NEW QUESTION 1
You have enabled “Full Log” as a tracking option to a security rule. However, you are still not seeing any data type information. What is the MOST likely reason?

• A. Logging has disk space issue
• B. Change logging storage options on the logging server or Security Management Server properties and install database.
• C. Data Awareness is not enabled.
• D. Identity Awareness is not enabled.
• E. Logs are arriving from Pre-R80 gateways.

Answer: A

Explanation: The most likely reason for the logs data to stop is the low disk space on the logging device, which can be the Management Server or the Gateway Server.

NEW QUESTION 2
Fill in the blanks: The Application Layer Firewalls inspect traffic through the ____ layer(s) of the TCP/IP model and up to and including the ____ layer.

• A. Lower; Application
• B. First two; Internet
• C. First two; Transport
• D. Upper; Application

Answer: A

NEW QUESTION 3
How Capsule Connect and Capsule Workspace differ?

• A. Capsule Connect provides a Layer3 VP
• B. Capsule Workspace provides a Desktop with usable applications
• C. Capsule Workspace can provide access to any application
• D. Capsule Connect provides Business data isolation
• E. Capsule Connect does not require an installed application at client

Answer: A

NEW QUESTION 4
What are the three components for Check Point Capsule?

• A. Capsule Docs, Capsule Cloud, Capsule Connect
• B. Capsule Workspace, Capsule Cloud, Capsule Connect
• C. Capsule Workspace, Capsule Docs, Capsule Connect
• D. Capsule Workspace, Capsule Docs, Capsule Cloud

Answer: D

NEW QUESTION 5
On R80.10 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:

• A. 18210
• B. 18184
• C. 257
• D. 18191

Answer: B

NEW QUESTION 6
A Cleanup rule:

• A. logs connections that would otherwise be dropped without logging by default.
• B. drops packets without logging connections that would otherwise be dropped and logged by default.
• C. logs connections that would otherwise be accepted without logging by default.
• D. drops packets without logging connections that would otherwise be accepted and logged by default.

Answer: A

NEW QUESTION 7
Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using ____ .

• A. User Directory
• B. Captive Portal and Transparent Kerberos Authentication
• C. Captive Portal
• D. UserCheck

Answer: B

Explanation: To enable Identity Awareness:
Log in to SmartDashboard.
From the Network Objects tree, expand the Check Point branch.
Double-click the Security Gateway on which to enable Identity Awareness.
In the Software Blades section, select Identity Awareness on the Network Security tab.
The Identity Awareness
Configuration wizard opens.
Select one or more options. These options set the methods for acquiring identities of managed and unmanaged assets.
AD Query - Lets the Security Gateway seamlessly identify Active Directory users and computers
Browser-Based Authentication - Sends users to a Web page to acquire identities from unidentified users. If Transparent Kerberos Authentication is configured, AD users may be identified transparently.

NEW QUESTION 8
In which deployment is the security management server and Security Gateway installed on the same appliance?

• A. Bridge Mode
• B. Remote
• C. Standalone
• D. Distributed

Answer: C

Explanation: Installing Standalone
Standalone Deployment - The Security Management Server and the Security Gateway are installed on the same computer or appliance.

NEW QUESTION 9
What is the Transport layer of the TCP/IP model responsible for?

• A. It transports packets as datagrams along different routes to reach their destination.
• B. It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.
• C. It defines the protocols that are used to exchange data between networks and how host programs interact with the Application layer.
• D. It deals with all aspects of the physical components of network connectivity and connects with different network types.

Answer: B

NEW QUESTION 10
Where do we need to reset the SIC on a gateway object?

• A. SmartDashboard > Edit Gateway Object > General Properties > Communication
• B. SmartUpdate > Edit Security Management Server Object > SIC
• C. SmartUpdate > Edit Gateway Object > Communication
• D. SmartDashboard > Edit Security Management Server Object > SIC

Answer: A

NEW QUESTION 11
Jennifer McHanry is CEO of ACME. She recently bought her own personal iPad. She wants use her iPad to access the internal Finance Web server. Because the iPad is not a member of the Active Directory domain, she cannot identify seamlessly with AD Query. However, she can enter her AD credentials in the Captive Portal and then get the same access as on her office computer. Her access to resources is based on rules in the R77 Firewall Rule Base.
To make this scenario work, the IT administrator must:
1) Enable Identity Awareness on a gateway and select Captive Portal as one of the Identity Sources.
2) In the Portal Settings window in the User Access section, make sure that Name and password login is selected.
3) Create a new rule in the Firewall Rule Base to let Jennifer McHanry access network destinations. Select accept as the Action.
4) Install policy.
Ms McHanry tries to access the resource but is unable. What should she do?

