Question 1

How many policy layers do Access Control policy support?

Accepted Answer

A)  2 
B)  4 
C)  1 
D)  3 
A)  2 
B)  4 
C)  1 
D)  3

Question 2

Which method below is NOT one of the ways to communicate using the Management API's?

Accepted Answer

A)  Typing API commands using the "mgmt_cli" command 
B)  Typing API commands from a dialog box inside the SmartConsole GUI application 
C)  Typing API commands using Gaia's secure shell(clish)19+ 
D)  Sending API commands over an http connection using web-services 
A)  Typing API commands using the "mgmt_cli" command 
B)  Typing API commands from a dialog box inside the SmartConsole GUI application 
C)  Typing API commands using Gaia's secure shell(clish)19+ 
D)  Sending API commands over an http connection using web-services

Question 3

For Management High Availability, which of the following is NOT a valid synchronization status?

Accepted Answer

A)  Collision 
B)  Down 
C)  Lagging 
D)  Never been synchronized 
A)  Collision 
B)  Down 
C)  Lagging 
D)  Never been synchronized

Question 4

What are the blades of Threat Prevention?

Accepted Answer

A)  IPS, QoS, AntiVirus, AntiBot, Threat Emulation/Extraction 
B)  DLP, AntiVirus, QoS, AntiBot, Threat Emulation/Extraction 
C)  IPS, AntiVirus, AntiBot 
D)  IPS, AntiVirus, AntiBot, Threat Emulation/Extraction 
A)  IPS, QoS, AntiVirus, AntiBot, Threat Emulation/Extraction 
B)  DLP, AntiVirus, QoS, AntiBot, Threat Emulation/Extraction 
C)  IPS, AntiVirus, AntiBot 
D)  IPS, AntiVirus, AntiBot, Threat Emulation/Extraction

Question 5

What is not a purpose of the deployment of Check Point API?

Accepted Answer

A)  Execute an automated script to perform common tasks 
B)  Create a customized GUI Client for manipulating the objects database 
C)  Create products that use and enhance the Check Point solution 
D)  Integrate Check Point products with 3 rd party solution Integrate Check Point products with 3 rd party solution 
A)  Execute an automated script to perform common tasks 
B)  Create a customized GUI Client for manipulating the objects database 
C)  Create products that use and enhance the Check Point solution 
D)  Integrate Check Point products with 3 rd party solution Integrate Check Point products with 3 rd party solution

Question 6

SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

Accepted Answer

A)  19090,22 
B)  19190,22 
C)  18190,80 
D)  19009,443 
A)  19090,22 
B)  19190,22 
C)  18190,80 
D)  19009,443

Question 7

What is true about VRRP implementations?

Accepted Answer

A)  VRRP membership is enabled in cpconfig 
B)  VRRP can be used together with ClusterXL, but with degraded performance 
C)  You cannot have a standalone deployment 
D)  You cannot have different VRIDs in the same physical network 
A)  VRRP membership is enabled in cpconfig 
B)  VRRP can be used together with ClusterXL, but with degraded performance 
C)  You cannot have a standalone deployment 
D)  You cannot have different VRIDs in the same physical network

Question 8

SmartConsole R80.x requires the following ports to be open for SmartEvent:

Accepted Answer

A)  19009, 19090 & 443 
B)  19009, 19004 & 18190 
C)  18190 & 443 
D)  19009, 18190 & 443 
A)  19009, 19090 & 443 
B)  19009, 19004 & 18190 
C)  18190 & 443 
D)  19009, 18190 & 443

Question 9

When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

Accepted Answer

A)  All UDP packets 
B)  All IPv6 Traffic 
C)  All packets that match a rule whose source or destination is the Outside Corporate Network 
D)  CIFS packets 
A)  All UDP packets 
B)  All IPv6 Traffic 
C)  All packets that match a rule whose source or destination is the Outside Corporate Network 
D)  CIFS packets

Question 10

During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

Accepted Answer

A)  Host having a Critical event found by Threat Emulation 
B)  Host having a Critical event found by IPS 
C)  Host having a Critical event found by Antivirus 
D)  Host having a Critical event found by Anti-Bot 
A)  Host having a Critical event found by Threat Emulation 
B)  Host having a Critical event found by IPS 
C)  Host having a Critical event found by Antivirus 
D)  Host having a Critical event found by Anti-Bot

Question 11

Automation and Orchestration differ in that:

Accepted Answer

A)  Automation relates to codifying tasks, whereas orchestration relates to codifying processes. 
B)  Automation involves the process of coordinating an exchange of information through web service interactions such as XML and JSON, but orchestration does not involve processes. 
C)  Orchestration is concerned with executing a single task, whereas automation takes a series of tasks and puts them all together into a process workflow. 
D)  Orchestration relates to codifying tasks, whereas automation relates to codifying processes. 
A)  Automation relates to codifying tasks, whereas orchestration relates to codifying processes. 
B)  Automation involves the process of coordinating an exchange of information through web service interactions such as XML and JSON, but orchestration does not involve processes. 
C)  Orchestration is concerned with executing a single task, whereas automation takes a series of tasks and puts them all together into a process workflow. 
D)  Orchestration relates to codifying tasks, whereas automation relates to codifying processes.

Question 12

R80.10 management server can manage gateways with which versions installed?

