Check Point Certified Security Expert Practice Exam

These questions are part of the practice quiz. Start practicing

• Which R80 feature permits blocking specific IP addresses for a specific time period?
• What is the main difference between Threat Extraction and Threat Emulation?
• What factor precludes Secure XL Templating?
• What API command enables a Firewall Administrator to create multiple new host objects efficiently?
• Which one of the following is true about Threat Extraction?
• Which of the following is a new feature in R80.10 Gateway that was not available in R77.X and older?
• What type of objects does the Check Point Security Management Server use?
• How do Capsule Connect and Capsule Workspace differ in functionality?
• As an Administrator, to add a logo to reports, where should you copy the image on the SmartEvent Server?
• What is true about Capsule Connect?
• Which command provides the most complete restoration of a R80 configuration?
• What function does the Dynamic Dispatcher provide in the Check Point architecture?
• What is the difference between an event and a log?
• What action does the firewall take for packets that are matched but not explicitly allowed by a rule?
• In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?
• What is the main role of the Check Point Management (cpm) process?
• Identify the three components associated with Check Point Capsule.
• Which component is NOT part of the SandBlast architecture?
• What statement best describes the Check Point ThreatCloud?
• What is the primary service of the INSPECT Engine in a firewall?
• Which of the following authentication methods are NOT used for Mobile Access?
• What are the attributes that SecureXL will check after the connection is allowed by Security Policy?
• Which command lists all tables in Gaia?
• What TCP port does Check Point Management (cpm) use for communication?
• Which command is used to view cluster interface status?
• What is an option for deployment of Check Point SandBlast Zero-Day Protection?
• What does the term "Threat Prevention" primarily refer to in Check Point terminology?
• Which statement is correct about the Sticky Decision Function?
• Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?
• What type of database is utilized by the CPM process for storing configuration data?
• What product correlates logs and detects security threats, providing centralized attack pattern displays?
• Which is NOT a component of Check Point SandBlast?
• What does the command 'fw ctl affinity' primarily manage?
• What is the primary role of the Check Point Security Management Server?
• What is the recommended sync method in a ClusterXL deployment?
• What type of files does Threat Extraction specifically target for sanitization?
• How does the fwd process on the Security Gateway send logs to the Management Server?
• Which command is used to check the state table size on a Security Gateway?
• Which application would you use to gather and analyze threats to your mobile device in a lightweight manner?
• What is the correct command to observe the Sync traffic in a VRRP environment?
• You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or ______ action for the file types.
• What is the name of the SmartEvent R80 Web application for real-time event monitoring?
• Which option is NOT recognized as a Check Point API?
• fwssd is a child process of which Check Point daemon?
• Which statement regarding Delta synchronization is NOT TRUE?
• Which Check Point software blade is responsible for preventing malicious files from entering a network?
• The Event List within the Event tab contains:
• From a SecureXL perspective, what are the three paths of traffic flow?
• Which type of licenses are required for running a Check Point Security Gateway?
• Which command is used to re-establish the Check Point configuration to a previous state?
• NAT rules are prioritized in which order?
• What is the command to check the cluster status in CLI expert mode?
• During inspection of your Threat Prevention logs, which hosts should you remediate first among those with a Critical Severity event?
• R80.10 management server can manage gateways with which versions installed?
• Does SecureXL improve non-encrypted traffic throughput and encrypted VPN traffic throughput?
• What is used specifically for clustered environments to provide state synchronization for failover?
• Which process on the Security Management Server handles the log records from the Security Gateway?
• Which of the following is NOT a SecureXL traffic flow?
• How is a High Availability deployment referred to compared to a Load Sharing deployment?
• Which command is used to verify the status of interfaces on a Check Point gateway?
• Which is a suitable command to check whether Drop Templates are activated or not?
• During which installation process is the IPS policy for pre-R80 gateways installed?
• Which ClusterXL mode utilizes a non-unicast MAC address for the cluster IP?
• In which file is the proxy ARP configuration stored?
• What is a capability of Threat Emulation?
• Fill in the blank: The R80 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of logs.
• Which option cannot be managed through Check Point APIs?
• When requiring certificates for mobile devices, which authentication method is an option?
• Which statement is NOT TRUE about Delta synchronization?
• Which type of authentication on Mobile Access can NOT be used as the first authentication method?
• Which NAT rules are prioritized first in Check Point configurations?
• Which of the following statements is TRUE about R80 management plug-ins?
• Which port is used for full synchronization between cluster members?
• In R80, spoofing is defined as which method?
• What protocol does the Check Point user authentication process primarily rely on?
• What is the function of Priority Delta in VRRP?
• On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API), the default Log Server uses port:
• Which protocol does Check Point Firewall use to manage command and control traffic?
• Which path is available only when CoreXL is enabled?
• What has to be taken into consideration when configuring Management HA?
• What is a new R80.10 Gateway feature that was not available in R77.X and older?
• To create a policy for traffic to or from a particular location, which policy should be used?
• Which of the following is not a feature of the Check Point R80 architecture?
• Connections to the Check Point R80 Web API use which protocol?
• What is true about the IPS-Blade?
• Which option is NOT a method of VPN Tunnel sharing?
• How does the Check Point Central Deployment Tool (CDT) communicate with the Security Gateway / Cluster Members?
• What CLI utility allows an administrator to capture traffic along the firewall inspection chain?
• What is the mechanism behind Threat Extraction?
• What role does the API Server play in Check Point Management?
• Which statement correctly identifies the capabilities of Capsule Connect and Capsule Workspace?
• Which of the following is a function of the Security Management Server?
