Check Point Certified Security Master - 156-115.77 Exam Practice Test

Question 1

Which FW-1 kernel flags should be used to properly debug and troubleshoot NAT issues?

A. nat, xlate, fwd, vm, ld, chain

B. nat, xltrc, xlate, drop, conn, vm

C. nat, route, conn, fwd, zeco, err

D. nat, drop, conn, xlate, filter, ioctl

Correct Answer: B

Question 2

Your customer has an R77 Multi-domain Management Server managing a mix of firewalls of R70 and R77 versions. A change was made to the file $FWDIR/lib/tables.def on one of the domains. However, it was found that the change was not applied to the R70 firewalls. What could be the problem?

A. To support R70, the file in the compatibility directory should have been modified.

B. R70 is end of life and is not supported. Most functions will work, but modifying the table.def will not.

C. In order to make changes on R70 machines you need work within GuiDBedit

D. Changes to the table.def can only be applied to firewalls matching the Management Server version. The customer needs to upgrade the firewalls to the same version as the firewall.

Correct Answer: A

Question 3

You are troubleshooting your VPN and are reviewing the output of your command fw monitor, shown below. What can you determine from the following output?

Checkpoint 156-115.77 Exam

A. Traffic is not being encrypted

B. The fw monitor command cannot display the relevant information since it is encrypted traffic

C. NAT is not being applied to the IP address 10.10.10.86

D. There is no issue, since the traffic is being seen at all points in the inspection kernel

Correct Answer: A

Question 4

Misha is working on a stand-by firewall and deletes the connections table in error. He finds that now the table is out of sync with the Active member. to get them completely synced again, Mish should run the command pair ____________ and __________ .

A. fw ctl sync stop, fw ctl sync start

B. fw ctl setsync stop, fw ctl setsync on

C. fw ctl setsync off, fw ctl setsync on

D. fw ctl setsync off, fw ctl setsync start

Correct Answer: D

Question 5

ACME Corp has a cluster consisting of two 13500 appliances. As the Firewall Administrator, you notice that on an output of top, you are seeing high CPU usage of the cores assigned as SNDs, but low CPU usage on cores assigned to individual fw_worker_X processes. What command should you run next to performance tune your cluster?

A. fwaccel off - this will turn off SecureXL, which is causing your SNDs to be running high in the first place.

B. fw ctl debug -m cluster + all - this will show you all the connections being processed by ClusterXL and explain the high CPU usage on your appliance.

C. fw tab -t connections -s - this will show you a summary of your connections table, and allow you to determine whether there is too much traffic traversing your firewall.

D. fwaccel stats -s - this will show you the acceleration profile of your connections and potentially why your SNDs are running high while other cores are running low.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

In IPS what does a high confidence rating mean?

A. There is a high likelihood of false positives

B. This is a rating for how confident Check Point is with catching this attack

C. There is a low likelihood of false positives

D. This is a rating for how likely this attack is to penetrate most systems

Correct Answer: C

Question 7

When troubleshooting and trying to understand which chain is causing a problem on the Security Gateway, you should use the command:

A. fw tab -t connections

B. fw ctl chain

C. fw monitor -e "accept;" -p all

D. fw ctl zdebug drop

Correct Answer: C

Question 8

You issue the command fwaccel stat and see the following: What is a possible reason that the "accept templates" is disabled?

Checkpoint 156-115.77 Exam

A. Rule one is a drop rule.

B. Rule one uses static NAT.

C. Rule one contains a time object.

D. Your administrator has not enabled templating.

Correct Answer: C

Question 9

Of the following answer choices, which best describes a possible effect of expanding the connections table?

A. Increased memory consumption

B. Decreased memory consumption

C. Decreased connection duration

D. Increased connection duration

Correct Answer: A

Question 10

Check Point Best Practices suggest that when you finish a kernel debug, you should run the command _____________________ .

A. fw debug 0

B. fw ctl debug default

C. fw ctl debug 0

D. fw debug off

Correct Answer: C

Question 11

Which of the following statements are TRUE about SecureXL?
I. SecureXL is able to accelerate all connections through the firewall.
II. Medium path acceleration will still cause some CPU utilization of CoreXL cores.
III. F2F connections represent "forwarded to firewall" connections that are not accelerated and fully processed through the firewall kernel.
IV.
Packets going through SecureXL must be inspected by the firewall kernel before being accelerated.

A. III and IV

B. I, II, and III

C. I and IV

D. II and III

Correct Answer: D

Question 12

Where can you configure OSPF on a GAiA firewall?

A. sysconfig

B. SmartDashboard

C. WebUI

D. cpconfig

Correct Answer: C

Question 13

Which of the following is true about Node / Host objects?

A. A Node / Host object can either have IPv4 or IPv6 IP address but not have both. Separate objects need to be created for hosts that use dual stack.

B. Node / Host object does not support IPv6, hence a Network object must be created for IPv6.

C. A Node / Host object can only have IPv4 IP address. For IPv6, a Node / Host6 object must be used.

D. A Node / Host object can either have IPv4 or IPv6 IP address or have both.

Correct Answer: D

Question 14

Your gateway object is currently defined with a max connection count of 25k connections in Smart Dashboard. Which of the following commands would show you the current and peak connection counts?

A. fw ctl chain

B. show connections all

C. fw ctl pstat

D. fw ctl conn

Correct Answer: C

Question 15

What command show the same information as fwaccel stats -l?

A. cat /proc/ppk/statistics

B. cphaprob -a hconf

C. fwaccell stats -s -u -k

D. cat /proc/ppk/cpls

Correct Answer: A

CheckPoint Check Point Certified Security Master - 156-115.77 Exam Practice Test

Latest Update

Useful Links

Contact Us