Checkpoint CCSA R70.1
Check Point CCSA Quiz
- 1.
If you check the box "Use Agressive Mode" in the IKE Properties dialog box, the standard:
- A.
Three-packet IKE Phase2 exchange is replaced by a six-packet
- B.
Three-packet IKE Phase 2 exchange is replaced by a two-packet exchange
- C.
Six-packet IKE Phase 1 exchange replaced by a three-packet exchange
- D.
Three-packet IKE phase 1 exchange is replaced by a six-packet exchange
Correct Answer
C. Six-packet IKE Phase 1 exchange replaced by a three-packet exchange -
- 2.
Of the following, what parameters will not be preserved when using Database Revision Control
- A.
Simplified mode Rule bases
- B.
Traditional mode Rule Bases
- C.
Secure platform WebUI users
- D.
SIC Certificates
- E.
Smartview Tracker audit logs
- F.
SmartView Tracker traffic logs
- G.
Implied Rules
- H.
IPS Profiles
- I.
Blocked Connections
- J.
Manual NAT rules
- K.
VPN Communities
- L.
Gateway Route table
- M.
Gateway licenses
Correct Answer(s)
E. Smartview Tracker audit logs
F. SmartView Tracker traffic logs
I. Blocked Connections
L. Gateway Route table
M. Gateway licenses -
- 3.
You believe Phase 2 negotiations are railing while you are attempting to configure a site-to-site VPN with one of your firm's business pastners. Which SmartConsol application should you use to confirm your suspicions?
- A.
SmartDashboard
- B.
SmartView Tracker
- C.
SmartUpdate
- D.
SmartView status
Correct Answer
B. SmartView Tracker -
- 4.
You are running a R71 Security Gatewayon SecurePlatform, in case of a harware failure. You have a server with the exact same hardware installed. What backup method should you use to quickly put the secondary firewall into production.
- A.
Upgrade_export
- B.
Manual backup
- C.
Snapshot
- D.
Backup
Correct Answer
C. Snapshot -
- 5.
What happens hi relation to the CRL cache after a cpstop and spstart have been Initiated
- A.
The Gateway retrieves a new CRL on startup, and then discards the old CRL as invalid
- B.
The gateway continues to use the old CRL, as long as it is valid
- C.
The gateway continues to use the old CRL even if it is not valid, until a new CRL is cached
- D.
The gateway issues a crl_zap on startup, which empties the cache and forces certificate
Correct Answer
B. The gateway continues to use the old CRL, as long as it is valid -
- 6.
What physical machine must have access to the User center public IP address when checking for new packages with smartUpdate
- A.
SmartUpdate GUI PC
- B.
SmartUpdate Repository SQL database Server
- C.
A Security gateway retrieving the new upgrade package
- D.
SmartUpdate installed Security Management Server PC
Correct Answer
A. SmartUpdate GUI PC -
- 7.
In SmartView tracker, which rule shows when a packet is dropped due to anti-spoofing?
- A.
Blank field under Rule Number
- B.
Rule 0
- C.
Cleanup rule
- D.
Rule 1
Correct Answer
B. Rule 0 -
- 8.
The URL Filtering Policy can be configured to monitor URLs in order to:
- A.
Log Sites from blocked categories
- B.
Redirect users to a new URL
- C.
Block sites only once
- D.
Alert the administrator to block a suspicious site
Correct Answer
A. Log Sites from blocked categories -
- 9.
The Customer has a small Check Point installation which includes one Windows XP workstation as SmartConsole, one Solaris server working as security Management Server, and a third server running SecurePlatform as Security Gateway. This is an Example of a (n):Stand-Alone Installation.
- A.
Stand-Alone Installation
- B.
Unsupported configuration
- C.
Distributed Installation
- D.
Hybrid Installation
Correct Answer
A. Stand-Alone Installation -
- 10.
You want to implement Static Destination NAT in order to provide external. Internet users access to an internal Webserver that has a reserved (RFC 1918) IP address You have an unused valid IP address on the network between your Security Gateway and ISP router. You control the router that sits between the external interface of the firewall and the Internet. What is an alternative configuration if proxy ARP cannot be used on your Security Gateway?
- A.
Place a static host route on the firewall for the valid IP address to the internal Web server.
- B.
Place a static ARP entry on the ISP router for the valid IP address to the firewall’s external address.
- C.
Publish a proxy ARP entry on the ISP router instead of the firewall for the valid IP address.
- D.
Publish a proxy ARP entry on the internal Web server instead of the firewall for the valid IP address.
Correct Answer
C. Publish a proxy ARP entry on the ISP router instead of the firewall for the valid IP address. -
- 11.
The third-shift Administrator was updating Security Management Server access settings in global properties. He managed to lock all of the administrators out of their accounts. How should you unlock these accounts?
- A.
Login to SmartDashboard as the special cpconfig_admin user account, right click on administrator object and select Unlock.
- B.
Type fwm lock_admin -ua from the command line of the Security Manager server.
- C.
Reinstall the Security Management Server and restore using upgrade_import.
- D.
Delete the file admin.lock in the $fwDIR/tmp/ directory of the Security Management server.
Correct Answer
B. Type fwm lock_admin -ua from the command line of the Security Manager server. -
- 12.
You find a suspicious connection from a problematic host. You decide that you want to block everything from the whole network, not just the problematic host. You want to block this for an hour while you investigate further, but you do not want to add any rules to the rule base. How do you achieve this?
- A.
Add a “temporary” rule using SmartDashboard and select hide rule.
- B.
Create a Suspicious Activity Rule in SmartView Monitor
- C.
Use dbedit to script the addition of a rule directly into the Rule Bases_5_0. fws configuration file.
- D.
Select block intruder from the tools menu in SmartView Tracker.
Correct Answer
B. Create a Suspicious Activity Rule in SmartView Monitor -
- 13.
The Check Point Security Gateway's virtual machine (kernel) exists between which two layers of the OSI model?
- A.
Session and Network layers
- B.
Application and Presentation layers
- C.
Physical and Data link layers
- D.
Network and Data link layers
Correct Answer
D. Network and Data link layers -
- 14.
Phase 1 uses________.
- A.
Conditional
- B.
Sequential
- C.
Asymmetric
- D.
Symmetric
Correct Answer
D. Symmetric -
- 15.
An advantage of using central instead of local licensing is:
- A.
A license can be taken from one Security Management server and given to another Security Management Server.
- B.
Only one IP address is used for all licenses.
- C.
Licenses are automatically attached to their respective Security Gateways.
- D.
The license must be renewed when changing the IP address of security Gateway. Each module’s license has a unique IP address.
Correct Answer
B. Only one IP address is used for all licenses. -
- 16.
Which of the following uses the same key to decrypt as it does to encrypt?
- A.
Asymmetric encryption
- B.
Symmetric encryption
- C.
Certificate-based encryption
- D.
Dynamic encryption
Correct Answer
B. Symmetric encryption -
- 17.
When configuring the network interfaces of a checkpoint Gateway, the direction can be defined as Internal or external. What is meaning of interface leading to DMZ?
- A.
It defines the DMZ Interface since this information is necessary for Content Control.
- B.
Using restricted Gateways, this option automatically turns off the counting of IP Addresses originating from this interface
- C.
When selecting this option. Ann-Spoofing is configured automatically to this net.
- D.
Activating this option automatically turns this interface to External
Correct Answer
A. It defines the DMZ Interface since this information is necessary for Content Control. -
- 18.
Which service is it NOT possible to configure user authentication?
- A.
HTTPS
- B.
FTP
- C.
SSH
- D.
Telnet
Correct Answer
C. SSH -
- 19.
You have created a rule Base Firewall, websydney. Now you are going to create a new policy package with security and address transaction rules for a secured gateway. What is true about the new package’s NAT rules?
- A.
Rules 1 and 5 will be appear in the new package
- B.
