Quiz
CCCS V2
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (92)
1What is Operational Excellence?
- AThe ability to use cloud resources efficiently for meeting system requirements, and maintaining that efficiency as demand changes and technologies evolve
- BThe ability to support development and run workloads effectively
- CIn terms of the cloud, security is about architecting every workload to prevent
- DThe ability of a Workload to function correctly and consistently in all expected
2How does CloudGuard CSPM enhance visibility into cloud assets?
- ACSPM does not provide visibility into cloud assets
- BBy manually reviewing each cloud asset once a year
- CBy limiting the reporting on cloud resource configurations
- DThrough comprehensive monitoring and reporting on cloud configurations and security postures
3Which of the following is a fundamental aspect of cloud security?
- AImplementation of strong access control mechanisms
- BUse of public internet for data transmission
- CLimited use of encryption technologies
- DRegularly scheduled physical access to data centers
4To troubleshoot CloudGuard Controller, administrators can execute the following command:
- Acloudguard security
- Bcloudguard troubleshoot
- Ccloudguard on
- Dcloudguard off
5Security Management Servers deployed in a cloud environment can manage which of the following gateways?
- APhysical Security Gateways and CloudGuard IaaS Security Gateways
- BOn-Prem Security Gateways and CloudGuard IaaS Security Gateways on multiple CSP’s
- COnly Security Gateways with the CloudGuard Controller installed
- DOnly CloudGuard IaaS Security Gateways
6Which is not a responsibility of the Customer?
- AGuest OS and Application Patching and Configuration
- BCustomer Employee Training
- CInfrastructure Patching and Configuration
- DService, Communication, and Data Security
7How is CloudGuard for Azure licensed in PAYG (Pay As You Go) mode?
- APer hour based on resources consumed
- BPer Gateway
- CPer Socket
- DPer vCore
8In a scenario where data compliance is critical, how does CloudGuard ensure data is handled according to legal requirements?
- ABy ignoring compliance to improve performance
- BBy physically isolating data in one geographic location
- CBy automating data handling in compliance with laws and regulations
- DBy requiring manual checks on each data transaction
9Which utility allows integration between the Check Point Security Management Server, the CloudGuard Network solution, and the CSPs?
- ACloudGuard Management Extension
- BMaestro
- CElastic Licensing
- DCloudGuard Controlle
10What is Cloud Security according to the Five Pillars?
- AThe ability to support development and run workloads effectively
- BIn terms of the cloud, security is about architecting every workload to prevent
- CThe ability of a Workload to function correctly and consistently in all expected
- DThe ability to use cloud resources efficiently for meeting system requirements, and maintaining that efficiency as demand changes and technologies evolve
11Which autoscaling method requires the VM to temporarily shut down while it processes system modification?
- AVertical Scaling
- BHorizontal Scaling
- CNeither autoscaling method requires the VM to
- DBoth Vertical and Horizontal Scaling
12Which APIs are used by Public clouds and Hybrid clouds to support the interactions between cloud resources, on-premises equipment, scripts, orchestration playbooks and CloudGuard Networ kcloud resources, on-premise equipment, scripts?
- ARepresentational State Transfer (REST) APIs
- BCloudGuard Controller API (CG-API)
- CCloud Security Posture Management (CSPM)
- DCloudGuard Management Extension API (CME-API)
13When using system routes and user defined routes in Azure, which takes precedent?
- AThe system route always takes precedent
- BThe user defined route takes precedent
- CThe newest route takes precedent
- DThe most specific route takes precedent
14In a CloudGuard deployment, what does the acronym IAM stand for?
- AInstant Access Management
- BIP Address Management
- CIdentity and Access Management
- DInformation and Adaptability Measures
15What does CSPM typically monitor in a cloud environment?
- AThe performance metrics of cloud-based applications
- BCompliance with organizational security policies and standards
- CNone, CSPM is not concerned with security
- DOnly the physical components of the cloud
16Which hub serves as the front end of the Workload that permits inbound web communications such as HTTP traffic from the Internet to reach spoke Workloads?
- AWeb Hub
- BSouthbound Hub
- CEast-West Hub
- DNorthbound Hub
17In what way does CloudGuard enhance regulatory compliance for cloud environments?
