Category: Checkpoint
Because CheckPoint 156-215 exam has changed recently,Flydumps presents the new version of CheckPoint 156-215 exam practice test, which helps candidates to pass the CheckPoint 156-215 exam easily.The exam dumps covers all aspect of CheckPoint 156-215 exam.You can visit our website to free CheckPoint 156-215 exam download the New Version VCE Player.
QUESTION 106
A Security Policy has several database versions. What configuration remains the same no matter which version is used?
A. Objects_5_0.C
B. fwauth.NDB
C. Rule Bases_5_0.fws
D. Internal Certificate Authority (ICA) certificate
Correct Answer: D QUESTION 107
You are working with multiple Security Gateways that enforce an extensive number of rules. To simplify security administration, which one of the following would you choose to do?
A. Create network objects that restrict all applicable rules to only certain networks.
B. Run separate SmartConsole instances to login and configure each Security Gateway directly.
C. Create a separate Security Policy package for each remote Security Gateway.
D. Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.
Correct Answer: C QUESTION 108
Which rules are not applied on a first-match basis?
A. Client Authentication
B. Session Authentication
C. User Authentication
D. Cleanup
Correct Answer: C QUESTION 109
Installing a policy usually has no impact on currently existing connections. Which statement is TRUE?
A. All connections are reset, so a policy install is recommended during announced downtime only.
B. Users being authenticated by Client Authentication have to re-authenticate.
C. Site-to-Site VPNs need to re-authenticate, so Phase 1 is passed again after installing the Security Policy.
D. All FTP downloads are reset; users have to start their downloads again.
Correct Answer: B QUESTION 110
Several Security Policies can be used for different installation targets. The firewall protecting Human Resources’ servers should have a unique Policy Package. These rules may only be installed on this machine and not accidentally on the Internet firewall. How can this be configured?
A. A Rule Base is always installed on all possible targets. The rules to be installed on a firewall are
defined by the selection in the row Install On of the Rule Base.
B. When selecting the correct firewall in each line of the row Install On of the Rule Base, only this firewall is shown in the list of possible installation targets after selecting Policy > Install.
C. In the SmartDashboard policy, select the correct firewall to be the Specific Target of the rule.
D. A Rule Base can always be installed on any Check Point firewall object. It is necessary to select the appropriate target directly after selecting Policy > Install.
Correct Answer: C
QUESTION 111
A ___________ rule is used to prevent all traffic going to the R75 Security Gateway.
A. Cleanup
B. Stealth
C. Reject
D. IPS
Correct Answer: B
QUESTION 112
In a distributed management environment, the administrator has removed the default check from Accept Control Connections under the Policy > Global Properties > FireWall tab. In order for the Security Management Server to install a policy to the Firewall, an explicit rule must be created to allow the server to communicate to the Security Gateway on port __________.
A. 259
B. 256
C. 80
D. 900
Correct Answer: B
QUESTION 113
To check the Rule Base, some rules can be hidden so they do not distract the administrator from the unhidden rules. Assume that only rules accepting HTTP or SSH will be shown. How do you accomplish this?
A. This cannot be configured since two selections (Service, Action) are not possible.
B. Ask your reseller to get a ticket for Check Point SmartUse and deliver him the Security Management Server cpinfo file.
C. In SmartDashboard menu, select Search > Rule Base Queries. In the window that opens, create a new Query, give it a name (e.g. “HTTP_SSH”) and define a clause regarding the two services HTTP and SSH. When having applied this, define a second clause for the action Accept and combine them with the Boolean operator AND.
D. In SmartDashboard, right-click in the column field Service > Query Column. Then, put the services HTTP and SSH in the list. Do the same in the field Action and select Accept here.
Correct Answer: C
QUESTION 114
What CANNOT be configured for existing connections during a policy install?
A. Reset all connections
B. Re-match connections
C. Keep all connections
D. Keep data connections
Correct Answer: A QUESTION 115
What is the purpose of a Stealth Rule?
A. To permit implied rules.
B. To drop all traffic to the management server that is not explicitly permitted.
C. To prevent users from connecting directly to the gateway.
D. To permit management traffic.
Correct Answer: C QUESTION 116
Which of these Security Policy changes optimize Security Gateway performance?
A. Use Automatic NAT rules instead of Manual NAT rules whenever possible.
B. Using domain objects in rules when possible.
C. Using groups within groups in the manual NAT Rule Base.
D. Putting the least-used rule at the top of the Rule Base.
Correct Answer: A QUESTION 117
Your perimeter Security Gateway’s external IP is 200.200.200.3. Your network diagram shows:Required:
Allow only network 192.168.10.0 and 192.168.20.0 to go out to Internet, using 200.200.200.5.
The local network 192.168.1.0/24 needs to use 200.200.200.3 to go out to the Internet.
Assume you enable all the settings in the NAT page of Global Properties.
How do you achieve this requirement?
A. Create a network object 192.168.0.0/16. Enable Hide NAT on the NAT page. Enter
200.200.200.5 as the hiding IP address. Add an ARP entry for 200.200.200.5 for the MAC address of 200.200.200.3.
B. Create network objects for 192.168.10.0/24 and 192.168.20.0/24. Enable Hide NAT on both network objects, using 200.200.200.5 as hiding IP address. Add an ARP entry for 200.200.200.3 for the MAC address of 200.200.200.5.
C. Create an Address Range object, starting from 192.168.10.1 to 192.168.20.254. Enable Hide NAT on the NAT page of the address range object. Enter Hiding IP address 200.200.200.5. Add an ARP entry for 200.200.200.5 for the MAC address of 200.200.200.3.
D. Create two network objects: 192.168.10.0/24 and 192.168.20.0/24. Add the two network objects to a group object. Create a manual NAT rule like the following: Original source -groupobject; Destination – any; Service – any; Translated source – 200.200.200.5; Destination -original; Service – original.
Correct Answer: C
QUESTION 118
Because of pre-existing design constraints, you set up manual NAT rules for your HTTP server. However, your FTP server and SMTP server are both using automatic NAT rules. All traffic from your FTP and SMTP servers are passing through the Security Gateway without a problem, but traffic from the Web server is dropped on rule 0 because of anti-spoofing settings. What is causing this?
A. Allow bi-directional NAT is not checked in Global Properties.
B. Translate destination on client side is not checked in Global Properties under Manual NAT Rules.
C. Manual NAT rules are not configured correctly.
D. Routing is not configured correctly.
Correct Answer: B
QUESTION 119
You enable Hide NAT on the network object, 10.1.1.0 behind the Security Gateway’s external interface. You browse to from host, 10.1.1.10 successfully. You enable a log on the rule that allows 10.1.1.0 to exit the network. How many log entries do you see for that connection in SmartView Tracker?
A. Two, one for outbound, one for inbound
B. Only one, inbound
C. Only one, outbound
D. Two, both outbound, one for the real IP connection and one for the NAT IP connection
Correct Answer: C
QUESTION 120
Which of the following statements BEST describes Check Point’s Hide Network Address Translation method?
A. Translates many source IP addresses into one source IP address
B. Many-to-one NAT which implements PAT (Port Address Translation) for accomplishing both Source and Destination IP address translation
C. Translates many destination IP addresses into one destination IP address
D. One-to-one NAT which implements PAT (Port Address Translation) for accomplishing both Source and Destination IP address translation
Correct Answer: A
QUESTION 121
Which Check Point address translation method allows an administrator to use fewer ISP-assigned IP addresses than the number of internal hosts requiring Internet connectivity?
A. Static Source
B. Static Destination
C. Dynamic Destination
D. Hide
Correct Answer: D
QUESTION 122
NAT can NOT be configured on which of the following objects?
A. Host
B. HTTP Logical Server
C. Address Range
D. Gateway
Correct Answer: B
QUESTION 123
Which Check Point address translation method is necessary if you want to connect from a host on the Internet via HTTP to a server with a reserved (RFC 1918) IP address on your DMZ?
A. Hide Address Translation
B. Static Destination Address Translation
C. Port Address Translation
D. Dynamic Source Address Translation
Correct Answer: B
QUESTION 124
You want to implement Static Destination NAT in order to provide external, Internet users access to an internal Web Server that has a reserved (RFC 1918) IP address. You have an unused valid IP address on the network between your Security Gateway and ISP router. You control the router that sits between the firewall external interface and the Internet. What is an alternative configuration if proxy ARP cannot be used on your Security Gateway?
A. Publish a proxy ARP entry on the ISP router instead of the firewall for the valid IP address.
B. Publish a proxy ARP entry on the internal Web server instead of the firewall for the valid IP address.
C. Place a static host route on the firewall for the valid IP address to the internal Web server.
D. Place a static ARP entry on the ISP router for the valid IP address to the firewall’s external address.
Correct Answer: D
QUESTION 125
After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by antispoofing protections. Which of the following is the MOST LIKELY cause?
A. The Global Properties setting Translate destination on client side is checked. But the topology on the DMZ interface is set to Internal – Network defined by IP and Mask. Uncheck the Global Properties setting Translate destination on client side.
B. The Global Properties setting Translate destination on client side is unchecked. But the topology on the external interface is set to Others +. Change topology to External.
C. The Global Properties setting Translate destination on client side is checked. But the topology on the external interface is set to External. Change topology to Others +.
D. The Global Properties setting Translate destination on client side is unchecked. But the topology on the DMZ interface is set to Internal – Network defined by IP and Mask. Check the Global Properties setting Translate destination on client side.
Correct Answer: D
QUESTION 126
Which NAT option applicable for Automatic NAT applies to Manual NAT as well?
A. Translate destination on client-side
B. Enable IP Pool NAT
C. Allow bi-directional NAT
D. Automatic ARP configuration
Correct Answer: A
QUESTION 127
Your main internal network 10.10.10.0/24 allows all traffic to the Internet using Hide NAT. You also have a small network 10.10.20.0/24 behind the internal router. You want to configure the kernel to translate the source address only when network 10.10.20.0 tries to access the Internet for HTTP, SMTP, and FTP services. Which of the following configurations will allow this network to access the Internet?
