Question 1

What is the minimum amount of RAM needed for a Threat Prevention Appliance?

Accepted Answer

A)  6 GB 
B)  8GB with Gaia in 64-bit mode 
C)  4 GB 
D)  It depends on the number of software blades enabled 
A)  6 GB 
B)  8GB with Gaia in 64-bit mode 
C)  4 GB 
D)  It depends on the number of software blades enabled

Question 2

SandBlast offers busineses flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

Accepted Answer

A)  Smart Cloud Service 
B)  Any Cloud Service 
C)  Threat Agent Service 
D)  Public Cloud Service 
A)  Smart Cloud Service 
B)  Any Cloud Service 
C)  Threat Agent Service 
D)  Public Cloud Service

Question 3

You need to see which hotfixes are installed on your Check Point server, which command would you use?

Accepted Answer

A)  cpinfo -h all 
B)  cpinfo -o hotfix 
C)  cpinfo -l hotfix 
D)  cpinfo -y all 
A)  cpinfo -h all 
B)  cpinfo -o hotfix 
C)  cpinfo -l hotfix 
D)  cpinfo -y all

Question 4

Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Accepted Answer

A)  Source Address 
B)  Destination Address 
C)  TCP Acknowledgement Number 
D)  Source Port 
A)  Source Address 
B)  Destination Address 
C)  TCP Acknowledgement Number 
D)  Source Port

Question 5

Which process is used mainly for backward compatibility of gateways in R80.X? It provides communication with GUI-client, database manipulation, policy compilation and Management HA synchronization.

Accepted Answer

A)  cpm 
B)  fwd 
C)  cpd 
D)  fwm 
A)  cpm 
B)  fwd 
C)  cpd 
D)  fwm

Question 6

What command verifies that the API server is responding?

Accepted Answer

A)  api stat 
B)  api status 
C)  show api_status 
D)  app_get_status 
A)  api stat 
B)  api status 
C)  show api_status 
D)  app_get_status

Question 7

What is the purpose of a SmartEvent Correlation Unit?

Accepted Answer

A)  The SmartEvent Correlation Unit is designed to check the connection reliability from SmartConsole to the SmartEvent Server. 
B)  The SmartEvent Correlation Unit's task it to assign severity levels to the identified events. 
C)  The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events. 
D)  The SmartEvent Correlation Unit is designed to check the availability of the SmartReporter Server. 
A)  The SmartEvent Correlation Unit is designed to check the connection reliability from SmartConsole to the SmartEvent Server. 
B)  The SmartEvent Correlation Unit's task it to assign severity levels to the identified events. 
C)  The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events. 
D)  The SmartEvent Correlation Unit is designed to check the availability of the SmartReporter Server.

Question 8

What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

Accepted Answer

A)  CCP and 18190 
B)  CCP and 257 
C)  CCP and 8116 
D)  CPC and 8116 
A)  CCP and 18190 
B)  CCP and 257 
C)  CCP and 8116 
D)  CPC and 8116

Question 9

What is the correct order of the default "fw monitor" inspection points?

Accepted Answer

A)  i, I, o, O 
B)  1, 2, 3, 4 
C)  i, o, I, O 
D)  I, i, O, o 
A)  i, I, o, O 
B)  1, 2, 3, 4 
C)  i, o, I, O 
D)  I, i, O, o

Question 10

How do Capsule Connect and Capsule Workspace differ?

Accepted Answer

A)  Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications. 
B)  Capsule Workspace can provide access to any application. 
C)  Capsule Connect provides Business data isolation. 
D)  Capsule Connect does not require an installed application at client. 
A)  Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications. 
B)  Capsule Workspace can provide access to any application. 
C)  Capsule Connect provides Business data isolation. 
D)  Capsule Connect does not require an installed application at client.

Question 11

Which file gives you a list of all security servers in use, including port number?

Accepted Answer

A)  $FWDIR/conf/conf.conf 
B)  $FWDIR/conf/servers.conf 
C)  $FWDIR/conf/fwauthd.conf 
D)  $FWDIR/conf/serversd.conf 
A)  $FWDIR/conf/conf.conf 
B)  $FWDIR/conf/servers.conf 
C)  $FWDIR/conf/fwauthd.conf 
D)  $FWDIR/conf/serversd.conf

Question 12

With SecureXL enabled, accelerated packets will pass through the following:

Accepted Answer

A)  Network Interface Card, OSI Network Layer, OS IP Stack, and the Acceleration Device 
B)  Network Interface Card, Check Point Firewall Kernal, and the Acceleration Device 
C)  Network Interface Card and the Acceleration Device 
D)  Network Interface Card, OSI Network Layer, and the Acceleration Device 
A)  Network Interface Card, OSI Network Layer, OS IP Stack, and the Acceleration Device 
B)  Network Interface Card, Check Point Firewall Kernal, and the Acceleration Device 
C)  Network Interface Card and the Acceleration Device 
D)  Network Interface Card, OSI Network Layer, and the Acceleration Device

Question 13

Which CLI command will reset the IPS pattern matcher statistics?

Accepted Answer

A)  ips reset pmstat 
B)  ips pstats reset 
C)  ips pmstats refresh 
D)  ips pmstats reset 
A)  ips reset pmstat 
B)  ips pstats reset 
C)  ips pmstats refresh 
D)  ips pmstats reset

Question 14

If you needed the Multicast MAC address of a cluster, what command would you run?