- ABy providing tools and configurations that help adhere to various compliance standards like GDPR, HIPAA, etc.
- BCompliance is considered outside the scope of CloudGuard capabilities
- CBy automatically adjusting compliance policies to match the least stringent regulations
- DThrough regular manual audits conducted by external agencies
18How does CloudGuard CSPM handle misconfigurations found in the cloud environment?
- ABy sending a physical technician to resolve the issue
- BIgnoring minor misconfigurations unless they cause downtime
- CThrough manual reconfiguration by the cloud administrator
- DBy automatically correcting configurations to align with best practi
19Why is an IAM role created when installing a cluster on AWS?
- AIAM role is created for auditing purposes
- BIn order to perform cluster related changes
- CIAM role is not created
- DIt is created for the installation process only, it gets deleted
20How does CloudGuard's CSPM facilitate regulatory compliance?
- ABy only focusing on non-regulatory aspects
- BProviding detailed compliance reports and real-time compliance monitoring
- CBy ignoring compliance requirements
- DCSPM does not support compliance activities
21Clouds use orchestration platforms to accomplish various deployment tasks. Which of the following is NOT one of those tasks?
- ADeploying environments with complex dependencies.
- BDeploying clustered applications.
- CDeploying endpoint security devices.
- DDeploying multiple data centers.
22How do CloudGuard’s access control policies enhance cloud security?
- ABy restricting access based on user roles and data sensitivity
- BBy improving the physical infrastructure of cloud data centers
- CBy monitoring cloud performance metrics
- DBy providing real-time pricing updates for cloud services
23Which cloud components specify the Workloads associated with traffic and tell load balancers which Workloads are members of the same group?
- AListening Rules
- BHealth Checks
- CTarget Groups
- DDynamic assignment
24Which is not a cloud component?
- AVLAN
- BMarketplace
- CIdentity and Access Management
- DCompute
25Which of these is true of the CloudGuard Controller?
- ACloudGuard Controller maintains visibility of the protected cloud environment
- BCloudGuard Controller only displays cloud-based Security Gateway objects
- CCloudGuard Controller manually updates SmartConsole security tads and API connections
- DCoudGuard Control statically .denies Cloud resources created within a single cloud or a multi- cloud environment.
26Which solution delivers a software platform for public cloud security and compliance orchestration?
- ACloud Security Posture Management
- BCloudGuard SaaS
- CCloudGuard Network Public
- DCloudGuard Network Private
27Which function do Load Balancers perform?
👀⁉- ADirect Internet traffic to spoke networks
- BRestrict traffic loads between servers
- CTrigger capacity on security gateways
- DTo secure balance between private and public clouds
28Can you configure Micro segmentation (control traffic inside a subnet) on Azure?
- ANo. Micro segmentation is not supported on Azure
- BYes. via UDR
- CYes, via System Routes
- DYes, via routes on vNet
29How many AWS Internet gateways can you define in AWS?
- ATwo per VPC
- BOne per VPC
- CUnlimited
- DOne per Region
30Which licensing packages are available for the CloudGuard platform?
- ANGTP & Firewall Only
- BNGTP Only
- CNGTP & NGTX
- DNGTX Only
31The framework for cloud security consists of five basic components, or pillars. Making small, reversible changes is a design principle of which of these five pillars?
- AOperational Excellence
- BPerformance Efficiency
- CCost Optimization
- DReliability
32The Cloud Security Posture Management platform uses REST API calls to carry out the following procedures EXCEPT:
- ADeploy agents to each resource in each region
- BRun the compliance engine and Security Policy groups
- CRemediate non-compliant cloud resources with Cloudbots
- DManage locking and unlocking cloud-based Security Groups and regions
33An organization is using an adaptive security policy where a Data Center Object was imported and used in some rules. When the cloud resource represented by this object changes it’s IP address, how will the change be effected on the Security Gateway?
- AThe change is automatically updated to the Security Management Server and so only a policy install from SmartConsole or with API will be required.
- BThe Data Center Object needs to be refreshed in the SmartConsole and then a policy install will be required.
- CWith a properly functioning configuration, the change will automatically be done on the Security Gateway without any action required by the administrator.
- DIf CloudGuard Controller is enabled on the Security Gateway, the gateway will connect with the Cloud account and synchronize all the Data Center Objects used on it.
