Check Point Certified Security Administrator R75 (156-215-75) Free Practice Test

Question 1

What statement is true regarding Visitor Mode?

A. Only Main mode and Quick mode traffic are tunneled on TCP port 443.

B. All VPN traffic is tunneled through UDP port 4500.

C. VPN authentication and encrypted traffic are tunneled through port TCP 443.

D. Only ESP traffic is tunneled through port TCP 443.

Correct Answer: C

Question 2

You are the Security Administrator for MegaCorp. A Check Point firewall is installed and in use on a SecurePlatform. You have trouble configuring the speed and duplex settings of your Ethernet interfaces. Which of the following commands can be used to configure the speed and duplex settings of an Ethernet interface and will survive a reboot? Give the BEST answer.

A. ifconfig - a

B. mii_tool

C. cthtool

D. eth_set

Correct Answer: D

Question 3

A host on the Internet initiates traffic to the Static NAT IP of your Web server behind the Security Gateway. With the default settings in place for NAT, the initiating packet will translate the_________.

A. source on server side

B. source on client side

C. destination on server side

D. destination on client side

Correct Answer: D

Question 4

An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R70 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every 1 minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.
Which of the following is the BEST explanation for this behavior?

A. The Log Server is failing to log GRE traffic property because it is VPN traffic. Disable all VPN configurations to the partner site to enable proper logging.

B. The Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.

C. The log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt. Because it is encrypted, the R75 Security Gateway cannot distinguish between GRE sessions. This is a known issue with the GRE. Use IPSEC instead of the non GRE protocol for encapsulation.

D. The setting Log does not capture this level of details for GRE Set the rule tracking a action to audit since certain types of traffic can only tracked this way.

Correct Answer: B

Question 5

Examine the following Security Policy. What, if any, changes could be made to accommodate Rule 4?

Checkpoint 156-215.75 : Practice Test

A. Modify the VPN column in Rule 2 to limit access to specific traffic

B. Remove the service HTTPS from the Service column in Rule A

C. Modify the Source or Destination columns in Rule 4

D. Nothing at all

Correct Answer: A

Question 6

You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

A. All users

B. internet user group

C. LDAP account unit Group

D. A group with generic user

Correct Answer: D

Question 7

What must a Security Administrator do to comply with a management requirement to log all traffic accepted through the perimeter Security gateway?

A. Define two log serves on the R75 Gateway object Enable Log Implied Rules on the first log server. Enable Log Rule Base on the second log server. Use SmartReporter to merge the two log server records into the same database for HIPPA log audits.

B. In Global Properties > Reporting Tools check the box Enable tracking all rules (including rules marked as None in the Track column). Send these logs to a secondary log server for a complete logging history. Use your normal log server for standard logging for troubleshooting.

C. Install the View Implicit Rules package using SmartUpdate

D. Check the Log Implied Rules Globally box on the R75 Gateway object.

Correct Answer: B

Question 8

After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by anti-spoofing protections. Which of the following is the MOST LIKELY cause?

A. The Global Properties setting Translate destination on client side is checked But the topology on the DMZ interface is set to Internal -Network defined by IP and Mask Uncheck the Global Properties setting Translate destination on client side

B. The Global Properties setting Translate destination on client side is unchecked. But the topology on the external interface is set to Others +. Change topology to External

C. The Global Properties setting Translate destination on client side is checked. But the topology on the external interface is set to External. Change topology to Others +.

D. The Global Properties setting Translate destination on client side is unchecked. But the topology on the DMZ interface is set to Internal - Network defined by IP and Mask. Check the Global Properties setting Translate destination on client side.

Correct Answer: D

Question 9

Which SmartView Tracker selection would most effectively show who installed a Security Policy blocking all traffic from the corporate network?

A. Active tab

B. Management Tab

C. Custom filter

D. Network and Endpoint tab

Correct Answer: B

Question 10

What is the difference between Standard and Specific Sign On methods?

A. Standard Sign On allows the user to be automatically authorized for all services that the rule allows, but re-authenticate for each host to which he is trying to connect. Specific Sign On requires that the user re-authenticate for each service.

B. Standard Sign On allows the user to be automatically authorized for all services that the rule allows. Specific Sign On requires that the user re-authenticate for each service and each host to which he is trying to connect.

C. Standard Sign On requires the user to re-authenticate for each service and each host to which he is trying to connect. Specific Sign On allows the user to sign on only to a specific IP address.

D. Standard Sign On allows the user to be automatically authorized for all services that the rule allows. Specific Sign On requires that the user re-authenticate for each service specifically defined in the window Specific Action Properties.

Correct Answer: B

Question 11

What rules send log information to Dshield.org when Storm Center is configured?

A. Determined by the Global Properties configuration: Log defined in the Log and Alerts section, rules with tracking sent to Account or SNMP trap.

B. Determined by the Dshield Storm Center Logging setting in Logs and Master of the Security Management Server object rules with tracking set to Log or None.

C. Determined in Web Intelligence, configuration: Information Disclosure is configured; rules with tracking set to User Defined Alerts or SNMP trap.

D. Determined in IPS, Dshield Storm Center configuration: Security Management Server sends logs from rules with tracking set to either Alert or one of the specific User Defined Alerts

Correct Answer: D

Question 12

Amy is unsure that her nightly backup configured from the Check Point backup tool is working. If she logged into her Gateway using SSH, in which directory would she find her nightly backups?

A. /backups

B. /var/CPbackup/backups

C. /var/backups

D. /opt/backups

Correct Answer: B

Question 13

You are working with multiple Security Gateways that enforce an extensive number of rules. To simplify Security administration, which one of the following would you choose to do?

A. Create network objects that restrict all applicable rules to only certain networks

B. Run separate SmartConsole instances to login and configure each Security Gateway directly

C. Eliminate all possible contradictory rules such as the Stealth or Cleanup rules

D. Create a separate Security Policy package for each remote Security Gateway

Correct Answer: D

Question 14

You create implicit and explicit rules for the following network. The group object internal-networks includes networks 10.10.10.0 and 10.10.20.0. Assume Accept ICMP requests is enabled as Before last in Global Properties.
Based on these rules, what happens if you Ping from host 10.10.10.5 to a host on the Internet by IP address? ICMP will be:

A. dropped by rule 2, the Cleanup Rule.

B. accepted by rule 1.

C. dropped by the last Implicit rule.

D. dropped by rule 0.

Correct Answer: B

Welcome to TestSimulate

CheckPoint Check Point Certified Security Administrator R75 (156-215-75) Free Practice Test