Exam 4 - CCSA 156-215 v7

Pregunta 1 de 49

1

QUESTION 1
Identify the ports to which the Client Authentication daemon listens by default.

Selecciona una o más de las siguientes respuestas posibles:

A. 259, 900
B. 256, 600
C. 80, 256
D. 8080, 529

Explicación

Pregunta 2 de 49

1

QUESTION 2
What is the Manual Client Authentication TELNET port?

Selecciona una o más de las siguientes respuestas posibles:

A. 23
B. 264
C. 900
D. 259

Explicación

Pregunta 3 de 49

1

QUESTION 3
Your company's Security Policy forces users to authenticate to the Gateway explicitly, before they can use
any services. The Gateway does not allow the Telnet service to itself from any location. How would you
configure authentication on the Gateway? With a:

Selecciona una o más de las siguientes respuestas posibles:

A. Client Authentication rule using the manual sign-on method, using HTTP on port 900
B. Client Authentication rule, using partially automatic sign on
C. Client Authentication for fully automatic sign on
D. Session Authentication rule

Explicación

Pregunta 4 de 49

1

QUESTION 4
Which authentication type permits five different sign-on methods in the authentication properties window?

Selecciona una o más de las siguientes respuestas posibles:

A. Client Authentication
B. Manual Authentication
C. User Authentication
D. Session Authentication

Explicación

Pregunta 5 de 49

1

QUESTION 5
Which Client Authentication sign-on method requires the user to first authenticate via the User
Authentication mechanism, when logging in to a remote server with Telnet?

Selecciona una o más de las siguientes respuestas posibles:

A. Manual Sign On
B. Agent Automatic Sign On
C. Partially Automatic Sign On
D. Standard Sign On

Explicación

Pregunta 6 de 49

1

QUESTION 6
Which Security Gateway R77 configuration setting forces the Client Authentication authorization time-out to
refresh, each time a new user is authenticated? The:

Selecciona una o más de las siguientes respuestas posibles:

A. Time properties, adjusted on the user objects for each user, in the Client Authentication rule Source.
B. IPS > Application Intelligence > Client Authentication > Refresh User Timeout option enabled.
C. Refreshable Timeout setting, in Client Authentication Action Properties > Limits
D. Global Properties > Authentication parameters, adjusted to allow for Regular Client Refreshment.

Explicación

Pregunta 7 de 49

1

QUESTION 7
All R77 Security Servers can perform authentication with the exception of one. Which of the Security
Servers can NOT perform authentication?

Selecciona una o más de las siguientes respuestas posibles:

A. FTP
B. SMTP
C. HTTP
D. RLOGIN

Explicación

Pregunta 8 de 49

1

QUESTION 8
Which of the following are authentication methods that Security Gateway R77 uses to validate connection
attempts? Select the response below that includes the MOST complete list of valid authentication methods.

Selecciona una o más de las siguientes respuestas posibles:

A. Proxied, User, Dynamic, Session
B. Connection, User, Client
C. User, Client, Session
D. User, Proxied, Session

Explicación

Pregunta 9 de 49

1

QUESTION 9
Security Gateway R77 supports User Authentication for which of the following services? Select the
response below that contains the MOST correct list of supported services.

Selecciona una o más de las siguientes respuestas posibles:

A. SMTP, FTP, TELNET
B. SMTP, FTP, HTTP, TELNET
C. FTP, HTTP, TELNET
D. FTP, TELNET

Explicación

Pregunta 10 de 49

1

QUESTION 10
With the User Directory Software Blade, you can create R77 user definitions on a(n) _________ Server.

Selecciona una o más de las siguientes respuestas posibles:

A. LDAP
B. Radius
C. SecureID
D. NT Domain

Explicación

Pregunta 11 de 49

1

QUESTION 11
The User Directory Software Blade is used to integrate which of the following with Security Gateway R77?

Selecciona una o más de las siguientes respuestas posibles:

A. RADIUS server
B. Account Management Client server
C. UserAuthority server
D. LDAP server

Explicación

Pregunta 12 de 49

1

QUESTION 12
If you are experiencing LDAP issues, which of the following should you check?

Selecciona una o más de las siguientes respuestas posibles:

A. Connectivity between the R77 Gateway and LDAP server
B. Secure Internal Communications (SIC)
C. Overlapping VPN Domains
D. Domain name resolution

Explicación

Pregunta 13 de 49

1

QUESTION 13
Which type of R77 Security Server does not provide User Authentication?

