Use UserDirectory (LDAP) for Security Gateways is checked
10Which of the following statements is TRUE about management plug-ins?
- AA management plug-in interacts with a Security Management Server to provide new features and support for new products.
- BInstalling a management plug-in is just like an upgrade process.
- CUsing a plug-in offers full central management only if special licensing is applied to specific features of the plug-in.
- DThe plug-in is a package installed on the Security Gateway.
11You are installing a Security Management Server. Your security plan calls for three administrators for this particular server. How many can you create during installation?
- AOne
- BOnly one with full access and one with read-only access
- CAs many as you want
- DDepends on the license installed on the Security Management Server
12During which step in the installation process is it necessary to note the fingerprint for first-time verification?
- AWhen configuring the Gateway in the WebUI
- BWhen configuring the Security Management Server using cpconfig
- CWhen establishing SIC between the Security Management Server and the Gateway
- DWhen configuring the Security Gateway object in SmartDashboard
13How can you most quickly reset Secure Internal Communications (SIC) between a Security Management Server and Security Gateway?
- AFrom cpconfig on the Gateway, choose the Secure Internal Communication option and retype the activation key. Next, retype the same key in the Gateway object in SmartDashboard and reinitialize Secure Internal Communications (SIC).
- BUse SmartUpdate to retype the Security Gateway activation key. This will automatically sync SIC to both the Security Management Server and Gateway.
- CFrom the Security Management Server's command line, type fw putkey -p <shared key> <IP Address of Security Gateway>.
- DRun the command fwm sic_reset to reinitialize the Security Management Server Internal Certificate Authority (ICA). Then retype the activation key on the Security Gateway from SmartDashboard.
14How can you recreate the Security Administrator account, which was created during initial Management Server installation on GAiA?
- AExport the user database into an ASCII file with fwm dbexport. Open this file with an editor, and delete the Administrator Account portion of the file. You will be prompted to create a new account.
- BType cpm -a, and provide the existing Administrator's account name. Reset the Security Administrator's password.
- CLaunch cpconfig and delete the Administrator's account. Recreate the account with the same name.
- DLaunch SmartDashboard in the User Management screen, and delete the cpconfig administrator.
15The London Security Gateway Administrator has just installed the Security Gateway and Management Server. He has not changed any default settings. As he tries to configure the Gateway, he is unable to connect. Which troubleshooting suggestion will NOT help him?
- ACheck if some intermediate network device has a wrong routing table entry, VLAN assignment, duplexmismatch, or trunk issue.
- BTest the IP address assignment and routing settings of the Security Management Server, Gateway, and console client.
- CVerify the SIC initialization.
- DVerify that the Rule Base explicitly allows management connections.
16You need to completely reboot the Operating System after making which of the following changes on the
Security Gateway? (i.e. the command cprestart is not sufficient.)
1. Adding a hot-swappable NIC to the Operating System for the first time.
2. Uninstalling the R77 Power/UTM package.
3. Installing the R77 Power/UTM package.
4. Re-establishing SIC to the Security Management Server.
5. Doubling the maximum number of connections accepted by the Security Gateway.- A3 only
- B2, 3 only
- C1, 2, 3, 4, and 5
- D3, 4, and 5 only
17The Security Gateway is installed on GAiA R77 The default port for the Web User Interface is _______.
- ATCP 18211
- BTCP 443
- CTCP 4433
- DTCP 257
18Over the weekend, an Administrator without access to SmartDashboard installed a new R77 Security Gateway using GAiA. You want to confirm communication between the Gateway and the Management Server by installing the Security Policy. What might prevent you from installing the Policy?
- AYou have not established Secure Internal Communications (SIC) between the Security Gateway and Management Server. You must initialize SIC on both the Security Gateway and the Management Server.
- BYou first need to run the command fw unloadlocal on the new Security Gateway.
- CYou first need to initialize SIC in SmartUpdate.
- DYou have not established Secure Internal Communications (SIC) between the Security Gateway and Management Server. You must initialize SIC on the Security Management Server.
19An Administrator without access to SmartDashboard installed a new IPSO-based R77 Security Gateway over the weekend. He e-mailed you the SIC activation key. You want to confirm communication between the Security Gateway and the Management Server by installing the Policy. What might prevent you from installing the Policy?