34One of the five pillars of the framework for cloud security is ‘Performance Efficiency’. The design principles of Performance Efficiency include:
- AApply security at all layers - Automate security best practices
- BAutomatically recover from failure - Test recovery procedures
- CGo Global in minutes - Use serverless architectures
- DAdopt a consumption model - Measure overall efficiency
35What is vertical scaling?
- ATunes the environment by manually adding or removing resources to an SDDC.
- BTunes the environment by automatically adding or removing resources to the SDN.
- CTunes the environment up and down according to the resource capacity needs.
- DScaling method that does not require a system shutdown to add or remove resources
36The Security Administrator needs to reconfigure the API server, which command would need to be ran?
- Aapi reconfig
- Bapi restart
- Capi reboot
- Dapi reconf
37Cloud Security Posture Management uses CloudBots to assist with ________________.
- Aidentifying where the organization's security posture need
- Bautomatic compliance remediation
- Ccloud account configurations and data flows
- Dsecuring IAM account credentials
38Which of the following is the Customer’s Responsibility in the shared responsibility model used in the cloud?
- ACustomer Employee Training
- BInfrastructure Configuration
- CInfrastructure Patching
- DPhysical and Environment Control
39Automated Security Policy enforcement requires coordinated effort between the Security Management Server, the Security Gateway and:
- AThe Application Server
- BCloudGuard Controller
- CThe Cloud Service Provider
- DThe SmartEvent Server
40What is an alternative method to double NAT in Azure? 👀⁉
- APeering
- BUser Defined Routes
- CSystem Routes
- DScaling
41The best practice for CloudGuard Network deployments utilizes the Hub and Spoke model. Which of these statements is the most correct for this model?
- AAll the security components including SMS, Northbound and Southbound Security Gateways and East-West VPN Gateways will all be deployed in one Hub
- BA Spoke can ONLY consist of a single virtual machine in a dedicated subnet shared between the VM and the Hub
- CThe Hub and Spoke model is applicable ONLY to multi-cloud environments. The Hub includes all the Security Gateways in all cloud environments. Each Spoke includes all resources of a Data-Center in a single Cloud Environment
- DAll traffic that enters and exits each spoke must travel through a hub
42How does the Cloud Security Posture Management (CSPM) service deliver intelligence threat feeds, enforce compliance policies, and apply security enhancement to the environment? 👀⁉
- AThe Cloud Security Posture Management (CSPM) does this by using the SOAP protocol and XML
- BThe Cloud Security Posture Management (CSPM) does this by using SIC connections on the cloud
- CThe Cloud Security Posture Management (CSPM) does this by using REST APIs
- DThe Cloud Security Posture Management (CSPM) does this by .usingSSH and microagents
43What is Performance Efficiency?
- AIn terms of the cloud, security is about architecting every workload to prevent
- BThe ability to use cloud resources efficiently for meeting system requirements, and maintaining that efficiency as demand changes and technologies evolve
- CThe ability to support development and run workloads effectively
- DThe ability of a Workload to function correctly and consistently in all expected
44When Cloud Security Posture Management discovers non-compliant cloud resources, CloudBot applications perform automated remediations to correct any violations. How true is this statement?
- AThis is not true, Cloud Security Posture Management (CSPM) can only report non-compliance and cannot remediate by itself
- BThis is partially true, however the automated remediation is not done by CloudBot applications but it is done by the Security Management Server
- CThis is true, however it requires Full Protection access to the Cloud Account to perform automated remediation
- DThis is not true because CloudBot applications are used to provide chat service to respond to non-compliance alerts
45Which of the following is a common limitation of cloud platforms?
- ANetwork address translations
- BCustom Route Tables
- CIdentity and Access Management
- DPacket Forwarding
46Which software blade provides forensic analysis tools?
- ALogging Blade
- BIdentity Awareness Blade
- CMonitoring Blade
- DSmartEvent Blade
47The framework for cloud security consists of five basic components, or pillars Making small, reversible changes is a design principle of which of these five pillars
- AReliability
- BPerformance Efficiency
- CCost Optimization
- DOperational Excellence
48How is CloudGuard for Azure licensed in BYOL (Bring your own license) mode?