A. Configure Automatic Static NAT on network 10.10.20.0/24.
B. Configure Automatic Hide NAT on network 10.10.20.0/24 and then edit the Service column in the NAT Rule Base on the automatic rule.
C. Configure one Manual Hide NAT rule for HTTP, FTP, and SMTP services for network 10.10.20.0/24.
D. Configure three Manual Static NAT rules for network 10.10.20.0/24, one for each service.
Correct Answer: C
QUESTION 128
You have three servers located in a DMZ, using private IP addresses. You want internal users from 10.10.10.x to access the DMZ servers by public IP addresses. Internal_net 10.10.10.x is configured for Hide NAT behind the Security Gateway’s external interface.
What is the best configuration for 10.10.10.x users to access the DMZ servers, using the DMZ servers’ public IP addresses?
A. When connecting to the Internet, configure manual Static NAT rules to translate the DMZ servers.
B. When connecting to internal network 10.10.10.x, configure Hide NAT for the DMZ network behind the Security Gateway DMZ interface.
C. When the source is the internal network 10.10.10.x, configure manual static NAT rules to translate the DMZ servers.
D. When trying to access DMZ servers, configure Hide NAT for 10.10.10.x behind the DMZ’s
interface. Correct Answer: C QUESTION 129 An internal host initiates a session to and is set for Hide NAT behind the Security Gateway. The initiating traffic is an example of ____________.
A. None of these
B. source NAT
C. destination NAT
D. client side NAT
Correct Answer: B QUESTION 130
A host on the Internet initiates traffic to the Static NAT IP of your Web server behind the Security Gateway. With the default settings in place for NAT, the initiating packet will translate the _________.
A. source on client side
B. source on server side
C. destination on client side
D. destination on server side
Correct Answer: C QUESTION 131
A Web server behind the Security Gateway is set to Automatic Static NAT. Client side NAT is not checked in the Global Properties. A client on the Internet initiates a session to the Web Server. Assuming there is a rule allowing this traffic, what other configuration must be done to allow the traffic to reach the Web server?
A. A static route for the NAT IP must be added to the Gateway’s upstream router.
B. Automatic ARP must be unchecked in the Global Properties.
C. Nothing else must be configured.
D. A static route must be added on the Security Gateway to the internal host.
Correct Answer: D QUESTION 132
When translation occurs using automatic Hide NAT, what also happens?
A. The destination port is modified.
B. Nothing happens.
C. The destination is modified.
D. The source port is modified.
Correct Answer: D QUESTION 133
The fw monitor utility is used to troubleshoot which of the following problems?
A. Address translation
B. Log Consolidation Engine
C. User data base corruption
D. Phase two key negotiation
Correct Answer: A
QUESTION 134
Looking at the SYN packets in the Wireshark output, select the statement that is true about NAT.
A. This is an example of Hide NAT.
B. This is an example of Static NAT and Translate destination on client side unchecked in Global Properties.
C. There is not enough information provided in the Wireshark capture to determine the NAT settings.
D. This is an example of Static NAT and Translate destination on client side checked in Global Properties.
Correct Answer: D
QUESTION 135
In SmartDashboard, Translate destination on client side is checked in Global Properties. When Network Address Translation is used:
A. VLAN tagging cannot be defined for any hosts protected by the Gateway.
B. The Security Gateway’s ARP file must be modified.
C. It is not necessary to add a static route to the Gateway’s routing table.
D. It is necessary to add a static route to the Gateway’s routing table.
Correct Answer: C
Each Answers in CheckPoint 156-215 study guides are checked by the concerned professional to provide you the best quality dumps. If you are looking to get certified in short possible time, you will never find quality product than Flydumps.com.
CheckPoint 156-215 Dumps PDF, Best Quality CheckPoint 156-215 Demo Free Download Online Shop
Where to free download the new Checkpoint 156-215 exam questions to pass the exam easily? Now,Flydumps has publised the new version of Checkpoint 156-215 exam dumps with new added exam questions.you can also get free VCE and PDF, and the new Checkpoint 156-215 practice tests ensure your exam 100% pass. Visit Flydumps.com to get the 100% pass ensure!
QUESTION 74
You want to generate a cpinfo file via CLI on a system running SecurePlatform. This will take about 40 minutes since the log files are also needed. What action do you need to take regarding timeout?
A. Log in as the default user expert and start cpinfo.
B. No action is needed because cpshell has a timeout of one hour by default.
C. Log in as Administrator, set the timeout to one hour with the command idle 60 and start cpinfo.
D. Log in as admin, switch to expert mode, set the timeout to one hour with the command, idle 60, then start cpinto.
Correct Answer: C
QUESTION 75
Many companies have defined more than one administrator. To increase security, only one administrator should be able to install a Rule Base on a specific Firewall. How do you configure this?
A. Define a permission profile in SmartDashboard with read/write privileges, but restrict it to all other firewalls by placing them in the Policy Targets field. Then, an administrator with this permission profile cannot install a policy on any Firewall not listed here.
B. In the General Properties of the object representing the specific Firewall, go to the Software Blades product list and select Firewall. Right-click in the menu, select Administrator to Install to define only this administrator.
C. Put the one administrator in an Administrator group and configure this group in the specific Firewall object in Advanced / Permission to Install.
D. Right-click on the object representing the specific administrator, and select that Firewall in Policy Targets.
Correct Answer: C
QUESTION 76
You are the Security Administrator for MegaCorp. A Check Point firewall is installed and in use on a SecurePlatform. You have trouble configuring the speed and duplex settings of your Ethernet interfaces. Which of the following commands can be used to configure the speed and duplex settings of an Ethernet interface and will survive a reboot? Give the BEST answer.
A. cthtool
B. ifconfig a
C. eth_set
D. mii_tool
Correct Answer: C
QUESTION 77
Which command enables IP forwarding on IPSO?
A. echo 1 > /proc/sys/net/ipv4/ip_forward
B. clish -c set routing active enable
C. echo 0 > /proc/sys/net/ipv4/ip_forward
D. ipsofwd on admin
Correct Answer: D QUESTION 78
Looking at an fw monitor capture in Wireshark, the initiating packet in Hide NAT translates on________.
A. I
B. O
C. o
D. i
Correct Answer: B QUESTION 79
You want to create an ASCII formatted output file of the fw monitor command. What is the correct syntax to accomplish this task?
A. fw monitor -e “accept;” > /tmp/monitor.txt
B. fw monitor -e “accept;” -f > /tmp/monitor.txt
C. fw monitor -m iO -e “accept;” -o /tmp/monitor.txt
D. fw monitor -e “accept;” -w /tmp/monitor.txt
Correct Answer: A QUESTION 80
The button Get Address, found on the Host Node Object > General Properties page, will retrieve what?
A. The domain name
B. The fully qualified domain name
C. The Mac address
D. The IP address
Correct Answer: D QUESTION 81
When you change an implicit rule’s order from last to first in global properties, how do you make the change take effect?
A. Select save from the file menu
B. Reinstall the security policy
C. Select install database from the policy menu
D. Run fw fetch from the security gateway
Correct Answer: B QUESTION 82
You create implicit and explicit rules for the following network. The group object internal-networks includes networks 10.10.10.0 and 10.10.20.0. Assume Accept ICMP requests is enabled as Before last in Global Properties.
Based on these rules, what happens if you Ping from host 10.10.10.5 to a host on the Internet by IP address? ICMP will be:
A. dropped by rule 0.
B. dropped by rule 2, the Cleanup Rule.
C. accepted by rule 1.
D. dropped by the last Implicit rule.
Correct Answer: C QUESTION 83
Anti-Spoofing is typically set up on which object type?
A. Host
B. Domain
C. Network
D. Security Gateway
Correct Answer: D QUESTION 84
Spoofing is a method of:
A. Hiding your firewall from unauthorized users.
B. Disguising an illegal IP address behind an authorized IP address through port address Translation.
C. Making packets appear as if they come from an authorized IP address
D. Detecting people using false or wrong authentication logins.
Correct Answer: C QUESTION 85
Which of the below is the MOST correct process to reset SIC from SmartDashboard?
A. Run cpconfig, and click Reset.
B. Click the Communication button for the firewall object, then click Reset. Run cpconfig and type a new activation key.
C. Click Communication > Reset on the Gateway object, and type a new activation key.
D. Run cpconfig, and select Secure Internal Communication > Change One Time Password.
Correct Answer: B QUESTION 86
“Pass Any Exam. Any Time.” – www.actualtests.com 49 Checkpoint 156-215.75 Exam You installed Security Management Server on a computer using SecurePlatform in the MegaCorp home office. You use IP address 10.1.1.1. You also installed the Security Gateway on a second SecurePlatform computer, which you plan to ship to another Administrator at a MegaCorp hub office. What is the correct order for pushing SIC certificates to the Gateway before shipping it?
1) Run cpconfig on the gateway, set secure internal communication, enter the activation key and reconfirm.
2) Initialize internal certificate authority (ICA) on the security Management server.
3) Confirm the gateway object with the host name and IP address for the remote site.
4) Click the communication button in the gateway object’s general screen, enter the activation key, and click initialize and ok.
5) Install the security policy.
A. 2, 3, 4, 5, 1
B. 1, 3, 2, 4, 5
C. 2, 3, 4, 1, 5
D. 2, 1, 3, 4, 5
Correct Answer: B
QUESTION 87
You want to reset SIC between smberlin and sgosaka.
In SmartDashboard, you choose sgosaka, Communication, Reset. On sgosaka, you start cpconfig, choose Secure Internal Communication and enter the new SIC Activation Key. The screen reads The SIC was successfully initialized and jumps back to the cpconfig menu. When trying to establish a connection, instead of a working connection, you receive this error message:
What is the reason for this behavior?