- AAn intermediate local Security Gateway does not allow a policy install through it to the remote new Security Gateway appliance. Resolve by running the command fw unloadlocal on the local Security Gateway.
- BYou first need to run the command fw unloadlocal on the R77 Security Gateway appliance in order to remove the restrictive default policy.
- CYou first need to create a new Gateway object in SmartDashboard, establish SIC via the Communication button, and define the Gateway's topology.
- DYou have not established Secure Internal Communications (SIC) between the Security Gateway and Management Server. You must initialize SIC on the Security Management Server.
20How can you reset the Security Administrator password that was created during initial Security Management Server installation on GAiA?
- ALaunch SmartDashboard in the User Management screen, and edit the cpconfig administrator.
- BAs expert user Type fwm -a, and provide the existing administrator's account name. Reset the Security Administrator's password.
- CType cpm -a, and provide the existing administrator's account name. Reset the Security Administrator's password.
- DExport the user database into an ASCII file with fwm dbexport. Open this file with an editor, and delete the Password portion of the file. Then log in to the account without a password. You will be prompted to assign a new password.
21You have configured SNX on the Security Gateway. The client connects to the Security Gateway and the user enters the authentication credentials. What must happen after authentication that allows the client to connect to the Security Gateway's VPN domain?
- ASNX modifies the routing table to forward VPN traffic to the Security Gateway.
- BAn office mode address must be obtained by the client.
- CThe SNX client application must be installed on the client.
- DActive-X must be allowed on the client.
22The Tokyo Security Management Server Administrator cannot connect from his workstation in Osaka. Which of the following lists the BEST sequence of steps to troubleshoot this issue?
- ACheck for matching OS and product versions of the Security Management Server and the client. Then, ping the Gateways to verify connectivity. If successful, scan the log files for any denied management packets.
- BVerify basic network connectivity to the local Gateway, service provider, remote Gateway, remote network and target machine. Then, test for firewall rules that deny management access to the target. If successful, verify that pcosaka is a valid client IP address.
- CCheck the allowed clients and users on the Security Management Server. If pcosaka and your user account are valid, check for network problems. If there are no network related issues, this is likely to be a problem with the server itself. Check for any patches and upgrades. If still unsuccessful, open a case with Technical Support.
- DCall Tokyo to check if they can ping the Security Management Server locally. If so, login to sgtokyo, verify management connectivity and Rule Base. If this looks okay, ask your provider if they have some firewall rules that filters out your management traffic.
23Where is the fingerprint generated, based on the output display?
- ASmartConsole
- BSmartUpdate
- CSecurity Management Server
- DSmartDashboard
24Match the following commands to their correct function. Each command has one function only listed. ( esta es la pregunta 24 del test 1)
- AC1>F6; C2>F4; C3>F2; C4>F5
- B( esta es la pregunta 24 del test 1)
25Which command displays the installed Security Gateway version?
- Afw printver
- Bfw ver
- Cfw stat
- Dcpstat -gw
26Which command line interface utility allows the administrator to verify the Security Policy name and timestamp currently installed on a firewall module?
- Acpstat fwd
- Bfw ver
- Cfw stat
- Dfw ctl pstat
27Suppose the Security Gateway hard drive fails and you are forced to rebuild it. You have a snapshot file stored to a TFTP server and backups of your Security Management Server. What is the correct procedure for rebuilding the Gateway quickly?
- AReinstall the base operating system (i.e., GAiA). Configure the Gateway interface so that the Gateway can communicate with the TFTP server. Revert to the stored snapshot image, and install the Security Policy.
- BRun the command revert to restore the snapshot, establish SIC, and install the Policy.
- CRun the command revert to restore the snapshot. Reinstall any necessary Check Point products. Establish SIC and install the Policy.
- DReinstall the base operating system (i.e., GAia). Configure the Gateway interface so that the Gateway can communicate with the TFTP server. Reinstall any necessary Check Point products and previously applied hotfixes. Revert to the stored snapshot image, and install the Policy.
28Which of the following statements accurately describes the command upgrade_export?
- Aupgrade_export stores network-configuration data, objects, global properties, and the database revisions prior to upgrading the Security Management Server.