Selecciona una o más de las siguientes respuestas posibles:

A. SMTP Security Server
B. HTTP Security Server
C. FTP Security Server
D. HTTPS Security Server

Explicación

Pregunta 14 de 49

1

QUESTION 14
You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to
be defined via SmartDashboard?

Selecciona una o más de las siguientes respuestas posibles:

A. A group with generic user
B. All users
C. LDAP Account Unit Group
D. Internal user Group

Explicación

Pregunta 15 de 49

1

QUESTION 15
For which service is it NOT possible to configure user authentication?

Selecciona una o más de las siguientes respuestas posibles:

A. Telnet
B. SSH
C. FTP
D. HTTPS

Explicación

Pregunta 16 de 49

1

QUESTION 16
Charles requests a Website while using a computer not in the net_singapore network. What is TRUE about
his location restriction?

Exhibit:

Selecciona una o más de las siguientes respuestas posibles:

A. Source setting in Source column always takes precedence
B. Source setting in User Properties always takes precedence
C. As location restrictions add up, he would be allowed from net_singapore and net_sydney.
D. It depends on how the User Auth object is configured; whether User Properties or Source Restriction
takes precedence.

Explicación

Pregunta 17 de 49

1

QUESTION 17
In the Rule Base displayed, user authentication in Rule 4 is configured as fully automatic. Eric is a member
of the LDAP group, MSD_Group.
What happens when Eric tries to connect to a server on the Internet?

Selecciona una o más de las siguientes respuestas posibles:

A. None of these things will happen
B. Eric will be authenticated and get access to the requested server.
C. Eric will be blocked because LDAP is not allowed in the Rule Base.
D. Eric will be dropped by the Stealth Rule

Explicación

Pregunta 18 de 49

1

QUESTION 18
Which of the following is an authentication method used by Identity Awareness?

Selecciona una o más de las siguientes respuestas posibles:

A. SSL
B. Captive Portal
C. RSA
D. PKI

Explicación

Pregunta 19 de 49

1

QUESTION 19
What is the purpose of an Identity Agent?

Selecciona una o más de las siguientes respuestas posibles:

A. Provide user and machine identity to a gateway
B. Manual entry of user credentials for LDAP authentication
C. Audit a user's access, and send that data to a log server
D. Disable Single Sign On

Explicación

Pregunta 20 de 49

1

QUESTION 20
What type of traffic can be re-directed to the Captive Portal?

Selecciona una o más de las siguientes respuestas posibles:

A. SMTP
B. HTTP
C. All of the above
D. FTP

Explicación

Pregunta 21 de 49

1

QUESTION 21
The Captive Portal tool:

Selecciona una o más de las siguientes respuestas posibles:

A. Acquires identities from unidentified users.
B. Is only used for guest user authentication.
C. Allows access to users already identified.
D. Is deployed from the Identity Awareness page in the Global Properties settings

Explicación

Pregunta 22 de 49

1

QUESTION 22
Captive Portal is a __________ that allows the gateway to request login information from the user.

Selecciona una o más de las siguientes respuestas posibles:

A. Pre-configured and customizable web-based tool
B. Transparent network inspection tool
C. LDAP server add-on
D. Separately licensed feature

Explicación

Pregunta 23 de 49

1

QUESTION 23
Complete this statement from the options provided. Using Captive Portal, unidentified users may be either;
blocked, allowed to enter required credentials, or required to download the _____________.

Selecciona una o más de las siguientes respuestas posibles:

A. Identity Awareness Agent
B. Full Endpoint Client
C. ICA Certificate
D. SecureClient

Explicación

Pregunta 24 de 49

1

QUESTION 24
Users with Identity Awareness Agent installed on their machines login with __________, so that when the
user logs into the domain, that information is also used to meet Identity Awareness credential requests.

Selecciona una o más de las siguientes respuestas posibles:

A. Key-logging
B. ICA Certificates
C. SecureClient
D. Single Sign-On

Explicación

Pregunta 25 de 49

1

QUESTION 25
Which of the following methods is NOT used by Identity Awareness to catalog identities?

Selecciona una o más de las siguientes respuestas posibles:

A. AD Query
B. Captive Portal
C. Identity Agent
D. GPO

Explicación

Pregunta 26 de 49

1

QUESTION 26
When using AD Query to authenticate users for Identity Awareness, identity data is received seamlessly
from the Microsoft Active Directory (AD). What is NOT a recommended usage of this method?