- APer usage
- BPer Socket
- CPer vCore
- DPer Gateway
49Once the Deployment finishes, Cloud Security Posture Management applies default network security posture that does what?
- AMinimizes the risk of external threats by blocking access to high risk sites and external users
- BMinimizes the risk of external threats by blocking accessed to the internet
- CMinimizes the risk of external threats by blocking access to all internal resources
- DMinimizes the risks of external threats by blocking access to services and ports
50Which is not a Pillar of the Framework for the Cloud?
- APerformance Efficiency
- BCost Optimization
- CScalability
- DReliability
51Which Pillar includes the following principals
*Experiment more often
• Go Global in minutes-
• Use serverless architectures- AReliability
- BCost Optimization
- CPerformance Efficiency
- DOperational Excellence
52The integration of cloud resources into the Security Policy requires establishing a secure connection between
- AThe SDDC, CloudGuard Security Gateways, and the Security Management Server
- BThe SDDC and CloudGuard Security Gateways.
- CThe SDDC and the Security Management Server
- DCloudGuard Security Gateways and the Security Management Server
53Which log file should an administrator gather to expedite the diagnosis of a CloudGuard Controller issue?
- A$CPDIR/logs/cloud.elg
- B$DADIR/logs/controller_proxy.elg
- C$FWDIR/logs/cloud_controller.elg
- D$FWDIR/logs/cloud_proxy.elg
54What are two basic rules Check Point recommends for building an effective policy?
- ACleanup and Stealth Rule
- BVPN and Admin Rules
- CImplicit and Explicit Rules
- DAccess and Identity Rules
55Which security principles are indicative of the CloudGuard Secure Public Cloud Blueprint architecture?
- ASecurity with Advanced Threat Prevention; Network Division; Agility, Automation, Efficiency, and Elasticity; with Cloud Borders
- BSecurity with Advanced Threat Prevention Network Unification Agility Automation, Efficiency, and Elasticity; Borderless
- CSecurity with Advanced Threat Prevention: Network Segmentation: Agility, Automation Efficiency, and Elasticity; Borderless
- DSecurity with Advanced Threat Protocol; Network Distribution; Agility, Automation, Efficiency, and Cloud Rigidity Borderless
56Which language can be used by users of Cloud Security Posture Management to create custom Security Policies?
- AeXtensible Markup Language (XML)
- BPosture Management Language (PML)
- CGovernance Specific Language (GSL)
- DJavaScript Object Notation (JSON)
57Logging Implied rules, enabling Hit Count and defining advanced VPN functions are all settings that are applied as
- AInline Layer
- BGlobal Properties
- CPolicy Settings
- DGateway Properties
58On Azure, can you deploy a Check Point Standalone installation (Management + GW)?
- ANo, it is not supported
- BYes, via GitHub only
- CYes, via PowerShell only
- DYes, via solution template / PowerShell / Marketplace
59According to best practices what would be the best way to install a Check Point cluster on AWS?
- AFollowing the instruction from the relevant Check Point SK
- BWith PowerShell
- CFrom AWS Console
- DFrom AWS Market Place
60How does micro-segmentation create boundaries and provide network segmentation for CloudGuard?
- AMicro-segmentation does not create boundaries.
- BIt creates borders within the cloud's perimeter to protect the major inbound and outbound traffic intersections.
- CIt applies a Security Gateway that enforces firewall policies to accept legitimate network traffic flows and deny unauthorized traffic
- DIt places inspection points between different applications, services, and single hosts within the same network segment.
61What are the Automation tools?
- AAPI, CLI, Scripts, Shells and Templates
- BTerraform and Ansible
- CAMls
- DCloudFormation
62Where are the api logs found on the Security Management Server?
- A$FWDIR/log/api.elg
- B/var/tmp/api.elg
- C/var/log/api.elg
- D/opt/log/api.elg
63Which one of the following is part of the Orchestration Playbook process for creating a new spoke and an automated Security Gateway?
- ATransfer of resources to a VPN
- BAn event trigger
- CVertical scaling
- DCommunication with the OS
64Which feature of CloudGuard allows for the dynamic enforcement of security policies based on real-time traffic and threats?
