CheckPoint CCSA R80 156-215.80 Exam Guides

1. Which of the following is NOT an attribute of packer acceleration?

2. John is using Management HA.

Which Smartcenter should be connected to for making changes?

3. Each cluster, at a minimum, should have at least ___________ interfaces.

4. The __________ is used to obtain identification and security information about network users.

5. Which software blade enables Access Control policies to accept, drop, or limit web site access based on user, group, and/or machine?

6. What needs to be configured if the NAT property ‘Translate destination on client side’ is not enabled in Global Properties?

7. Which is the correct order of a log flow processed by SmartEvent components:

8. Where can administrator edit a list of trusted SmartConsole clients in R80?

9. You manage a global network extending from your base in Chicago to Tokyo, Calcutta and Dallas. Management wants a report detailing the current software level of each Enterprise class Security Gateway. You plan to take the opportunity to create a proposal outline, listing the most cost-effective way to upgrade your Gateways.

Which two SmartConsole applications will you use to create this report and outline?

10. Which of the following is NOT supported by Bridge Mode Check Point Security Gateway?

11. What is the purpose of the Clean-up Rule?

12. John is the administrator of a R80 Security Management server managing an R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole. To make John’s changes available to other administrators, and to save the database before installing a policy, what must John do?

13. What is NOT an advantage of Packet Filtering?

14. The SIC Status “Unknown” means

15. Using R80 Smart Console, what does a “pencil icon” in a rule mean?

16. Which statement is TRUE of anti-spoofing?

17. To enforce the Security Policy correctly, a Security Gateway requires:

18. To create policy for traffic to or from a specific geographical location, use the _____________.

19. What is the command to see cluster status in cli expert mode?

20. Your users are defined in a Windows 2008 R2 Active Directory server. You must add LDAP users to a Client Authentication rule.

Which kind of user group do you need in the Client Authentication rule in R77?

21. Which rule is responsible for the user authentication failure?

22. You want to define a selected administrator's permission to edit a layer.

However, when you click the + sign in the “Select additional profile that will be able edit this layer” you do not see anything.





What is the most likely cause of this problem?

23. MegaCorp's security infrastructure separates Security Gateways geographically. You must request a central license for one remote Security Gateway.

How do you apply the license?

24. The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs and shows them as prioritized security events.

25. When launching SmartDashboard, what information is required to log into R77?

26. Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?

27. An LDAP server holds one or more ______________.

28. Which one of the following is the preferred licensing model?

29. How many users can have read/write access in Gaia at one time?

30. You are the administrator for Alpha Corp. You have logged into your R80 Management server. You are making some changes in the Rule Base and notice that rule No.6 has a pencil icon next to it.





What does this mean?

31. What are the advantages of a “shared policy” in R80?

32. Which utility allows you to configure the DHCP service on GAIA from the command line?

33. What statement is true regarding Visitor Mode?

34. Which of the following is NOT a valid deployment option for R80?

35. By default, which port does the WebUI listen on?

B. 4434

C. 443

D. 8080

36. Which configuration element determines which traffic should be encrypted into a VPN tunnel vs. sent in the clear?

37. Which Threat Prevention Profile is not included by default in R80 Management?

38. A digital signature:

39. Which tool CANNOT be launched from SmartUpdate R77?

40. In order to modify Security Policies the administrator can use which of the following tools?

41. Which Threat Prevention Software Blade provides comprehensive against malicious and unwanted network traffic, focusing on application and server vulnerabilities?

42. When logging in for the first time to a Security management Server through SmartConsole, a fingerprint is saved to the:

43. Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?

44. Which one of the following is TRUE?

45. What are the three types of UserCheck messages?

46. John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, the gateway policy permits access only from John's desktop which is assigned a static IP address 10.0.0.19.

John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but that limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his desktop with a static IP (10.0.0.19). He wants to move around the organization and continue to have access to the HR Web Server.

To make this scenario work, the IT administrator:

1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources installs the policy.

2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location.

3) Changes from static IP address to DHCP for the client PC.

What should John request when he cannot access the web server from his laptop?

47. Permanent VPN tunnels can be set on all tunnels in the community, on all tunnels for specific gateways, or__________.

48. From SecureXL perspective, what are the tree paths of traffic flow:

49. Which product correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices?

50. What is Consolidation Policy?

51. Which of the following is NOT an authentication scheme used for accounts created through SmartConsole?

52. Which of the following is NOT a tracking option?(Select three)

53. What component of R80 Management is used for indexing?

54. Check Point APIs allow system engineers and developers to make changes to their organization’s security policy with CLI tools and Web Services for all of the following except:

55. If the first packet of an UDP session is rejected by a security policy, what does the firewall send to the client?

56. A security Policy is created in _________ , stored in the _________ , and Distributed to the various __________ .

57. In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log.

Which of the following options can you add to each Log, Detailed Log and Extended Log?