Selecciona una o más de las siguientes respuestas posibles:

A. Leveraging identity in the application control blade
B. Basic identity enforcement in the internal network
C. Identity-based auditing and logging
D. Identity-based enforcement for non-AD users (non-Windows and guest users)

Explicación

Pregunta 27 de 49

1

QUESTION 27
The Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
What is not a recommended usage of this method?

Selecciona una o más de las siguientes respuestas posibles:

A. When accuracy in detecting identity is crucial
B. Leveraging identity for Data Center protection
C. Protecting highly sensitive servers
D. Identity based enforcement for non-AD users (non-Windows and guest users)

Explicación

Pregunta 28 de 49

1

QUESTION 28
Which of the following is NOT a valid option when configuring access for Captive Portal?

Selecciona una o más de las siguientes respuestas posibles:

A. From the Internet
B. Through internal interfaces
C. Through all interfaces
D. According to the Firewall Policy

Explicación

Pregunta 29 de 49

1

QUESTION 29
If you were NOT using IKE aggressive mode for your IPsec tunnel, how many packets would you see for
normal Phase 1 exchange?

Selecciona una o más de las siguientes respuestas posibles:

A. 9
B. 2
C. 3
D. 6

Explicación

Pregunta 30 de 49

1

QUESTION 30
How many packets does the IKE exchange use for Phase 1 Main Mode?

Selecciona una o más de las siguientes respuestas posibles:

A. 12
B. 1
C. 3
D. 6

Explicación

Pregunta 31 de 49

1

QUESTION 31
How many packets does the IKE exchange use for Phase 1 Aggressive Mode?

Selecciona una o más de las siguientes respuestas posibles:

A. 12
B. 6
C. 3
D. 1

Explicación

Pregunta 32 de 49

1

QUESTION 32
Which of the following actions take place in IKE Phase 2 with Perfect Forward Secrecy disabled?

Selecciona una o más de las siguientes respuestas posibles:

A. Symmetric IPsec keys are generated.
B. Each Security Gateway generates a private Diffie-Hellman (DH) key from random pools.
C. The DH public keys are exchanged.
D. Peers authenticate using certificates or preshared secrets.

Explicación

Pregunta 33 de 49

1

QUESTION 33
Which of the following commands can be used to remove site-to-site IPsec Security Association (SA)?

Selecciona una o más de las siguientes respuestas posibles:

A. vpn debug ipsec
B. vpn ipsec
C. fw ipsec tu
D. vpn tu

Explicación

Pregunta 34 de 49

1

QUESTION 34
How many packets are required for IKE Phase 2?

Selecciona una o más de las siguientes respuestas posibles:

A. 12
B. 2
C. 6
D. 3

Explicación

Pregunta 35 de 49

1

QUESTION 35
Which of the following actions do NOT take place in IKE Phase 1?

Selecciona una o más de las siguientes respuestas posibles:

A. Peers agree on encryption method.
B. Diffie-Hellman key is combined with the key material to produce the symmetrical IPsec key.
C. Peers agree on integrity method.
D. Each side generates a session key from its private key and the peer's public key.

Explicación

Pregunta 36 de 49

1

QUESTION 36
When using vpn tu, which option must you choose if you only want to clear phase 2 for a specific IP
(gateway)?
Exhibit:

Selecciona una o más de las siguientes respuestas posibles:

A. (5) Delete all IPsec SAs for a given peer (GW)
B. (7) Delete all IPsec+IKE SAs for a given peer (GW)
C. (6) Delete all IPsec SAs for a given User (Client)
D. (8) Delete all IPsec+IKE SAs for a given User (Client)

Explicación

Pregunta 37 de 49

1

QUESTION 37
When using vpn tu, which option must you choose if you want to rebuild your VPN for a specific IP
(gateway)?
Exhibit:

Selecciona una o más de las siguientes respuestas posibles:

A. (6) Delete all IPsec SAs for a given User (Client)
B. (5) Delete all IPsec SAs for a given peer (GW)
C. (8) Delete all IPsec+IKE SAs for a given User (Client)
D. (7) Delete all IPsec+IKE SAs for a given peer (GW)

Explicación

Pregunta 38 de 49

1

QUESTION 38
Which SmartConsole component can Administrators use to track changes to the Rule Base?

Selecciona una o más de las siguientes respuestas posibles:

A. WebUI
B. SmartView Tracker
C. SmartView Monitor
D. SmartReporter

Explicación

Pregunta 39 de 49

1

QUESTION 39
UDP packets are delivered if they are ___________.

Selecciona una o más de las siguientes respuestas posibles:

A. a stateful ACK to a valid SYN-SYN/ACK on the inverse UDP ports and IP
B. a valid response to an allowed request on the inverse UDP ports and IP
C. bypassing the kernel by the forwarding layer of ClusterXL
D. referenced in the SAM related dynamic tables

Explicación

Pregunta 40 de 49

1

QUESTION 40
The INSPECT engine inserts itself into the kernel between which two OSI model layers?

Selecciona una o más de las siguientes respuestas posibles:

A. Session and Transport
B. Physical and Data
C. Presentation and Application
D. Datalink and Network

Explicación

Pregunta 41 de 49

1

QUESTION 41
Your company has two headquarters, one in London, and one in New York. Each office includes several
branch offices. The branch offices need to communicate with the headquarters in their country, not with
each other, and only the headquarters need to communicate directly. What is the BEST configuration for
establishing VPN Communities for this company? VPN Communities comprised of:

Selecciona una o más de las siguientes respuestas posibles:

A. One star Community with the option to mesh the center of the star: New York and London
Gateways added to the center of the star with the mesh center Gateways option checked; all London
branch offices defined in one satellite window, but, all New York branch offices defined in another
satellite window.
B. Two mesh and one star Community: One mesh Community is set up for each of the headquarters and
its branch offices. The star Community is configured with London as the center of the Community and
New York is the satellite.
C. Two star and one mesh Community: One star Community is set up for each site, with headquarters as
the Community center, and its branches as satellites. The mesh Community includes only New York
and London Gateways.
D. Three mesh Communities: One for London headquarters and its branches, one for New York
headquarters and its branches, and one for London and New York headquarters.

Explicación

Pregunta 42 de 49

1

QUESTION 42
Your company has two headquarters, one in London, one in New York. Each of the headquarters includes
several branch offices. The branch offices only need to communicate with the headquarters in their country,
not with each other, and the headquarters need to communicate directly. What is the BEST configuration
for establishing VPN Communities among the branch offices and their headquarters, and between the two
headquarters? VPN Communities comprised of:

Selecciona una o más de las siguientes respuestas posibles:

A. Three mesh Communities: one for London headquarters and its branches; one for New York
headquarters and its branches; and one for London and New York headquarters.
B. Two mesh and one star Community: Each mesh Community is set up for each site between
headquarters their branches. The star Community has New York as the center and London as its
satellite.
C. Two star communities and one mesh: A star community for each city with headquarters as center, and
branches as satellites. Then one mesh community for the two headquarters.
D. One star Community with the option to mesh the center of the star: New York and London Gateways
added to the center of the star with the "mesh center Gateways? option checked; all London branch
offices defined in one satellite window; but, all New York branch offices defined in another satellite
window.

Explicación

Pregunta 43 de 49

1

QUESTION 43
Match the terms with their definitions:
Exhibit:

Selecciona una o más de las siguientes respuestas posibles:

A. A-3, B-2, C-4, D-1
B. A-2, B-3, C-4, D-1
C. A-3, B-2, C-1, D-4
D. A-3, B-4, C-1, D-2

Explicación

Pregunta 44 de 49

1

QUESTION 44
Which of these attributes would be critical for a site-to-site VPN?

Selecciona una o más de las siguientes respuestas posibles:

A. Scalability to accommodate user groups
B. Centralized management
C. Strong authentication
D. Strong data encryption

Explicación

Pregunta 45 de 49

1

QUESTION 45
Which of the following is NOT true for Clientless VPN?

Selecciona una o más de las siguientes respuestas posibles:

A. The Gateway can enforce the use of strong encryption.
B. The Gateway accepts any encryption method that is proposed by the client and supported in the VPN.
C. Secure communication is provided between clients and servers that support HTTP.
D. User Authentication is supported.

Explicación

Pregunta 46 de 49

1

QUESTION 46
You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external
partner. Which of the following activities should you do first?

Selecciona una o más de las siguientes respuestas posibles:

A. Create a new logical-server object to represent your partner's CA.
B. Exchange exported CA keys and use them to create a new server object to represent your partner's
Certificate Authority (CA).
C. Manually import your partner's Certificate Revocation List.
D. Manually import your partner's Access Control List.

