Question 1

Consider the Global Properties following settings:  The selected option "Accept Domain Name over UDP (Queries)" means:

Accepted Answer

A)  UDP Queries will be accepted by the traffic allowed only through interfaces with external anti-spoofing topology and this will be done before first explicit rule written by Administrator in a Security Policy. 
B)  All UDP Queries will be accepted by the traffic allowed through all interfaces and this will be done before first explicit rule written by Administrator in a Security Policy. 
C)  No UDP Queries will be accepted by the traffic allowed through all interfaces and this will be done before first explicit rule written by Administrator in a Security Policy. 
D)  All UDP Queries will be accepted by the traffic allowed by first explicit rule written by Administrator in a Security Policy.

Question 2

What Check Point technologies deny or permit network traffic?

Accepted Answer

A)  Application Control, DLP 
B)  Packet Filtering, Stateful Inspection, Application Layer Firewall. 
C)  ACL, SandBlast, MPT 
D)  IPS, Mobile Threat Protection

Question 3

Browser-based Authentication sends users to a web page to acquire identities using ________ .

Accepted Answer

A)  User Directory 
B)  Captive Portal and Transparent Kerberos Authentication 
C)  Captive Portal 
D)  UserCheck

Question 4

Which firewall daemon is responsible for the FW CLI commands?

Accepted Answer

A)  fwd 
B)  fwm 
C)  cpm 
D)  cpd

Question 5

Which of the following actions do NOT take place in IKE Phase 1?

Accepted Answer

A)  Peers agree on encryption method. 
B)  Diffie-Hellman key is combined with the key material to produce the symmetrical IPsec key. 
C)  Peers agree on integrity method. 
D)  Each side generates a session key from its private key and peer's public key.

Question 6

With the User Directory Software Blade, you can create R80 user definitions on a(an) ___________ Server.

Accepted Answer

A)  NT domain 
B)  SMTP 
C)  LDAP 
D)  SecurID

Question 7

You want to establish a VPN, using certificates. Your VPN will exchange certificates with an external partner. Which of the following activities sh you do first?

Accepted Answer

A)  Create a new logical-server object to represent your partner's CA 
B)  Exchange exported CA keys and use them to create a new server object to represent your partner's Certificate Authority (C
A)  
C)  Manually import your partner's Certificate Revocation List. 
D)  Manually import your partner's Access Control List.

Question 8

What type of NAT is a one-to-one relationship where each host is translated to a unique address?

Accepted Answer

A)  Source 
B)  Static 
C)  Hide 
D)  Destination

Question 9

Packages and licenses are loaded from all of theses sources EXCEPT

Accepted Answer

A)  Download Center Web site 
B)  UserUpdate 
C)  User Center 
D)  Check Point DVD

Question 10

What happens if the identity of a user is known?

Accepted Answer

A)  If the user credentials do not match an Access Role, the system displays the Captive Portal. 
B)  If the user credentials do not match an Access Role, the system displays a sandbox. 
C)  If the user credentials do not match an Access Role, the traffic is automatically dropped. 
D)  If the user credentials match an Access Role, the rule is applied and traffic is accepted or dropped based on the defined action.

Question 11

What statement is true regarding Visitor Mode?

Accepted Answer

A)  VPN authentication and encrypted traffic are tunneled through port TCP 443. 
B)  Only ESP traffic is tunneled through port TCP 443. 
C)  Only Main mode and Quick mode traffic are tunneled on TCP port 443. 
D)  All VPN traffic is tunneled through UDP port 4500.

Question 12

Fill in the blank: The tool _______ generates a R80 Security Gateway configuration report.

Accepted Answer

A)  infoCP 
B)  infoview 
C)  cpinfo 
D)  fw cpinfo

Question 13

Choose what BEST describes the Policy Layer Traffic Inspection.

Accepted Answer

A)  If a packet does not match any of the inline layers, the matching continues to the next Layer. 
B)  If a packet matches an inline layer, it will continue matching the next layer. 
C)  If a packet does not match any of the inline layers, the packet will be matched against the Implicit Clean-up Rule. 
D)  If a packet does not match a Network Policy Layer, the matching continues to its inline layer.

Question 14

Which of the following licenses are considered temporary?

Accepted Answer

A)  Perpetual and Trial 
B)  Plug-and-play (Trial) and Evaluation 
C)  Subscription and Perpetual 
D)  Evaluation and Subscription

Question 15

Which tool CANNOT be launched from SmartUpdate R77?

Accepted Answer

A)  IP Appliance Voyager 
B)  snapshot 
C)  GAiA WebUI 
D)  cpinfo

Question 16

One of major features in R80.x SmartConsole is concurrent administration. Which of the following is NOT possible considering that AdminA, AdminB, and AdminC are editing the same Security Policy?

Accepted Answer

A)  AdminC sees a lock icon which indicates that the rule is locked for editing by another administrator. 
B)  AdminA and AdminB are editing the same rule at the same time. 
C)  AdminB sees a pencil icon next the rule that AdminB is currently editing. 
D)  AdminA, AdminB and AdminC are editing three different rules at the same time.

Question 17

To enforce the Security Policy correctly, a Security Gateway requires:

Accepted Answer

A)  a routing table 
B)  awareness of the network topology 
C)  a Demilitarized Zone 
D)  a Security Policy install

Question 18

Which component functions as the Internal Certificate Authority for R77?

Accepted Answer

A)  Security Gateway 
B)  Management Server 
C)  Policy Server 
D)  SmartLSM

Question 19

Which of these components does NOT require a Security Gateway R77 license?

Accepted Answer

A)  Security Management Server 
B)  Check Point Gateway 
C)  SmartConsole 
D)  SmartUpdate upgrading/patching

Question 20

Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?

Accepted Answer

A)  UserCheck 
B)  Active Directory Query 
C)  Account Unit Query 
D)  User Directory Query

Exam 2: Check Point Certified Security Administrator (CCSA R80)

Consider the Global Properties following settings: The selected option "Accept Domain Name over UDP (Queries) " means: