Category: Checkpoint
Welcome to download the newest Dumpsoon 1Z0-060 dumps:
Don’t leave your fate to boring books, you should sooner trust FLYDUMPS CheckPoint 156-210 exam sample questions. If you prefer the course on FLYDUMPS CheckPoint 156-210 exam sample questions, then you will need to attend their class and their classroom sessions are quite expensive. FLYDUMPS CheckPoint 156-210 pdf could be the passport for your career life since it covers everything needed to pass CheckPoint 156-210 exam. CheckPoint 156-210 Testing Engine are composed by current and active Information Technology experts, who use their experience in preparing you for your future CheckPoint 156-210 exam sample questions available at FLYDUMPS will save you money, and get you started on the right road to making more with your new found skills.
QUESTION 177
When you disable a rule the rule is NOT disabled until you verify your Security Policy.
A. True
B. False
Correct Answer: B
QUESTION 178
Static Source NAT translates public internal source IP addresses to private external source IP addresses.
A. True
B. False.
Correct Answer: B
QUESTION 179
What is the command that lists the interfaces to which VPN-1/FireWall-1 bound?
A. Fw ct1 iflist
B. Ifconfig -a
C. Ifconfig \all
D. Netstat -m
E. Cp bind -all
Correct Answer: A
QUESTION 180
Your customer has created a rule so that every time a user wants to go to Internet, that user must be authenticated. Which if the following is the best authentication method for roaming users, such as doctors updating patient records at various floor stations in a hospital?
A. Session
B. User
C. Client
D. Connection
E. None of the above.
Correct Answer: B QUESTION 181
Which command utility allows verification of the Security Policy installed on a firewall module?
A. Fw ct1 pstat.
B. Fw printlic.
C. Fw stat.
D. Fw ver.
E. Fw pol.
Correct Answer: C QUESTION 182
You are a firewall administrator with one Management Server managing 3 different Enforcement Modules. One of the Enforcement Modules does NOT show up in the dialog box when attempting to install a Security Policy. Which of the following is the most likely cause?
A. No master file was created.
B. License for multiple firewalls has expired.
C. The firewall has NOT been rebooted.
D. The firewall was NOT listed in the Install On column of the rule.
E. The firewall is listed as “Managed by another Management Module (external)” in the Workstation Properties dialog box.
Correct Answer: E QUESTION 183
In the Install On column of a rule, when you select a specific firewall object as the only configuration object, that rule is enforced on all firewalls with in the network, with related configurations.
A. True
B. False.
Correct Answer: B QUESTION 184
As an administrator, you want to force your users to authenticate. You have selected Client Authentication as your authentication scheme. Users will be using a Web browser to authenticate. On which TCP port will authentication be performed?
A. 23
B. 80
C. 259
D. 261
E. 900
Correct Answer: E QUESTION 185
Once installed the VPN-1/FireWall-1 NG resides directly below what layer of the TCP/IP stack?
A. Data
B. Transport
C. Physical
D. Application
E. Network
Correct Answer: E QUESTION 186
Client Authentication rules should be placed above the Stealth rule, so users can authenticate to the firewall.
A. True
B. False
Correct Answer: A QUESTION 187
The following rule base tells you any automatically created NAT rules have simply hidden but have not been deleted from the Rule Base.
A. True
B. False
Correct Answer: B QUESTION 188
You are using static Destination NAT. You have VPN-1/FireWall-1 NG running on Windows NT/Solaris platform. By default, routing occurs after the address translation when the packet is passing form the client towards the server.
A. True
B. False
Correct Answer: B QUESTION 189
Which if the following statements are FALSE?
A. Dynamic NAT cannot be used for protocols where the port number cannot be changed.
B. Dynamic NAT cannot be used when an external server must distinguish between clients bases on their IP addresses.
C. With Dynamic NAT, packet’s source port numbers are modified.
D. In Dynamic NAT, public internal addresses are hidden behind a single private external address using dynamically assigned port numbers to distinguish between them.
E. Dynamically assigned post numbers are used to distinguish between hidden private addresses.
Correct Answer: D QUESTION 190
When you modify a User Template, any users already operating under that template will be updates to the new template properties.
A. True
B. False
Correct Answer: B QUESTION 191
Installation time for creating network objects will decrease if you list machine names and IP addresses in the hosts files.
A. True
B. False
Correct Answer: A QUESTION 192
Consider the following network: No Original Packet Translated Packet Source Destination Service Source Destination Service The administrator wants to take all the local and DMZ hosts behind the gateway except the HTTP server
192.9.200.9. The http server will be providing public services and must be accessible from Internet. Select the best NAT solution below that meets these requirements.
A. Use automatic NAT that creates a static NAT to the HTTP server.
B. To hide the private addresses set the address translation for Private Net.
C. To hide the private address set the address translation for 192.9.200.0.
D. Use automatic NAT rule creation to hide NAT Local net and private Net.
E. Both A and D.
Correct Answer: E QUESTION 193
What NAT made is necessary if you want to start and HTTP session on a Reserved or Illegal IP address?
A. Static Source.
B. Static destination.
C. Dynamic
D. None of the above.
Correct Answer: B
QUESTION 194
With SecureUpdate you are able to: (Select all that apply)
A. Change Central Licenses to Local Licenses
B. Track current installed versions of Check Point and OPSEC products
C. Update Check Point and OPSEC software remotely from a central location
D. Centrally manage Licenses
E. Perform a new installation of VPN-1/FW-1 remotely
Correct Answer: BCD
QUESTION 195
Which is false about SIC communications?
A. A.VPN Certificates, such as those for IKE are used for secure communications
B. B.The Policy Editior initiates an SSL based connection with the Management Server
C. The Policy Editor must be defined as being authorised to use the Management Server
D. The Management Server verifies that the Clients IP address belongs to an authorised Policy Editor Client
Correct Answer: A
Looking to become a certified Adobe professional? Would you like to reduce or minimize your CheckPoint 156-210 certification cost? Do you want to pass all of the Microsoft certification? If you answered YES, then look no further. Flydumps.com offers you the best CheckPoint 156-210 exam certification test questions which cover all core topics and certification requirements.
Welcome to download the newest Dumpsoon 1Z0-060 dumps: http://www.dumpsoon.com/1Z0-060.html
http://www.i-tec.org/aruba-accp-v6-practise-questions-the-most-effective-aruba-accp-v6-actual-test-on-our-store/
Welcome to download the newest Pass4itsure 400-101 dumps:
Top IT industry experts and professionals make sure that the students get thoroughly researched 100% authentic answers. Flydumps CheckPoint 156-215 exam sample questions includes CheckPoint 156-215 exam questions answers and online CheckPoint 156-215 is extremely important for the real CheckPoint 156-215 certification. Flydumps simulator exam containing 90 questions is designed in a way that could help you pass the exam with no other books or helping materials and more effective. With our Cisco 642-618 exam sample questions you will feel on top of the illusive CheckPoint 156-215 exam.
QUESTION 182
Which command allows verification of the Security Policy name and install date on a Security Gateway?
“Pass Any Exam. Any Time.” – www.actualtests.com 73 Checkpoint 156-215.75 Exam
A. fw show policy
B. fw ctl pstat -policy
C. fw stat -l
D. fwver-p
Correct Answer: C
QUESTION 183
You have two rules, ten users, and two user groups in a Security Policy. You create database version 1 for this configuration. You then delete two existing users and add a new user group. You modify one rule and add two new rules to the Rule Base. You save the Security Policy and create database version 2. After awhile, you decide to roll back to version 1 to use the Rule Base, but you want to keep your user database. How can you do this?
A. Run fwm_dbexport to export the user database. Select restore the entire database in the Database Revision screen. Then, run fwm_dbimport.
B. Restore the entire database, except the user database, and then create the new user and user group.
C. Restore the entire database, except the user database.
D. Run fwm dbexport -l filename. Restore the database. Then, run fwm dbimport -l filename to import the users.
Correct Answer: C
QUESTION 184
Which feature or command provides the easiest path for Security Administrators to revert to earlier versions of the same Security Policy and objects configuration?
A. Policy Package management
B. dbexport/dbimport
C. Database Revision Control
D. upgrade_export/upgrade_import
Correct Answer: C
QUESTION 185
Your Security Management Server fails and does not reboot. One of your remote Security Gateways managed by the Security Management Server reboots. What occurs with the remote Gateway after reboot?
A. Since the Security Management Server is not available, the remote Gateway cannot fetch the Security Policy. Therefore, no traffic is allowed through the Gateway.
B. Since the Security Management Server is not available, the remote Gateway cannot fetch the Security Policy. Therefore, all traffic is allowed through the Gateway.
C. Since the Security Management Server is not available, the remote Gateway uses the local Security Policy, but does not log traffic.
D. The remote Gateway fetches the last installed Security Policy locally and passes traffic normally. The Gateway will log locally, since the Security Management Server is not available.
Correct Answer: D
QUESTION 186
How can you configure an application to automatically launch on the Security Management Server when traffic is dropped or accepted by a rule in the Security Policy?
A. Pop-up alert script
B. User-defined alert script
C. Custom scripts cannot be executed through alert scripts
D. SNMP trap alert script
Correct Answer: B QUESTION 187
Which of the following is NOT useful to verify whether or NOT a Security Policy is active on a Gateway?
A. Check the name of Security Policy of the appropriate Gateway in Smart Monitor.
B. Cpstat fw ?f policy
C. fw stat
D. fw ctl get string active_secpol “Pass Any Exam. Any Time.” – www.actualtests.com 75 Checkpoint 156-215.75 Exam
Correct Answer: D
QUESTION 188
Of the following, what parameters will not be preserved when using Database Revision Control? 1) Simplified mode Rule Bases 2) Traditional mode Rule Bases 3) Secure Platform WebUI Users 4) SIC certificates 5) SmartView Tracker audit logs 6) SmartView Tracker traffic logs 7) Implied Rules 8) IPS Profiles 9) Blocked connections 10) Manual NAT rules 11) VPN communities 12) Gateway route table 13) Gateway licenses
A. 3, 4, 5, 6, 9, 12, 13
B. 5, 6, 9, 12, 13
C. 1, 2, 8, 10, 11
D. 2, 4, 7, 10, 11
Correct Answer: A QUESTION 189
Which of the following describes the default behavior of an R75 Security Gateway?
“Pass Any Exam. Any Time.” – www.actualtests.com 76 Checkpoint 156-215.75 Exam
A. Traffic is filtered using controlled port scanning.
B. All traffic is expressly permitted via explicit rules.
C. Traffic not explicitly permitted is dropped.
D. IP protocol types listed as secure are allowed by default, i.e. ICMP, TCP, UDP sessions are inspected.
Correct Answer: C
QUESTION 190
When you use the Global Properties’ default settings on R75, which type of traffic will be dropped if no explicit rule allows the traffic?
A. SmartUpdate connections
B. Firewall logging and ICA key-exchange information
C. Outgoing traffic originating from the Security Gateway
D. RIP traffic
Correct Answer: D
QUESTION 191
You have installed a R75 Security Gateway on SecurePlatform. To manage the Gateway from the enterprise Security Management Server, you create a new Gateway object and Security Policy. When you install the new Policy from the Policy menu, the Gateway object does not appear in the Install Policy window as a target. What is the problem?
A. The new Gateway’s temporary license has expired.
B. The object was created with Node > Gateway.
C. The Gateway object is not specified in the first policy rule column Install On.
D. No Masters file is created for the new Gateway.
Correct Answer: B
QUESTION 192
“Pass Any Exam. Any Time.” – www.actualtests.com 77 Checkpoint 156-215.75 Exam Select the correct statement about Secure Internal Communications (SIC) Certificates. SIC Certificates:
A. Are used for securing internal network communications between the SmartDashboard and the Security Management Server.
B. For R75 Security Gateways are created during the Security Management Server installation.
C. Decrease network security by securing administrative communication among the Security Management Servers and the Security Gateway.
D. Uniquely identify Check Point enabled machines; they have the same function as VPN Certificates.
Correct Answer: D
QUESTION 193
John is the Security Administrator in his company. He installs a new R75 Security Management Server and a new R75 Gateway. He now wants to establish SIC between them. After entering the activation key, the message “Trust established” is displayed in SmartDashboard, but SIC still does not seem to work because the policy won’t install and interface fetching still does not work. What might be a reason for this?
A. This must be a human error.
B. The Gateway’s time is several days or weeks in the future and the SIC certificate is not yet valid.
C. SIC does not function over the network.
D. It always works when the trust is established.
Correct Answer: B
QUESTION 194
A _______ rule is used to prevent all traffic going to the R75 Security Gateway.
A. Cleanup
B. Reject
C. Stealth
D. IPS “Pass Any Exam. Any Time.” – www.actualtests.com 78 Checkpoint 156-215.75 Exam
Correct Answer: C
QUESTION 195
In a distributed management environment, the administrator has removed the default check from Accept Control Connections under the Policy / Global Properties / FireWall tab. In order for the Security Management Server to install a policy to the Firewall, an explicit rule must be created to allow the server to communicate to the Security Gateway on port ______.
A. 256
B. 80
C. 900
D. 259
Correct Answer: A
QUESTION 196
Your internal network is configured to be 10.1.1.0/24. This network is behind your perimeter R75 Gateway, which connections to your ISP provider. How do you configure the Gateway to allow this network to go out to the internet?
A. Use Hide NAT for network 10.1.1.0/24 behind the internal interface of your perimeter Gateway.
B. Use Hide NAT for network 10.1.1.0/24 behind the external IP address of your perimeter Gateway.
C. Use automatic Static NAT for network 10.1.1.0/24.
D. Do nothing, as long as 10.1.1.0 network has the correct default Gateway.
Correct Answer: B
QUESTION 197
Which specific R75 GUI would you use to add an address translation rule?
A. SmartConsole “Pass Any Exam. Any Time.” – www.actualtests.com 79 Checkpoint 156-215.75 Exam
B. SmartDashboard
C. SmartNAT
D. SmartView Monitor
Correct Answer: B
QUESTION 198
You are a Security Administrator who has installed Security Gateway R75 on your network. You need to allow a specific IP address range for a partner site to access your intranet Web server. To limit the partner’s access for HTTP and FTP only, you did the following:
1.
Created manual Static NAT rules for the Web server.
2.
Created the following settings in the Global Properties’ Network Address Translation screen
-Allow bi-directional NAT*
–
Translate destination on client side
A.
Yes, This will ensure that traffic only matches the specific rule configured for this traffic, and that the Gateway translates the traffic after accepting the packet.
B.
Yes, Both of these settings are only application to automatically NAT rules.
