CheckPoint CheckPoint Certification 156-727.77 Questions & Answers

• Question 21:

  This graphic shows traffic being blocked from certain countries.

  

  What is the deciding factor for this?

  A. The traffic from selected countries is being blocked because of an IPS traffic-type rule in the rulebase

  B. The traffic from selected countries is being blocked because it is overloading the Gateway

  C. The traffic from selected countries is being blocked due to the GeoProtection ruleset

  D. The traffic from selected countries is being blocked due to IPS-detected specific attacks originating there

  Correct Answer: C

• Question 22:

  Looking at these logs, what happened at 10:55?

  

  A. An IPS rule was installed, causing IPS to temporarily stop working

  B. The Gateway was rebooted, causing IPS to temporarily stop working

  C. A new IPS policy was installed, causing IPS to temporarily stop working

  D. IPD Inspections were temporarily suspended, due to high load on the gateway

  Correct Answer: D

• Question 23:

  _______________ enforces or monitors traffic, based on the source or destination IP address of the country.

  A. IPS Recommended_Protections Profile

  B. Geo-protection

  C. Secure Web Gateway

  D. ThreatCloud

  Correct Answer: B

• Question 24:

  Order the steps to bypass the IPS for specific protection:

  a.

  Open the SmartDashboard

  b.

  Find the protection you want to bypass

  c.

  Add the exception for this specific protection

  d.

  Go to Network Exception tab

  e.

  Click New.

  f.

  Go to Protections view

  g.

  Install Security policy

  h.

  Go to IPS tab

  A.

  a, g, h, f, e, c, b, d

  B.

  a, d, f, h, e, c, b, g

  C.

  a, h, f, b, d, e, c, g

  D.

  a, f, h, c, e, d, b, g

  Correct Answer: C

• Question 25:

  What advantage does the Recommended_Profile provide over the Default_Protection profile?

  A. Reduced server load

  B. Accelerated throughput

  C. Advanced reporting options

  D. Higher security posture

  Correct Answer: D

• Question 26:

  SmartEvent has several components that work together to help track down security threats. What is the function of the Correlation Unit as one of those components in the architecture? The Correlation Unit:

  A. connects with the SmartEvent Client when generating reports.

  B. analyzes each log entry as it enters a log server, according to the Event Policy; when a threat pattern is identified, an event is forwarded to the SmartEvent Server.

  C. collects syslog data from third party devices and saves them to the database.

  D. correlates all the identified threats with the consolidation policy.

  Correct Answer: B

• Question 27:

  In SmartViewTracker, you see a log record of type "control" and severity "critical" for the product "Threat

  Emulation" which says:

  "cloud emulation failed. Reason: failed to authenticate gateway..."

  What is likely to be the reason for this failure?

  A. The user provided the wrong credentials to the gateway

  B. The gateway should be configured in a way that Threat Emulation can be done locally in case the cloud is not accessible

  C. The cloud is not accessible right now

  D. Verify the gateway license / contract

  Correct Answer: D

• Question 28:

  John is troubleshooting a dropped traffic issue. Looking in SmartViewTracker, he cannot find anything related to it. What CLI command might help him in this situation where he suspects a possible problem with IPS?

  A. All of the information is visible in SmartViewTracker without additional commands.

  B. fw ctl pstat

  C. fw logexport ¦ grep drop

  D. fw ctl zdebug drop

  Correct Answer: D

• Question 29:

  How can SmartEvent be launched out of SmartDashboard?

  A. Threat Prevention Tab > Launch SmartEvent

  B. Menu SmartConsole > SmartEvent

  C. Menu SmartConsole > SmartEvent or Threat Prevention Tab > Analyze and Report

  D. SmartEvent has always to be launched via Start > Programs

  Correct Answer: C

• Question 30:

  An end-user calls the helpdesk, complaining that he cannot access a web site. You check the log and see that an IPS signature is dropping his connections. What can you do? Change the signature action to:

  A. Bypass

  B. Detect

  C. Inactive

  D. Prevent

  Correct Answer: B