- BUsed primarily when upgrading the Security Management Server, upgrade_export stores all object databases and the /conf directories for importing to a newer Security Gateway version.
- Cupgrade_export is used when upgrading the Security Gateway, and allows certain files to be included or excluded before exporting.
- DThis command is no longer supported in GAiA.
29What are you required to do before running the command upgrade_export?
- ARun a cpstop on the Security Gateway.
- BRun a cpstop on the Security Management Server.
- CClose all GUI clients.
- DRun cpconfig and set yourself up as a GUI client.
30A snapshot delivers a complete GAiA backup. The resulting file can be stored on servers or as a local file in /var/CPsnapshot/snapshots. How do you restore a local snapshot named MySnapshot.tgz?
- AReboot the system and call the start menu. Select the option Snapshot Management, provide the Expert password and select [L] for a restore from a local file. Then, provide the correct file name.
- BAs expert user, type the command snapshot -r MySnapshot.tgz.
- CAs expert user, type the command revert --file MySnapshot.tgz.
- DAs expert user, type the command snapshot - R to restore from a local file. Then, provide the correct file name.
31What is the primary benefit of using the command upgrade_export over either backup or snapshot?
- Aupgrade_export is operating system independent and can be used when backup or snapshot is not available.
- Bupgrade_export will back up routing tables, hosts files, and manual ARP configurations, where backup and snapshot will not.
- CThe commands backup and snapshot can take a long time to run whereas upgrade_export will take a much shorter amount of time.
- Dupgrade_export has an option to back up the system and SmartView Tracker logs while backup and snapshot will not.
32What is the syntax for uninstalling a package using newpkg?
- A-u <pathname of package>
- B-i <full pathname of package>
- C-S <pathname of package>
- Dnewpkg CANNOT be used to uninstall a package
33Your primary Security Gateway runs on GAiA. What is the easiest way to back up your Security Gateway R77 configuration, including routing and network configuration files?
- ACopying the directories $FWDIR/conf and $FWDIR/lib to another location.
- BUsing the native GAiA backup utility from command line or in the Web based user interface.
- CUsing the command upgrade_export.
- DRun the pre_upgrade_verifier and save the .tgz file to the directory /temp.
34You need to back up the routing, interface, and DNS configuration information from your R77 GAiA Security Gateway. Which backup-and-restore solution do you use?
- AManual copies of the directory $FWDIR/conf
- BGAiA back up utilities
- Cupgrade_export and upgrade_import commands
- DDatabase Revision Control
35You are running a R77 Security Gateway on GAiA. In case of a hardware failure, you have a server with the exact same hardware and firewall version installed. What back up method could be used to quickly put the secondary firewall into production?
- Amanual backup
- Bupgrade_export
- Cbackup
- Dsnapshot
36Before upgrading SecurePlatform to GAiA, you should create a backup. To save time, many administrators use
the command backup. This creates a backup of the Check Point configuration as well as the system
configuration.
An administrator has installed the latest HFA on the system for fixing traffic problem after creating a backup file.
There is a mistake in the very complex static routing configuration. The Check Point configuration has not been
changed. Can the administrator use a restore to fix the errors in static routing?- AThe restore is not possible because the backup file does not have the same build number (version).
- BThe restore is done by selecting Snapshot Management from the boot menu of GAiA.
- CThe restore can be done easily by the command restore and copying netconf.C from the production environment.
- DA backup cannot be restored, because the binary files are missing.
37Which operating systems are supported by a Check Point Security Gateway on an open server? Select MOST complete list.
- ASun Solaris, Red Hat Enterprise Linux, Check Point SecurePlatform, IPSO, Microsoft Windows
- BCheck Point GAiA and SecurePlatform, and Microsoft Windows
- CCheck Point GAiA, Microsoft Windows, Red Hat Enterprise Linux, Sun Solaris, IPSO
- DCheck Point GAiA and SecurePlatform, IPSO, Sun Solaris, Microsoft Windows
38You intend to upgrade a Check Point Gateway from R71 to R77. Prior to upgrading, you want to back up the Gateway should there be any problems with the upgrade. Which of the following allows for the Gateway configuration to be completely backed up into a manageable size in the least amount of time?
