CheckPoint 156-215.81 Quiz 11 Topic 5 Questions 51-55

Question: 1

Which of the following authentication methods can be configured in the Identity Awareness setup wizard?

ACheck Point Password

BTACACS

CLDAP

DWindows password

Show Answer

Question: 2

An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).

Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.

If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.

Which of the following is the BEST for this behavior?

AThe setting Log does not capture this level of detail for GRE. Set the rule tracking action to Audit since certain types of traffic can only be tracked this way.

BThe log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt. Because it is encrypted, the R77 Security Gateway cannot distinguish between GRE sessions. This is a known issue with GRE. Use IPSEC instead of the non-standard GRE protocol for encapsulation.

CThe Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.

DThe Log Server is failing to log GRE traffic properly because it is VPN traffic. Disable all VPN configuration to the partner site to enable proper logging.

Show Answer

Question: 3

Choose the correct statement regarding Implicit Rules.

ATo edit the Implicit rules you go to: Launch Button > Policy > Global Properties > Firewall.

BImplied rules are fixed rules that you cannot change.

CYou can directly edit the Implicit rules by double-clicking on a specific Implicit rule.

DYou can edit the Implicit rules but only if requested by Check Point support personnel.

Show Answer

Question: 4

You find that Users are not prompted for authentication when they access their Web servers, even though you have created an HTTP rule via User Authentication. Choose the BEST reason why.

AYou checked the cache password on desktop option in Global Properties.

BAnother rule that accepts HTTP without authentication exists in the Rule Base.

CYou have forgotten to place the User Authentication Rule before the Stealth Rule.

DUsers must use the SecuRemote Client, to use the User Authentication Rule.

Show Answer

Question: 5

You have two rules, ten users, and two user groups in a Security Policy. You create database version 1 for this configuration. You then delete two existing users and add a new user group. You modify one rule and add two new rules to the Rule Base. You save the Security Policy and create database version 2. After a while, you decide to roll back to version 1 to use the Rule Base, but you want to keep your user database. How can you do this?

ARun fwm dbexport -1 filename. Restore the database. Then, run fwm dbimport -1 filename to import the users.

BRun fwm_dbexport to export the user database. Select restore the entire database in the Database Revision screen. Then, run fwm_dbimport.

CRestore the entire database, except the user database, and then create the new user and user group.

DRestore the entire database, except the user database.

Show Answer

CheckPoint 156-215.81 Quiz:11 Topic:5 Questions:51-55