C.
No, The first setting is not applicable. The second setting will reduce performance, by translating traffic in the kernel nearest the intranet server.
D.
No. The first setting is only applicable to automatic NAT rules. The second setting is necessary to make sure there are no conflicts between NAT and anti-spoofing.
Do you above settings limit the partner’s access?
Correct Answer: D
QUESTION 199
You enable Automatic Static NAT on an internal host node object with a private IP address of 10.10.10.5, which is NATed into 216.216.216.5. (You use the default settings in Global Properties / NAT.)
When you run fw monitor on the R75 Security Gateway and then start a new HTTP connection from host
10.10.10.5 to browse the Internet, at what point in the monitor output will you observe the HTTP SYN-ACK packet translated from 216.216.216.5 back into 10.10.10.5?
“Pass Any Exam. Any Time.” – www.actualtests.com 80 Checkpoint 156-215.75 Exam
A. i=inbound kernel, before the virtual machine
B. O=outbound kernel, after the virtual machine
C. o=outbound kernel, before the virtual machine
D. I=inbound kernel, after the virtual machine
Correct Answer: D
QUESTION 200
You have configured a remote site Gateway that supports your boss’s access from his home office using a DSL dialup connection. Everything worked fine yesterday, but today all connectivity is lost. Your initial investigation results in “nobody has touched anything”, which you can support by taking a look in SmartView Tracker Management. What is the problem and what can be done about it?
A. You cannot use NAT and a dialup connection.
B. The NAT configuration is not correct; you can only use private IP addresses in a static NAT setup.
C. A static NAT setup may not work with DSL, since the external IP may change. Hide NAT behind the Gateway is the preferred method here.
D. According to published limitations of Security Gateway R75, there’s a bug with NAT. A restart of the Gateway will help here.
Correct Answer: C
This is the reason why this program is highly recommended to all those students who are serious about passing out CheckPoint 156-215 ECSS. You will find CheckPoint 156-215 ECSS exam which you will require when CheckPoint 156-215 ECSS exam you have to test your knowledge and skills. Without them you will not be able to get information about what your areas of expertise are. It has been seen that students are feeling quite at home in presence of CheckPoint 156-215 ECSS exam as they provide them a chance to take a sigh of relief and they need not to spend hours in their studies for the certification. A great number of candidates for Exam have already been benefited themselves with the amazing study material of questions CheckPoint 156-215 ECSS study materials.
Welcome to download the newest Pass4itsure 400-101 dumps: http://www.pass4itsure.com/400-101.html
http://www.i-tec.org/avaya-3102-certification-exam-best-quality-avaya-3102-exam-dumps-with-the-knowledge-and-skills/
Welcome to download the newest Examwind JN0-360 dumps:
Each Answers in CheckPoint 156-210 study guides are checked by the concerned professional to provide you the best quality dumps. If you are looking to get certified in short possible time, you will never find quality product than Flydumps.
QUESTION 127
As a firewall administrator you encounter the following you error message:
Authentication for command failed.
What is the most logical reasoning for thus type of error message?
A. The Rule Base has been corrupted.
B. The kernel cannot communicate with the management module.
C. The administrator does not have the ability to push the policy.
D. Remote encryption keys cannot be fetched.
E. Client authentication has failed.
Correct Answer: B
QUESTION 128
Your customer has created a rule so that every time a user wants to go to the Internet, that user must be authenticated. Firewall load is a concern for the customer. Which authentication method does not result in any additional connections to the firewall?
A. Session
B. User
C. Client
D. Connection
E. None of the above.
Correct Answer: A
QUESTION 129
What variable is used to extend the interval of the Timeout in a NAT to prevent a hidden UDP connection from losing its port?
A. Fwx_udp_todefaultextend.
B. Fwx_udp_expdefaultextend.
C. Fwx_udp_todefaultext
D. Fwx_udp_timeout.
E. Fwx_udp_expiration.
Correct Answer: D
QUESTION 130
To hide data filed in the log viewer:
A. Select Hide from the Log Viewer menu.
B. Right-click anywhere in a column of the Log Viewer GUI and select Show Details.
C. Right-click anywhere in the column of the Log Viewer GUI and select Disable.
D. Right-click anywhere in the column of the Log Viewer GUI and select Hide.
E. Select Hide from the Log Viewer tool bar.
Correct Answer: D
QUESTION 131
You are following the procedure to setup user authentication for TELNET to prompt for a distinct destination. This allows the firewall to simulate a TELNET Proxy. After you defined the user on the Firewall and use VPN-1/FireWall-1 Authentication, you would:
A. Stop the Firewall.
B. Restart the Firewall.
C. Start the Policy Editor and go to Manage service, and edit TELNET service.
D. Ensure that the Authentication method is enabled in the firewall object.
E. Ensure that there are no existing rules already allowing TELNET.
Correct Answer: D
QUESTION 132
You have the VPN-1/Firewall-1 NG product installed. The following Rule Base order correctly implements Implicit Client Authentication fort HTTP. No. SOURCE DESTINATION SERVICE ACTION 1 All *Any TCP ftp User Auth Users@localnet 2 All Users@localnet *Any TCP http User Auth
A. True
B. False
Correct Answer: B
QUESTION 133
What is the software package through which all Check Point products use infrastructure services?
A. Cpstart/cpstop.
B. Check Point Registry.
C. CPD
D. Watch Dog for critical services.
E. SVN Foundation.
Correct Answer: E
QUESTION 134
Choose the BEST response to finish this statement. A Firewall:
A. Prevents unauthorized to or from a secured network.
B. Prevents unauthorized to or from a unsecured network.
C. Prevents authorized access to or from an Intranet.
D. Prevents authorized access to or from an Internet.
E. Prevents macro viruses from infecting the network.
Correct Answer: A
QUESTION 135
Where is the external if file located in VPN1/Firewall-1 NG?
A. FWDIR conf directory.
B. Database directory.
C. State directory.
D. Temp Directory.
E. Not used in VPN1/Firewall-1 NG.
Correct Answer: E
QUESTION 136
Which log viewer mode allows you to actually see the contents of the files HTTP-ed by the corporation’s Chief Executive Officer?
A. Security Log.
B. Active Connections Log.
C. Accounting Log.
D. Administrative Log.
E. None of the above.
Correct Answer: E
QUESTION 137
When you select the alert radio button on the topology tab of the interface properties window:
A. The action specified in the Action element of the Rule Base is taken.
B. The action specified in the Anti-Spoofing Alert field in the Global properties window is taken.
C. The action specified in the Pop up Alter Command in the Global properties window is taken.
D. Both A and B.
E. Both B and C.
Correct Answer: E
QUESTION 138
You are the firewall administrator with one management server managing one firewall. The system status displays a computer icon with a ‘!’ symbol in the status column. Which of the following is the most likely cause?
A. The destination object has been defined as external.
B. The Rule Base is unable to resolve the IP address.
C. The firewall has been halted.
D. The firewall is unprotected, no security policy is loaded.
E. Nothing is wrong.
Correct Answer: D
QUESTION 139
System Administrators use session authentication when they want users to:
A. Authenticate each time they use a supported service.
B. Authenticate all services.
C. Use only TENET, FTP, RLOGIN, and HTTP services.
D. Authenticate once, and then be able to use any service until logging off.
E. Both B and D
Correct Answer: B
QUESTION 140
Your customer has created a rule so that every time a user wants to go to Internet, that user must be authenticated. The customer requires an authentication scheme that provides transparency for the user and granular control for the administrator. User must also be able to log in from any location. Based on this information, which authentication schemes meets the customer’s needs?