Rules 1, 3.A and 5 will appear in the new package Rules 1, 3.A Rules 1, 3.A and 5 will appear in the new package
- C.
Rules 2, 3 and 4 will appear in the new package
- D.
NAT rules will be empty in the new package
Correct Answer
D. NAT rules will be empty in the new package -
- 20.
You run cpconfig to reset SIC on the Security Gateway. After the SIC reset operation is complete, the policy that will be installed is the
- A.
Last policy that was installed
- B.
Default filter
- C.
Standard policy
- D.
Initial policy
Correct Answer
D. Initial policy -
- 21.
What can NOT be selected for VPN tunnel sharing?
- A.
One tunnel per subnet pair
- B.
One tunnel per Gateway pair
- C.
One tunnel per pair of hosts
- D.
One tunnel per VPN domain pair
Correct Answer
D. One tunnel per VPN domain pair -
- 22.
Which answers are TRUE? Automatic Static NAT CANNOT be used when: i) NAT decision is based on the destination port ii) Source and Destination IP both have to be translated iii) The NAT rule should only be installed on a dedicated Gateway only iv) NAT should be performed on the server side
- A.
(i), (ii), and (iii)
- B.
(i), and (ii)
- C.
(ii) and (iv)
- D.
Only (i)
Correct Answer
D. Only (i) -
- 23.
Security Gateway R71 supports User Authentication for which of the following services? Select the response below that contains the most complete list of supported services.
- A.
FTP, HTTP, TELNET
- B.
FTP, TELNET
- C.
SMTP, FTP, HTTP, TELNET
- D.
SMTP, FTP, TELNET
Correct Answer
A. FTP, HTTP, TELNET -
- 24.
Which of these security policy changes optimize Security Gateway performance?
- A.
Use Automatic NAT rules instead of Manual NAT rules whenever possible
- B.
Putting the least-used rule at the top of the Rule Base
- C.
Using groups within groups in the manual NAT Rule Base
- D.
Using domain objects in rules when possible
Correct Answer
D. Using domain objects in rules when possible -
- 25.
A Web server behind the Security Gateway is set to Automatic Static NAT Client side NAT is not checked in the Global Properties. A client on the Internet initiates a session to the Web Server. Assuming there is a rule allowing this traffic, what other configuration must be done to allow the traffic to reach the Web server?
- A.
Automatic ARP must be unchecked in the Global Properties.
- B.
A static route must be added on the Security Gateway to the internal host.
- C.
Nothing else must be configured.
- D.
A static route for the NAT IP must be added to the Gateway's upstream router.
Correct Answer
B. A static route must be added on the Security Gateway to the internal host. -
- 26.
Latency has lost SIC communication with her Security Gateway and she needs to re establish SIC. What would be the correct order of steps needed to perform this task? 1) Create a new activation key on the Security Gateway, then exit cpconfig. 2) Click the Communication tab on the Security Gateway object, and then click Reset. 3) Run the cpconfig tool, and then select Secure Internal Communication to reset. 4) Input the new activation key in the Security Gateway object, and then click initialize 5) Run the cpconfig tool, then select source Internal Communication to reset.
- A.
5, 4, 1, 2
- B.
2, 3, 1, 4
- C.
2, 5, 1, 4
- D.
3, 1, 4, 2
Correct Answer
B. 2, 3, 1, 4 -
- 27.
Which type of resource could a Security Administrator use to control access to specific share on target machines?URI
- A.
URI
- B.
CIFS
- C.
Telnet
- D.
FTP
Correct Answer
B. CIFS -
- 28.
Which port must be allowed to pass through enforcement points in order to allow packet logging to operate correctly?
- A.
514
- B.
256
- C.
257
- D.
258
Correct Answer
C. 257 -
- 29.
While in Smart View Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 but cannot remember all the steps. What is the correct order of steps needed to perform this? 1) Select the Active Mode tab In Smart view Tracker 2) Select Tools > Block Intruder 3) Select the Log Viewing tab in SmartView Tracker 4) Set the Blocking Time out value to 60 minutes 5) Highlight the connection he wishes to block
- A.
3, 2, 5, 4
- B.
3, 5, 2, 4
- C.
1, 5, 2, 4
- D.
1, 2, 5, 4
Correct Answer
C. 1, 5, 2, 4 -
- 30.
A rule _______ is designed to log and drop all other communication that does not match another rule?
- A.
Stealth
- B.
Cleanup
- C.
Reject
- D.
Anti-Spoofing
Correct Answer
B. Cleanup -
- 31.
Which the following statement is TRUE about management plug-ins?
- A.
The plug-in is a package installed on the Security Gateway
- B.
A management plug-in interacts with a Security Management Server to provide new features and support for new products
- C.
Using a plug m offers full central management only if special licensing is applied to specific features of the plug-in
- D.
Installing a management plug-in is just like an upgrade process (It overwrites existing components )
Correct Answer
B. A management plug-in interacts with a Security Management Server to provide new features and support for new products -
- 32.
For normal packet transaction of an accepted communication to a host protocol by a Security Gate Way how many lines per packet are recorded on a packet analyzer like wire Shark using fw monitor?
- A.
2
- B.
4
- C.
3
- D.
None
Correct Answer
B. 4 -
- 33.
Your R71 enterprise Security Management Server is running abnormally on Windows 2003 Server. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings impact (i.e , all security policies database, SIC, licensing etc). What is the BEST method to reinstall the Server and keep its critical configuration?
- A.
Run the latest upgrade_export utility to export the configuration 2) Leave the exported - tgz file in %FWDIR\bin. 3) Install the primary security Management Server on top of the current installation 4) Run upgrade_import to Import the configuration.
- B.
Insert the R71 CD-ROM. and select the option to export the configuration into a . tgz file 2) Skip any upgrade verification warnings since you are not upgrading. 3) Transfer the. tgz file to another networked machine. 4) Download and run the cpclean utility and reboot. 5) Use the R71 CD_ROM to select the upgrade__import option to import the c
- C.
Download the latest upgrade_export utility and run it from a \ temp directory to export the Configuration. 2) Perform any requested upgrade verification suggested steps. 3) Uninstall all R71 packages via Add/Remove Programs and reboot 4) Use smartUpdate to reinstall the Security Management server and reboot 5) Transfer the .tgz file back to the local \ temp. 6) Run upgrade_import to import the configuration.
- D.
1) Download the latest upgrade_export utility and run it from a \ temp directory to export the Configuration. 2) Transferee .tgz file to another network machine 3) Uninstall all R71 packages via Add/Remove Programs and reboot 4) Install again using the R71 CD ROM as a primary security management server 5) Reboot and than transfer the .tgz file back to the local\ tem p 6) Run upgcade_import to import the configuration.
Correct Answer
C. Download the latest upgrade_export utility and run it from a \ temp directory to export the Configuration. 2) Perform any requested upgrade verification suggested steps. 3) Uninstall all R71 packages via Add/Remove Programs and reboot 4) Use smartUpdate to reinstall the Security Management server and reboot 5) Transfer the .tgz file back to the local \ temp. 6) Run upgrade_import to import the configuration. -
- 34.
Which of the following are authentication methods that Security Gateway R7Tuses to validate connection attempts? Select the response below that includes the MOST complete list of valid authentication methods.
- A.
Proxied, User, Dynamic, Session
- B.
Connection, User, Client
- C.
User, Client, Session
- D.
Connection, Proxied, Session
Correct Answer
C. User, Client, Session -
- 35.
Which Security Servers can perform authentication tasks, but CANNOT perform content security tasks?
- A.
HTTPS
- B.
Telnet
- C.
FTP
- D.
HTTP
Correct Answer
B. Telnet -
Quiz Review Timeline +
Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.
-
Current Version
-
Feb 12, 2013Quiz Edited by
ProProfs Editorial Team -
Jan 02, 2012Quiz Created by
Mastermind1100
Back to top