Question 1

As a Security Administrator, you must refresh the Client Authentication authorized time-out every time a new user connection is authorized. How do you do this? Enable the Refreshable Timeout setting:

Accepted Answer

The Refreshable Timeout setting is enabled in the Limit tab of the Client Authentication Action Properties screen to refresh the authorized time-out for new user connections.

Question 2

While in SmartView Tracker, Brady has noticed some very odd network traffic that he thinks could be an intrusion. He decides to block the traffic for 60 minutes, but cannot remember all the steps. What is the correct order of steps needed to set up the block? 1) Select Active Mode tab in SmartView Tracker. 2) Select Tools > Block Intruder . 3) Select Log Viewing 4) Set Blocking Timeout value to 60 minutes. 5) Highlight connection that should be blocked.

Accepted Answer

First, select the Active Mode tab, then highlight the connection to be blocked, select Block Intruder, and finally set the blocking timeout.

Question 3

You find a suspicious connection from a problematic host. You decide that you want to block everything from that whole network, not just the problematic host. You want to block this for an hour while you investigate further, but you do not want to add any rules to the Rule Base. How do you achieve this?

Accepted Answer

The answer of You find a suspicious connection from a...

Question 4

Your company enforces a strict change control policy. Which of the following would be MOST effective for quickly dropping an attacker's specific active connection?

Accepted Answer

The answer of Your company enforces a strict change control...

Question 5

MegaCorp's security infrastructure separates Security Gateways geographically. You must request a central license for one remote Security Gateway. How do you apply the license?

Accepted Answer

The central license is tied to the Security Management Server's IP address, and then it is attached to the remote Security Gateway using SmartUpdate.

Question 6

Your users are defined in a Windows 2008 R2 Active Directory server. You must add LDAP users to a Client Authentication rule. Which kind of user group do you need in the Client Authentication rule in R77?

Accepted Answer

In R77, to add LDAP users to a Client Authentication rule, you need to use an LDAP group, which allows integration with Active Directory for user authentication.

Question 7

A client has created a new Gateway object that will be managed at a remote location. When the client attempts to install the Security Policy to the new Gateway object, the object does not appear in the Install On check box. What should you look for?

Accepted Answer

A Gateway object created using the Check Point > Externally Managed VPN Gateway option from the Network Objects dialog box.

Question 8

Which of the following firewall modes DOES NOT allow for Identity Awareness to be deployed?

Accepted Answer

Bridge mode does not allow for Identity Awareness to be deployed because it does not have the ability to inspect traffic and make decisions based on user identity.

Question 9

When launching SmartDashboard, what information is required to log into R77?

Accepted Answer

To log into SmartDashboard in R77, you need to provide the User Name, Password, and Management Server IP.

Question 10

According to Check Point Best Practice, when adding a non-managed Check Point Gateway to a Check Point security solution what object SHOULD be added? A(n):

Accepted Answer

The answer of According to Check Point Best Practice, when...

Question 11

You manage a global network extending from your base in Chicago to Tokyo, Calcutta and Dallas. Management wants a report detailing the current software level of each Enterprise class Security Gateway. You plan to take the opportunity to create a proposal outline, listing the most cost-effective way to upgrade your Gateways. Which two SmartConsole applications will you use to create this report and outline?

Accepted Answer

The answer of You manage a global network extending from...

Question 12

A digital signature:

Accepted Answer

A digital signature ensures that a message has not been altered and verifies the sender's identity, thus guaranteeing authenticity and integrity.

Question 13

You are about to integrate RSA SecurID users into the Check Point infrastructure. What kind of users are to be defined via SmartDashboard?

Accepted Answer

RSA SecurID users are typically integrated as a group with generic users in Check Point's SmartDashboard to allow for authentication and access control.

Question 14

Which of the following authentication methods can be configured in the Identity Awareness setup wizard?

Accepted Answer

The answer of Which of the following authentication methods can...

Question 15

How do you configure the Security Policy to provide uses access to the Captive Portal through an external (Internet) interface?

Accepted Answer

The answer of How do you configure the Security Policy...

Question 16

Where do you verify that UserDirectory is enabled?

Accepted Answer

The correct location to verify if UserDirectory is enabled is in the Global Properties under UserDirectory (LDAP) settings.

Question 17

Which of these attributes would be critical for a site-to-site VPN?

Accepted Answer

The answer of Which of these attributes would be critical...

Question 18

What is also referred to as Dynamic NAT ?

Accepted Answer

Dynamic NAT is often referred to as Hide NAT because it allows multiple private IP addresses to be mapped to a single public IP address, effectively "hiding" the internal addresses.

Question 19

What is the Manual Client Authentication TELNET port?

Accepted Answer

The answer of What is the Manual Client Authentication TELNET...

Question 20

Which of the following uses the same key to decrypt as it does to encrypt?

Accepted Answer

Symmetric encryption uses the same key for both encryption and decryption, unlike asymmetric encryption which uses a pair of keys (public and private).

Exam 2: Check Point Certified Security Administrator (CCSA R80)