A. Session
B. User
C. Client
D. Dual
E. Reverse
Correct Answer: B QUESTION 141
Implementing Dynamic NAT would enable an internal machine behind the firewall to act as an FTP Server for external clients.
A. True
B. False
Correct Answer: B QUESTION 142
The Enforcement Module (part if the VPN-1/FireWall-1 Module):
A. Examines all communications according to an Enterprise Security Policy.
B. Is installed on a host enforcement point.
C. Can provide authentication and Content Security features at the application level.
D. Us usually installed on a multi-homed machine.
E. All of the above.
Correct Answer: E QUESTION 143
In most cases when you are building the Rule Base you should place the Stealth Rule above all other rules except:
A. Clean up rules.
B. Implicit Riles.
C. Client Authentication Rules.
D. Pseudo Rules.
E. Default Rules.
Correct Answer: C QUESTION 144
If you change the inspection order of any of the implied rules under the Security Policy Setup, does it change the order in which the rules are enforced?
A. True
B. False
Correct Answer: A QUESTION 145
The fw fetch command allows an administrator to specify which Security Policy a remote enforcement module retrieves.
A. True
B. False
Correct Answer: A
QUESTION 146
You can edit VPE objects before they are actualized (translated from virtual network objects to real).
A. True
B. False.
Correct Answer: B
QUESTION 147
Stateful inspection is a firewall technology introduced in Checkpoint VPN-1/Firewall-1 software. It is designed to meet which if the following security requirements?
1.
Scan information from all layers in the packet.
2.
Save state information derived from previous communications, such as the outgoing Port command of an FTP session, so that incoming data communication can be verified against it.
3.
Allow state information derived from other applications access through the firewall for authorized services only, such as previously authenticated users.
4.
Evaluate and manipulate flexible expressions based on communication and application derived state information.
A. 1, 2, 3
B. 1, 3, 4
C. 1, 2, 4
D. 2, 3, 4
E. 1, 2, 3, 4
Correct Answer: E
QUESTION 148
If the security policy editor or system status GUI is open, you can open the log viewer GUI from the window menu.
A. True
B. False
Correct Answer: A
QUESTION 149
NAT can NOT be configured on which of the objects?
A. Hosts
B. Gateways
C. Networks
D. Users
E. Routers
Correct Answer: D
QUESTION 150
Your customer has created a rule so that every user wants to go to Internet, that user must be authenticated. Which is the best method of authentication for users who must use specific computers for Internet access?
A. Session
B. User
C. Client
D. Connection
E. None of the above.
Correct Answer: C
QUESTION 151
Which of the following describes the behavior of VPN-1/Firewall-1 NG?
A. Traffic not expressly prohibited is permitted.
B. Traffic not expressly permitted is prohibited.
C. TELNET, SMTP and HTTP are allowed by default.
D. Secure connections are authorized by default, unsecured connections are not.
E. All traffic is controlled by explicit rules.
Correct Answer: B
QUESTION 152
New users are created from templates. What is the name of the standard template from which you would create a new user?
A. New
B. User
C. Group
D. Standard User.
E. Default
Correct Answer: E
QUESTION 153
In a distributed management environment, the firewall administrator has removed the default check from Accept VPN-1/Firewall-1 control connections under the Security Policy tab of the properties setup dialogue box. In order for the management module and the Firewall to communicate, you must create a rule to allow the Management Module to communicate to the firewall on which port?
A. 80
B. 256
C. 259
D. 900
E. 23
Correct Answer: B
QUESTION 154
What is the command for installing a Security Policy from a *.W file?
A. Fw gen and then the name of the .W file.
B. Fw load and then the name of .W file.
C. Fw regen and then the name of the .W file.
D. Fw reload and then the directory location of the .W file.
E. Fw import and then the name of the .W file.
Correct Answer: B
QUESTION 155
In the Check Point Configuration Too, you create a GUI administrator with Read Only privileges. This allows the Firewall-1 administrator for the authorized GUI client (GUI workstation) privileges to change network object, and create and install rules.
A. True
B. False
Correct Answer: B QUESTION 156
Hybrid Authentication allows VPN-1/Firewall-1 NG to authenticate SecuRemote/SecureClient, using which of the following?
A. RADIUS
B. 3DES
C. TACACS
D. Any authentication method supported by VPN-1/Firewall-1.
E. Both A and C.
Correct Answer: D QUESTION 157
In order to install a new Security Policy on a remote firewall, what command must be issued on the remote firewall?
A. Fw unload all all.
B. Fw load new.
C. Cp clear policy.
D. None of the above, the command cp policy remove is issued from the manager.
E. None of the above, the new policy will automatically overwrite the existing policy.
Correct Answer: E QUESTION 158
As a firewall administrator if you want to log packets dropped by “implicit drop anything not covered” rules, you must explicitly define a Clean-up rule. This must be the last rule in the rule base.
A. True
B. False
Correct Answer: A QUESTION 159
Fully Automatic Client authentication provides authentication for all protocols, whether supported by these protocols or not.
A. True
B. False
Correct Answer: A QUESTION 160
VPN-1/Firewall-1 NG differs from Packet filtering and Application Layer Gateways, because?
A. VPN-1/Firewall-1 NG provides only minimal logging and altering mechanism.
B. VPN-1/Firewal-1 NG uses Stateful inspection which allows packet to be examined at the top of the layers of the OSI model.
C. VPN-1/Firewall-1 NG has access to a limited part of the packet header only.
D. VPN-1/Firewall-1NG requires a connection from a client to a firewall and firewall to a server.
E. VPN-1/Firewall-1 NG has access to packets passing through key locations in a network.
Correct Answer: B
QUESTION 161
AlphaBravo Corp has 72 privately addressed internal addresses. Each network is a piece of the 10-net subnetted to a class C address. AlphaBravo uses Dynamic NAT and hides all of the internal networks behind the external IP addresses of the Firewall. The Firewall administrator for AlphaBravo has noticed that policy installation takes significantly longer since adding all 72 internal networks to the address translation rule. What should the Firewall administrator do to reduce the time it takes to install a policy?
A. Create an object for the entire 10-net and use the object for the translation rule instead of the individual network objects.
B. Use automatic NAT rule creation on each network object. Hide the network behind the firewall’s external IP addresses.
C. Match packets to the state table, so packets are not dropped. Increase the size of the NAT tables.
D. Reinstall the Firewall and Security Policy Editor. The policy is corrupting Firewall’s binaries.
E. Increase the size of state table. Use automatic NAT rule creation to hide the networks behind an IP address other than firewall’s external IP.
Correct Answer: A
QUESTION 162
How does VPN-1/Firewall-1 NG implement Transparent authentication?
A. Unknown user receive error messages indicating that the firewalled gateway does not know the user names on the gateway.
B. VPN-1/Firewall-1 NG prompts for user names even through the authentication data may not be recognized by the firewall’s user database.
C. VPN-1/Firewall-1 NG allows connections, but hides the firewall from authenticated users.
D. Unknown users error messages indicating that the host does not know the users names on the server.
E. VPN-1/Firewall-1 NG does not allow connections from users who do not know the name of the firewall.
Correct Answer: C
QUESTION 163
When creating user authentication rule, select intersect with user database for source and destination to allow access according to the source specified in the rules.
