CheckPoint Checkpoint Certifications 156-836 Questions & Answers

• Question 61:

  There are two appliances within the same Security Group. One of them is connected by One downlink only, another one by Two downlinks. Assuming there's no NAT and no VPN, what would be proportion of traffic distribution done by Orchestrator?

  A. 100%/0%

  B. 33%/66%

  C. 50%/50%

  D. 66%/33%

  Correct Answer: C

• Question 62:

  What is a security group?

  A. A solution for Security Gateway redundancy and Load Sharing.

  B. A set of appliances of the same model that are collectively managed by the MHO.

  C. A set of network interfaces and individual SGMs assigned to a logical group.

  D. A set of objects in SmartConsole that are responsible for enforcing an access policy.

  Correct Answer: A

• Question 63:

  What is one benefit of a Dual MHO environment?

  A. Dual MHOs provide redundancy to the Maestro environment by increasing throughput by at least 50 percent.

  B. Dual MHOs allow better synchronization to occur between SGMs.

  C. Dual MHOs allow additional SGMs to be added to the SG.

  D. Dual MHOs can be used to achieve increased scalability and redundancy.

  Correct Answer: D

• Question 64:

  There is a Security group of 10 Appliances and all of them are up and running. How many Appliances within a Security Group keep the same connection in its connection table in case of NAT?

  A. Between 2 and 4

  B. All 10

  C. 2

  D. 3

  Correct Answer: A

• Question 65:

  In case of Correction, where is information about Owner stored?

  A. In Correction table of Target Appliance

  B. In Connection tables of all Appliances participating in Correction Layer flow

  C. In Correction tables of all Appliances participating in Correction Layer flow

  D. In Connection table of Target Appliances

  Correct Answer: C

• Question 66:

  What does the lldpctl command do?

  A. Show all devices discovered by LLDP protocol on downlink ports

  B. Show all devices discovered by LLDP protocol on all ports

  C. Discover orchestrators

  D. Show all devices discovered by LLDP protocol on uplink ports

  Correct Answer: B

• Question 67:

  When a VPN tunnel is formed with a Maestro SGM,

  A. The receiving SGM makes an encryption decision. The SGM then syncs the traffic to two backup SGMs: one for clear traffic and one for encrypted traffic.

  B. SGM 1 analyzes the policy and topology. If encryption is required, it calculates the tunnel owner's IP address. SGM 1 sends a clear packet to the tunnel owner. SGM 2 is now the connectionand tunnel owner.

  C. The MHO handles the IKE before distributing the traffic to a SGM to handle all encrypted traffic. This helps to prevent any issues with the correction layer.

  D. The MHO distributes copies of the packets to two different SGMs because SGM 1 will handle the clear traffic IKE exchange packets, while SGM2 handles encrypted packets.

  Correct Answer: C

• Question 68:

  What is the purpose of g_tcpdump command?

  A. Collects traffic dump from all Active Appliances within Security Group

  B. Collects traffic dump from CIN network

  C. Collects traffic dump from Sync network

  D. The same as tcpdump, just on Scalable Platform

  Correct Answer: A

• Question 69:

  What kinds of transceivers are supported on Orchestrator MHO-140?

  A. SFP, QSFP, QSFP28

  B. SFP+, SFP28, QSFP

  C. SFP, SFP+, SFP28

  D. SFP, SFP+, QSFP, QSFP28

  Correct Answer: C

• Question 70:

  When security policy is installed

  A. All SGMs receive the security policy and one by one performs an independent policy verification. Then, all SGMs simultaneously install the policy.

  B. The SMO Master receives the policy and performs a policy verification the policy is installed on the SMO Master, the SMO Master broadcasts the available package, other membersretrieve the new policy from the SMO Master, then the non-SMO Master SGMs install the policy.

  C. All SGMs receive the security policy and simultaneous policy installation occurs.

  D. The policy is installed on the SMO, the SMO Master broadcasts the available package, other members retrieve the new policy from the SMO Master and perform an independent policy verification, then the non-SMO Master SGMs install the policy.

  Correct Answer: B