Accepted Answer

A)  Versions R77 and higher 
B)  Versions R76 and higher 
C)  Versions R75.20 and higher 
D)  Versions R75 and higher 
A)  Versions R77 and higher 
B)  Versions R76 and higher 
C)  Versions R75.20 and higher 
D)  Versions R75 and higher

Question 13

Which TCP-port does CPM process listen to?

Accepted Answer

A)  18191 
B)  18190 
C)  8983 
D)  19009 
A)  18191 
B)  18190 
C)  8983 
D)  19009

Question 14

What is the command to show SecureXL status?

Accepted Answer

A)  fwaccel status 
B)  fwaccel stats -m 
C)  fwaccel -s 
D)  fwaccel stat 
A)  fwaccel status 
B)  fwaccel stats -m 
C)  fwaccel -s 
D)  fwaccel stat

Question 15

To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Accepted Answer

A)  fw ctl set int fwha vmac global param enabled 
B)  fw ctl get int vmac global param enabled; result of command should return value 1 
C)  cphaprob-a if 
D)  fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1 
A)  fw ctl set int fwha vmac global param enabled 
B)  fw ctl get int vmac global param enabled; result of command should return value 1 
C)  cphaprob-a if 
D)  fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1

Question 16

Which view is NOT a valid CPVIEW view?

Accepted Answer

A)  IDA 
B)  RAD 
C)  PDP 
D)  VPN 
A)  IDA 
B)  RAD 
C)  PDP 
D)  VPN

Question 17

The Check Point history feature in R80 provides the following:

Accepted Answer

A)  View install changes and install specific version 
B)  View install changes 
C)  Policy Installation Date, view install changes and install specific version 
D)  Policy Installation Date only 
A)  View install changes and install specific version 
B)  View install changes 
C)  Policy Installation Date, view install changes and install specific version 
D)  Policy Installation Date only

Question 18

How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

Accepted Answer

A)  By dropping traffic from websites identified through ThreatCloud Verification and URL Caching 
B)  By dropping traffic that is not proven to be from clean websites in the URL Filtering blade 
C)  By allowing traffic from websites that are known to run Antivirus Software on servers regularly 
D)  By matching logs against ThreatCloud information about the reputation of the website 
A)  By dropping traffic from websites identified through ThreatCloud Verification and URL Caching 
B)  By dropping traffic that is not proven to be from clean websites in the URL Filtering blade 
C)  By allowing traffic from websites that are known to run Antivirus Software on servers regularly 
D)  By matching logs against ThreatCloud information about the reputation of the website

Question 19

What is considered Hybrid Emulation Mode?

Accepted Answer

A)  Manual configuration of file types on emulation location. 
B)  Load sharing of emulation between an on premise appliance and the cloud. 
C)  Load sharing between OS behavior and CPU Level emulation. 
D)  Load Sharing of Threat Emulation Server and Firewall blade 
A)  Manual configuration of file types on emulation location. 
B)  Load sharing of emulation between an on premise appliance and the cloud. 
C)  Load sharing between OS behavior and CPU Level emulation. 
D)  Load Sharing of Threat Emulation Server and Firewall blade

Question 20

Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

Accepted Answer

A)  Yes, but they need to have a mutually trusted certificate authority 
B)  Yes, but they have to have a pre-shared secret key 
C)  No, they cannot share certificate authorities 
D)  No, Certificate based VPNs are only possible between Check Point devices 
A)  Yes, but they need to have a mutually trusted certificate authority 
B)  Yes, but they have to have a pre-shared secret key 
C)  No, they cannot share certificate authorities 
D)  No, Certificate based VPNs are only possible between Check Point devices

How many policy layers do Access Control policy support?

Which method below is NOT one of the ways to communicate using the Management API's?

For Management High Availability, which of the following is NOT a valid synchronization status?

What are the blades of Threat Prevention?

What is not a purpose of the deployment of Check Point API?

SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

What is true about VRRP implementations?

SmartConsole R80.x requires the following ports to be open for SmartEvent:

When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

Automation and Orchestration differ in that:

R80.10 management server can manage gateways with which versions installed?

Which TCP-port does CPM process listen to?

What is the command to show SecureXL status?

To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Which view is NOT a valid CPVIEW view?

The Check Point history feature in R80 provides the following:

How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

What is considered Hybrid Emulation Mode?

Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

Check Point Certified Security Principles Associate (CCSPA)

Check Point Certified Security Administrator (CCSA R80)

Filters

Exam 3: Check Point Certified Security Expert - R80

How many policy layers do Access Control policy support?

Which method below is NOT one of the ways to communicate using the Management API's?

For Management High Availability, which of the following is NOT a valid synchronization status?

What are the blades of Threat Prevention?

What is not a purpose of the deployment of Check Point API?

SmartConsole R80 requires the following ports to be open for SmartEvent R80 management:

What is true about VRRP implementations?

SmartConsole R80.x requires the following ports to be open for SmartEvent:

When SecureXL is enabled, all packets should be accelerated, except packets that match the following conditions:

During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity. Which of those hosts should you try to remediate first?

Automation and Orchestration differ in that:

R80.10 management server can manage gateways with which versions installed?

Which TCP-port does CPM process listen to?

What is the command to show SecureXL status?

To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?

Which view is NOT a valid CPVIEW view?

The Check Point history feature in R80 provides the following:

How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?

What is considered Hybrid Emulation Mode?

Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?

Check Point Certified Security Principles Associate (CCSPA)

Check Point Certified Security Administrator (CCSA R80)

Filters