A. True
B. False
Correct Answer: B
QUESTION 164
A connection initiated by the client in the figure below will be hidden behind the IP address of the interface
through which the connection was routed on the server side if the gateway (behind either interface 2 or
interface 3). Specifying 0.0.0.0 as the address is convenient because of network address translation (NAT)
is performed dynamically. And if the IP addresses of the gateway are changed, it is not necessary to
reconfigure the NAT parameters.
Which of the following is true about the following figure?
A. A connection initiated by the client will be hidden behind the IP address of the exit interface.
B. A connection initiated by the server will be hidden behind the IP address of the exit interface.
C. A connection initiated by the server will be hidden by the IP address of the client.
D. Source addresses of outbound packets from the client will be translated to 0.0.0.0.
E. Source addresses of outbound packets from the server will be translated to 0.0.0.0.
Correct Answer: A QUESTION 165
Which if the following statements about Client Authentication are FALSE?
A. In contrast to User Authentication, which allows access per user, Client Authentication allows access per ID address.
B. Authentication is by user name and password, but is the host machine (client) that is granted access.
C. Client Authentication is more secure than User Authentication, because it allows multiple users and connections from an authorized IP address or host.
D. Client Authentication enables administration to grant access privileges to a specific IP address after successful authentication.
Correct Answer: C QUESTION 166
When you make a rule, the rule is not enforces as part of your Security Policy.
A. True
B. False
Correct Answer: B QUESTION 167
Which of the following user actions would you insert as an INTERNAL Authentication scheme?
A. The user enters the security dynamics passcode.
B. The user prompted for a response from the RADIUS server.
C. The user prompted for a response from the AXENT server.
D. The user prompted for a response from the TACACS server.
E. The user enters an operating system account password.
Correct Answer: E QUESTION 168
When configuring Static NAT, you cannot map the routable IP address to the external IP address of the Firewall if attempted, the security policy installation fails with the following error “rule X conflicts with rule Y”.
A. True
B. False
Correct Answer: A QUESTION 169
The advantage of client authentication is that it can be used for any number of connections and for any services, but authentication is only valid for a specified length of time.
A. True
B. False Correct Answer: B QUESTION 170
You have set up Static NAT on a VPN-1/Firewall-1 to allow Internet traffic to an internal web server. You notice that any HTTP attempts to that machine being dropped in the log due to rule 0. Which of the following is the most likely cause?
A. Spoofing on the internal interface us set to Network defined by Interface IP and Net Mask.
B. Spoofing on the external interface is set to Not Defined.
C. You do NOT have a rule that allows HTTP access to the internal Web Server.
D. You do NOT have a rule that allows HTTP from the Web Server to Any destination.
E. None of the above.
Correct Answer: C QUESTION 171
As a firewall administrator, you are required to create VPN-1/Firewall-1 users for authentication. When you create a user for user authentication, the data is stored in the?
A. Inspect Engine.
B. Rule base.
C. Users database
D. Rulebase fws file
E. Inspect module.
Correct Answer: C QUESTION 172
If users authenticated successfully, they have matched the User and Authentication rule restriction of the user group to which they belong.
A. True
B. False
Correct Answer: A QUESTION 173
The only way to unblock BLOCKED connections by deleting all the blocking rules from the Rule base.
A. True
B. False
Correct Answer: B QUESTION 174
When you perform a cp fetch, what can you expect from this command?
A. Firewall retrieves the user database from the tables on the Management Module.
B. Firewall retrieves the inspection code from the remote Management Module and installs it to the kernel.
C. Management module retrieves the IP address of the target specified in the command.
D. Management module retrieves the interface information for the target specified in the command.
E. None of the above.
Correct Answer: B QUESTION 175
Each incoming UDP packet is locked up in the list of pending connections. Packets are delivered if they are _________.
A. A request.
B. A response to a request.
C. Source routed.
D. Allowed by the Rule Base.
E. Both B and D.
Correct Answer: E
QUESTION 176
Assume an NT system. What is the default expiration for a Dynamic NAT connection NOT showing any TCP activity?
A. 30 Seconds.
B. 60 Seconds.
C. 330 Seconds.
D. 660 Seconds.
E. 3600 Seconds.
Correct Answer: E
Buying all CheckPoint 156-210 exam sample questions can guarantee you to pass your first CheckPoint 156-210 exam. If you do not pass the exam,FLYDUMPS will full refund to you. You can also free online download the part of FLYDUMPS’s CheckPoint 156-210 exam practice questions and answers as a try. After your understanding of our reliability, I believe you will quickly add FLYDUMPS’s CheckPoint 156-210 exam sample questions to your cart. FLYDUMPS will achieve your dream. FLYDUMPS is a website to achieve dreams of many IT people. FLYDUMPS provide candidates participating in the IT certification exams the information they want to help them pass the CheckPoint 156-210 exam.
Welcome to download the newest Examwind JN0-360 dumps: http://www.examwind.com/jn0-360.html
http://www.maeeonline.org/sap-c-hanatec-1-preparation-materials-provides-best-sap-c-hanatec-1-test-engine-with-100-pass-rate/
FLYDUMPS ensures the quality and value of the CheckPoint 156-510 exam sample questions, and one hundred percent pass the exam, let you can pass the CheckPoint 156-510 exam successfully in your first studying. In addition, Killtest provide you with high-quality CheckPoint 156-510exam sample questions to help you learn more about the CheckPoint 156-510 examination of information, learning more knowledge of the entire examination, complete your dream of entering the IT Dream. FLYDUMPS CheckPoint 156-510 exam sample questions are based on the actual template of CheckPoint 156-510 Exam. You will learn all the tactics and techniques in FLYDUMPS CheckPoint 156-510 exam sample questions.
QUESTION 127
What is the name of the traffic capture tool that is available on Unix platforms?
A. Network monitor
B. Snoop
C. Sniffer
D. Tcpdump
Correct Answer: B
QUESTION 128
When initially setting up high availability, where would you enable the high availability services?
A. The cpconfig utility
B. The fwstart script
C. The management server global properties screen
D. The gateway cluster properties screen
Correct Answer: A
QUESTION 129
What is true about hardening the operating system of a firewall gateway?
A. It is only necessary on a Solaris platform
B. It is necessary on both Solaris and NT platforms
C. It is not necessary
D. It is only necessary on an NT platform
Correct Answer: B QUESTION 130
What command would you use to initiate a packet capture on a Unix machine?
A. snoop -o filename
B. tcpdump -i filename
C. snoop -i filename
D. tcpdump -o filename
Correct Answer: A QUESTION 131
If you use the -a option in the “fw dbexport” command to export a subset of the possible user attributes. What happens if you import the exported file back into the FW-1 user database using the “fw import” command?
A. The database is merged with the subset database
B. You will get a warning, stating that you may delete part of your database
C. The process will error with no change to the original database
D. The database is overwritten with the subset database
Correct Answer: D QUESTION 132
How do you remake a connection between a management server and a firewall module, if not using backward compatibility?
A. Reboot
B. Bounce the management server
C. Remake the SIC connection
D. Remake the putkey association
Correct Answer: C QUESTION 133
What is true about the following command? snoop -i filename | more
A. The file named “filename” contains raw captured traffic
B. It analyses captured traffic
C. It will continue the display until it ends
D. It captures traffic
Correct Answer: AB QUESTION 134
When configuring automatic synchronization for HA management modules, which is NOT a valid trigger for the synchronization to take place?