A. You must first initialize the Gateway object in SmartDashboard (i.e., right-click on the object, choose Basic Setup / Initialize).
B. The Gateway was not rebooted, which is necessary to change the SIC key.
C. The Check Point services on the Gateway were not restarted because you are still in the cpconfig utility.
D. The activation key contains letters that are on different keys on localized keyboards. Therefore, the activation can not be typed in a matching fashion.
Correct Answer: C
QUESTION 88
Which rule should be the Cleanup Rule in the Rule Base?
A. Last. It serves a logging function before the implicit drop.
B. Last, it explicitly drops otherwise accepted traffic
C. Before last followed by the Stealth Rule.
D. First, it explicitly accepts otherwise dropped traffic.
Correct Answer: A
QUESTION 89
What are the two basic rules which should be used by all Security Administrators?
A. Administrator Access and Stealth rules
B. Cleanup and Administrator Access rules
C. Network Traffic and Stealth rules
D. Cleanup and Stealth rules
Correct Answer: D
QUESTION 90
When you hide a rule in a Rule Base, how can you then disable the rule?
A. Use the search utility in SmartDashboard to view all hidden rules Select the relevant rule and click Disable Rule(s).
B. Right-click on the hidden rule place-holder bar and select Disable Rule(s).
C. Right-click on the hidden rule place-holder bar and uncheck Hide, then right-click and select Disable Rule(s); re-hide the rule.
D. Hidden rules are already effectively disabled from Security Gateway enforcement.
Correct Answer: C QUESTION 91
A Stealth rule is used to:
A. Use the Security Gateway to hide the border router from internal attacks.
B. Cloak the type of Web server in use behind the Security Gateway.
C. Prevent communication to the Security Gateway itself.
D. Prevent tracking of hosts behind the Security Gateway.
Correct Answer: C QUESTION 92
A Clean-up rule is used to:
A. Drop without logging connections that would otherwise be dropped and logged fry default
B. Log connections that would otherwise be accepted without logging by default.
C. Log connections that would otherwise be dropped without logging by default.
D. Drop without logging connections that would otherwise be accepted and logged by default
Correct Answer: C QUESTION 93
Which statement is TRUE about implicit rules?
A. They are derived from Global Properties and explicit object properties.
B. The Gateway enforces implicit rules that enable outgoing packets only.
C. You create them in SmartDashboard.
D. Changes to the Security Gateway’s default settings do not affect implicit rules.
Correct Answer: A QUESTION 94
You have included the Cleanup Rule in your Rule Base. Where in the Rule Base should the Accept ICMP Requests implied rule have no effect?
A. First
B. Before Last
C. Last
D. After Stealth Rule
Correct Answer: C QUESTION 95
In a distributed management environment, the administrator has removed all default check boxes from the Policy / Global Properties / Firewall tab. In order for the Security Gateway to send logs to the Security Management Server, an explicit rule must be created to allow the Security Gateway to communicate to the Security Management Server on port ______.
A. 259
B. 257
C. 900
D. 256
Correct Answer: B QUESTION 96
Examine the following Security Policy. What, if any, changes could be made to accommodate Rule 4?
A. Nothing at all
B. Modify the Source or Destination columns in Rule 4
C. Remove the service HTTPS from the Service column in Rule A
D. Modify the VPN column in Rule 2 to limit access to specific traffic
Correct Answer: D
QUESTION 97
A Security Policy has several database versions. What configuration remains the same no matter which version is used?
A. Rule Bases_5_0.fws
B. Internal Certificate Authority (ICA) certificate
C. Fwauth.NDB
D. Objects_5_0.C
Correct Answer: B
QUESTION 98
You are working with multiple Security Gateways that enforce a common set of rules. To minimize the number of policy packages, which one of the following would you choose to do?
A. Install a separate local Security Management Server and SmartConsole for each remote Security Gateway.
B. Create a separate Security Policy package for each remote Security Gateway and specify Install On / Gateways.
C. Create a single Security Policy package with Install On / Target defined whenever a unique rule is required for a specific Gateway.
D. Run separate SmartDashbord instance to login and configure each Security Gateway directly.
Correct Answer: C QUESTION 99
Which rules are not applied on a first-match basis?
A. Cleanup
B. User Authentication
C. Session Authentication
D. Client Authentication
Correct Answer: B QUESTION 100
Several Security Policies can be used for different installation targets. The firewall protecting Human Resources’ servers should have a unique Policy Package. These rules may only be installed on this machine and not accidentally on the Internet firewall. How can this be configured?
A. A Rule Base is always installed on all possible targets. The rules to be installed on a firewall are defined by the selection in the row Install On of the Rule Base.
B. When selecting the correct firewall in each line of the row Install On of the Rule Base, only this firewall is shown in the list of possible installation targets after selecting Policy > Install.
C. In the SmartDashboard main menu go to Policy / Policy Installation / Targets and select the correct firewall to be put into the list via Specific Targets.
D. A Rule Base can always be installed on any Check Point firewall object It is necessary to select the appropriate target directly after selecting Policy > Install.
Correct Answer: C QUESTION 101
Which of these security policy changes optimize Security Gateway performance?
A. Use Automatic NAT rules instead of Manual NAT rules whenever possible
B. Putting the least-used rule at the top of the Rule Base
C. Using groups within groups in the manual NAT Rule Base
D. Using domain objects in rules when possible
Correct Answer: A QUESTION 102
Your perimeter Security Gateway’s external IP is 200.200.200.3. Your network diagram shows: RequireD. Allow only network 192.168.10.0 and 192.168.20.0 to go out to the Internet, using 200.
200.200.5.
The local network 192.168.1.0/24 needs to use 200.200.200.3 to go out to the Internet.
Assuming you enable all the settings in the NAT page of Global Properties, how could you achieve these requirements?
A. Create a network object 192.168.0.0/16. Enable Hide NAT on the NAT page. Enter 200.200.200.5 as the hiding IP address. Add and ARP entry for 200.200.200.5 for the MAC “Pass Any Exam. Any Time.”
-www.actualtests.com 58
Checkpoint 156-215.75 Exam
address of 200.200.200.3.
B. Create network objects for 192.168.10.0/24 and 192.168.20.0/24. Enable Hide NAT on both network objects, using 200.200.200.5 as hiding IP address Add an ARP entry for 200.200.200.3 for the MAC address of 200.200.200.5.
C. Create an Address Range object, starting from 192.168.10.1 to 192.168.20.254. Enable Hide NAT on the NAT page of the address range object. Enter Hiding IP address 200.200.200.5. Add an ARP entry for 200.200.200.5 for the MAC address of 200.200.200.3.
D. Create two network objects: 192.168.10.0/24. and 192.168.20.0/24. Add the two network objects. Create a manual NAT rule like the following Original source group object; Destination any Service -any, Translated source 200.200.200.5; Destination original, Service original.
Correct Answer: C
QUESTION 103
You enable Hide NAT on the network object, 10.1.1.0 behind the Security Gateway’s external interface. You browse to from host, 10.1.1.10 successfully. You enable a log on the rule that allows 10.1.1.0 to exit the network. How many log entries do you see for that connection in SmartView Tracker?
A. Only one, outbound
B. Two, one for outbound, one for inbound
C. Only one, inbound
D. Two, both outbound, one for the real IP connection and one for the NAT IP connection
Correct Answer: A QUESTION 104
Which of the following statements BEST describes Check Point’s Hide Network Address Translation method?
A. Many-to-one NAT which implements PAT (Port Address Translation) for accomplishing both Source and Destination IP address translation
B. Translates many destination IP addresses into one destination IP address
C. Translates many source IP addresses into one source IP address
D. One-to-one NAT which implements PAT (Port Address Translation) for accomplishing both Source and Destination IP address translation
Correct Answer: C
QUESTION 105
Which Check Point address translation method allows an administrator to use fewer ISP-assigned IP addresses than the number of internal hosts requiring Internet connectivity?
A. Static Destination
B. Hide
C. Dynamic Destination
D. Static Source
Correct Answer: B
QUESTION 106
NAT can be implemented on which of the following lists of objects?
A. Host, Network
B. Host, User
C. Domain, Network
D. Network, Dynamic Object
Correct Answer: A
QUESTION 107
You want to implement Static Destination NAT in order to provide external, Internet users access to an internal Web Server that has a reserved (RFC 1918) IP address. You have an unused valid IP address on the network between your Security Gateway and ISP router. You control the router that sits between the external interface of the firewall and the Internet. What is an alternative configuration if proxy ARP cannot be used on your Security Gateway?
A. Place a static host route on the firewall for the valid IP address to the internal Web server.
B. Place a static ARP entry on the ISP router for the valid IP address to the firewall’s external address.
C. Publish a proxy ARP entry on the ISP router instead of the firewall for the valid IP address.
D. Publish a proxy ARP entry on the internal Web server instead of the firewall for the valid IP address.
Correct Answer: B
QUESTION 108
After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by anti- spoofing protections. Which of the following is the MOST LIKELY cause?
A. The Global Properties setting Translate destination on client side is checked. But the topology on the external interface is set to External.Change topology to Others +.
B. The Global Properties setting Translate destination on client side is unchecked. But the topology on the external interface is set to Others +. Change topology to External
C. The Global Properties setting Translate destination on client side is checked But the topology on the DMZ interface is set to Internal -Network defined by IP and Mask Uncheck the Global Properties setting Translate destination on client side
D. The Global Properties setting Translate destination on client side is unchecked. But the topology on the DMZ interface is set to Internal – Network defined by IP and Mask. Check the Global Properties setting Translate destination on client side.
Correct Answer: D
QUESTION 109
Which NAT option applicable for Automatic NAT applies to Manual NAT as well?
A. Allow bi-directional NAT
B. Automatic ARP configuration
C. Enable IP Pool NAT
D. Translate destination on client-side
Correct Answer: D
QUESTION 110
Your main internal network 10.10.10.0/24 allows all traffic to the Internet using Hide NAT. You also have a small network 10.10.20.0/24 behind the internal router. You want to configure the kernel to translate the source address only when network 10.10.20.0 tries to access the Internet for HTTP, SMTP, and FTP services. Which of the following configurations will allow this network to access the Internet?