Explicación

Pregunta 47 de 49

1

QUESTION 47
Your company is still using traditional mode VPN configuration on all Gateways and policies. Your manager
now requires you to migrate to a simplified VPN policy to benefit from the new features. This needs to be
done with no downtime due to critical applications which must run constantly.
How would you start such a migration?

Selecciona una o más de las siguientes respuestas posibles:

A. This cannot be done without downtime as a VPN between a traditional mode Gateway and a simplified
mode Gateway does not work.
B. This can not be done as it requires a SIC- reset on the Gateways first forcing an outage.
C. You first need to completely rewrite all policies in simplified mode and then push this new policy to all
Gateways at the same time.
D. Convert the required Gateway policies using the simplified VPN wizard, check their logic and then
migrate Gateway per Gateway.

Explicación

Pregunta 48 de 49

1

QUESTION 48
Your manager requires you to setup a VPN to a new business partner site. The administrator from the
partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256
for IKE phase 2. Why is this a problematic setup?

Selecciona una o más de las siguientes respuestas posibles:

A. The two algorithms do not have the same key length and so don't work together. You will get the error
.... No proposal chosen....
B. All is fine as the longest key length has been chosen for encrypting the data and a shorter key length for
higher performance for setting up the tunnel.
C. Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in
phase 2 only costs performance and does not add security due to a shorter key in phase 1.
D. All is fine and can be used as is.

Explicación

Pregunta 49 de 49

1

QUESTION 49
Why are certificates preferred over pre-shared keys in an IPsec VPN?

Selecciona una o más de las siguientes respuestas posibles:

A. Weak performancE. PSK takes more time to encrypt than Diffie-Hellman.
B. Weak Security: PSK are static and can be brute-forced.
C. Weak security: PSKs can only have 112 bit length.
D. Weak scalability: PSKs need to be set on each and every Gateway.

	Creado por Gustavo Gonçalves hace casi 7 años

Exam 4 - CCSA 156-215 v7

Exam 4 - CCSA 156-215 v7

Pregunta 1 de 49

QUESTION 1 Identify the ports to which the Client Authentication daemon listens by default.

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 2 de 49

QUESTION 2 What is the Manual Client Authentication TELNET port?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 3 de 49

QUESTION 3 Your company's Security Policy forces users to authenticate to the Gateway explicitly, before they can use any services. The Gateway does not allow the Telnet service to itself from any location. How would you configure authentication on the Gateway? With a:

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 4 de 49

QUESTION 4 Which authentication type permits five different sign-on methods in the authentication properties window?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 5 de 49

QUESTION 5 Which Client Authentication sign-on method requires the user to first authenticate via the User Authentication mechanism, when logging in to a remote server with Telnet?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 6 de 49

QUESTION 6 Which Security Gateway R77 configuration setting forces the Client Authentication authorization time-out to refresh, each time a new user is authenticated? The:

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 7 de 49

QUESTION 7 All R77 Security Servers can perform authentication with the exception of one. Which of the Security Servers can NOT perform authentication?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 8 de 49

QUESTION 8 Which of the following are authentication methods that Security Gateway R77 uses to validate connection attempts? Select the response below that includes the MOST complete list of valid authentication methods.

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 9 de 49

QUESTION 9 Security Gateway R77 supports User Authentication for which of the following services? Select the response below that contains the MOST correct list of supported services.

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 10 de 49

QUESTION 10 With the User Directory Software Blade, you can create R77 user definitions on a(n) _________ Server.

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 11 de 49

QUESTION 11 The User Directory Software Blade is used to integrate which of the following with Security Gateway R77?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 12 de 49

QUESTION 12 If you are experiencing LDAP issues, which of the following should you check?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 13 de 49

QUESTION 13 Which type of R77 Security Server does not provide User Authentication?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 14 de 49

QUESTION 14 You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 15 de 49

QUESTION 15 For which service is it NOT possible to configure user authentication?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 16 de 49

QUESTION 16 Charles requests a Website while using a computer not in the net_singapore network. What is TRUE about his location restriction? Exhibit:

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 17 de 49

QUESTION 17 In the Rule Base displayed, user authentication in Rule 4 is configured as fully automatic. Eric is a member of the LDAP group, MSD_Group. What happens when Eric tries to connect to a server on the Internet?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 18 de 49

QUESTION 18 Which of the following is an authentication method used by Identity Awareness?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 19 de 49

QUESTION 19 What is the purpose of an Identity Agent?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 20 de 49

QUESTION 20 What type of traffic can be re-directed to the Captive Portal?