- Adatabase revision
- Bsnapshot
- Cupgrade_export
- Dbackup
39An advantage of using central instead of local licensing is:
- AA license can be taken from one Security Management Server and given to another Security Management Server.
- BOnly one IP address is used for all licenses.
- CThe license must be renewed when changing the IP address of a Security Gateway. Each module's license has a unique IP address.
- DLicenses are automatically attached to their respective Security Gateways.
40You are running the license_upgrade tool on your GAiA Gateway. Which of the following can you NOT do with the upgrade tool?
- APerform the actual license-upgrade process
- BSimulate the license-upgrade process
- CView the licenses in the SmartUpdate License Repository
- DView the status of currently installed licenses
41If a SmartUpdate upgrade or distribution operation fails on GAiA, how is the system recovered?
- AThe Administrator can only revert to a previously created snapshot (if there is one) with the command cprinstall snapshot <object name> <filename>.
- BThe Administrator must reinstall the last version via the command cprinstall revert <object name> <file name>.
- CThe Administrator must remove the rpm packages manually, and re-attempt the upgrade.
- DGAiA will reboot and automatically revert to the last snapshot version prior to upgrade.
42Why should the upgrade_export configuration file (.tgz) be deleted after you complete the import process?
- ASmartUpdate will start a new installation process if the machine is rebooted.
- BIt will prevent a future successful upgrade_export since the .tgz file cannot be overwritten.
- CIt contains your security configuration, which could be exploited.
- DIt will conflict with any future upgrades when using SmartUpdate.
43Which of these components does NOT require a Security Gateway R77 license?
- ASecurity Management Server
- BCheck Point Gateway
- CSmartConsole
- DSmartUpdate upgrading/patching
44If a Security Gateway enforces three protections, LDAP Injection, Malicious Code Protector, and Header Rejection, which Check Point license is required in SmartUpdate?
- AIPS
- BSSL: VPN
- CSmartEvent Intro
- DData Loss Prevention
45Central license management allows a Security Administrator to perform which of the following functions?
1. Check for expired licenses.
2. Sort licenses and view license properties.
3. Attach both R77 Central and Local licesnes to a remote module.
4. Delete both R77 Local Licenses and Central licenses from a remote module.
5. Add or remove a license to or from the license repository.
6. Attach and/or delete only R77 Central licenses to a remote module (not Local licenses).- A1, 2, 5, & 6
- B2, 3, 4, & 5
- C2, 5, & 6
- D1, 2, 3, 4, & 5
46Which command gives an overview of your installed licenses?
- Acplicense
- Bshowlic
- Cfw lic print
- Dcplic print
47Where are SmartEvent licenses installed?
- ASmartEvent server
- BLog Server
- CSecurity Management Server
- DSecurity Gateway
48ALL of the following options are provided by the GAiA sysconfig utility, EXCEPT:
- AExport setup
- BDHCP Server configuration
- CTime & Date
- DGUI Clients
49Which of the following options is available with the GAiA cpconfig utility on a Management Server?
- AExport setup
- BDHCP Server configuration
- CGUI Clients
- DTime & Date
50Which command would provide the most comprehensive diagnostic information to Check Point Technical Support?
- Afw cpinfo
- Bcpinfo -o date.cpinfo.txt
- Cdiag
- Dcpstat - date.cpstat.txt
51Which of the following statements accurately describes the command snapshot?
- Asnapshot creates a full OS-level backup, including network-interface data, Check Point product information, and configuration settings during an upgrade of a GAiA Security Gateway.
- Bsnapshot creates a Security Management Server full system-level backup on any OS.
- Csnapshot stores only the system-configuration settings on the Gateway.
- DA Gateway snapshot includes configuration settings and Check Point product information from the remote Security Management Server.
52How do you recover communications between your Security Management Server and Security Gateway if you lock yourself out through a rule or policy mis-configuration?
- Afw unload policy
- Bfw unloadlocal
- Cfw delete all.all@localhost
- Dfwm unloadlocal
53How can you check whether IP forwarding is enabled on an IP Security Appliance?
- Aclish -c show routing active enable
- Bcat /proc/sys/net/ipv4/ip_forward
- Cecho 1 > /proc/sys/net/ipv4/ip_forward
- Dipsofwd list
54Which command allows you to view the contents of an R77 table?