A. When the policy is installed
B. When the policy is saved
C. Regularly after a specified period
D. When you log off the GUI client
Correct Answer: D
QUESTION 135
To create synchronization between gateways in NG, which file do you need to edit?
A. conf.sync
B. sync.conf
C. None
D. rulebases.fws
Correct Answer: C
QUESTION 136
When a primary gateway cluster member fails another will take over. When the primary recovers what is true?
A. The action depends on the configuration of the ClusterXL screen of the cluster properties
B. The primary always resumes primary function
C. The action depends on the configuration of the Cluster member gateway general properties
D. The primary will become a lower priority and not resume its primary function
Correct Answer: A
QUESTION 137
When exporting a checkpoint user database for importation to an LDAP server, what format should the output file take?
A. LDAP
B. Binary
C. LDIF
D. HTTP
Correct Answer: C
QUESTION 138
Which of the following are termed CPMAD global parameters?
A. MAD_Memory
B. MAD_syn_attack_action
C. MAD_number_of_connection_attempts
D. MAD_anti_spoofing_mode AC
Correct Answer: AC
QUESTION 139
What is true about the effects of configuring a high MAD_clean_interval in CPMAD?
A. It reduces CPU utilization
B. It increases CPU utilization
C. It decreases memory usage
D. It increases memory usage
Correct Answer: AD QUESTION 140
What is the meaning of the “collision” status when seen against a secondary management module?
A. Synchronization was attempted from both primary and secondary at the same time
B. The primary management module database lags behind the secondary
C. Both the primary and secondary management module have independently updated databases since the last synchronization
D. Synchronization has failed due to network problems
Correct Answer: C QUESTION 141
If you want to use information from a cpinfo file produced by a Windows platform, you first need to perform a series of operations to extract the file concerned. True or false?
A. False
B. True
Correct Answer: A QUESTION 142
What command would you use on a Solaris machine to increase the amount of memory allocated to the kernel to approximately 16Mbytes?
A. set fw:fwhmem=0x16
B. set fw:fwhmem=0x10
C. set fw:fwhmem=0x1000000
D. set fw:fwhmem=0x16000000
Correct Answer: C QUESTION 143
How would you specify the primary member of a gateway cluster?
A. On the gateway cluster properties screen select “cluster members”, then arrange priority sequence using the increase and decrease priority buttons
B. On the gateway cluster properties screen select “cluster members”, then select priority number (1 is the highest)
C. On the member gateway properties general screen arrange priority sequence using the increase and decrease priority buttons
D. On the member gateway properties general screen select priority number (1 is the highest)
Correct Answer: A QUESTION 144
Which debug option will gather information regarding the accept or drop action performed on traffic?
A. ioctl
B. packet
C. driver
D. kbuf
Correct Answer: B QUESTION 145
Which of the following files is held on a management module and cotains the whole rulebase?
A. rulebases_5_0.C
B. objects.C
C. objects_5_0.C
D. rulebases_5_0.fws
Correct Answer: D
QUESTION 146
In the peer status area of the high availability management module screen of the active server, there are defined status levels that can apply to a peer module. Which status implies that a secondary module has a later version of the database than the primary?
A. Advanced
B. Lagging
C. Collision
D. Never Synchronized
Correct Answer: A
QUESTION 147
On a Windows platform, you can enable VPN and IKE logging by setting an environment variable. What is the command to do that?
A. Setenv VPN_DEBUG 1
B. Setenv VPN_DEBUG 0
C. Set VPN_DEBUG=0
D. Set VPN_DEBUG=1
Correct Answer: D
QUESTION 148
To configure a fully overlapping encryption domain, what type of group(s) do you need to configure?
A. A group containing both gateways and all the networks they protect
B. A group containing both gateways only
C. A group containing all the networks that both gateways protect
D. Two groups, one containing both gateways and the networks that one protects. The other containing both gateways and the networks the other protects.
Correct Answer: A
QUESTION 149
What is the approximate memory requirement of a simple (I.e. not authenticated or encrypted) connection in VPN-1/FW-1?
A. 3 Kbytes
B. 70 bytes
C. 10 bytes
D. 1 Kbytes
Correct Answer: B
QUESTION 150
If you want to run the cpinfo utility to gather diagnostic information for a problematic enforcement module in a distributed system, what is true?
A. You should run cpinfo on the enforcement module only
B. You should run cpinfo on all the modules in the distributed system
C. You should run cpinfo on both the management and enforcement modules
D. You should run cpinfo on the management module only
Correct Answer: C QUESTION 151
Which two types of overlapping encryption domains are supported by FW-1?
A. Partial overlap
B. Full overlap
C. Proper subset
D. Partial subset
Correct Answer: BC QUESTION 152
Which is NOT a valid log file maintained on the SecuRemote client?
A. sr_watchdog_tde.log
B. sr_service_<serial number>.log
C. sr_background_tde.log
D. sr_gui_tde.log
Correct Answer: C QUESTION 153
Which debug option will gather information about input/output control messages, such as loading of FW-1 or kernel to daemon communications?
A. kbuf
B. ioctl
C. misc
D. driver
Correct Answer: B QUESTION 154
It is not possible to use two gateways running a standalone installation in an MEP environment. True or false?
A. False
B. True
Correct Answer: B QUESTION 155
How would you use a policy editor gui in local mode when using FW-1 NG FP-2?
A. Enter *local in the “management server” box of the GUI login screen
B. Check the “demo mode” box of the GUI login screen
C. Enter demo_mode in the “management server” box of the GUI login screen
D. Enter *local in the “user name” box of the GUI login screen
Correct Answer: AB QUESTION 156
How would you restart CPMAD on a firewall?
A. $FWDIR/conf/fwstart
B. $FWDIR/bin/cpmad
C. $FWDIR/cpmad/fwstart
D. $FWDIR/bin/fwstart
Correct Answer: D QUESTION 157
What is used by FW-1 to create a SIC certificate?
A. External CA
B. Putkey
C. LDAP
D. Internal CA
Correct Answer: D QUESTION 158
How would you find more information about the “fw tab” options?
A. fw tab help
B. fw tab -h
C. fw tab -?
D. fw tab options -h
Correct Answer: B QUESTION 159
What is contained in the rulebases.fws file?
A. Auditing information
B. All rulebases
C. All rulebases plus auditing information
D. Only the rulebase from the last load
Correct Answer: B QUESTION 160
When using management high availability, you can synchronize from the primary or secondary management server. True or false?
A. False
B. True
Correct Answer: A QUESTION 161
On a SecuRemote client, in which directory are the log files located?
A. $CPDIR/log
B. $SCDIR/log
C. $SRDIR/log
D. $FWDIR/log
Correct Answer: C QUESTION 162
If you were having problems with a CVP server, you may want to capture traffic to and from the server. What could you do to get this information?
A. Run “fw monitor” for port 18182 on the interface connected to the management server
B. Run “fw monitor” for port 18182 on the interface connected to the CVP server
C. Run “fw monitor” for port 18181 on the interface connected to the management server
D. Run “fw monitor” for port 18181 on the interface connected to the CVP server
Correct Answer: D
QUESTION 163
When using backward compatibility, what is true?
A. It restricts inter-module communications to the putkey method
B. It allows the management of 4.1 gateways
C. It restricts inter-module communication to the SIC method
D. It allows the use of the old putkey function
Correct Answer: BD
QUESTION 164
Why would you disable NetBEUI on a FW-1 Windows Platform?
A. It can cause FW-1 to crash
B. It clashes with internal FW-1 protocols
C. It is an inefficient protocol
D. It is a security risk
Correct Answer: D
QUESTION 165
What does “resolver_ttl” do in relation to SecuRemote configuration?
A. Specifies the interval in seconds between RDP status queries
B. Specifies that RDP status queries are sent automatically
C. Specifies the number of seconds that a Securemote client waits for a reply to a RDP status query
D. Controls the time to live when accessing a DNS server
Correct Answer: C
By the use of CheckPoint 156-510 exam sample questions along with most relevant CheckPoint 156-510 questions and answers as they are an ideal study tool to pass CheckPoint 156-510 test in very first try. FLYDUMPS CheckPoint 156-510 exam sample questions are developed by our team of IT experts. Send us a scanned copy of your failed exam and we will promptly proceed to refund. The last package which is certainly not the least but a royal pack, which can give you full preparation on the subject and provide you 100 per cent guarantee of clearing the CheckPoint 156-510 exam sample questions. We are all well aware that a major problem in the IT industry is that there is a lack of quality questions answers.
Not only will you be given theoretical, but also given practical labs which will give you even more practice than before. Our site offers you a comprehensive look at the best prospects available in Checkpoint 156-215 exam sample questions throughout the Industry. The Checkpoint 156-215 exam sample questions offered by FLYDUMPS is very comprehensive and covers all exam questions that need to be covered to pass the Checkpoint 156-215 exam. Professionals and experts at FLYDUMPS are very dedicated and they prepare Checkpoint 156-215 exam sample questions with great effort. In our Checkpoint 156-215 exam sample questions you will the accurate and up-to-date information.
QUESTION 119
You create implicit and explicit rules for the following network. The group object “internal-networks” include networks 10.10.10.0 and 10.10.20.0. Assume “Accept ICMP requests” is enabled as before last in the Global Properties.
Based on these rules, what happens if you Ping from host 10.10.10.5 to a host on the Internet, by IP address? ICMP will be:
A. dropped by rule 0
B. dropped by rule 2, the Cleanup Rule
C. accepted by rule 1
D. dropped by the last implicit rule
E. accepted by the implicit rule
Correct Answer: C
QUESTION 120
What does schema checking do?
A. Authenticates users attempting to access resources protected by an NGX Security Gateway.
B. Verifies that every object class, and its associated attributes, is defined in the directory schema.
C. Maps LDAP objects to objects in the NGX objects_5_0.c files.
D. Verifies the Certificate Revocation List for Certificate Validity.
E. Provides topology downloads for SecuRemote and SecureClient users authenticated by an LDAP server.
Correct Answer: B
QUESTION 121
Jill is about to test some rule and object changes suggested in an NGX newsgroup. Which backup and restore solution should Jill use, to ensure she can most easily restore her Security Policy to its previous configuration, after testing the changes?
A. SecurePlatform backup utilities
B. Manual copies of the $FWDIR/conf directory
C. Upgrade_export and upgrade_import commands
D. Policy Package management
E. Database Revision Control
Correct Answer: E
QUESTION 122
You want VPN traffic to match packets from internal interfaces. You also want the traffic to exit the Security Gateway, bound for all site-to-site VPN Communities, including Remote Access Communities. How should you configure the VPN match rule
A. internalclear>All-GwToGw
B. Communities>Communities
C. Internalclear>ExternalClear
D. Internalclear>Communities
E. Internalclear>Allcommunities
Correct Answer: E
QUESTION 123
Review the following rules and note the Client Authentication Action properties screen, as shown in the
exhibit.
After being authenticated by the Security Gateway when a user starts an HTTP connection to a Web site
the user tries to FTP to another site using the command line. What happens to the user?
The….
A. FTP session is dropprd by the implicit Cleanup Rule.
B. User is prompted from the FTP site only, and does not need to enter username nad password for the Client Authentication.
C. FTP connection is dropped by rule 2.
D. FTP data connection is dropped, after the user is authenticated successfully.
E. User is prompted for authentication by the Security Gateway again.
Correct Answer: B
QUESTION 124
What is the command to see the licenses of the Security Gateway Certkiller from your SmartCenter Server?
A. print Certkiller
B. fw licprint Certkiller
C. fw tab -t fwlic Certkiller
D. cplic print Certkiller
E. fw lic print Certkiller
Correct Answer: D
QUESTION 125
Ophelia is the security Administrator for a shipping company. Her company uses a custom application to update the distribution database. The custom application includes a service used only to notify remote sites that the distribution database is malfunctioning. The perimeter Security Gateways Rule Base includes a rule to accept this traffic. Ophelia needs to be notified, via atext message to her cellular phone, whenever traffic is accepted on this rule. Which of the following options is MOST appropriate for Ophelia’s requirement?
A. User-defined alert script
B. Logging implied rules
C. SmartViewMonitor
D. Pop-up API
E. SNMP trap
Correct Answer: A
QUESTION 126
Which of the following is the final step in an NGXbackup?
A. Test restoration in a non-production environment, using the upgradeimport command
B. Move the *.tgz file to another location
C. Run the upgradeexport command
D. Copy the conf directory to another location
E. Run the cpstop command
Correct Answer: B
QUESTION 127
Which mechanism is used to export Check Point logs to third party applications?
A. OPSE
B. CPLogManager
C. LEA
D. SmartViewTracker
E. ELA
Correct Answer: C
QUESTION 128
In NGX, what happens if a Distinguished Name (ON) is NOT found in LADP?
A. NGX takes the common-name value from the Certificate subject, and searches the LADP account unit for a matching user id
B. NGX searches the internal database for the username
C. The Security Gateway uses the subject of the Certificate as the ON for the initial lookup
D. If the first request fails or if branches do not match, NGX tries to map the identity to the user id attribute
E. When users authenticate with valid Certificates, the Security Gateway tries to map the identities with users registered in the extemal LADP user database
Correct Answer: D
QUESTION 129
Which command allows you to view the contents of an NGX table?
A. fw tab -s <tablename>-
B. fw tab -t <tablename>-
C. fw tab -u <tablename>-
D. fw tab -a <tablename>-
E. fw tab -x <tablename>-
Correct Answer: B QUESTION 130
The following is cphaprobstate command output from a New Mode High Availability cluster member:
Which machine has the highest priority?
A. 192.168.1.2,since its number is 2
B. 192.168.1.1,because its number is 1
C. This output does not indicate which machine has the highest priority
D. 192.168.1.2, because its state is active
Correct Answer: B
QUESTION 131
What do you use to view an NGX Security Gateway’s status, including CPU use, amount of virtual memory, percent of free hard-disk space, and version?
A. SmartLSM
B. SmartViewTracker
C. SmartUpdate
D. SmartViewMonitor
E. SmartViewStatus
Correct Answer: D
QUESTION 132
Which of the following commands is used to restore NGX configuration information?
A. cpcontig
B. cpinfo-i
C. restore
D. fwm dbimport
E. upgradeimport
Correct Answer: E
QUESTION 133
Which of the following commands shows full synchronizalion status?
