Question 1

Which SmartConsole tab is used to monitor network and security performance?

Accepted Answer

A)  Manage Setting 
B)  Security Policies 
C)  Gateway and Servers 
D)  Logs and Monitor 
A)  Manage Setting 
B)  Security Policies 
C)  Gateway and Servers 
D)  Logs and Monitor

Question 2

When attempting to start a VPN tunnel, in the logs the error "no proposal chosen" is seen numerous times. No other VPN-related entries are present. Which phase of the VPN negotiations has failed?

Accepted Answer

A)  IKE Phase 1 
B)  IPSEC Phase 2 
C)  IPSEC Phase 1 
D)  IKE Phase 2 
A)  IKE Phase 1 
B)  IPSEC Phase 2 
C)  IPSEC Phase 1 
D)  IKE Phase 2

Question 3

What is the responsibility of SOLR process on R80.10 management server?

Accepted Answer

A)  Validating all data before it's written into the database 
B)  It generates indexes of data written to the database 
C)  Communication between SmartConsole applications and the Security Management Server 
D)  Writing all information into the database 
A)  Validating all data before it's written into the database 
B)  It generates indexes of data written to the database 
C)  Communication between SmartConsole applications and the Security Management Server 
D)  Writing all information into the database

Question 4

Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?

Accepted Answer

A)  fwm 
B)  cpd 
C)  cpwd 
D)  cpm 
A)  fwm 
B)  cpd 
C)  cpwd 
D)  cpm

Question 5

You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the PWO daemon to do a Full Synchronization?

Accepted Answer

A)  TCP port 443 
B)  TCP port 257 
C)  TCP port 256 
D)  UDP port 8116 
A)  TCP port 443 
B)  TCP port 257 
C)  TCP port 256 
D)  UDP port 8116

Question 6

CoreXL is supported when one of the following features is enabled:

Accepted Answer

A)  Route-based VPN 
B)  IPS 
C)  IPv6 
D)  Overlapping NAT 
A)  Route-based VPN 
B)  IPS 
C)  IPv6 
D)  Overlapping NAT

Question 7

By default, the R80 web API uses which content-type in its response?

Accepted Answer

A)  Java Script 
B)  XML 
C)  Text 
D)  JSON 
A)  Java Script 
B)  XML 
C)  Text 
D)  JSON

Question 8

Check Point security components are divided into the following components:

Accepted Answer

A)  GUI Client, Security Gateway, WebUI Interface 
B)  GUI Client, Security Management, Security Gateway 
C)  Security Gateway, WebUI Interface, Consolidated Security Logs 
D)  Security Management, Security Gateway, Consolidate Security Logs 
A)  GUI Client, Security Gateway, WebUI Interface 
B)  GUI Client, Security Management, Security Gateway 
C)  Security Gateway, WebUI Interface, Consolidated Security Logs 
D)  Security Management, Security Gateway, Consolidate Security Logs

Question 9

Which command would you use to set the network interfaces' affinity in Manual mode?

Accepted Answer

A)  sim affinity -m 
B)  sim affinity -l 
C)  sim affinity -a 
D)  sim affinity -s 
A)  sim affinity -m 
B)  sim affinity -l 
C)  sim affinity -a 
D)  sim affinity -s

Question 10

Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

Accepted Answer

A)  ffffffff 
B)  00000001 
C)  00000002 
D)  00000003 
A)  ffffffff 
B)  00000001 
C)  00000002 
D)  00000003

Question 11

SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

Accepted Answer

A)  Analyzes each log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server. 
B)  Correlates all the identified threats with the consolidation policy. 
C)  Collects syslog data from third party devices and saves them to the database. 
D)  Connects with the SmartEvent Client when generating threat reports. 
A)  Analyzes each log entry as it arrives at the log server according to the Event Policy. When a threat pattern is identified, an event is forwarded to the SmartEvent Server. 
B)  Correlates all the identified threats with the consolidation policy. 
C)  Collects syslog data from third party devices and saves them to the database. 
D)  Connects with the SmartEvent Client when generating threat reports.

Question 12

What is considered Hybrid Emulation Mode?

Accepted Answer

A)  Manual configuration of file types on emulation location. 
B)  Load sharing of emulation between an on premise appliance and the cloud. 
C)  Load sharing between OS behavior and CPU Level emulation. 
D)  High availability between the local SandBlast appliance and the cloud. 
A)  Manual configuration of file types on emulation location. 
B)  Load sharing of emulation between an on premise appliance and the cloud. 
C)  Load sharing between OS behavior and CPU Level emulation. 
D)  High availability between the local SandBlast appliance and the cloud.

Question 13

What Factor preclude Secure XL Templating?

Accepted Answer

A)  Source Port Ranges/Encrypted Connections 
B)  IPS 
C)  ClusterXL in load sharing Mode 
D)  CoreXL 
A)  Source Port Ranges/Encrypted Connections 
B)  IPS 
C)  ClusterXL in load sharing Mode 
D)  CoreXL

Question 14

Which is NOT a SmartEvent component?