- Afw tab -a <tablename>
- Bfw tab -t <tablename>
- Cfw tab -s <tablename>
- Dfw tab -x <tablename>
55Which of the following tools is used to generate a Security Gateway R77 configuration report?
- Afw cpinfo
- BinfoCP
- Ccpinfo
- Dinfoview
56Which of the following is a CLI command for Security Gateway R77?
- Afw tab -u
- Bfw shutdown
- Cfw merge
- Dfwm policy_print <policyname>
57You are the Security Administrator for MegaCorp. A Check Point firewall is installed and in use on a platform using GAiA. You have trouble configuring the speed and duplex settings of your Ethernet interfaces. Which of the following commands can be used in CLISH to configure the speed and duplex settings of an Ethernet interface and will survive a reboot? Give the BEST answer.
- Aethtool
- Bset interface <options>
- Cmii_tool
- Difconfig -a
58Which command enables IP forwarding on IPSO?
- Aipsofwd on admin
- Becho 0 > /proc/sys/net/ipv4/ip_forward
- Cclish -c set routing active enable
- Decho 1 > /proc/sys/net/ipv4/ip_forward
59Which of the following objects is a valid source in an authentication rule?
- AHost@Any
- BUser@Network
- CUser_group@Network
- DUser@Any
60You find that Users are not prompted for authentication when they access their Web servers, even though you have created an HTTP rule via User Authentication. Choose the BEST reason why.
- AYou checked the cache password on desktop option in Global Properties.
- BAnother rule that accepts HTTP without authentication exists in the Rule Base.
- CYou have forgotten to place the User Authentication Rule before the Stealth Rule.
- DUsers must use the SecuRemote Client, to use the User Authentication Rule.
61Which authentication type requires specifying a contact agent in the Rule Base?
- AClient Authentication with Partially Automatic Sign On
- BClient Authentication with Manual Sign On
- CUser Authentication
- DSession Authentication
62What is the difference between Standard and Specific Sign On methods?
- AStandard Sign On allows the user to be automatically authorized for all services that the rule allows. Specific Sign On requires that the user re-authenticate for each service specifically defined in the window Specific Action Properties.
- BStandard Sign On allows the user to be automatically authorized for all services that the rule allows, but reauthenticate for each host to which he is trying to connect. Specific Sign On requires that the user reauthenticate for each service.
- CStandard Sign On allows the user to be automatically authorized for all services that the rule allows. Specific Sign On requires that the user re-authenticate for each service and each host to which he is trying to connect.
- DStandard Sign On requires the user to re-authenticate for each service and each host to which he is trying to connect. Specific Sign On allows the user to sign on only to a specific IP address.
63Which set of objects have an Authentication tab?
- ATemplates, Users
- BUsers, Networks
- CUsers, User Groups
- DNetworks, Hosts
64How are cached usernames and passwords cleared from the memory of a R77 Security Gateway?
- ABy using the Clear User Cache button in SmartDashboard.
- BUsernames and passwords only clear from memory after they time out.
- CBy retrieving LDAP user information using the command fw fetchldap.
- DBy installing a Security Policy.
65Your users are defined in a Windows 2008 R2 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R77?
- AExternal-user group
- BLDAP group
- CA group with a generic user
- DAll Users
66Assume you are a Security Administrator for ABCTech. You have allowed authenticated access to users from Mkting_net to Finance_net. But in the user's properties, connections are only permitted within Mkting_net. What is the BEST way to resolve this conflict?
- ASelect Ignore Database in the Action Properties window.
- BPermit access to Finance_net.
- CSelect Intersect with user database in the Action Properties window.
- DSelect Intersect with user database or Ignore Database in the Action Properties window.
67For remote user authentication, which authentication scheme is NOT supported?
- ACheck Point Password
- BRADIUS
- CTACACS
- DSecurID
68Review the rules.
Assume domain UDP is enabled in the impled rules.
What happens when a user from the internal network tries to browse to the internet using HTTP? The user:
(EXAMEN 1 PREGUNTA 68)- Acan connect to the Internet successfully after being authenticated.
- Bis prompted three times before connecting to the Internet successfully.
- Ccan go to the Internet after Telnetting to the client authentication daemon port 259.
- Dcan go to the Internet, without being prompted for authentication.