58. What is the default method for destination NAT?

59. Which feature is NOT provided by all Check Point Mobile Access solutions?

60. Administrator Kofi has just made some changes on his Management Server and then clicks on the Publish button in SmartConsole but then gets the error message shown in the screenshot below.





Where can the administrator check for more information on these errors?

61. What is the difference between SSL VPN and IPSec VPN?

62. What is the BEST method to deploy Identity Awareness for roaming users?

63. Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance?

64. Why would an administrator see the message below?

65. On the following picture an administrator configures Identity Awareness:





After clicking “Next” the above configuration is supported by:

66. Session unique identifiers are passed to the web api using which http header option?

67. You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?

68. When configuring Anti-Spoofing, which tracking options can an Administrator select?

69. What does it mean if Bob gets this result on an object search? Refer to the image below.

70. The technical-support department has a requirement to access an intranet server. When configuring a User Authentication rule to achieve this, which of the following should you remember?

71. Back up and restores can be accomplished through_________.

72. What is the mechanism behind Threat Extraction?

73. Which Threat Tool within SmartConsole provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?

74. In SmartView Tracker, which rule shows when a packet is dropped due to anti-spoofing?

75. Which of the following actions do NOT take place in IKE Phase 1?

76. You are going to upgrade from R77 to R80. Before the upgrade, you want to back up the system so that, if there are any problems, you can easily restore to the old version with all configuration and management files intact.

What is the BEST backup method in this scenario?

77. What are the three deployment considerations for a secure network?

78. Which statement describes what Identity Sharing is in Identity Awareness?

79. What are types of Check Point APIs available currently as part of R80.10 code?

80. Which type of Check Point license is tied to the IP address of a specific Security Gateway and cannot be transferred to a gateway that has a different IP address?

81. A High Availability deployment is referred to as a ______ cluster and a Load Sharing deployment is referred to as a ________ cluster.

82. When a policy package is installed, ________ are also distributed to the target installation Security Gateways.

83. Which of the following is NOT an option for internal network definition of Anti-spoofing?

84. Joey wants to configure NTP on R80 Security Management Server. He decided to do this via WebUI.

What is the correct IP address and default port to access the Web UI for Gaia platform via browser?

85. Jennifer McHanry is CEO of ACME. She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory

domain, she cannot identify seamlessly with AD Query.

However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R77 Firewall Rule Base.

To make this scenario work, the IT administrator must:

1) Enable Identity Awareness on a gateway and select Captive Portal as one of the Identity Sources.

2) In the Portal Settings window in the User Access section, make sure that Name and password login is selected.

3) Create a new rule in the Firewall Rule Base to let Jennifer McHanry access network destinations. Select accept as the Action.

4) Install policy.

Ms McHanry tries to access the resource but is unable.

What should she do?

86. When configuring Spoof Tracking, which tracking actions can an administrator select to be done when spoofed packets are detected?

87. While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps.

What is the correct order of steps needed to set up the block?

1) Select Active Mode tab in SmartView Tracker.

2) Select Tools > Block Intruder.

3) Select Log Viewing tab in SmartView Tracker.

4) Set Blocking Timeout value to 60 minutes.

5) Highlight connection that should be blocked.

88. What port is used for delivering logs from the gateway to the management server?

89. Vanessa is attempting to log into the Gaia Web Portal. She is able to login successfully. Then she tries the same username and password for SmartConsole but gets the message in the screenshot image below. She has checked that the IP address of the Server is correct and the username and password she used to login into Gaia is also correct.





What is the most likely reason?

90. If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsible, which of these steps should NOT be performed:

91. In which scenario is it a valid option to transfer a license from one hardware device to another?

92. There are 4 ways to use the Management API for creating host object with R80 Management API.

Which one is NOT correct?

93. Which Check Point feature enables application scanning and the detection?

94. Which of the following Automatically Generated Rules NAT rules have the lowest implementation priority?

95. You want to store the GAiA configuration in a file for later reference.

What command should you use?

96. When using Monitored circuit VRRP, what is a priority delta?

97. The Firewall kernel is replicated multiple times, therefore:

98. What is the purpose of Priority Delta in VRRP?

99. Which of the following is NOT a VPN routing option available in a star community?

100. Which software blade does NOT accompany the Threat Prevention policy?

101. Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256 for IKE phase 2.

Why is this a problematic setup?

102. SandBlast offers flexibility in implementation based on their individual business needs.

What is an option for deployment of Check Point SandBlast Zero-Day Protection?