• Which command allows you to see the interface status?
• Which statement is true about VRRP implementations?
• Which feature of Threat Extraction minimizes operational disruption?
• After backing up Check Point configurations, which command should be used to restore without OS information?
• In R80.10, how do you manage your Mobile Access Policy?
• How many rules are needed on a Check Point Firewall for a user to access a web page and retrieve its DNS lookup?
• To fully enable Dynamic Dispatcher on a Security Gateway, what is the required action?
• Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?
• Which tool generates a R80 Security Gateway configuration report?
• What is the primary function of the Threat Emulation service in Check Point?
• How many interfaces does each cluster have?
• Which of the following processes pulls application monitoring status?
• What is the primary function of the SandBlast Agent?
• Which protocol is primarily used for secure access in Check Point systems?
• Which configuration settings can be adjusted for Stream Control Transmission Protocol (SCTP) in Check Point Firewalls?
• After replacing a single core CPU with a multicore CPU, what must the security administrator do next?
• What is a feature that enables VPN connections to maintain a secure session without employing Stateful Inspection?
• What function does the CPD daemon NOT perform?
• The default port for the Web User interface on a Security Gateway installed on GAIA R80 is?
• Which option can you add to each Log, Detailed Log and Extended Log in Logging and Monitoring?
• Which Threat Prevention Profile is NOT included by default in R80 Management?
• How many images are included with Check Point TE appliance in Recommended Mode?
• In the context of Check Point, what does the term “Rule Base” refer to?
• Where can a user review the behavior of cluster member recovery in SmartDashboard?
• Which command collects diagnostic data for analyzing customer setup remotely?
• Which packet info is ignored with Session Rate Acceleration?
• To find the Multicast MAC address of a cluster, which command is recommended?
• How can a Check Point Security Policy be segmented for different departments in an organization?
• What SmartEvent component is responsible for creating events?
• Which technology extracts detailed information from packets and stores it in state tables?
• Which statement is true regarding redundancy?
• What factors preclude SecureXL templating?
• Which features are only supported with R80.10 Gateways but not R77.x?
• Which command is used to set the CCP protocol to Multicast?
• Which CLI command will reset the IPS pattern matcher statistics?
• How does Threat Extraction function?
• Which CLI command should be used to ensure VMAC mode is enabled on all cluster members?
• What component of R80 Management is used for indexing?
• Can a Check Point gateway translate both source IP address and destination IP address in a packet?
• In a Client to Server scenario, which represents that the packet has already checked against the tables and the Rule Base?
• CoreXL is supported when which feature is enabled?
• What does SandBlast Threat Emulation primarily focus on?
• What is the least amount of CPU cores required to enable CoreXL?
• What is the purpose of the command 'fw tab -t connections'?
• Which approach allows for individual policies to be configured for each application within Mobile Access?
• During the Check Point Stateful Inspection Process, what happens to packets that do not pass Firewall Kernel Inspection?
• Which command shows actual allowed connections in the state table?
• On R80.10, which port does the default Log Server use for Third-Party device log reading via LEA?
• What is the priority delta in Monitored circuit VRRP?
• What is the main function of Check Point's SmartCenter?
• What is the correct order of log flow processed by SmartEvent components?
• What does the 'cpconfig' utility primarily configure in Check Point systems?
• Which command can you use to verify the number of active concurrent connections?
• Using mgmt_cli, which command correctly imports a host object called Server_1?
• Automatic affinity resets every how many seconds if SecureXL is running?
• What statement about the Sticky Decision Function in ClusterXL is true?
• Vanessa received a PDF file that appeared empty. Which component of SandBlast protection is her company using on a Gateway?
• What type of license is required to use Check Point SandBlast?
• What is the main purpose of Check Point APIs?
• What command do you use to enable Priorities Queues and Dynamic Dispatcher to optimize CPU core utilization?
• What function does the Sticky Decision Function (SDF) serve in an Active-Active cluster?
• What does the Check Point Firewall do with packets that are explicitly rejected by the rule definition?
• Which command is used to show the installed licenses on a Check Point device?
• In a Management HA setup, which Smartcenter should John connect to for making changes?
• In the Policy Tab, how many options are available to calculate traffic direction for SmartEvent?
• What is the function of Adaptive Threat Prevention in R80?
• SandBlast Appliances can be deployed in which of the following modes?
• When is Check Point ClusterXL Active/Active deployment typically used?
• Which configuration file contains the structure of the Security Servers, including port numbers and protocol names?
• Which Check Point product best protects against malware and zero-day attacks?
• Which of the following is NOT a component of Check Point Capsule?
• Which CLI command provides the most accurate info about assignment (FW, SND) of all CPUs in your SGW?
• Which command is used to check the status of the Check Point kernel?
• When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?
• Which attribute is NOT used for identifying a connection in packet acceleration (SecureXL)?
• What command can enable or disable multi-queue per interface?
• What is the primary purpose of anti-spoofing in a firewall architecture?
• Which SecureXL template is enabled by default on a Security Gateway?
• Which limitation of CoreXL is mitigated by using Multi-Queue?
• Which process handles the exchange of information between Security Gateways and the Management Server?
• What happens when IPS profile is set in Detect Only Mode for troubleshooting?
• Which types of Check Point APIs are available as part of the R80.10 code?
• Session unique identifiers are passed to the web API using which HTTP header option?
• What is the best method for Jack to create 17 new policies quickly with R80 security management?
• Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?
• You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?
• Which view is NOT a valid CPVIEW view?
• Which Check Point software blade provides protection from zero-day and undiscovered threats?
• Which component of Check Point is tasked with correlating and consolidating events?