69Study the Rule base and Client Authentication Action properties screen -
After being authenticated by the Security Gateway, when a user starts an HTTP connection to a Web site, the
user tries to FTP to another site using the command line. What happens to the user?
(EXAMEN 1 PREGUNTA 69)- Auser is prompted for authentication by the Security Gateway again.
- BFTP data connection is dropped after the user is authenticated successfully.
- Cuser is prompted to authenticate from that FTP site only, and does not need to enter his username and password for Client Authentication.
- DFTP connection is dropped by Rule 2.
70One of your remote Security Gateway's suddenly stops sending logs, and you cannot install the Security Policy on the Gateway. All other remote Security Gateways are logging normally to the Security Management Server, and Policy installation is not affected. When you click the Test SIC status button in the problematic Gateway object, you receive an error message. What is the problem?
- AThe remote Gateway's IP address has changed, which invalidates the SIC Certificate.
- BThe time on the Security Management Server's clock has changed, which invalidates the remote Gateway's Certificate.
- CThe Internal Certificate Authority for the Security Management Server object has been removed from objects_5_0.C.
- DThere is no connection between the Security Management Server and the remote Gateway. Rules or routing may block the connection.
71What information is found in the SmartView Tracker Management log?
- ASIC revoke certificate event
- BDestination IP address
- CMost accessed Rule Base rule
- DNumber of concurrent IKE negotiations
72What information is found in the SmartView Tracker Management log?
- AHistorical reports log
- BPolicy rule modification date/time stamp
- CDestination IP address
- DMost accessed Rule Base rule
73What information is found in the SmartView Tracker Management log?
- ACreation of an administrator using cpconfig
- BGAiA expert login event
- CFTP username authentication failure
- DAdministrator SmartDashboard logout event
74How do you use SmartView Monitor to compile traffic statistics for your company's Internet Web activity during production hours?
- ASelect Tunnels view, and generate a report on the statistics.
- BConfigure a Suspicious Activity Rule which triggers an alert when HTTP traffic passes through the Gateway.
- CUse Traffic settings and SmartView Monitor to generate a graph showing the total HTTP traffic for the day.
- DView total packets passed through the Security Gateway.
75What happens when you run the command. fw sam -J src [Source IP Address]?
- AConnections from the specified source are blocked without the need to change the Security Policy.
- BConnections to the specified target are blocked without the need to change the Security Policy.
- CConnections to and from the specified target are blocked without the need to change the Security Policy.
- DConnections to and from the specified target are blocked with the need to change the Security Policy.
76An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.
Which of the following is the BEST explanation for this behavior?- AThe setting Log does not capture this level of detail for GRE. Set the rule tracking action to Audit since certain types of traffic can only be tracked this way.
- BThe log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt. Because it is encrypted, the R77 Security Gateway cannot distinguish between GRE sessions. This is a known issue with GRE. Use IPSEC instead of the non-standard GRE protocol for encapsulation.
- CThe Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.
- DThe Log Server is failing to log GRE traffic properly because it is VPN traffic. Disable all VPN configuration to the partner site to enable proper logging.
77Which port must be allowed to pass through enforcement points in order to allow packet logging to operate correctly?
- A514
- B257
- C256
- D258
78You are the Security Administrator for MegaCorp and would like to view network activity using SmartReporter. You select a standard predefined report. As you can see here, you can select the london Gateway.
(EXAMEN 1 PREGUNTA 78)- AYou must enable the Eventia Express Mode on the london Gateway.
- BYou have the license for Eventia Reporter in Standard mode only.
- CYou must enable the Express Mode inside Eventia Reporter.
- DYou must enable Monitoring in the london Gateway object's General Properties.
79In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?
- ARule 0
- BBlank field under Rule Number
- CRule 1
- DCleanup Rule
80A third-shift Security Administrator configured and installed a new Security Policy early this morning. When you arrive, he tells you that he has been receiving complaints that Internet access is very slow. You suspect the Security Gateway virtual memory might be the problem. Which SmartConsole component would you use to verify this?
- AEventia Analyzer
- BSmartView Tracker
- CSmartView Monitor
- DThis information can only be viewed with the command fw ctl pstat from the CLI.