103. How Capsule Connect and Capsule Workspace differ?

104. The WebUI offers three methods for downloading Hotfixes via CPUSE. One of them is Automatic method.

How many times per day will CPUSE agent check for hotfixes and automatically download them?

105. Which two of these Check Point Protocols are used by _____ ?

106. An administrator wishes to enable Identity Awareness on the Check Point firewalls.

However they allow users to use company issued or personal laptops. Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?

107. The ______ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.

108. Your bank's distributed R77 installation has Security Gateways up for renewal.

Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

109. 1.Which of the following is NOT an integral part of VPN communication within a network?

110. Which of the following Windows Security Events will NOT map a username to an IP address in Identity Awareness?

111. Which remote Access Solution is clientless?

112. Which path below is available only when CoreXL is enabled?

113. One of major features in R80 SmartConsole is concurrent administration.

Which of the following is NOT possible considering that AdminA, AdminB, and AdminC are editing the same Security Policy?

114. When should you generate new licenses?

115. Which of the following commands is used to verify license installation?

116. Which information is included in the “Extended Log” tracking option, but is not included in the “Log” tracking option?

117. What SmartEvent component creates events?

118. What is the most complete definition of the difference between the Install Policy button on the SmartConsole’s tab, and the Install Policy button within a specific policy?

119. Provide very wide coverage for all products and protocols, with noticeable performance impact.





How could you tune the profile in order to lower the CPU load still maintaining security at good level?

120. You are about to integrate RSA SecurID users into the Check Point infrastructure.

What kind of users are to be defined via SmartDashboard?

121. Where would an administrator enable Implied Rules logging?

122. What is the potential downside or drawback to choosing the Standalone deployment option instead of the Distributed deployment option?

123. Once a license is activated, a ________ should be installed.

124. How do you manage Gaia?

125. Which SmartConsole tab shows logs and detects security threats, providing a centralized display of potential attack patterns from all network devices?

126. You have two rules, ten users, and two user groups in a Security Policy. You create database version 1 for this configuration. You then delete two existing users and add a new user group. You modify one rule and add two new rules to the Rule Base. You save the Security Policy and create database version 2. After a while, you decide to roll back to version 1 to use the Rule Base, but you want to keep your user database.

How can you do this?

127. Which of the following is NOT a component of a Distinguished Name?

128. In SmartEvent, what are the different types of automatic reactions that the administrator can configure?

129. How are the backups stored in Check Point appliances?

130. Which tool is used to enable cluster membership on a Gateway?

131. What does it mean if Deyra sees the gateway status:

132. On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

133. Where do you verify that UserDirectory is enabled?

134. Identity Awareness allows the Security Administrator to configure network access based on which of the following?

135. R80 Security Management Server can be installed on which of the following operating systems?

136. Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?

137. If there is an Accept Implied Policy set to “First”, what is the reason Jorge cannot see any logs?

138. When an encrypted packet is decrypted, where does this happen?

139. You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet.

However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet.





How can you fix this?

140. What is true about the IPS-Blade?

141. You find a suspicious connection from a problematic host. You decide that you want to block everything from that whole network, not just the problematic host. You want to block this for an hour while you investigate further, but you do not want to add any rules to the Rule Base.

How do you achieve this?

142. What does the “unknown” SIC status shown on SmartConsole mean?

143. In the R80 SmartConsole, on which tab are Permissions and Administrators defined?

144. Your boss wants you to closely monitor an employee suspected of transferring company secrets to the competition. The IT department discovered the suspect installed a WinSCP client in order to use encrypted communication.

Which of the following methods is BEST to accomplish this task?

145. Which of the following statements is TRUE about R80 management plug-ins?

146. You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have received a call by one of the management users stating that they are unable to browse the Internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway.

How do you review the logs to see what the problem may be?

147. Authentication rules are defined for ____________.

148. Which of the following is NOT a component of Check Point Capsule?

149. What is the Manual Client Authentication TELNET port?

150. From the Gaia web interface, which of the following operations CANNOT be performed on a Security Management Server?

151. Which of the following is NOT a valid configuration screen of an Access Role Object?

152. When using LDAP as an authentication method for Identity Awareness, the query:

153. What is the default shell for the command line interface?

154. Mesh and Star are two types of VPN topologies.

Which statement below is TRUE about these types of communities?

155. Which type of the Check Point license ties the package license to the IP address of the Security Management Server?

156. Which GUI tool can be used to view and apply Check Point licenses?

157. Which of the following is NOT a valid application navigation tab in the R80 SmartConsole?

158. Examine the sample Rule Base.





What will be the result of a verification of the policy from SmartConsole?