Check Point Certified Security Master (156-115.77) Free Practice Test

Question 1

Which operating systems support Wire mode?

A. IPSO and SecurePlatform

B. IPSO and GAIA

C. SecurePlatform and GAIA

D. Solaris and SecurePlatform

Correct Answer: C

Question 2

You find that your open server SecurePlatform system is lagging although you know you have plenty of memory and the complexity of the Rule Base has not changed significantly. You think that upgrading the CPU frequency speed could help your performance. Which command could help you see what speed and model of CPU you are using?

A. sysconfig

B. fw tab

C. top

D. cat /proc/cpuinfo

Correct Answer: D

Question 3

You have to establish a VPN communication between 2 spokes, routed through the Hub gateway. Where do you configure VPN routing?

A. Security Gateway Object

B. WebUI

C. vpn_route.conf

D. VPN shell

Correct Answer: C

Question 4

A firewall has 8 CPU cores and the correct license. CoreXL is enabled. How could you set kernel instance #3 to run on processing core #5?

A. fw ctl affinity -s -k 3 5

B. Edit the file fwaffinity.conf and add the line "k3 cpuid 5"

C. Run fwaffinity_apply -t 3 -k 5 and then check that the settings have taken affect with the command fw ctl multik stat.

D. This is not possible CoreXL is best left to manage the Kernel to CPU core mappings. It is only when a daemon is bound to a dedicated core that CoreXL will ignore that CPU core when mapping Kernel instances to CPU cores.

Correct Answer: A

Question 5

Which of the following IPS Layers is a set of signatures and/or handlers, where:
?Signature is a malicious pattern that is searched for.
?Handler is the INSPECT code that performs more complex inspection.

A. Protections

B. Passive Streaming Library (PSL)

C. Context Management Interface layer (CMI)

D. Protocol Parsers

Correct Answer: A

Question 6

Which is NOT a valid upgrade method in an R77 GAiA ClusterXL deployment?

A. Automatic Incremental Upgrade

B. Full Connectivity Upgrade

C. Optimal Service Upgrade

D. Minimal Effort Upgrade

Correct Answer: A

Question 7

What command would you use to check if CoreXL is enabled?

A. cpconfig

B. fw ctl multik stat

C. fw ctl affinity -1

D. fw ctl pstat

Correct Answer: B

Question 8

Where can you configure Wire mode?

A. In the gateway object in "Stateful Inspection"

B. In the VPN community in "Advanced Settings"

C. In cpconfig

D. In Global Properties

Correct Answer: B

Question 9

What are the kernel parameters that control "Magic MACs"?

A. fwha_mac_magic and fw_mac_forward_magic

B. cpha_magic_mac and cpha_mac_forward_magic

C. cpha_mac_magic and cp_mac_forward_magic

D. fwha_magic_mac and fw_forward_magic_mac

Correct Answer: A

Question 10

When VPN user-based authentication fails, which of the following debug logs is essential to understanding the issue?

A. VPN-1 kernel debug logs

B. IKE.elg

C. Vpnd.elg

D. fw monitor trace

Correct Answer: B

Question 11

When performing a fwm debug, to which directory are the logs written?

A. $FWDIR/log/fwm.elg

B. $FWDIR/conf/fwm.elg

C. $FWDIR/log

D. $CPDIR/log/fwm.elg

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

How can you see a dropped connection and the cause from the kernel?

A. fw debug drop on

B. fw ctl zdebug drop

C. fw zdebug drop

D. fw ctl debug drop on

Correct Answer: B

Question 13

Which of the following is true about Node / Host objects?

A. A Node / Host object can only have IPv4 IP address. For IPv6, a Node / Host6 object must be used.

B. A Node / Host object can either have IPv4 or IPv6 IP address but not have both. Separate objects need to be created for hosts that use dual stack.

C. Node / Host object does not support IPv6, hence a Network object must be created for IPv6.

D. A Node / Host object can either have IPv4 or IPv6 IP address or have both.

Correct Answer: D

Welcome to TestSimulate

CheckPoint Check Point Certified Security Master (156-115.77) Free Practice Test