Exam 2: Check Point Certified Security Administrator (CCSA R80)

When an encrypted packet is decrypted, where does this happen?

According to Check Point Best Practice, when adding a 3 rd party gateway to a Check Point security solution what object SHOULD be added? A(n):

Fill in the blank: To create policy for traffic to or from a particular location, use the _____________.

Which of the following Windows Security Events will NOT map a username to an IP address in Identity Awareness?

All R77 Security Servers can perform authentication with the exception of one. Which of the Security Servers can NOT perform authentication?

Which of the below is the MOST correct process to reset SIC from SmartDashboard?

Where can you trigger a failover of the cluster members? 1. Log in to Security Gateway CLI and run command clusterXL_admin down . 2. In SmartView Monitor right-click the Security Gateway member and select Cluster member stop 3. Log into Security Gateway CLI and run command cphaprob down

Which two of these Check Point Protocols are used by _____ ?

Where does the security administrator activate Identity Awareness within SmartDashboard?

It is Best Practice to have a _____ rule at the end of each policy layer.

Choose what BEST describes users on Gaia Platform.

Fill in the blank: The ________ feature allows administrators to share a policy with other policy packages.

Administrator Kofi has just made some changes on his Management Server and then clicks on the Publish button in SmartConsole but then gets the error message shown in the screenshot below. Where can the administrator check for more information on these errors?

While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the correct order of steps needed to set up the block? 1) Select Active Mode tab in SmartView Tracker. 2) Select Tools > Block Intruder . 3) Select Log Viewing 4) Set Blocking Timeout value to 60 minutes. 5) Highlight connection that should be blocked.

You are conducting a security audit. While reviewing configuration files and logs, you notice logs accepting POP3 traffic, but you do not see a rule allowing POP3 traffic in the Rule Base. Which of the following is the most likely cause?

John Adams is an HR partner in the ACME organization. ACME IT wants to limit access to HR servers to designated IP addresses to minimize malware infection and unauthorized access risks. Thus, gateway policy permits access only from Join's desktop which is assigned an IP address 10.0.0.19 via DHCP. John received a laptop and wants to access the HR Web Server from anywhere in the organization. The IT department gave the laptop a static IP address, but the limits him to operating it only from his desk. The current Rule Base contains a rule that lets John Adams access the HR Web Server from his laptop. He wants to move around the organization and continue to have access to the HR Web Server. To make this scenario work, the IT administrator: 1) Enables Identity Awareness on a gateway, selects AD Query as one of the Identity Sources. 2) Adds an access role object to the Firewall Rule Base that lets John Adams PC access the HR Web Server from any machine and from any location. John plugged in his laptop to the network on a different network segment and he is not able to connect. How does he solve this problem?

You have discovered suspicious activity in your network. What is the BEST immediate action to take?

What does it mean if Bob gets this result on an object search? Refer to the image below. Choose the BEST answer.

What is the most complete definition of the difference between the Install Policy button on the SmartConsole's tab, and the Install Policy button within a specific policy?

Which Threat Prevention Software Blade provides protection from malicious software that can infect your network computers?