A. Configure three Manual Static NAT rules for network 10.10.20.0/24, one for each service
B. Configure one Manual Hide NAT rule for HTTP, FTP, and SMTP services for network 10.10.20.0/24
C. Configure Automatic Hide NAT on network 10.10.20.0/24 and then edit the Service column in the NAT Rule Base on the automatic rule
D. Configure Automatic Static NAT on network 10.10.20.0/24
Correct Answer: B
QUESTION 111
You have three servers located in a DMZ, using private IP addresses. You want internal users from
10.10.10.x
to access the DMZ servers by public IP addresses. Internal_net 10.10.10.x is configured for Hide NAT behind the Security Gateway’s external interface.
A.
When connecting to the Internet, configure manual Static NAT rules to translate the DMZ servers
B.
When the source is the internal network 10.10.10.x, configure manual static NAT rules to translate the DMZ servers.
C.
When connecting to internal network 10 10.10 x. configure Hide NAT for the DMZ servers.
D.
When connecting to the internal network 10.10.10x, configure Hide Nat for the DMZ network behind the DMZ interface of the Security Gateway
What is the best configuration for 10.10.10.x users to access the DMZ servers, using the DMZ servers’ public IP addresses?
Correct Answer: B
QUESTION 112
A host on the Internet initiates traffic to the Static NAT IP of your Web server behind the Security Gateway. With the default settings in place for NAT, the initiating packet will translate the_________.
A. source on client side
B. destination on server side
C. destination on client side
D. source on server side
Correct Answer: C
QUESTION 113
A Web server behind the Security Gateway is set to Automatic Static NAT. Client side NAT is not checked in the Global Properties. A client on the Internet initiates a session to the Web Server. Assuming there is a rule allowing this traffic, what other configuration must be done to allow the traffic to reach the Web server?
A. Automatic ARP must be unchecked in the Global Properties.
B. A static route must be added on the Security Gateway to the internal host.
C. Nothing else must be configured.
D. A static route for the NAT IP must be added to the Gateway’s upstream router.
Correct Answer: B
QUESTION 114
When translation occurs using automatic Hide NAT, what also happens?
A. Nothing happens.
B. The source port is modified.
C. The destination port is modified.
D. The destination is modified.
Correct Answer: B
QUESTION 115
The fw monitor utility is used to troubleshoot which of the following problems?
A. Phase two key negotiation
B. User data base corruption
C. Address translation
D. Log Consolidation Engine
Correct Answer: C
QUESTION 116
Looking at the SYN packets in the Wireshark output, select the statement that is true about NAT.
A. There is not enough information provided in the Wireshark capture to determine NAT settings.
B. This is an example hide NAT.
C. There is an example of Static NAT and translate destination on client side unchecked in Global Properties.
D. This is an example of Static NAT and Translate destination on client side checked in Global Properties.
Correct Answer: D
QUESTION 117
In SmartDashboard, Translate destination on client side is checked in Global Properties. When Network Address Translation is used:
A. It is necessary to add a static route to the Gateway’s routing table.
B. The Security Gateway’s ARP file must be modified.
C. It is not necessary to add a static route to the Gateway’s routing table.
D. VLAN tagging cannot be defined for any hosts protected by the Gateway.
Correct Answer: C QUESTION 118
Static NAT connections, by default, translate on which firewall kernel inspection point?
A. Post-inbound
B. Eitherbound
C. Inbound
D. Outbound
Correct Answer: C QUESTION 119
In a Hide NAT connection outbound, which portion of the packet is modified?
A. Source IP address and destination port
B. Destination IP address and destination port
C. Source IP address and source port
D. Destination IP address and destination port
Correct Answer: C QUESTION 120
You are MegaCorp’s Security Administrator. There are various network objects which must be NATed. Some of them use the Automatic Hide NAT method, while others use the Automatic Static NAT method. What is the order of the rules if both methods are used together? Give the best answer.
A. The Administrator decides on the order of the rules by shifting the corresponding rules up and down.
B. The Static NAT rules have priority over the Hide NAT rules and the NAT on a node has priority over the NAT on a network or an address range
C. The Hide NAT rules have priority over the Static NAT rules and the NAT on a node has priority over the NAT on a network or an address range
D. The position of the rules depends on the time of their creation. The rules created first are placed at the top; rules created later are placed successively below the others.
Correct Answer: B QUESTION 121
Which answers are TRUE? Automatic Static NAT CANNOT be used when: i) NAT decision is based on the destination port ii) Source and Destination IP both have to be translated iii) The NAT rule should only be installed on a dedicated Gateway only iv) NAT should be performed on the server side
A. (i), (ii), and (iii)
B. (i), and (ii)
C. (ii) and (iv)
D. only (i)
Correct Answer: D QUESTION 122
After filtering a fw monitor trace by port and IP, a packet is displayed three times; in the i, I, and o inspection points, but not in the O inspection point. Which is the likely source of the issue?
A. The packet has been sent out through a VPN tunnel unencrypted.
B. An IPSO ACL has blocked the outbound passage of the packet.
C. A SmartDefense module has blocked the packet
D. It is an issue with NAT
Correct Answer: D
QUESTION 123
A marketing firm’s networking team is trying to troubleshoot user complaints regarding access to audio-streaming material from the Internet. The networking team asks you to check the object and rule configuration settings for the perimeter Security Gateway. Which SmartConsole application should you use to check these objects and rules?
A. SmartView Tracker
B. SmartView Status
C. SmartView Monitor
D. SmartDashboard
Correct Answer: D
QUESTION 124
Which of the following is a viable consideration when determining Rule Base order?
A. Grouping authentication rules with address-translation rules
B. Grouping rules by date of creation
C. Grouping reject and drop rules after the Cleanup Rule
D. Grouping functionally related rules together
Correct Answer: D
QUESTION 125
Which of the following is a viable consideration when determining Rule Base order?
A. Adding SAM rules at the top of the Rule Base
B. Placing frequently accessed rules before less frequently accessed rules
C. Grouping rules by date of creation
D. Grouping IPS rules with dynamic drop rules
Correct Answer: B
Flydumps.com provides you with the most reliable practice exams to master Checkpoint 156-215 Certification. Our Microsoft questions and answers are certified by the senior lecturer and experienced technical experts in the Microsoft field. These test questions provide you with the experience of taking the Checkpoint 156-215 actual test.
Checkpoint 156-215 Dumps, Helpful Checkpoint 156-215 PDF Exams With 100% Pass Rate
[The Newest Dumps] Real CheckPoint 156-215 exam dumps revised by experts, they were updated with the change of the Software Certifications CSQA,covering all the whole aspects of CheckPoint 156-215 exam. Just have a training of Flydumps CheckPoint 156-215 exam questions to guarantee your 100% pass.
QUESTION 135
In a distributed management environment, the administrator has removed all default check boxes from the Policy / Global Properties / Firewall tab. In order for the Security Gateway to send logs to the Security Management Server, an explicit rule must be created to allow the Security Gateway to communicate to the Security Management Server on port ______.
A. 259
B. 257 “Pass Any Exam. Any Time.” – www.actualtests.com 54 Checkpoint 156-215.75 Exam
C. 900
D. 256
Correct Answer: B
QUESTION 136
Examine the following Security Policy. What, if any, changes could be made to accommodate Rule 4?
A. Nothing at all
B. Modify the Source or Destination columns in Rule 4
C. Remove the service HTTPS from the Service column in Rule A
D. Modify the VPN column in Rule 2 to limit access to specific traffic
Correct Answer: D
QUESTION 137
A Security Policy has several database versions. What configuration remains the same no matter which version is used?
A. Rule Bases_5_0.fws “Pass Any Exam. Any Time.” – www.actualtests.com 55 Checkpoint 156-215.75 Exam
B. Internal Certificate Authority (ICA) certificate
C. Fwauth.NDB
D. Objects_5_0.C
Correct Answer: B
QUESTION 138
You are working with multiple Security Gateways that enforce an extensive number of rules. To simplify Security administration, which one of the following would you choose to do?
A. Create a separate Security Policy package for each remote Security Gateway
B. Run separate SmartConsole instances to login and configure each Security Gateway directly
C. Eliminate all possible contradictory rules such as the Stealth or Cleanup rules
D. Create network objects that restrict all applicable rules to only certain networks
Correct Answer: A
QUESTION 139
You are working with multiple Security Gateways that enforce a common set of rules. To minimize the number of policy packages, which one of the following would you choose to do?
A. Install a separate local Security Management Server and SmartConsole for each remote Security Gateway.
B. Create a separate Security Policy package for each remote Security Gateway and specify Install On / Gateways.
C. Create a single Security Policy package with Install On / Target defined whenever a unique rule is required for a specific Gateway.
D. Run separate SmartDashbord instance to login and configure each Security Gateway directly.
Correct Answer: C
QUESTION 140
Which rules are not applied on a first-match basis?
“Pass Any Exam. Any Time.” – www.actualtests.com 56 Checkpoint 156-215.75 Exam
A. Cleanup
B. User Authentication
C. Session Authentication
D. Client Authentication
Correct Answer: B
QUESTION 141
Installing a policy usually has no impact on currently existing connections. Which statement is TRUE?
A. Users being authenticated by Client Authentication have to re-authenticate.
B. Site-to-Site VPNs need to re-authenticate, so Phase 1 is passed again after installing the Security Policy.
C. All FTP downloads are reset; users have to start their downloads again.
D. All connections are reset, so a policy install is recommended during announced downtime only.
Correct Answer: A QUESTION 142
Several Security Policies can be used for different installation targets. The firewall protecting Human Resources’ servers should have a unique Policy Package. These rules may only be installed on this machine and not accidentally on the Internet firewall. How can this be configured?
A. A Rule Base is always installed on all possible targets. The rules to be installed on a firewall are defined by the selection in the row Install On of the Rule Base.
B. When selecting the correct firewall in each line of the row Install On of the Rule Base, only this firewall is shown in the list of possible installation targets after selecting Policy > Install.
C. In the SmartDashboard main menu go to Policy / Policy Installation / Targets and select the correct firewall to be put into the list via Specific Targets.
D. A Rule Base can always be installed on any Check Point firewall object It is necessary to select the appropriate target directly after selecting Policy > Install.
Correct Answer: C
QUESTION 143
Which of these security policy changes optimize Security Gateway performance?
A. Use Automatic NAT rules instead of Manual NAT rules whenever possible
B. Putting the least-used rule at the top of the Rule Base
C. Using groups within groups in the manual NAT Rule Base
D. Using domain objects in rules when possible
Correct Answer: A
QUESTION 144
Your perimeter Security Gateway’s external IP is 200.200.200.3. Your network diagram shows:
RequireD. Allow only network 192.168.10.0 and 192.168.20.0 to go out to the Internet, using 200.
200.200.5.
The local network 192.168.1.0/24 needs to use 200.200.200.3 to go out to the Internet.
Assuming you enable all the settings in the NAT page of Global Properties, how could you achieve these requirements?
A. Create a network object 192.168.0.0/16. Enable Hide NAT on the NAT page. Enter 200.200.200.5 as the hiding IP address. Add and ARP entry for 200.200.200.5 for the MAC “Pass Any Exam. Any Time.”
-www.actualtests.com 58 Checkpoint 156-215.75 Exam
address of 200.200.200.3.
B. Create network objects for 192.168.10.0/24 and 192.168.20.0/24. Enable Hide NAT on both network objects, using 200.200.200.5 as hiding IP address Add an ARP entry for 200.200.200.3 for the MAC address of 200.200.200.5.
C. Create an Address Range object, starting from 192.168.10.1 to 192.168.20.254. Enable Hide NAT on the NAT page of the address range object. Enter Hiding IP address 200.200.200.5. Add an ARP entry for 200.200.200.5 for the MAC address of 200.200.200.3.
D. Create two network objects: 192.168.10.0/24. and 192.168.20.0/24. Add the two network objects. Create a manual NAT rule like the following Original source 璯roup object; Destination ?any Service ? any, Translated source ?200.200.200.5; Destination ?original, Service ?original.
Correct Answer: C
QUESTION 145
Because of a pre-existing design constraints, you set up manual NAT rules for your HTTP server. However, your FTP server and SMTP server are both using automatic NAT rules. All traffic from your FTP and SMTP servers are passing through the Security Gateway without a problem, but traffic from the Web server is dropped on rule 0 because of anti-spoofing settings. What is causing this?
A. Allow bi-directional NAT is not checked in Global Properties.
B. Manual NAT rules are not configured correctly.
C. Translate destination on client side is not checked in Global Properties under manual NAT rules.
D. Routing is not configured correctly.
Correct Answer: C
QUESTION 146
You enable Hide NAT on the network object, 10.1.1.0 behind the Security Gateway’s external interface. You browse to from host, 10.1.1.10 successfully. You enable a log on the rule that allows 10.1.1.0 to exit the network. How many log entries do you see for that connection in SmartView Tracker?
A. Only one, outbound
B. Two, one for outbound, one for inbound “Pass Any Exam. Any Time.” – www.actualtests.com 59 Checkpoint 156-215.75 Exam
C. Only one, inbound
D. Two, both outbound, one for the real IP connection and one for the NAT IP connection
Correct Answer: A
QUESTION 147
Which of the following statements BEST describes Check Point’s Hide Network Address Translation method?
A. Many-to-one NAT which implements PAT (Port Address Translation) for accomplishing both Source and Destination IP address translation
B. Translates many destination IP addresses into one destination IP address
C. Translates many source IP addresses into one source IP address
D. One-to-one NAT which implements PAT (Port Address Translation) for accomplishing both Source and Destination IP address translation
Correct Answer: C
QUESTION 148
Which Check Point address translation method allows an administrator to use fewer ISP-assigned IP addresses than the number of internal hosts requiring Internet connectivity?
A. Static Destination B. Hide
C. Dynamic Destination
D. Static Source
Correct Answer: B QUESTION 149
NAT can NOT be configured on which of the following objects?
“Pass Any Exam. Any Time.” – www.actualtests.com 60 Checkpoint 156-215.75 Exam
A. Address Range
B. HTTP Logical Server
C. Host
D. Gateway
Correct Answer: B QUESTION 150
NAT can be implemented on which of the following lists of objects?
A. Host, Network
B. Host, User
C. Domain, Network
D. Network, Dynamic Object
Correct Answer: A QUESTION 151
Which Check Point address translation method is necessary if you want to connect from a host on the Internet via HTTP to a server with a reserved (RFC 1918) IP address on your DMZ?
A. Static Destination Address Translation
B. Port Address Translation
C. Dynamic Source Address Translation
D. Hide Address Translation
Correct Answer: A QUESTION 152
You want to implement Static Destination NAT in order to provide external, Internet users access to an internal Web Server that has a reserved (RFC 1918) IP address. You have an unused valid IP address on the network between your Security Gateway and ISP router. You control the router that sits between the external interface of the firewall and the Internet.
“Pass Any Exam. Any Time.” – www.actualtests.com 61 Checkpoint 156-215.75 Exam What is an alternative configuration if proxy ARP cannot be used on your Security Gateway?
A. Place a static host route on the firewall for the valid IP address to the internal Web server.
B. Place a static ARP entry on the ISP router for the valid IP address to the firewall’s external address.
C. Publish a proxy ARP entry on the ISP router instead of the firewall for the valid IP address.
D. Publish a proxy ARP entry on the internal Web server instead of the firewall for the valid IP address.
Correct Answer: B QUESTION 153
After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by anti- spoofing protections. Which of the following is the MOST LIKELY cause?
A. The Global Properties setting Translate destination on client side is checked. But the topology on the external interface is set to External.Change topology to Others +.
B. The Global Properties setting Translate destination on client side is unchecked. But the topology on the external interface is set to Others +. Change topology to External
C. The Global Properties setting Translate destination on client side is checked But the topology on the DMZ interface is set to Internal -Network defined by IP and Mask Uncheck the Global Properties setting Translate destination on client side
D. The Global Properties setting Translate destination on client side is unchecked. But the topology on the DMZ interface is set to Internal – Network defined by IP and Mask. Check the Global Properties setting Translate destination on client side.
Correct Answer: D
QUESTION 154
Which NAT option applicable for Automatic NAT applies to Manual NAT as well?
A. Allow bi-directional NAT
B. Automatic ARP configuration
C. Enable IP Pool NAT
D. Translate destination on client-side “Pass Any Exam. Any Time.” – www.actualtests.com 62 Checkpoint 156-215.75 Exam
Correct Answer: D
QUESTION 155
Your main internal network 10.10.10.0/24 allows all traffic to the Internet using Hide NAT. You also have a small network 10.10.20.0/24 behind the internal router. You want to configure the kernel to translate the source address only when network 10.10.20.0 tries to access the Internet for HTTP, SMTP, and FTP services. Which of the following configurations will allow this network to access the Internet?
A. Configure three Manual Static NAT rules for network 10.10.20.0/24, one for each service
B. Configure one Manual Hide NAT rule for HTTP, FTP, and SMTP services for network 10.10.20.0/24
C. Configure Automatic Hide NAT on network 10.10.20.0/24 and then edit the Service column in the NAT Rule Base on the automatic rule
D. Configure Automatic Static NAT on network 10.10.20.0/24
Correct Answer: B
QUESTION 156
You have three servers located in a DMZ, using private IP addresses. You want internal users from
10.10.10.x to access the DMZ servers by public IP addresses. Internal_net 10.10.10.x is configured for Hide NAT behind the Security Gateway’s external interface.
What is the best configuration for 10.10.10.x users to access the DMZ servers, using the DMZ servers’ public IP addresses?
“Pass Any Exam. Any Time.” – www.actualtests.com 63 Checkpoint 156-215.75 Exam A. When connecting to the Internet, configure manual Static NAT rules to translate the DMZ servers
B. When the source is the internal network 10.10.10.x, configure manual static NAT rules to translate the DMZ servers.
C. When connecting to internal network 10 10.10 x. configure Hide NAT for the DMZ servers.
D. When connecting to the internal network 10.10.10x, configure Hide Nat for the DMZ network behind the DMZ interface of the Security Gateway
Correct Answer: B
QUESTION 157
An internal host initiates a session to and is set for Hide NAT behind the Security Gateway. The initiating traffic is an example of __________.
A. None of these
B. source NAT
C. destination NAT
D. client side NAT
Correct Answer: B
QUESTION 158
A host on the Internet initiates traffic to the Static NAT IP of your Web server behind the Security Gateway. With the default settings in place for NAT, the initiating packet will translate the_________.
A. source on client side
B. destination on server side
C. destination on client side
D. source on server side
Correct Answer: C
QUESTION 159
A Web server behind the Security Gateway is set to Automatic Static NAT. Client side NAT is not checked in the Global Properties. A client on the Internet initiates a session to the Web Server. Assuming there is a rule allowing this traffic, what other configuration must be done to allow the traffic to reach the Web server?
A. Automatic ARP must be unchecked in the Global Properties.
B. A static route must be added on the Security Gateway to the internal host.
C. Nothing else must be configured.
D. A static route for the NAT IP must be added to the Gateway’s upstream router.
Correct Answer: B QUESTION 160
When translation occurs using automatic Hide NAT, what also happens?
A. Nothing happens.
B. The source port is modified.
C. The destination port is modified.
D. The destination is modified. “Pass Any Exam. Any Time.” – www.actualtests.com 65 Checkpoint 156-215.75 Exam
Correct Answer: B
QUESTION 161
The fw monitor utility is used to troubleshoot which of the following problems?
