CheckPoint Checkpoint Certifications 156-215.80 Questions & Answers

• Question 91:

  There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A's interface issues were resolved and it became operational. When it re-joins the cluster, will it become active automatically?

  A. No, since "maintain current active cluster member" option on the cluster object properties is enabled by default

  B. No, since "maintain current active cluster member" option is enabled by default on the Global Properties

  C. Yes, since "Switch to higher priority cluster member" option on the cluster object properties is enabled by default

  D. Yes, since "Switch to higher priority cluster member" option is enabled by default on the Global Properties

  Correct Answer: A

  What Happens When a Security Gateway Recovers?

  In a Load Sharing configuration, when the failed Security Gateway in a cluster recovers, all connections are redistributed among all active members. High Availability and Load Sharing in ClusterXL ClusterXL Administration Guide R77 Versions | 31 In a High Availability configuration, when the failed Security Gateway in a cluster recovers, the recovery method depends on the configured cluster setting. The options are: Maintain Current Active Security Gateway means that if one member passes on control to a lower priority member, control will be returned to the higher priority member only if the lower priority member fails. This mode is recommended if all members are equally capable of processing traffic, in order to minimize the number of failover events. Switch to Higher Priority Security Gateway means that if the lower priority member has control and the higher priority member is restored, then control will be returned to the higher priority member. This mode is recommended if one member is better equipped for handling connections, so it will be the default Security Gateway.

  Reference: http://dl3.checkpoint.com/paid/7e/7ef174cf00762ceaf228384ea20ea64a/ CP_R77_ClusterXL_AdminGuide.pdf? HashKey=1479822138_31410b1f8360074be87fd8f1ab682464andxtn=.pdf

• Question 92:

  In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

  A. Security Policies

  B. Logs and Monitor

  C. Manage and Settings

  D. Gateway and Servers

  Correct Answer: C

• Question 93:

  Which type of Endpoint Identity Agent includes packet tagging and computer authentication?

  A. Full

  B. Light

  C. Custom

  D. Complete

  Correct Answer: A

  Endpoint Identity Agents ?dedicated client agents installed on users' computers that acquire and report identities to the Security Gateway.

• Question 94:

  In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?

  A. Pentagon

  B. Combined

  C. Meshed

  D. Star

  Correct Answer: D

  VPN communities are based on Star and Mesh topologies. In a Mesh community, there are VPN connections between each Security Gateway. In a Star community, satellites have a VPN connection with the center Security Gateway, but not to each other.

  Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/92709.htm

• Question 95:

  Fill in the blank: ________information is included in the "Full Log" tracking option, but is not included in the "Log" tracking option?

  A. file attributes

  B. application

  C. destination port

  D. data type

  Correct Answer: D

  Tracking Options

  Network Log - Generates a log with only basic Firewall information: Source, Destination, Source Port,

  Destination Port, and Protocol. Log - Equivalent to the Network Log option, but also includes the

  application name (for example, Dropbox), and application information (for example, the URL of the

  Website). This is the default Tracking option.

  Full Log - Equivalent to the log option, but also records data for each URL request made.

  -

  If suppression is not selected, it generates a complete log (as defined in pre-R80 management).

  -

  If suppression is selected, it generates an extended log (as defined in pre-R80 management).

  None - Do not generate a log.

  Reference: https://sc1.checkpoint.com/documents/R80/CP_R80_LoggingAndMonitoring/

  html_frameset.htm?topic=documents/R80/CP_R80_LoggingAndMonitoring/131914

• Question 96:

  Fill in the blank: The _________ software blade enables Application Security policies to allow, block, or limit website access based on user, group, and machine identities.

  A. Application Control

  B. Data Awareness

  C. URL Filtering

  D. Threat Emulation

  Correct Answer: A

• Question 97:

  At what point is the Internal Certificate Authority (ICA) created?

  A. Upon creation of a certificate

  B. During the primary Security Management Server installation process.

  C. When an administrator decides to create one.

  D. When an administrator initially logs into SmartConsole.

  Correct Answer: B

  Introduction to the ICA The ICA is a Certificate Authority which is an integral part of the Check Point product suite. It is fully compliant with X.509 standards for both certificates and CRLs. See the relevant X.509 and PKI documentation, as well as RFC 2459 standards for more information. You can read more about Check Point and PKI in the R76 VPN Administration Guide. The ICA is located on the Security Management server. It is created during the installation process, when the Security Management server is configured. Reference: https://sc1.checkpoint.com/documents/R76/ CP_R76_SecMan_WebAdmin/html_frameset.htm?topic=documents/R76/ CP_R76_SecMan_WebAdmin/13118

• Question 98:

  What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.

  

  A. Search detailed is missing the subnet mask.

  B. There is no object on the database with that name or that IP address.

  C. There is no object on the database with that IP address.

  D. Object does not have a NAT IP address.

  Correct Answer: B

• Question 99:

  Why would an administrator see the message below?

  

  A. A new Policy Package created on both the Management and Gateway will be deleted and must be packed up first before proceeding.

  B. A new Policy Package created on the Management is going to be installed to the existing Gateway.

  C. A new Policy Package created on the Gateway is going to be installed on the existing Management.

  D. A new Policy Package created on the Gateway and transferred to the management will be overwritten by the Policy Package currently on the Gateway but can be restored from a periodic backup on the Gateway.

  Correct Answer: B

• Question 100:

  On the following picture an administrator configures Identity Awareness:

  

  After clicking "Next" the above configuration is supported by:

  A. Kerberos SSO which will be working for Active Directory integration

  B. Based on Active Directory integration which allows the Security Gateway to correlate Active Directory users and machines to IP addresses in a method that is completely transparent to the user

  C. Obligatory usage of Captive Portal

  D. The ports 443 or 80 what will be used by Browser-Based and configured Authentication

  Correct Answer: B

  To enable Identity Awareness:

  1.

  Log in to R80 SmartConsole.

  2.

  From the Gateways and Servers view, double-click the Security Gateway on which to enable Identity

  Awareness.

  3.

  On the Network Security tab, select Identity Awareness.

  The Identity Awareness Configuration wizard opens.

  4.

  Select one or more options. These options set the methods for acquiring identities of managed and

  unmanaged assets.

  AD Query - Lets the Security Gateway seamlessly identify Active Directory users and computers.

  Browser-Based Authentication - Sends users to a Web page to acquire identities from unidentified users. If Transparent Kerberos Authentication is configured, AD users may be identified transparently.

  Terminal Servers - Identify users in a Terminal Server environment (originating from one IP address).

  Reference: https://sc1.checkpoint.com/documents/R80/CP_R80BC_IdentityAwareness/ html_frameset.htm?topic=documents/R80/CP_R80BC_IdentityAwareness/62050