A. cphaprob -i list
B. cphastop
C. fw ctl pstat
D. cphaprob -a if
E. fw hastat
Correct Answer: C
QUESTION 134
Which VPN Community object is used to configure VPN routing within the SmartDashboard?
A. Star
B. Mesh
C. Remote Access
D. Map
Correct Answer: A
QUESTION 135
If you are experiencing LDAP issues, which of the following should you check?
A. Secure lnternal Cornrnunicalions(SIC)
B. VPN tunneling
C. Overlapping VPN Domains
D. NGX connectivity
E. VPN Load Balancing
Correct Answer: D
QUESTION 136
Which operating system is not supported byVPN-1 SecureClient?
A. IPS0 3.9
B. Windows XP SP2
C. Windows 2000 Professional
D. RedHat Linux 7 0
E. MacOS X
Correct Answer: A
QUESTION 137
Which Check Point QoS feature issued to dynamically allocate relative portions of available bandwidth?
A. Guarantees
B. Differentiated Services
C. Limits
D. Weighted Fair Queueing
E. Low Latency Queueinq
Correct Answer: D
QUESTION 138
You are running a VPN-1 NG with Application Intelligence R54 SecurePlatform VPN-1 Pro Gateway. The Gateway also serves as a Policy Server. When you run patch add cd from the NGX CD, what does this command allow you to upgrade?
A. Only VPN-1 Pro Security Gateway
B. Both the operating system (OS) and all Check Point products
C. All products, except the Policy Server
D. On~ the patch utility is upgraded using this command
E. Only the OS
Correct Answer: B
QUESTION 139
Amanda is compiling traffic statistics for Certkiller .com’s Internet activity during production hours. How could she use SmartView Monitor to find this information? By
A. using the “Traffic Counters” settings and SmartView Monitor to generate a graph showing the total HTTP traffic for the day
B. -monitoring each specific user’s Web traffic use.
C. Viewing total packets passed through the Security Gateway
D. selecting the “Tunnels” view, and generating a report on the statistics
E. configuring a Suspicious Activity Rule which triggers an alert when HTTP traffic passes through the Gateway
Correct Answer: A
QUESTION 140
Certkiller is the Security Administrator for a software-development company. To isolate the corporate network from the developer’s network, Certkiller installs an internal Security Gateway. Jack wants to optimize the performance of this Gateway. Which of the following actions is most likely to improve the Gateway’s performance?
A. Remove unused Security Policies from Policy Packages
B. Clear all Global Properties check boxes, and use explicit rules
C. Use groups within groups in the manual NAT Rule Base
D. Put the least-used rules at the top of the Rule Base
E. Use domain objects in rules, where possible
Correct Answer: A
QUESTION 141
Certkiller is the Security Administrator for a chain of grocery stores. Each grocery store is protected by a Security Gateway. Certkiller is generating a report for the information-technology audit department. The report must include the name of the Security Policy installed on each remote Security Gateway, the date and time the Security Policy was installed, and general performance statistics (CPU Use, average CPU time, active real memory, etc.). Which SmartConsole application should Certkiller use to gather this information?
A. SmartUpdate
B. SmartView Status
C. SmartView Tracker
D. SmartLSM
E. SmartView Monitor
Correct Answer: E
QUESTION 142
How can you reset Secure Internal Communications (SIC) between a SmartCenter Server and Security Gateway?
A. Run the command fwm sicreset to reinitialize the Internal Certificate Authority (ICA) of the SmartCenter Server. Then retype the activation key on the Security-Gateway from SmartDashboard
B. From cpconfig on the SmartCenter Server, choose the Secure Internal Communication option and retype the actrvation key Next, retype the same key in the gateway object in SmartDashboard and reinitialize Secure Internal Communications (SIC)
C. From the SmartCenter Server’s command line type fw putkey -p <shared key>- <IP Address of SmartCenter Server>-.
D. From the SmartCenter Server’s command line type fw putkey -p <shared key>- <IP Address of security Gateway>-.
E. Re-install the Security Gateway
Correct Answer: B QUESTION 143
Which NGX feature or command allows Security Administrators to revert to earlier versions of the Security Policy without changing object configurations?
A. upgradeexport/upgradeimport
B. Policy Package management
C. fwm dbexport/fwm dbimport
D. cpconfig
E. Database Revision Control
Correct Answer: B
QUESTION 144
Certkiller is the Security Administrator for Certkiller .com’s large geographically distributed network. The internet connection at one of her remote sites failed during the weekend, and the Security Gateway logged locally for over 48 hours. Certkiller is concerned that the logs may have consumed most of the free space on the Gateway’s hard disk. Which SmartConsole application should Certkiller use, to view the percent of free hard-disk space on the remote Security Gateway?
A. SmartView Status
B. SmartView Tracker
C. SmartUpdate
D. SmartView Monitor
E. SmartLSM
Correct Answer: D
QUESTION 145
Certkiller is recently hired as the Security Administrator for a public relations company. Certkiller’s manager has asked her to investigate ways to improve the performance of the firm’s perimeter Security Gateway. Certkiller must propose a plan based on the following required and desired results Required Result #1: Do not purchase new hardware Required Result #2: Use configuration changes that do not reduce security Desired Result #1: Reduce the number of explicit rules in the Rule Base Desired Result #2: Reduce the volume of logs Desired Result #3: Improve the Gateway’s performance Proposed Solution: Certkiller recommends the following changes to the Gateway’s configuration:
1.
Replace all domain objects with network and group objects.
2.
Stop logging Domain Name over UDP (queries)
3.
Use Global Properties, instead of explicit rules, to control ICMP. VRRP, and RIP. Does Certkiller’s proposed solution meet the required and desired result s?
A. The solution meets the required results, and two of the desired results
B. The solution does not meet the required results
C. The solution meets all required results, and none of the desired results
D. The solution meets all required and desired results
E. The solution meets the required results, and one of the desired results
Correct Answer: A
QUESTION 146
What is a Consolidation Policy?
A. The collective name of the Security Policy, Address Translation, and SmartDefense Policies
B. The specific Policy used by Eventia Reporter to configure log-management practices
C. The state of the Policy once installed on a Security Gateway
D. A Policy created by Eventia Reporter to generate logs
E. The collective name of the logs generated by Eventia Reporter
Correct Answer: B
QUESTION 147
To change an existing ClusterXL cluster object from Multicast to Unicast mode, what configuration change must be made?
A. Change the cluster mode to Unicast on the cluster object Reinstall the Security Policy
B. Reset Secure Internal Communications (SIC) on the cluster-member objects. Reinstall the Security Policy
C. Run cpstop and cpstart, to reenable High Availability on both objects. Select Pivot mode in cpconfig
D. Change the cluster mode to Unicast on the cluster-member object
E. Switch the internal network’s default Security Gateway to the pivot machine’s IP address
Correct Answer: A
Checkpoint 156-215 exam from FLYDUMPS will certainly assist you in gaining the knowledge and experience needed to study. Many of our customers claim that the Checkpoint 156-215 exam included in our study guide are a great compliment to already popular CCB-400 exam sample questions. FLYDUMPS Checkpoint 156-215 exam can guarantee that combined with proper effort, Checkpoint 156-215 exam questions will certainly boost your chance of passing the Checkpoint 156-215 exam. FLYDUMPS Checkpoint 156-215 exam follows the same syllabus followed by actual Checkpoint 156-215 certification exam, we also constantly upgrade our Checkpoint 156-215 exam so you always get the best and updated information.