A. Phase two key negotiation
B. User data base corruption
C. Address translation
D. Log Consolidation Engine
Correct Answer: C QUESTION 162
The fw monitor utility would be best to troubleshoot which of the following problems?
A. An error occurs when editing a network object in SmartDashboard
B. A statically NATed Web server behind a Security Gateway cannot be reached from the Internet.
C. You get an invalid ID error in SmartView Tracker for phase 2 IKE key negotiations.
D. A user in the user database is corrupt.
Correct Answer: B QUESTION 163
Looking at the SYN packets in the Wireshark output, select the statement that is true about NAT.
“Pass Any Exam. Any Time.” – www.actualtests.com 66 Checkpoint 156-215.75 Exam
A. There is not enough information provided in the Wireshark capture to determine NAT settings.
B. This is an example hide NAT.
C. There is an example of Static NAT and translate destination on client side unchecked in Global Properties.
D. This is an example of Static NAT and Translate destination on client side checked in Global Properties.
Correct Answer: D QUESTION 164
In SmartDashboard, Translate destination on client side is checked in Global Properties. When Network Address Translation is used:
A. It is necessary to add a static route to the Gateway’s routing table.
B. The Security Gateway’s ARP file must be modified.
C. It is not necessary to add a static route to the Gateway’s routing table.
D. VLAN tagging cannot be defined for any hosts protected by the Gateway.
Correct Answer: C QUESTION 165
Secure Internal Communications (SIC) is completely NAT-tolerant because it is based on:
A. MAC addresses.
B. SIC names.
C. SIC is not NAT-tolerant. “Pass Any Exam. Any Time.” – www.actualtests.com 67 Checkpoint 156-215.75 Exam
D. IP addresses.
Correct Answer: B QUESTION 166
Static NAT connections, by default, translate on which firewall kernel inspection point?
A. Post-inbound
B. Eitherbound
C. Inbound
D. Outbound
Correct Answer: C QUESTION 167
In a Hide NAT connection outbound, which portion of the packet is modified?
A. Source IP address and destination port
B. Destination IP address and destination port
C. Source IP address and source port
D. Destination IP address and destination port
Correct Answer: C QUESTION 168
You are MegaCorp’s Security Administrator. There are various network objects which must be NATed. Some of them use the Automatic Hide NAT method, while others use the Automatic Static NAT method. What is the order of the rules if both methods are used together? Give the best answer.
A. The Administrator decides on the order of the rules by shifting the corresponding rules up and down. “Pass Any Exam. Any Time.” – www.actualtests.com 68
Checkpoint 156-215.75 Exam
B. The Static NAT rules have priority over the Hide NAT rules and the NAT on a node has priority over the NAT on a network or an address range
C. The Hide NAT rules have priority over the Static NAT rules and the NAT on a node has priority over the NAT on a network or an address range
D. The position of the rules depends on the time of their creation. The rules created first are placed at the top; rules created later are placed successively below the others.
Correct Answer: B
QUESTION 169
Which answers are TRUE? Automatic Static NAT CANNOT be used when:
i) NAT decision is based on the destination port
ii) Source and Destination IP both have to be translated
iii) The NAT rule should only be installed on a dedicated Gateway only
iv) NAT should be performed on the server side
A. (i), (ii), and (iii)
B. (i), and (ii)
C. (ii) and (iv)
D. only (i)
Correct Answer: D
QUESTION 170
In order to have full control, you decide to use Manual NAT entries instead of Automatic NAT rules. Which of the following is NOT true?
A. When using Static NAT, you must enter ARP entries for the Gateway on all hosts that are using the NAT Gateway with that Gateway’s internal interface IP address.
B. When using Static NAT, you must add proxy ARP entries to the Gateway for all hiding addresses.
C. If you chose Automatic NAT instead, all necessary entries are done for you.
D. When using Dynamic Hide NAT with an address that is not configured on a Gateway interface, “Pass Any Exam. Any Time.” – www.actualtests.com 69 Checkpoint 156-215.75 Exam you need to add a proxy ARP entry for that address.
Correct Answer: A
QUESTION 171
After filtering a fw monitor trace by port and IP, a packet is displayed three times; in the i, I, and o inspection points, but not in the O inspection point. Which is the likely source of the issue?
A. The packet has been sent out through a VPN tunnel unencrypted.
B. An IPSO ACL has blocked the outbound passage of the packet.
C. A SmartDefense module has blocked the packet
D. It is an issue with NAT
Correct Answer: D
QUESTION 172
A marketing firm’s networking team is trying to troubleshoot user complaints regarding access to audio-streaming material from the Internet. The networking team asks you to check the object and rule configuration settings for the perimeter Security Gateway. Which SmartConsole application should you use to check these objects and rules?
A. SmartView Tracker
B. SmartView Status
C. SmartView Monitor
D. SmartDashboard
Correct Answer: D
QUESTION 173
Which statement below describes the most correct strategy for implementing a Rule Base?
A. Add the Stealth Rule before the last rule. “Pass Any Exam. Any Time.” – www.actualtests.com 70 Checkpoint 156-215.75 Exam
B. Umit grouping to rules regarding specific access.
C. Place the most frequently used rules at the top of the Policy and the ones that are not frequently used further down.
D. Place a network-traffic rule above the administrator access rule.
Correct Answer: C
QUESTION 174
Which of the following is a viable consideration when determining Rule Base order?
A. Grouping authentication rules with address-translation rules
B. Grouping rules by date of creation
C. Grouping reject and drop rules after the Cleanup Rule
D. Grouping functionally related rules together
Correct Answer: D
QUESTION 175
Which of the following is a viable consideration when determining Rule Base order?
A. Adding SAM rules at the top of the Rule Base
B. Placing frequently accessed rules before less frequently accessed rules
C. Grouping rules by date of creation
D. Grouping IPS rules with dynamic drop rules
Correct Answer: B
QUESTION 176
Which of the following is a viable consideration when determining Rule Base order?
A. Grouping IPS rules with dynamic drop rules
B. Grouping reject and drop rules after the Cleanup Rule “Pass Any Exam. Any Time.” -www.actualtests.com 71 Checkpoint 156-215.75 Exam
C. Placing more restrictive rules before more permissive rules
D. Grouping authentication rules with QOS rules
Correct Answer: C
QUESTION 177
You would use the Hide Rule feature to:
A. Make rules invisible to incoming packets.
B. View only a few rules without the distraction of others
C. Hide rules from read-only administrators.
D. Hide rules from a SYN/ACK attack.
Correct Answer: B QUESTION 178
When you add a resource object to a rule, which of the following occurs?
A. All packets that match the resource will be dropped.
B. All packets matching that rule are either encrypted or decrypted by the defined resource.
C. All packets matching the resource service are analyzed through an application-layer proxy.
D. Users attempting to connect to the destination of the rule will be required to authenticate.
Correct Answer: C QUESTION 179
You are a Security Administrator using one Security Management Server managing three different firewalls. One of the firewalls does NOT show up in the dialog box when attempting to install a Security Policy. Which of the following is a possible cause?
A. The firewall object has been created but SIC has not yet been established.
B. The license for this specific firewall has expired. “Pass Any Exam. Any Time.” – www.actualtests.com 72 Checkpoint 156-215.75 Exam
C. The firewall has failed to sync with the Security Management Server for 60 minutes.
D. The firewall is not listed in the Policy Installation Targets screen for this policy package.
Correct Answer: D QUESTION 180
Your shipping company uses a custom application to update the shipping distribution database. The custom application includes a service used only to notify remote sites that the distribution database is malfunctioning. The perimeter Security Gateway’s Rule Base includes a rule to accept this traffic. Since you are responsible for multiple sites, you want notification by a text message to your cellular phone, whenever traffic is accepted on this rule. Which of the following would work BEST for your purpose?
A. SmartView Monitor Threshold
B. SNMP trap
C. Logging implied rules
D. User-defined alert script
Correct Answer: D QUESTION 181
Flydumps.com takes in the latest CheckPoint 156-215 questions in the CheckPoint 156-215 exam materials so that our material should be always the latest and the most relevant. We know that CheckPoint 156-215 examination wouldn’t repeat the same set of questions all the time. Microsoft certification examinations are stringent and focus is often kept on updated technology trends. The CheckPoint 156-215 exam questions organized by the professionals will help to condition your mind to promptly grasp what you could be facing in the CheckPoint 156-215 cert examination.
CheckPoint 156-215 Study Guide, Real CheckPoint 156-215 Exam Cost On Our Store
Welcome to download the newest Pass4itsure ns0-155 Practice Test dumps: http://www.pass4itsure.com/ns0-155.html
You can pass CheckPoint 156-210 exam if you get a complete hold of CheckPoint 156-210 dumps. What’s more, all the CheckPoint 156-210 Certification exams Q and A provided by Flydumps is the latest.
QUESTION 101
You are working with multiple firewalls that have extensive Rule Bases. To simplify administration task, which of the following should you choose to do?
A. Create Network range objects that restrict all applicable rules to only certain networks.
B. Run separate GUI clients for external and internal firewalls.
C. Eliminate all possible contradictory rules such as stealth and clean-up rules.
D. Save a different Rule Base for each remote firewall.
E. None of the above.
Correct Answer: D
QUESTION 102
Currently, the Accounting Department is FTP-ing a file in the bank. Which Log Viewer Module would show you the activity occurring at the present time?
A. Security Log.
B. Active Connections Log.
C. Accounting Log-
D. Administrative Log.
E. None of the above.
Correct Answer: B
QUESTION 103
With Blocking Scope default settings, a selected connection is terminated:
A. And all further attempts to establish a connection from the same source IP address to the same destination IP address and port will be blocked.
B. But all further attempts to establish connections from this specific source IP address will be authenticated before being denied.
C. And all further attempts to establish connections to this specific destination IP address will be denied.
D. And all further attempts to establish a connection from the same source IP address to the firewall’s IP address will be blocked.
