Check Point Certified Security Administrator - 156-215.77 Exam Practice Test

Question 1

Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256 for IKE phase 2. Why is this a problematic setup?

A. The two algorithms do not have the same key length and so don't work together. You will get the error .... No proposal chosen....

B. Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key length in phase 2 only costs performance and does not add security due to a shorter key in phase 1.

C. All is fine as the longest key length has been chosen for encrypting the data and a shorter key length for higher performance for setting up the tunnel.

D. All is fine and can be used as is.

Correct Answer: B

Question 2

Which of the following is true of the Cleanup rule?

A. The Cleanup rule is an example of an Implied rule

B. The Cleanup rule is important for blocking unwanted connections

C. The Cleanup rule should not be logged

D. The Cleanup rule must be the last rule in a policy

Correct Answer: B

Question 3

All of the following are Security Gateway control connections defined by default implied rules, EXCEPT:

A. Communication with server types, such as RADIUS, CVP, UFP, TACACS, and LDAP.

B. Exclusion of specific services for reporting purposes.

C. Specific traffic that facilitates functionality, such as logging, management, and key exchange.

D. Acceptance of IKE and RDP traffic for communication and encryption purposes.

Correct Answer: B

Question 4

With the User Directory Software Blade, you can create R77 user definitions on a(n)
_________ Server.

A. NT Domain

B. Radius

C. SecureID

D. LDAP

Correct Answer: D

Question 5

You want to generate a cpinfo file via CLI on a system running GAiA. This will take about
40 minutes since the log files are also needed.
What action do you need to take regarding timeout?

A. Log in as Administrator, set the timeout to one hour with the command idle 60 and start cpinfo.

B. Log in as admin, switch to expert mode, set the timeout to one hour with the command, idle 60, then start cpinfo.

C. No action is needed because cpshell has a timeout of one hour by default.

D. Log in as the default user expert and start cpinfo.

Correct Answer: A

Question 6

Assume you are a Security Administrator for ABCTech. You have allowed authenticated access to users from Mkting_net to Finance_net. But in the user's properties, connections are only permitted within Mkting_net. What is the BEST way to resolve this conflict?

A. Select Intersect with user database in the Action Properties window.

B. Select Intersect with user database or Ignore Database in the Action Properties window.

C. Select Ignore Database in the Action Properties window.

D. Permit access to Finance_net.

Correct Answer: B

Question 7

Identity Awareness is implemented to manage access to protected resources based on a user's _____________.

A. Application requirement

B. Time of connection

C. Identity

D. Computer MAC address

Correct Answer: C

Question 8

You are responsible for the configuration of MegaCorp's Check Point Firewall. You need to allow two NAT rules to match a connection. Is it possible? Give the BEST answer.

A. Yes, it is possible to have two NAT rules which match a connection, but only in using Manual NAT (bidirectional NAT).

B. Yes, there are always as many active NAT rules as there are connections.

C. Yes, it is possible to have two NAT rules which match a connection, but only when using Automatic NAT (bidirectional NAT).

D. No, it is not possible to have more than one NAT rule matching a connection. When the firewall receives a packet belonging to a connection, it compares it against the first rule in the Rule Base, then the second rule, and so on. When it finds a rule that matches, it stops checking and applies that rule.

Correct Answer: C

Question 9

Which operating systems are supported by a Check Point Security Gateway on an open server? Select MOST complete list.

A. Check Point GAiA and SecurePlatform, and Microsoft Windows

B. Sun Solaris, Red Hat Enterprise Linux, Check Point SecurePlatform, IPSO, Microsoft Windows

C. Check Point GAiA, Microsoft Windows, Red Hat Enterprise Linux, Sun Solaris, IPSO

D. Check Point GAiA and SecurePlatform, IPSO, Sun Solaris, Microsoft Windows

Correct Answer: A

Question 10

By default, when you click File > Switch Active File in SmartView Tracker, the Security Management Server:

A. Purges the current log file, and starts a new log file.

B. Saves the current log file, names the log file by date and time, and starts a new log file.

C. Purges the current log file, and prompts you for the new log's mode.

D. Prompts you to enter a filename, and then saves the log file.

Correct Answer: B

Question 11

You are working with multiple Security Gateways that enforce an extensive number of rules. To simplify security administration, which one of the following would you choose to do?

A. Run separate SmartConsole instances to login and configure each Security Gateway directly.

B. Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.

C. Create network objects that restrict all applicable rules to only certain networks.

D. Create a separate Security Policy package for each remote Security Gateway.

Correct Answer: D

Question 12

What command with appropriate switches would you use to test Identity Awareness connectivity?

A. test_ad

B. test_ldap_connectivity

C. test_ldap

D. test_ad_connectivity

Correct Answer: D

Question 13

Your bank's distributed R77 installation has Security Gateways up for renewal.
Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

A. SmartPortal

B. SmartDashboard

C. SmartView Tracker

D. SmartUpdate

Correct Answer: D

Question 14

What is the default setting when you use NAT?

A. Source Translated on Client side

B. Destination Translated on Client side

C. Source Translated on both sides

D. Destination Translated on Server side

Correct Answer: B

Question 15

Where is the fingerprint generated, based on the output display?
Exhibit:

A. Security Management Server

B. SmartConsole

C. SmartDashboard

D. SmartUpdate

Correct Answer: A

CheckPoint Check Point Certified Security Administrator - 156-215.77 Exam Practice Test

Latest Update

Useful Links

Contact Us