81You find a suspicious connection from a problematic host. You decide that you want to block everything from that whole network, not just the problematic host. You want to block this for an hour while you investigate further, but you do not want to add any rules to the Rule Base. How do you achieve this?
- AUse dbedit to script the addition of a rule directly into the Rule Bases_5_0.fws configuration file.
- BSelect Block intruder from the Tools menu in SmartView Tracker.
- CCreate a Suspicious Activity Rule in SmartView Monitor.
- DAdd a temporary rule using SmartDashboard and select hide rule.
82In SmartDashboard, you configure 45 MB as the required free hard-disk space to accommodate logs. What can you do to keep old log files, when free space falls below 45 MB?
- ADo nothing. Old logs are deleted, until free space is restored.
- BUse the command fwm logexport to export the old log files to another location.
- CConfigure a script to run fw logswitch and SCP the output file to a separate file server.
- DDo nothing. The Security Management Server automatically copies old logs to a backup server before purging.
83How do you configure an alert in SmartView Monitor?
- AAn alert cannot be configured in SmartView Monitor.
- BBy choosing the Gateway, and Configure Thresholds.
- CBy right-clicking on the Gateway, and selecting Properties.
- DBy right-clicking on the Gateway, and selecting System Information.
84True or FalsE. SmartView Monitor can be used to create alerts on a specified Gateway.
- ATrue, by right-clicking on the Gateway and selecting Configure Thresholds.
- BTrue, by choosing the Gateway and selecting System Information.
- CFalse, an alert cannot be created for a specified Gateway.
- DFalse, alerts can only be set in SmartDashboard Global Properties.
85Which R77 SmartConsole tool would you use to verify the installed Security Policy name on a Security Gateway?
- ASmartView Monitor
- BSmartUpdate
- CSmartView Status
- DNone, SmartConsole applications only communicate with the Security Management Server.
86Which R77 GUI would you use to see the number of packets accepted since the last policy install?
- ASmartView Monitor
- BSmartView Tracker
- CSmartDashboard
- DSmartView Status
87You are trying to save a custom log query in R77 SmartView Tracker, but getting the following error:
Could not save <query-name> (Error: Database is Read Only)
Which of the following is a likely explanation for this?- AAnother administrator is currently connected to the Security Management Server with read/write permissions which impacts your ability to save custom log queries to the Security Management Server.
- BYou do not have OS write permissions on the local SmartView Tracker PC in order to save the custom query locally.
- CYou have read-only rights to the Security Management Server database.
- DYou do not have the explicit right to save a custom query in your administrator permission profile under SmartConsole customization.
88The R77 fw monitor utility is used to troubleshoot which of the following problems?
- ATraffic issues
- BLog Consolidation Engine
- CUser data base corruption
- DPhase two key negotiation
89You are the Security Administrator for MegaCorp. In order to see how efficient your firewall Rule Base is, you would like to see how often the particular rules match. Where can you see it? Give the BEST answer.
- AIn the SmartView Tracker, if you activate the column Matching Rate.
- BIn SmartReporter, in the section Firewall Blade - Activity > Network Activity with information concerning Top Matched Logged Rules.
- CSmartReporter provides this information in the section Firewall Blade - Security > Rule Base Analysis with information concerning Top Matched Logged Rules.
- DIt is not possible to see it directly. You can open SmartDashboard and select UserDefined in the Track column. Afterwards, you need to create your own program with an external counter.
90A company has disabled logging for some of the most commonly used Policy rules. This was to decrease load on the Security Management Server and to make tracking dropped connections easier. What action would you recommend to get reliable statistics about the network traffic using SmartReporter?
- ASmartReporter analyzes all network traffic, logged or not.
- BNetwork traffic cannot be analyzed when the Security Management Server has a high load.
- CTurn the field Track of each rule to LOG.
- DConfigure Additional Logging on an additional log server.
91What is a Consolidation Policy?
- AThe collective name of the Security Policy, Address Translation, and IPS Policies.
- BThe specific Policy written in SmartDashboard to configure which log data is stored in the SmartReporter database.
- CThe collective name of the logs generated by SmartReporter.
- DA global Policy used to share a common enforcement policy for multiple Security Gateways.
92Which feature in R77 permits blocking specific IP addresses for a specified time period?