Accepted Answer

A)  SmartEvent Server 
B)  Correlation Unit 
C)  Log Consolidator 
D)  Log Server 
A)  SmartEvent Server 
B)  Correlation Unit 
C)  Log Consolidator 
D)  Log Server

Question 15

Kurt is planning to upgrade his Security Management Server to R80.X. What is the lowest supported version of the Security Management he can upgrade from?

Accepted Answer

A)  R76 Splat 
B)  R77.X Gaia 
C)  R75 Splat 
D)  R75 Gaia 
A)  R76 Splat 
B)  R77.X Gaia 
C)  R75 Splat 
D)  R75 Gaia

Question 16

John detected high load on sync interface. Which is most recommended solution?

Accepted Answer

A)  For short connections like http service - delay sync for 2 seconds 
B)  Add a second interface to handle sync traffic 
C)  For FTP connections - do not sync 
D)  For short connections like icmp service - delay sync for 2 seconds 
A)  For short connections like http service - delay sync for 2 seconds 
B)  Add a second interface to handle sync traffic 
C)  For FTP connections - do not sync 
D)  For short connections like icmp service - delay sync for 2 seconds

Question 17

How many images are included with Check Point TE appliance in Recommended Mode?

Accepted Answer

A)  2(OS) images 
B)  images are chosen by administrator during installation 
C)  as many as licensed for 
D)  the newest image 
A)  2(OS) images 
B)  images are chosen by administrator during installation 
C)  as many as licensed for 
D)  the newest image

Question 18

In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:

Accepted Answer

A)  Basic, Optimized, Strict 
B)  Basic, Optimized, Severe 
C)  General, Escalation, Severe 
D)  General, purposed, Strict 
A)  Basic, Optimized, Strict 
B)  Basic, Optimized, Severe 
C)  General, Escalation, Severe 
D)  General, purposed, Strict

Question 19

When setting up an externally managed log server, what is one item that will not be configured on the R80 Security Management Server?

Accepted Answer

A)  IP 
B)  SIC 
C)  NAT 
D)  FQDN 
A)  IP 
B)  SIC 
C)  NAT 
D)  FQDN

Question 20

Which two of these Check Point Protocols are used by SmartEvent Processes?

Accepted Answer

A)  ELA and CPD 
B)  FWD and LEA 
C)  FWD and CPLOG 
D)  ELA and CPLOG 
A)  ELA and CPD 
B)  FWD and LEA 
C)  FWD and CPLOG 
D)  ELA and CPLOG

Which SmartConsole tab is used to monitor network and security performance?

When attempting to start a VPN tunnel, in the logs the error "no proposal chosen" is seen numerous times. No other VPN-related entries are present. Which phase of the VPN negotiations has failed?

What is the responsibility of SOLR process on R80.10 management server?

Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?

You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the PWO daemon to do a Full Synchronization?

CoreXL is supported when one of the following features is enabled:

By default, the R80 web API uses which content-type in its response?

Check Point security components are divided into the following components:

Which command would you use to set the network interfaces' affinity in Manual mode?

Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

What is considered Hybrid Emulation Mode?

What Factor preclude Secure XL Templating?

Which is NOT a SmartEvent component?

Kurt is planning to upgrade his Security Management Server to R80.X. What is the lowest supported version of the Security Management he can upgrade from?

John detected high load on sync interface. Which is most recommended solution?

How many images are included with Check Point TE appliance in Recommended Mode?

In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:

When setting up an externally managed log server, what is one item that will not be configured on the R80 Security Management Server?

Which two of these Check Point Protocols are used by SmartEvent Processes?

Check Point Certified Security Principles Associate (CCSPA)

Check Point Certified Security Administrator (CCSA R80)

Filters

Exam 3: Check Point Certified Security Expert - R80

Which SmartConsole tab is used to monitor network and security performance?

When attempting to start a VPN tunnel, in the logs the error "no proposal chosen" is seen numerous times. No other VPN-related entries are present. Which phase of the VPN negotiations has failed?

What is the responsibility of SOLR process on R80.10 management server?

Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?

You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization. What service is used by the PWO daemon to do a Full Synchronization?

CoreXL is supported when one of the following features is enabled:

By default, the R80 web API uses which content-type in its response?

Check Point security components are divided into the following components:

Which command would you use to set the network interfaces' affinity in Manual mode?

Within the Check Point Firewall Kernel resides Chain Modules, which are individually responsible for the inspection of a specific blade or feature that has been enabled in the configuration of the gateway. For Wire mode configuration, chain modules marked with _______ will not apply.

SmartEvent has several components that function together to track security threats. What is the function of the Correlation Unit as a component of this architecture?

What is considered Hybrid Emulation Mode?

What Factor preclude Secure XL Templating?

Which is NOT a SmartEvent component?

Kurt is planning to upgrade his Security Management Server to R80.X. What is the lowest supported version of the Security Management he can upgrade from?

John detected high load on sync interface. Which is most recommended solution?

How many images are included with Check Point TE appliance in Recommended Mode?

In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:

When setting up an externally managed log server, what is one item that will not be configured on the R80 Security Management Server?

Which two of these Check Point Protocols are used by SmartEvent Processes?

Check Point Certified Security Principles Associate (CCSPA)

Check Point Certified Security Administrator (CCSA R80)

Filters