E. Both A and D.
Correct Answer: A
QUESTION 104
Consider the following Rule Base for VPN-1/Firewall-1 NG. Assuming the default settings in global properties have NOT changed, ICMP would be allowed through the firewall. No SOURCE SERVICE ACTION TRACK
DESTINATION
1 Any Web_Server http Accept Long
2 Any Any Any Any Long
A. True
B. False
Correct Answer: B
QUESTION 105
Which is the correct rule in the following Rule Base? No SOURCE SERVICE ACTION TRACK DESTINATION
1 Any Any Session Log Auth AllUsers@Chicago
2 Chicago Any Session Log Auth AllUsers@Chicago
3 Any Any Session Log Auth AllUsers@Any
4 Any Any User Log Auth AllUsers@Chicago
A. Rule 2
B. Rule 1
C. Rule 3
D. Rule 4
E. None of the rules allow access.
Correct Answer: B
QUESTION 106
In the Client Authentication Action Properties window (below), for the required Sign On Method section, Manual is selected.
This means:
A. If a connection matches the Rule Base the service is an authenticated service, the client is signed on after a successful authentication.
B. The user must initiate the Client Authentication Session to the gateway.
C. If a connection using any service matches Rule Base, the client is authenticated.
D. If authentication is successful, access is granted from the network that initiated the connection.
E. The user must TELNET to the target server on port 259.
Correct Answer: B
QUESTION 107
Changes made to the Security Policy do not take effect on the Enforcement Module until the administrator performs which of the following actions?
A. Saves the policy.
B. Verifies the policy.
C. Install the policy.
D. Stops firewall services on the Enforcement Module.
E. Stops firewall services on the Management module.
Correct Answer: C
QUESTION 108
Consider the following network: The public servers are a web form. Since the web servers accepts and initiate connections Dynamic translation is required.
A. True
B. False
Correct Answer: B QUESTION 109
The fw fetch command perform the following function:
A. Attempts to fetch the policy from the Management Server.
B. Fetches users from the Management server.
C. Produces an output screen of the Rule Base.
D. Fetches the logs.
E. Fetches the systems status.
Correct Answer: A QUESTION 110
Inclement weather and a UPS-failure cause a firewall to reboot. Earlier that day a tornado destroyed the building where the firewall’s Management Module was located. The Management Module was not recovered and has not been replaced. Bases on the scenario, which of the following statements is FALSE?
A. The firewall will continue to enforce the last rule base installed.
B. The firewall will log locally.
C. The firewall will fetch the last installed policy form local host and install it.
D. Communication between the firewall and the replacement Management Module must be established before the replacement Management Module can install a policy on the firewall.
E. Because the firewall cannot contact the Management Module, no policy will be installed.
Correct Answer: E QUESTION 111
When configuring Anti-Spoofing for VPN-1/FireWall-1 NG on the firewall interfaces, all of the following are valid address choices except:
A. Network defined by Interface IP and Net Mask.
B. Not Defined.
C. Security Policy Installed.
D. Specific
E. None of the above.
Correct Answer: C
QUESTION 112
The security administrator for the following configuration only allows members of the localnet managers group access files in BigBen (the FTP Server)
Select below the rule that allows local managers to access the FTP server from any location. No SOURCE SERVICE ACTION
DESTINATION
1 BigBen ftp User Auth LocalManagers@Any
2 BigBen ftp Client Auth LocalManagers@Net_London
3 BigBen ftp Session Auth LocalManagers@Any 4 BigBen ftp User Auth LocalManagers@Net_Tokyo
A. Rule 1.
B. Rule 2.
C. Rule 3.
D. Rule 4.
E. None of these rules allow access.
Correct Answer: A QUESTION 113
Assume that you are working on a Windows NT operating system. What is the default expiration for a Dynamic NAT connection NOT showing any UDP activity?
A. 30 Seconds.
B. 60 Seconds.
C. 40 Seconds.
D. 600 Seconds.
E. 3000 Seconds.
Correct Answer: C QUESTION 114
Assume there has been no change made to default policy properties. To allow a telnet connection into your
network, you must create two rules.
One to allow the initial Telnet connection in.
One to allow the destination machine to send information back to the client.
A. True
B. False
Correct Answer: B QUESTION 115
In Windows NT to force log entries other than the default directory.
A. You must use the cpconfig command.
B. Change the fwlog environment variable.
C. Modify the registry.
D. Change the directory in log viewer.
E. Use the fw log switch command.
Correct Answer: C QUESTION 116
For most installations, the Clean-Up rule should be the last rule in Rule Base.
A. True
B. False
Correct Answer: A QUESTION 117
What complements are necessary for VPN-1/FireWall-1 NG to scan e-mail, passing through the firewall, for macro viruses?
A. UFP and OPSEC-certified scanning product.
B. CVP and OPSEC-certified virus scanning product.
C. UFP and CVP.
D. UFP, CVP and OPSEC-certified content filter.
E. None of the above, VPN-1/FireWall-1 NG scans for macro viruses by default.
Correct Answer: B QUESTION 118
Why would you want to verify a Security Policy before installation?
A. To install Security Policy cleanly.
B. To check up the enforcement-point firewall for errors.
C. To identify conflicting rules in your Security Policy.
D. To compress the Rule Base for faster installation
E. There us no benefit verifying a Security Policy before installing it.
Correct Answer: C
QUESTION 119
To completely setup Static NAT, you ONLY have to select Add Automatic Address Translation rules on the NAT tab, and specify a public NAT IP address.
A. True
B. False
Correct Answer: B
QUESTION 120
If you configure the Minutes interval for a firewall in the User Authentication session timeout box, as shown below on the Authentication Tab of the Workstations properties window, users of one time password must re-authenticate for each request during this time period.
A. True
B. False
Correct Answer: B
QUESTION 121
What does a status of Untrusted tell you?
A. A VPN-1/Firewall-1 NG firewall module has been compromised.
B. A gateway cannot be reached.
C. A module is installed and responding to status checks, but the status is problematic.
D. A gateway is connected, but the management module is not the master of the module installed on the gateway.
E. None of the above.
Correct Answer: D
QUESTION 122
Omanan Enterprises has the premier reclamation system for scrap aluminum in the western hemisphere. Then phenomenal growth over the last 10 years has led to the decision to establish a presence in the Internet in order to their customers. To that end, Omanan Enterprise network administrator, Jason has acquired a Web Server, and email server and 14 IP addresses from their ISP. Jason also purchased a Checkpoint VPN-1/FireWall-1 stand alone gateway module, with these interfaces, to protect Omanan enterprises’ corporate data their ISP will be providing DNS services. The Web Server and email server must have Static routable IP addresses. The eight member executive counsel of Omanan Enterprises would to have routable IP addresses also, so that they can video-conference with the company’s suppliers. Omanan Enterprises’ remaining 200 employees would like to have access to Internet, and the executive counsel believe that granting them access might improve company morale. Jason installs and configured Checkpoint VPN-1/FireWall1 stand alone Gateway module at the perimeter of Omanan Enterprises corporate LAN. He uses the 3rd NIC in the stand alone firewall gateway module to create DMZ. Jason installs the Web server and the email server on the DMZ. He creates tools and objects on the checkpoint VPN-1/FireWall-1 stand alone gateway module to allow HTTP, POP3 and SMTP from the Internet to the DMZ. He Creates objects to represent the web and email server and configures them for Static NAT. Jason reconfigures his DHCP server so that each of the members of the executive counsel has reserved IP address. He then sues those reservations co create Statically NAT-ed objects on the Checkpoint VPN/ Firewall-1 Standalone Gateway module. Jason creates another object represents the internal network he
configures this object for Dynamic NAT. He adds a rule allowing HTTP traffic from the internal network to
any destination. Jason created an additional rule to allow POP3 and SMTP traffic between the internal
networks and DMZ.
Choose the one phrase below that best describes Jason’s proposal.
A. The proposed solution meets the required objectives and none of the desired objectives.
B. The proposed solution meets the required objectives and only one of the desired objectives.
C. The proposed solution meets the required objectives and all desired objectives.
D. The proposed solution does not meet the required objective.
Correct Answer: C
QUESTION 123
Anna is a security administrator setting up User Authentication for the first time. She has correctly configured her Authentication rule, but authentication still does not work. What is the Check Point recommended way to troubleshoot this issue?
A. Verify the properties of the user attempting authentication and the authentication method selected in the Authentication Properties of your firewall object.
B. Verify the firewall settings of your firewall object, and the properties for the user attempting encryption and authentication.
C. Verify the properties for the user attempting authentication and make sure that the file Stealth Authentication method is selected in the Authentication properties of both the peer gateway object and your firewall object.
D. Verify both Client and User Authentication, and the authentication method selected in the Authentication properties of your Firewall object.
E. Re-import Schema from the VPN-1/FireWall-1 NG installation CD.
Correct Answer: A
QUESTION 124
Session authentication provides an authentication method NOT supported by protocols that can be integrated with any application. No. Source Service Action Track Install On Destination
1.
Any Local_Net telnet Accept Long Gateways
2.
Any Accept Long Gateways Pub Pub Server1 Server2
A. True
B. False
Correct Answer: A
QUESTION 125
How do recover communications between your management module and enforcement module if you lock yourself out via a rule policy that is configured incorrectly?
A. Cp delete all all.
B. Cp pause all all.
C. Cp stop all all.
D. Cp unload all all.
E. Cp push all all.
Correct Answer: D QUESTION 126
You have set up a firewall and management module on one NT box and a remote module on a different location. You receive only sporadic logs from the local firewall and only and control message from remote firewall. All rules on both firewalls are logging and you know the traffic is flowing through the firewall using these rules. All the firewall related services are running and you are using NAT and you receive few logs from the local firewall. What actions from the choices below would you perform to find out why you cannot see logs?