- AIdentity Awareness
- BDynamic Shielding
- CThreat Extraction
- DGeo Protection
65What does the Adaptive Security Policy involve to import the Data Center Objects?
- ACloudGuard API
- BCloudGuard Controller
- CCloudGuard Access Control
- DCloudGuard Gateway
66What is Cost Optimization?
- AA. The ability of the system to deliver business value at the lowest cost point
- BB. In terms of the cloud, security is about architecting every workload to prevent
- CC. The ability of a Workload to function correctly and consistently in all expected
- DD. The ability to support development and run workloads effectively
67What is Reliability according to the Five Pillars?
- AA. The ability to use cloud resources efficiently for meeting system requirements, and maintaining that efficiency as demand changes and
technologies evolve - BB. The ability of a Workload to function correctly and consistently in all expected
- CC. The ability to support development and run workloads effectively
- DD. In terms of the cloud, security is about architecting every workload to prevent
- AA. The ability to use cloud resources efficiently for meeting system requirements, and maintaining that efficiency as demand changes and
68The Administrator’s ability to protect data, systems, and assets while taking advantage of cloud technologies is commonly called:
- AA. Cost Optimization
- BB. Security
- CC. Operational Excellence
- DD. Performance Efficiency
69What are the languages supported for Cloud Templates?
- AA. JSON and YAML
- BB. JSON and Python
- CC. Python and PERL
- DD. YAML and Python
70What is the primary difference between Vertical and Horizontal autoscaling?
- AA. Vertical scaling doesn’t require moving resources but horizontal scaling does.
- BB. Vertical scaling is automatic and horizontal scaling is manual.
- CC. Vertical scaling is linear and horizontal scaling goes across.
- DD. Vertical scaling requires a virtual machine to completely shut down as opposed to horizontal scaling transferring resources without having
to power down the VM.
71What part of the Secure Public Cloud Blueprint may be housed in on-premises equipment?
- AA. Peering Connection
- BB. Security Gateway
- CC. Security Management Server
- DD. Application Server
72A utility that allows integration between the SMS, the CloudGuard Network solution, and CSPs, allowing the SMS to monitor and control scaling solutions in their associated cloud environments is called:
- AA. CloudGuard Management Extension (CME)
- BB. CloudGuard Controller and Enforcer (CCE)
- CC. CloudGuard Scanner and Enforcer (CSE)
- DD. CloudGuard Controller (CC)
73Adding new Security Gateways as system load increases is an example of ________________
- AA. Vertical Scaling
- BB. Network Scaling
- CC. Horizontal Scaling
- DD. System Scaling
74Which of these Cloud Platforms support User Defined Routes (UDR) to force traffic destined for spoke networks to go through a network virtual appliance?
- AA. Amazon AWS
- BB. Google Cloud Platform
- CC. Amazon AWS and Google Cloud Platform
- DD. Microsoft Azure
75To travel between spokes, non-transitive traffic uses ________ to allow IPv4 and IPv6 traffic to reach a spoke network.
- AA. a VTI
- BB. the Northbound hub
- CC. the Southbound hub
- DD. Peering
76Which scripting language is used by CloudGuard to develop templates that automate Security Gateway deployments?
- AA. Perl
- BB. C++
- CC. JSON
- DD. Python
77What do Workloads require to automate processes?
- AA. API
- BB. CLI
- CC. CSP Portal
- DD. Shell
78REST is an acronym for the following:
- ARepresentation of Security Traffic
- BReally Efficient Security Template
- CRepresentational State Transfer
- DReal Security Threat
79Logging Implied rules, enabling Hit Count, and defining advanced VPN functions are all settings that are applied as:
- AInline Layer
- BGlobal Properties
- CPolicy Settings
- DGateway Properties
80What is a Security Zone?
- AA Security Zone is the subnet of each of the firewall’s interfaces. All other Spoke networks are peered with the Security Zone network.
- BA Cloud Service Provider (CSP) provides a network zone to deploy virtual security device. CloudGuard Security Gateways and Security
Management Servers are deploying in this Security Zone so that they are protected from the rest of the world. - CA Security Zone is a group of one or more network interfaces from different centrally managed gateways bound together and used directly
in the Rulebase. It allows administrators to define the Security Policy based on network interfaces rather than IP addresses. - DA Security Zone is the network in which the Security Management and SmartConsole are deployed. This can be in one of the Spoke
networks on the Cloud or it can be in on-premise network
81Which of these is an example of Control Connections as accepted with implicit rules enabled from Global Properties?
