CheckPoint Checkpoint Certifications 156-915.77 Questions & Answers

• Question 41:

  When configuring numbered VPN Tunnel Interfaces (VTIs) in a clustered environment, what issues need

  to be considered?

  1) Each member must have a unique source IP address.

  2) Every interface on each member requires a unique IP address.

  3) All VTI's going to the same remote peer must have the same name.

  4) Cluster IP addresses are required.

  A. 1, 2, and 4

  B. 2 and 3

  C. 1, 2, 3 and 4

  D. 1, 3, and 4

  Correct Answer: C

• Question 42:

  You have three Gateways in a mesh community. Each gateway's VPN Domain is their internal network as defined on the Topology tab setting All IP Addresses behind Gateway based on Topology information.

  You want to test the route-based VPN, so you created VTIs among the Gateways and created static route entries for the VTIs. However, when you test the VPN, you find out the VPN still go through the regular domain IPsec tunnels instead of the routed VTI tunnels.

  What is the problem and how do you make the VPN use the VTI tunnels?

  A. Domain VPN takes precedence over the route-based VTI. To make the VPN go through VTI, remove the Gateways out of the mesh community and replace with a star community

  B. Domain VPN takes precedence over the route-based VTI. To make the VPN go through VTI, use an empty group object as each Gateway's VPN Domain

  C. Route-based VTI takes precedence over the Domain VPN. To make the VPN go through VTI, use dynamic-routing protocol like OSPF or BGP to route the VTI address to the peer instead of static routes

  D. Route-based VTI takes precedence over the Domain VPN. Troubleshoot the static route entries to insure that they are correctly pointing to the VTI gateway IP.

  Correct Answer: B

• Question 43:

  You are trying to configure Directional VPN Rule Match in the Rule Base. But the Match column does not have the option to see the Directional Match. You see the following window.

  

  What must you enable to see the Directional Match?

  A. directional_match(true) in the objects_5_0.C file on Security Management Server

  B. VPN Directional Match on the Gateway object's VPN tab

  C. VPN Directional Match on the VPN advanced window, in Global Properties

  D. Advanced Routing on each Security Gateway

  Correct Answer: C

• Question 44:

  Fill in the blank. To enter the router shell, use command __________ .

  A. cligated

  Correct Answer: A

• Question 45:

  Fill in the blanks. To view the number of concurrent connections going through your firewall, you would use the command and syntax __ ___ __ __________ __ .

  A. fw tab –t connections –s

  Correct Answer: A

• Question 46:

  If you need strong protection for the encryption of user data, what option would be the BEST choice?

  A. Use Diffie-Hellman for key construction and pre-shared keys for Quick Mode. Choose SHA in Quick Mode and encrypt with AES. Use AH protocol. Switch to Aggressive Mode.

  B. When you need strong encryption, IPsec is not the best choice. SSL VPN's are a better choice.

  C. Use certificates for Phase 1, SHA for all hashes, AES for all encryption and PFS, and use ESP protocol.

  D. Disable Diffie-Hellman by using stronger certificate based key-derivation. Use AES-256 bit on all encrypted channels and add PFS to QuickMode. Use double encryption by implementing AH and ESP as protocols.

  Correct Answer: C

• Question 47:

  Fill in the blank. To remove site-to-site IKE and IPSEC keys you would enter command ____ ___ and select the option to delete all IKE and IPSec SA's.

  A. vpn tu

  Correct Answer: A

• Question 48:

  You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities should you do first?

  A. Exchange exported CA keys and use them to create a new server object to represent your partner's Certificate Authority (CA).

  B. Create a new logical-server object to represent your partner's CA.

  C. Manually import your partner's Access Control List.

  D. Manually import your partner's Certificate Revocation List.

  Correct Answer: A

• Question 49:

  How many pre-defined exclusions are included by default in SmartEvent R77 as part of the product installation?

  A. 5

  B. 0

  C. 10

  D. 3

  Correct Answer: D

• Question 50:

  Which Check Point tool allows you to open a debug file and see the VPN packet exchange details.

  A. PacketDebug.exe

  B. VPNDebugger.exe

  C. IkeView.exe

  D. IPSECDebug.exe

  Correct Answer: C