- ASuspicious Activity Monitoring
- BHTTP Methods
- CLocal Interface Spoofing
- DBlock Port Overflow
93You find a suspicious FTP site trying to connect to one of your internal hosts. How do you block it in real time and verify it is successfully blocked? Highlight the suspicious connection in SmartView Tracker:
- ALog mode. Block it using Tools > Block Intruder menu. Observe in the Log mode that the suspicious connection does not appear again in this SmartView Tracker view.
- BLog mode. Block it using Tools > Block Intruder menu. Observe in the Log mode that the suspicious connection is listed in this SmartView Tracker view as "dropped?.
- CActive mode. Block it using Tools > Block Intruder menu. Observe in the Active mode that the suspicious connection does not appear again in this SmartView Tracker view.
- DActive mode. Block it using Tools > Block Intruder menu. Observe in the Active mode that the suspicious connection is listed in this SmartView Tracker view as "dropped?.
94Your Security Gateways are running near performance capacity and will get upgraded hardware next week. Which of the following would be MOST effective for quickly dropping all connections from a specific attacker's IP at a peak time of day?
- AIntrusion Detection System (IDS) Policy install
- BChange the Rule Base and install the Policy to all Security Gateways
- CSAM - Block Intruder feature of SmartView Tracker
- DSAM - Suspicious Activity Rules feature of SmartView Monitor
95Your company enforces a strict change control policy. Which of the following would be MOST effective for quickly dropping an attacker's specific active connection?
- AChange the Rule Base and install the Policy to all Security Gateways
- BBlock Intruder feature of SmartView Tracker
- CIntrusion Detection System (IDS) Policy install
- DSAM - Suspicious Activity Rules feature of SmartView Monitor
96______________ is an R77 component that displays the number of packets accepted, rejected, and dropped on a specific Security Gateway, in real time.
- ASmartEvent
- BSmartView Status
- CSmartUpdate
- DSmartView Monitor
97You have just installed your Gateway and want to analyze the packet size distribution of your traffic with SmartView Monitor
(EXAMEN 1 PREGUNTA 97)- APurchase the SmartView Monitor license for your Security Management Server.
- BEnable Monitoring on your Security Management Server.
- CPurchase the SmartView Monitor license for your Security Gateway.
- DEnable Monitoring on your Security Gateway.
98You want to configure a mail alert for every time the policy is installed to a specific Gateway. Where would you configure this alert?
- AIn SmartView Monitor, select Gateway > Configure Thresholds and in SmartDashboard select Global Properties > Log and Alerts > Alert Commands.
- BIn SmartDashboard, select Global Properties > Log and Alerts > Alert Commands.
- CYou cannot create a mail alert for Policy installation.
- DIn SmartView Monitor, select Gateway > Configure Thresholds.
99Your boss wants you to closely monitor an employee suspected of transferring company secrets to the competition. The IT department discovered the suspect installed a WinSCP client in order to use encrypted communication. Which of the following methods is BEST to accomplish this task?
- AUse SmartView Tracker to follow his actions by filtering log entries that feature the WinSCP destination port. Then, export the corresponding entries to a separate log file for documentation.
- BUse SmartDashboard to add a rule in the firewall Rule Base that matches his IP address, and those of potential targets and suspicious protocols. Apply the alert action or customized messaging.
- CWatch his IP in SmartView Monitor by setting an alert action to any packet that matches your Rule Base and his IP address for inbound and outbound traffic.
- DSend the suspect an email with a keylogging Trojan attached, to get direct information about his wrongdoings.
100You install and deploy GAiA with default settings. You allow Visitor Mode in the Gateway object's Remote Access properties and install policy. What additional steps are required for this to function correctly?
- AYou need to start SSL Network Extender first, then use Visitor Mode.
- BSet Visitor Mode in Policy > Global Properties > Remote-Access > VPN - Advanced.
- COffice mode is not configured.
- DThe WebUI on GAiA runs on port 443 (HTTPS). When you configure Visitor Mode it cannot bind to default port 443, because it's used by another program (WebUI). With multi-port no additional changes are necessary.
Information
- Description
- Quiz on Untitled, created by jose.escolar.mor on 24/02/2015.
- Author
- jose.escolar.mor
- Language
- Español
- Views
- 14
- Rating
- No ratings yet Rate this quiz