Accepted Answer

A)  cphaprob -a if 
B)  cphaconf ccp multicast 
C)  cphaconf debug data 
D)  cphaprob igmp 
A)  cphaprob -a if 
B)  cphaconf ccp multicast 
C)  cphaconf debug data 
D)  cphaprob igmp

Question 15

What is the correct command to observe the Sync traffic in a VRRP environment?

Accepted Answer

A)  fw monitor -e "accept[12:4,b]=224.0.0.18;" 
B)  fw monitor -e "accept port(6118;" 
C)  fw monitor -e "accept proto=mcVRRP;" 
D)  fw monitor -e "accept dst=224.0.0.18;" 
A)  fw monitor -e "accept[12:4,b]=224.0.0.18;" 
B)  fw monitor -e "accept port(6118;" 
C)  fw monitor -e "accept proto=mcVRRP;" 
D)  fw monitor -e "accept dst=224.0.0.18;"

Question 16

What is the SandBlast Agent designed to do?

Accepted Answer

A)  Performs OS-level sandboxing for SandBlast Cloud architecture 
B)  Ensure the Check Point SandBlast services is running on the end user's system 
C)  If malware enters an end user's system, the SandBlast Agent prevents the malware from spreading with the network 
D)  Clean up email sent with malicious attachments 
A)  Performs OS-level sandboxing for SandBlast Cloud architecture 
B)  Ensure the Check Point SandBlast services is running on the end user's system 
C)  If malware enters an end user's system, the SandBlast Agent prevents the malware from spreading with the network 
D)  Clean up email sent with malicious attachments

Question 17

Which of the following process pulls application monitoring status?

Accepted Answer

A)  fwd 
B)  fwm 
C)  cpwd 
D)  cpd 
A)  fwd 
B)  fwm 
C)  cpwd 
D)  cpd

Question 18

True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway.

Accepted Answer

A)  True, CLI is the prefer method for Licensing 
B)  False, Central License are handled via Security Management Server 
C)  False, Central Licenses are installed via Gaia on Security Gateways 
D)  True, Central License can be installed with CPLIC command on a Security Gateway 
A)  True, CLI is the prefer method for Licensing 
B)  False, Central License are handled via Security Management Server 
C)  False, Central Licenses are installed via Gaia on Security Gateways 
D)  True, Central License can be installed with CPLIC command on a Security Gateway

Question 19

What command lists all interfaces using Multi-Queue?

Accepted Answer

A)  cpmq get 
B)  show interface all 
C)  cpmq set 
D)  show multiqueue all 
A)  cpmq get 
B)  show interface all 
C)  cpmq set 
D)  show multiqueue all

Question 20

Which command collects diagnostic data for analyzing customer setup remotely?

Accepted Answer

A)  cpinfo 
B)  migrate export 
C)  sysinfo 
D)  cpview 
A)  cpinfo 
B)  migrate export 
C)  sysinfo 
D)  cpview

What is the minimum amount of RAM needed for a Threat Prevention Appliance?

SandBlast offers busineses flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

You need to see which hotfixes are installed on your Check Point server, which command would you use?

Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Which process is used mainly for backward compatibility of gateways in R80.X? It provides communication with GUI-client, database manipulation, policy compilation and Management HA synchronization.

What command verifies that the API server is responding?

What is the purpose of a SmartEvent Correlation Unit?

What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

What is the correct order of the default "fw monitor" inspection points?

How do Capsule Connect and Capsule Workspace differ?

Which file gives you a list of all security servers in use, including port number?

With SecureXL enabled, accelerated packets will pass through the following:

Which CLI command will reset the IPS pattern matcher statistics?

If you needed the Multicast MAC address of a cluster, what command would you run?

What is the correct command to observe the Sync traffic in a VRRP environment?

What is the SandBlast Agent designed to do?

Which of the following process pulls application monitoring status?

True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway.

What command lists all interfaces using Multi-Queue?

Which command collects diagnostic data for analyzing customer setup remotely?

Check Point Certified Security Principles Associate (CCSPA)

Check Point Certified Security Administrator (CCSA R80)

Filters

Exam 3: Check Point Certified Security Expert - R80

What is the minimum amount of RAM needed for a Threat Prevention Appliance?

SandBlast offers busineses flexibility in implementation based on their individual business needs. What is an option for deployment of Check Point SandBlast Zero-Day Protection?

You need to see which hotfixes are installed on your Check Point server, which command would you use?

Packet acceleration (SecureXL) identifies connections by several attributes. Which of the attributes is NOT used for identifying connection?

Which process is used mainly for backward compatibility of gateways in R80.X? It provides communication with GUI-client, database manipulation, policy compilation and Management HA synchronization.

What command verifies that the API server is responding?

What is the purpose of a SmartEvent Correlation Unit?

What is the protocol and port used for Health Check and State Synchronization in ClusterXL?

What is the correct order of the default "fw monitor" inspection points?

How do Capsule Connect and Capsule Workspace differ?

Which file gives you a list of all security servers in use, including port number?

With SecureXL enabled, accelerated packets will pass through the following:

Which CLI command will reset the IPS pattern matcher statistics?

If you needed the Multicast MAC address of a cluster, what command would you run?

What is the correct command to observe the Sync traffic in a VRRP environment?

What is the SandBlast Agent designed to do?

Which of the following process pulls application monitoring status?

True or False: In a Distributed Environment, a Central License can be installed via CLI on a Security Gateway.

What command lists all interfaces using Multi-Queue?

Which command collects diagnostic data for analyzing customer setup remotely?

Check Point Certified Security Principles Associate (CCSPA)

Check Point Certified Security Administrator (CCSA R80)

Filters