• A. Have the security administrator select the Action field of the Firewall Rule “Redirect HTTP connections to an authentication (captive) portal”.
• B. Have the security administrator reboot the firewall.
• C. Have the security administrator select Any for the Machines tab in the appropriate Access Role.
• D. Install the Identity Awareness agent on her iPad.

Answer: A

NEW QUESTION 12
What needs to be configured if the NAT property ‘Translate destination on client side’ is not enabled in Global properties?

• A. A host route to route to the destination IP
• B. Use the file local.arp to add the ARP entries for NAT to work
• C. Nothing, the Gateway takes care of all details necessary
• D. Enabling ‘Allow bi-directional NAT’ for NAT to work correctly

Answer: C

NEW QUESTION 13
Kofi, the administrator of the ABC Corp network wishes to change the default Gaia WebUI Portal port number currently set on the default HTTPS port. Which CLISH commands are required to be able to change this TCP port?

• A. set web ssl-port <new port number>
• B. set Gaia-portal <new port number>
• C. set Gaia-portal https-port <new port number>
• D. set web https-port <new port number>

Answer: A

Explanation: In Clish
Connect to command line on Security Gateway / each
Log in to Clish.
Set the desired port (e.g., port 4434):
Cluster member.
HostName> set web ssl-port <Port_Number>
Save the changes:
HostName> save config
Verify that the configuration was saved:
[Expert@HostName]# grep 'httpd:ssl_port' /config/db/initial References:

NEW QUESTION 14
MegaCorp's security infrastructure separates Security Gateways geographically. You must request a central license for one remote Security Gateway.
How do you apply the license?

• A. Using the remote Gateway's IP address, and attaching the license to the remote Gateway via SmartUpdate.
• B. Using your Security Management Server's IP address, and attaching the license to the remote Gateway via SmartUpdate.
• C. Using the remote Gateway's IP address, and applying the license locally with command cplic put.
• D. Using each of the Gateway's IP addresses, and applying the licenses on the Security Management Server with the command cprlic put.

Answer: B

NEW QUESTION 15
Under which file is the proxy arp configuration stored?

• A. $FWDIR/state/proxy_arp.conf on the management server
• B. $FWDIR/conf/local.arp on the management server
• C. $FWDIR/state/_tmp/proxy.arp on the security gateway
• D. $FWDIR/conf/local.arp on the gateway

Answer: D

NEW QUESTION 16
You want to verify if there are unsaved changes in GAiA that will be lost with a reboot. What command can be used?

• A. show unsaved
• B. show save-state
• C. show configuration diff
• D. show config-state

Answer: D

NEW QUESTION 17
What are the two types of address translation rules?

• A. Translated packet and untranslated packet
• B. Untranslated packet and manipulated packet
• C. Manipulated packet and original packet
• D. Original packet and translated packet

Answer: D

Explanation: NAT Rule Base
The NAT Rule Base has two sections that specify how the IP addresses are translated:
Original Packet
Translated Packet References:

NEW QUESTION 18
Your bank's distributed R77 installation has Security Gateways up for renewal. Which SmartConsole application will tell you which Security Gateways have licenses that will expire within the next 30 days?

• A. SmartView Tracker
• B. SmartPortal
• C. SmartUpdate
• D. SmartDashboard

Answer: C

NEW QUESTION 19
Fill in the blanks: VPN gateways authenticate using _____ and ______.

• A. Passwords; tokens
• B. Certificates; pre-shared secrets
• C. Certificates; passwords
• D. Tokens; pre-shared secrets

Answer: B

Explanation: VPN gateways authenticate using Digital Certificates and Pre-shared secrets.

NEW QUESTION 20
The SmartEvent R80 Web application for real-time event monitoring is called:

• A. SmartView Monitor
• B. SmartEventWeb
• C. There is no Web application for SmartEvent
• D. SmartView

Answer: B