QUESTION 1
Identify the ports to which the Client Authentication daemon listens by default.

QUESTION 2
What is the Manual Client Authentication TELNET port?

QUESTION 3
Your company's Security Policy forces users to authenticate to the Gateway explicitly, before they can use
any services. The Gateway does not allow the Telnet service to itself from any location. How would you
configure authentication on the Gateway? With a:

QUESTION 4
Which authentication type permits five different sign-on methods in the authentication properties window?

QUESTION 5
Which Client Authentication sign-on method requires the user to first authenticate via the User
Authentication mechanism, when logging in to a remote server with Telnet?

QUESTION 6
Which Security Gateway R77 configuration setting forces the Client Authentication authorization time-out to
refresh, each time a new user is authenticated? The:

QUESTION 7
All R77 Security Servers can perform authentication with the exception of one. Which of the Security
Servers can NOT perform authentication?

QUESTION 8
Which of the following are authentication methods that Security Gateway R77 uses to validate connection
attempts? Select the response below that includes the MOST complete list of valid authentication methods.

QUESTION 9
Security Gateway R77 supports User Authentication for which of the following services? Select the
response below that contains the MOST correct list of supported services.

QUESTION 10
With the User Directory Software Blade, you can create R77 user definitions on a(n) _________ Server.

QUESTION 11
The User Directory Software Blade is used to integrate which of the following with Security Gateway R77?

QUESTION 12
If you are experiencing LDAP issues, which of the following should you check?

QUESTION 13
Which type of R77 Security Server does not provide User Authentication?

QUESTION 14
You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to
be defined via SmartDashboard?

QUESTION 15
For which service is it NOT possible to configure user authentication?

QUESTION 16
Charles requests a Website while using a computer not in the net_singapore network. What is TRUE about
his location restriction?

Exhibit:

QUESTION 17
In the Rule Base displayed, user authentication in Rule 4 is configured as fully automatic. Eric is a member
of the LDAP group, MSD_Group.
What happens when Eric tries to connect to a server on the Internet?

QUESTION 18
Which of the following is an authentication method used by Identity Awareness?

QUESTION 19
What is the purpose of an Identity Agent?

QUESTION 20
What type of traffic can be re-directed to the Captive Portal?

QUESTION 21
The Captive Portal tool:

QUESTION 22
Captive Portal is a __________ that allows the gateway to request login information from the user.

QUESTION 23
Complete this statement from the options provided. Using Captive Portal, unidentified users may be either;
blocked, allowed to enter required credentials, or required to download the _____________.

QUESTION 24
Users with Identity Awareness Agent installed on their machines login with __________, so that when the
user logs into the domain, that information is also used to meet Identity Awareness credential requests.

QUESTION 25
Which of the following methods is NOT used by Identity Awareness to catalog identities?

QUESTION 26
When using AD Query to authenticate users for Identity Awareness, identity data is received seamlessly
from the Microsoft Active Directory (AD). What is NOT a recommended usage of this method?

QUESTION 27
The Identity Agent is a lightweight endpoint agent that authenticates securely with Single Sign-On (SSO).
What is not a recommended usage of this method?

QUESTION 28
Which of the following is NOT a valid option when configuring access for Captive Portal?

QUESTION 29
If you were NOT using IKE aggressive mode for your IPsec tunnel, how many packets would you see for
normal Phase 1 exchange?

QUESTION 30
How many packets does the IKE exchange use for Phase 1 Main Mode?

QUESTION 31
How many packets does the IKE exchange use for Phase 1 Aggressive Mode?

QUESTION 32
Which of the following actions take place in IKE Phase 2 with Perfect Forward Secrecy disabled?

QUESTION 33
Which of the following commands can be used to remove site-to-site IPsec Security Association (SA)?

QUESTION 34
How many packets are required for IKE Phase 2?

QUESTION 35
Which of the following actions do NOT take place in IKE Phase 1?

QUESTION 36
When using vpn tu, which option must you choose if you only want to clear phase 2 for a specific IP
(gateway)?
Exhibit:

QUESTION 37
When using vpn tu, which option must you choose if you want to rebuild your VPN for a specific IP
(gateway)?
Exhibit: