Identify the default username and password for a newly installed Check Point appliance.
Aadmin/password
Badmin/Chkp1234
Ccpadmin/cpadmin
Dadmin/admin
Inline Layers are evaluated against the rules; if none of the rules match _____ is applied.
Athe Accept action
Bthe Implicit Cleanup Rule
Cthe Drop action
Dthe Explicit Cleanup Rule if exists
When Accounting is enabled what is the time interval the logs are being updated?
AThe log is updated in 10-minute intervals.
BThe log update interval has to be specified as a firewall kernel parameter.
CThe log is updated in 10-minute intervals or if 20 MB of log data is collected.
DThe log update interval varies upon the queued user mode processes on the Management Servers, such as FWD, CPD, CPM.
What happens when disk space on the Log Server drops below 5000 MBytes by default?
AA popup alert is triggered
BFiles begin to be deleted
CLogging stops immediately
DA script is executed
What is the purpose of Dynamic Objects in SmartConsole?
ATo change IP addresses dynamically
BTo provide default security settings
CTo represent external services
DTo manage user accounts
Which HTTPS Inspection setting allows bypassing connections to software update services?
AFail Mode
BCategorization Mode
CBypass Allow List
DCertificate Blocking
What is the purpose of the Policy Enforcement Point (PEP) in Identity Awareness?
ATo receive identity data from identity sources
BTo organize identity data
CTo store logs of user activity
DTo enforce network access restrictions based on identity
What of the following is NOT an Identity Source supported by the Check Point Identity Awareness Blade?
ARemote Access and Terminal Servers.
BIdentity Connector and TACACS
CBrowser-Based Authentication and AD Query.
DRADIUS Accounting, Identity Collector.
What is the role of Policy Decision Point (PDP) in Identity Awareness?
AThe PDP receives identity data from identity sources
BThe PDP receives identity data from the identity sources and enforces network access restrictions on traffic based on the identity of a user
CThe PDP is an object to configure specifies users, computers, and network locations as one object
DThe PDP enforces network access restrictions on traffic based on the identity of a user
How do you match a user or a computer identity in the security policy?
AUse identity awareness objects in source or destination columns.
BUse the AD Query Object in source or destination column.
CUse a user or a user group object in source or destination column.
DUse Access Role Objects in source or destination columns.
What is the difference between generating logs per connection or per session?
APer Session is only available for URL Filtering, whereas the Connection could be applied to URL Filtering as well as Application Control.
BPer connection means that a log is generated for each connection in the session while per session means that only one log per session is generated.
CPer Session means that you will get the name of application in Application Control, although the applications were not specified in the rule base. Per Connections means that you will get the whole list of content in the Content Awareness blade.
DPer session means that a log is collected for each session in a connection while per connection means that only one log is collected per session.
Select the correct description of the SmartView Monitor.
AUsed to view collected logs, monitor health, performance, and regulatory compliance of Check Point components
BUsed to view collected logs and query for information
CUsed to monitor health, performance, and regulatory compliance of Check Point components using web browser
DUsed to monitor health, performance, and regulatory compliance of Check Point components
When should you enable log indexing on a Standalone Deployment?
ALog indexing is enabled by default on all deployments
Bonly when the standalone computer CPU has 8 or more cores
CLog indexing is disabled by default only on Bridge mode deployments
Donly when the standalone computer CPU has 4 or more cores
Which component is the source of the Logs sent to the Log Server?
AThe SmartReporter along with the Eventia Reporter.
BThe SmartEvent Correlation Unit
CThe SmartEvent Server
DSecurity Gateway
In which deployment type is the log indexing disabled by default?
ABridge mode
BDistributed
CMaestro Orchestrator
DStandalone
What is the purpose of Audit logs?
AAudit Logs record administrative actions, such as configuration of static routes in CLISH or adding an OS administrator password.
BAudit Logs record administrative actions, such as policy modifications, user logins, and configuration changes.
CAudit Logs is to check the validity of the IPS, Anti-Bot, Anti-Virus, URL Filtering, Application Control subscription license from the Check Point ThreatCloud repository.
DAudit Log is to comply with the Regulations, such as FIPS, HIPAA or PCI-DSS.
Which of the following is a best practice for policy layers?
AAvoid sharing layers across policies
BUse only one layer per policy
CDisable implicit cleanup rules
DShare layers with other policy packages
When looking at the Ordered Access Control Layers in the SmartConsole they are organized sequentially. How does the security gateway enforce the rules?
AAll ordered layers are analyzed in parallel. If there is a matched drop rule in any layer then the traffic is allowed.
BAfter checking each layer the firewall engages the relevant blades and starts to evaluate again one at a time while working with the other access control blades.
CEach layer is evaluated independently.
DAll ordered layers are analyzed in parallel. If there is a matched accept rule in any layer then the traffic is allowed.
Which Identity Awareness Client can collect identities from not only Active Directory Domain Controllers, but also from Cisco Identity Services Engine Servers or NetIQ eDirectory Servers?
AIdentity Agent for a User Endpoint Computer
BIdentity Agent for a Terminal Server v2
CIdentity Agent for a Terminal Server
DIdentity Collector
What happens when a rule in an Ordered Layer matches a packet and the action is Drop?
AThe packet is encrypted
BThe packet is dropped and no further rules are checked
CThe packet is logged and forwarded
DThe packet is sent to the next layer
What is the difference between the Access Control policy and NAT policy?
AThe Access Control policy is a collection of rules that control network access. The NAT rules can be used to make the gateway change IP addresses and port numbers in packets.
BThe Access Control policy is an enforced on the Security Gateway. The NAT rules are enforced on a separate NAT Gateway.
CThe Access Control policy is a collection of rules that control application and web site access. The NAT rules allow or deny connections on the gateway and can also change IP addresses and port numbers in packets.
DThe Access Control policy is a collection of rules that mostly blocks network access. The NAT rules are used to allow access through the gateway. A NAT rule causes the gateway to allow access to or from the IP addresses and translates the packet according to the rule.
The Access Control Policy includes which of these features?
AFirewall, Application & URL Filtering, Content Awareness, IPsec VPN and Mobile Access, Identity Awareness
BFirewall, Application &U RL Filtering, Data Loss Prevention, IPsec VPN and Mobile Access, Identity Awareness
CFirewall, Application &U RL Filtering, antivirus, IPsec VPN and Mobile Access, Identity Awareness
DFirewall, Application &U RL Filtering, file content analysis, IPsec VPN and Mobile Access, Identity Awareness
Select the correct description of the Explicit Rules.
AExplicit rules are created by the administrator
BExplicit rules are created in Security Policies by the Security Management Server
CExplicit rules are created by the Security Gateway
DExplicit rules are created in the Global Properties on the Security Management Server
What is the purpose of the Cleanup Rule in a security policy?
ATo accept all unmatched traffic
BTo log all security events
CTo block all known malicious traffic
DTo drop or reject all traffic that does not match any rule in the rulebase
Which type of Control Model is used in Application Control & URL Filtering and Content Awareness Policy?
APermissive Control Model (also known as Whitelist Model)
BRestrictive Control Model (also known as Blacklist Model)
CPositive Control Model (also known as Whitelist Model)
DNegative Control Model (also known as Blacklist Model)