- AAny TCP or UDP communication from the Primary SMS to any managed Security Gateway.
- BB. Communication with various types of servers, such as RADIUS, CVP, UFP, TACACS, LDAP and logical servers, even if these servers are not
specifically defined resources in your Security Policy. - CC. Cluster Control Protocol (CCP) communication between members of a Security Gateway Cluster.
- DCommunication using any protocol that can be used to control a remote host machine e.g. SSH, Telnet, RDP, etc.
82What tool can prevent intruders from using altered packet IP Addresses to gain access to internal network resources?
- AAnti-Spoofing
- BSecurity Zones
- CDefault Rules
- DScavenging
83When using Data Center Objects in a policy and the objects are not updating, what are two steps we can check?
- A1. Verify process is running with ‘cloudguard on’ and 2. restart the api process with ‘api restart’
- B1. Verify process is running with ‘cloudguard on’ and 2. ‘test communication’ button the Data Center Server object
- CReboot the Security Management Server and 2. restart the cloudguard process with ‘cloudguard on’
- DReboot the Security Management Server and 2. restart the api process with ‘api restart’
84What can a Security Admin do in a situation where collecting additional log file information to examine a CloudGuard Controller issue is required?
- AExecute a debug on the SMS.
- BSet the operation to TRACE to collect more data.
- CVerify connectivity between the SMS and the SDDC.
- DSearch for the information in the objects database.
85When Cloud Security Posture Management discovers non- compliant cloud resources, CloudBot applications perform automated remediations to correct any violations. How true is this statement?
- AThis is true, however it requires Full Protection access to the Cloud Account to perform automated remediation
- BThis is not true, Cloud Security Posture Management (CSPM) can only report non-compliance and cannot remediate by itself
- CThis is partially true, however the automated remediation is not done by CloudBot applications but it is done by the Security Management
Server - DThis is not true because CloudBot applications are used to provide chat service to respond to non-compliance alerts
86After the cloud acquisition process finishes, Cloud Security Posture Management may begin to manage network security protections. The Network Security module secures access to cloud environments by performing the following tasks: Visualizes Security Policies in cloud environments, controls access to protected cloud assets with short-term dynamic access leases, and _________________.👀⁉
- AAutomatically Installs Policies
- BDeploys new management resources
- CManages Network Security Groups
- DDeploys new internal cloud resources
87Cloud Security Posture Management (CSPM) operates as which type of service based platform?
- ACaaS
- BSaaS
- CPaaS
- DIaaS
88Cloud Security Posture Management uses which one of the following to integrate with cloud accounts?
- AIAM account credentials
- BSecurity Objects
- CSDDC
- DCloudGuard Controller
89Cloud Security Posture Management operational modes for cloud accounts are:
- ARead Only, Full Protection, Region Lock
- BRead Only, Read/Write, Region Lock
- CRead Only, Read/Write, Full Protection
- DRead/Write, Partial Protection, Full Protection
90What platform provides continuous compliance and governance assessments that evaluate public infrastructure according to industry standards and best practices?
- ACloud Security Posture Management
- BCloudGuard IaaS Public Cloud
- CCloudGuard SaaS
- DCloudGuard IaaS Private Cloud
91On Public Cloud, what is included in the BYOL (Bring your own license) package?
- A1 year subscription includes: Software, Services & Support
- B1 year subscription for Services & Support
- CPerpetual licenses for Software only
- DPerpetual licenses for Software & Services
92Which can be said about the CloudGuard IaaS – Public Cloud solution?
- AIt supports platforms such as VMware ESXi, Hyper-V, and KVM.
- BIts primary function is to block hacking attempts to breach cloud-based e-mail.
- CIt integrates advanced threat prevention and policy automation.
- DIt deploys and commissions Security Gateways as cloud networks.
Information
- Description
- Sexto ciber Quiz on CCCS V2, created by Carlos Velas on 13/06/2025.
- Author
- Carlos Velas
- Language
- Español
- Views
- 5
- Tags
- Rating
- No ratings yet Rate this quiz