A. Make sure there is no masters file in SFWDIR/conf on the remote module.
B. Make sure there is no masters file in SFWDIR/conf on the local NT box.
C. See if you can do a fwfetch from the module.
D. Run the fw logexport -t -n from the command line prompt on the remote module.
E. Use pulist.exe from the Windows NT resource kit.
Correct Answer: C
Flydumps is a website to improve the pass rate of CheckPoint 156-210 exam. Senior IT experts in the Passcert constantly developed a variety of successful programs of passing CheckPoint 156-210 exam, so the results of their research can 100% guarantee you CheckPoint 156-210 exam for one time. Flydumps CheckPoint 156-210 are very effective and many people who have passed a number of IT certification exams used the CheckPoint 156-210 dumps provided by Flydumps. Some of them who have passed the CheckPoint 156-210 also use Passcert products. Selecting Flydumps means choosing a success.
Welcome to download the newest Pass4itsure ns0-155 Practice Test dumps: http://www.pass4itsure.com/ns0-155.html
CheckPoint 156-210 Exam Questions, Valid and updated CheckPoint 156-210 Certification Exams Online
Welcome to download the newest Pass4itsure hp0-m52 VCE dumps: http://www.pass4itsure.com/hp0-m52.html
Flydumps presents the highest quality of CheckPoint 156-110 practice material which helps candidates to pass the CheckPoint 156-110 exams in the first attempt.The dumps are the latest, authenticated by expert and covering each and every aspect of CheckPoint 156-110 exam.
QUESTION 81
A security administrator implements Secure Configuration Verification (SCV), because SCV: (Choose THREE.)
A. Does not enable the administrator to monitor the configuration of remote computers.
B. Can block connectivity for machines that do not comply with the organization’s security policy.
C. Enables the administrator to monitor the configuration of remote computers.
D. Prevents attackers from penetrating headquarters’ Security Gateway.
E. Confirms that a remote configuration complies with the organization’s security policy.
Correct Answer: BCE
QUESTION 82
Which of the following is likely in a small-business environment?
A. Most small businesses employ a full-time information-technology staff.
B. Resources are available as needed.
C. Small businesses have security personnel on staff.
D. Most employees have experience with information security.
E. Security budgets are very small.
Correct Answer: E
QUESTION 83
ABC Corporation’s network is configured such that a user must log in individually at each server and access control. Which type of authentication is in use?
A. Role-based access control
B. Three-factor authentication
C. Single sign-on
D. Hybrid access control
E. Mandatory sign-on
Correct Answer: E
QUESTION 84
Which type of Business Continuity Plan (BCP) test involves shutting down a primary site, bringing an alternate site on-line, and moving all operations to the alternate site?
A. Parallel
B. Full interruption
C. Checklist
D. Structured walkthrough
E. Simulation
Correct Answer: B
QUESTION 85
A(n) _______ is the first step for determining which technical information assets should be protected.
A. Network diagram
B. Business Impact Analysis
C. Office floor plan
D. Firewall
E. Intrusion detection system
Correct Answer: A
QUESTION 86
Which of the following is an example of a simple, physical-access control?
A. Lock
B. Access control list
C. Background check
D. Token
E. Firewall
Correct Answer: A
QUESTION 87
Which of the following best describes an external intrusion attempt on a local-area network (LAN)?
A. Internal users try to gain unauthorized access to information assets outside the organizational perimeter.
B. External-intrusion attempts from sources outside the LAN are not granted permissions or rights to an organization’s information assets.
C. External users attempt to access public resources.
D. External intruders attempt exploitation of vulnerabilities, to remove their own access.
E. Internal users perform inappropriate acts on assets to which they have been given rights or permissions.
Correct Answer: B
QUESTION 88
Maintenance of the Business Continuity Plan (BCP) must be integrated with an organization’s _______________ process.
A. Change-control
B. Disaster-recovery
C. Inventory-maintenance
D. Discretionary-budget
E. Compensation-review
Correct Answer: A
QUESTION 89
Which types of security solutions should a home user deploy? (Choose TWO.)
A. Managed Security Gateway
B. Access control lists on a router
C. Personal firewall
D. Network intrusion-detection system
E. Anti-virus software
Correct Answer: CE QUESTION 90
You are a system administrator for a pool of Web servers. The vendor who sells your Web server posts a patch and sample exploit for a newly discovered vulnerability. You will take all of the actions listed below. Which of the following actions should you take first?
A. Run the sample exploit against a test server.
B. Run the sample exploit against a production server.
C. Apply the patch to all production servers.
D. Test the patch on a production server.
E. Test the patch on a non-production server.
Correct Answer: A
QUESTION 91
_______ is a method of tricking users into revealing passwords, or other sensitive information.
A. Dumpster diving
B. Means testing
C. Social engineering
D. Risk
E. Exposure
Correct Answer: C
QUESTION 92
Which of the following equations results in the Single Loss Expectancy for an asset?
A. Asset Value x % Of Loss From Realized Exposure
B. Asset Value x % Of Loss From Realized Threat
C. Annualized Rate of Occurrence / Annualized Loss Expectancy
D. Asset Value x % Of Loss From Realized Vulnerability
E. Annualized Rate of Occurrence x Annualized Loss Expectancy
Correct Answer: B
QUESTION 93
Which encryption algorithm has the highest bit strength?
A. AES
B. Blowfish
C. DES
D. CAST
E. Triple DES
Correct Answer: A
QUESTION 94
_________________ is a type of cryptography, where letters of an original message are systematically rearranged into another sequence.
A. Symmetric-key exchange
B. Steganography
C. Transposition cipher
D. Asymmetric-key encryption
E. Simple substitution cipher
Correct Answer: C QUESTION 95
Which of the following are appropriate uses of asymmetric encryption? (Choose THREE.)
A. Authentication
B. Secure key-exchange mechanisms
C. Public Web site access
D. Data-integrity checking
E. Sneaker net
Correct Answer: ABD
QUESTION 96
What is the purpose of resource isolation?
A. To reduce the level of broadcast traffic on physical segments.
B. To ensure that anyone accessing a resource has appropriate integrity.
C. To automate the creation of access control lists and Trusted Computing Bases.
D. To enforce access controls, and clearly separate resources from each other.
E. To make people buy more computers than they really need.
Correct Answer: D
QUESTION 97
Why should user populations be segmented?
A. To allow resources to be shared among employees
B. To allow appropriate collaboration, and prevent inappropriate resource sharing
C. To prevent appropriate collaboration
D. To provide authentication services
E. To prevent the generation of audit trails from gateway devices
Correct Answer: B
QUESTION 98
A(n) _______________ is an abstract machine, which mediates all access subjects have to objects.
A. ACL
B. Reference monitor
C. State machine
D. TCB
E. Router
Correct Answer: B
QUESTION 99
Who should have physical access to network-connectivity devices and corporate servers?
A. Customers and clients
B. Accounting, information-technology, and auditing staff
C. Managers and C-level executives
D. Only appropriate information-technology personnel
E. Only the maintenance staff
Correct Answer: D
QUESTION 100
Which of the following represents a valid reason for testing a patch on a nonproduction system, before applying it to a production system?
A. Patches may re-enable services previously disabled.
B. Patches are a kind of virus.
C. Patches always overwrite user data.
D. Only patches on vendor-pressed CDs can be trusted.
E. Patches usually break important system functionality.
Correct Answer: A
QUESTION 101
How do virtual corporations maintain confidentiality?
A. Encryption
B. Checksum
C. Data hashes
D. Redundant servers
E. Security by obscurity
Correct Answer: A
QUESTION 102
Enterprise employees working remotely require access to data at an organization’s headquarters. Which of the following is the BEST method to transfer this data?
A. Standard e-mail
B. Faxed information
C. Dial-in access behind the enterprise firewall
D. Virtual private network
E. CD-ROMs shipped with updated versions of the data
Correct Answer: D
QUESTION 103
Which of the following is NOT a concern for enterprise physical security?
A. Network Intrusion Detection Systems
B. Social engineering
C. Dumpster diving
D. Property theft
E. Unauthorized access to a facility
Correct Answer: A
QUESTION 104
A(n) _______________ is an abstract machine, which mediates all access subjects have to objects.
A. ACL
B. Reference monitor
C. State machine
D. TCB
E. Router
Correct Answer: B
QUESTION 105
Digital signatures are typically provided by a ____________________, where a third party verifies a key’s authenticity.
A. Network firewall
B. Security administrator
C. Domain controller
D. Certificate Authority
E. Hash function
Correct Answer: D
QUESTION 106
Which of the following is a cost-effective solution for securely transmitting data between remote offices?
A. Standard e-mail
B. Fax machine
C. Virtual private network
D. Bonded courier
E. Telephone
Correct Answer: C
QUESTION 107
Which of the following is the MOST important consideration, when developing security- awareness training materials?
A. Training material should be accessible and attractive.
B. Delivery mechanisms should allow easy development of additional materials, to complement core material.
C. Security-awareness training materials should never contradict an organizational security policy.
D. Appropriate language should be used to facilitate localization, should training materials require translation.
E. Written documentation should be archived, in case of disaster.
Correct Answer: C
QUESTION 108
Why should the number of services on a server be limited to required services?
A. Every open service represents a potential vulnerability.
B. Closed systems require special connectivity services.
C. Running extra services makes machines more efficient.
D. All services are inherently stable and secure.
E. Additional services make machines more secure.
Correct Answer: A
Flydumps ensures that the first time you take the exam will be able to pass the exam to obtain the exam certification. Because CheckPoint 156-110 provide to you the highest quality analog CheckPoint 156-110 Exam will take you into the exam step by step. Flydumps guarantee that Latest CheckPoint 156-110 exam help you to pass the exam successfully.
Welcome to download the newest Pass4itsure hp0-m52 VCE dumps: http://www.pass4itsure.com/hp0-m52.html
CheckPoint 156-110 PDF Download, Helpful CheckPoint 156-110 Practice Exam Latest Version PDF&VCE