CheckPoint Check Point Security Administration NGX II (156-315.1) Sample Questions:

1. You configure a Check Point QoS Rule Base with two rules: an HTTP rule with a weight of
40, and the Default Rule with a weight of 10. If the only traffic passing through your QoS Module is HTTP traffic, what percent of bandwidth will be allocated to the HTTP traffic?

A) 80%
B) 50%
C) 100%
D) 10%
E) 40%

2. Steve tries to configure Directional VPN Rule Match in the Rule Base. But the Match column does not have the option to see the Directional Match. Steve sees the following screen. What is the problem?

A) Steve must enable directional_match(true) in the objects_5_0.C file on SmartCenter Server.
B) Steve must enable VPN Directional Match on the VPN Advanced screen, in Global properties.
C) Steve must enable Advanced Routing on each Security Gateway.
D) Steve must enable a dynamic-routing protocol, such as OSPF, on the Gateways.
E) Steve must enable VPN Directional Match on the gateway object's VPN tab.

3. After you add new interfaces to this cluster, how can you check if the new interfaces and associated virtual IP address are recognized by ClusterXL?

A) By running the cpconfig command on both members
B) By running the cphaprob -a if command on both members
C) By running the cphaprob -I list command on both members
D) By running the cphaprob state command on both members
E) By running the fw ctl iflist command on both members

4. Your VPN Community includes three Security Gateways. Each Gateway has its own internal network defined as a VPN Domain. You must test the VPN-1 NGX route-based VPN feature, without stopping the VPN. What is the correct order of steps?

A) 1. Add a new interface on each Gateway.
2. Remove the newly added network from the current VPN Domain for each Gateway.
3. Create VTIs on each Gateway, to point to the other two peers
4. Enable advanced routing on all three Gateways.
B) 1. Add a new interface on each Gateway.
2. Remove the newly added network from the current VPN Domain in each gateway object.
3. Create VPN Tunnel Interfaces (VTI) on each gateway object, to point to the other two peers.
4. Add static routes on three Gateways, to route the new network to each peer's VTI interface.
C) 1. Add a new interface on each Gateway.
2. Add the newly added network into the existing VPN Domain for each gateway object.
3. Create VTIs on each gateway object, to point to the other two peers.
4. Add static routes on three Gateways, to route the new networks to each peer's VTI interface.
D) 1. Add a new interface on each Gateway.
2. Add the newly added network into the existing VPN Domain for each Gateway.
3. Create VTIs on each gateway object, to point to the other two peers.
4. Enable advanced routing on all three Gateways.

5. A cluster contains two members, with external interfaces 172.28.108.1 and 172.28.108.2.
The internal interfaces are 10.4.8.1 and 10.4.8.2. The external cluster's IP address is
172.28.108.3, and the internal cluster's IP address is 10.4.8.3. The synchronization interfaces are 192.168.1.1 and 192.168.1.2. The Security Administrator discovers State Synchronization is not working properly. cphaprob if command output displays as follows:What is causing the State Synchronization problem?

A) The synchronization network has a cluster, with IP address 192.168.1.3 defined in the gateway-cluster object. Remove the 192.168.1.3 VIP interface from the cluster topology.
B) The synchronization interface on the cluster member object's Topology tab is enabled with "Cluster Interface". Disable this interface.
C) Interfaces 192.168.1.1 and 192.168.1.2 have defined 192.168.1.3 as a sub-interface.
D) Another cluster is using 192.168.1.3 as one of the unprotected interfaces.

Solutions: