156-215-71 by CheckPoint Actual Free Exam Q&As

Question 1

Beginning with R71, Software Blades were introduced. One of the Software Blades is the IPS Software Blade as a replacement for SmartDefense. When buying or upgrading to a bundle, some blades are included, e.g. FW, VPN, IPS in SG103. Which statement is NOT true?

A. The license price includes IPS Updates for the first year. B. After one year, it is mandatory to renew the service contract for the IPS Software Blade because it has been bundled with the license when purchased. C. The IPS Software Blade can be used for an unlimited time. D. There is no need to renew the service contract after one year.

Discussion 0

Correct Answer: B Vote an answer

Question 2

You are the Security Administrator for MegaCorp. In order to see how efficient your firewall Rule Base is, you would like to see how often the particular rules match. Where can you see it? Give the BEST answer.

A. In SmartReporter, in the section Firewall Blade - Activity / Network Activity with information concerning Top Matched Logged Rules. B. SmartReporter provides this information in the section Firewall Blade - Security / Rule Base Analysis with information concerning Top Matched Logged Rules. C. It is not possible to see it directly. You can open SmartDashboard and select UserDefined in the Track column. Afterwards, you need to create your own program with an external counter. D. In the SmartView Tracker, if you activate the column Matching Rate.

Discussion 0

Correct Answer: B Vote an answer

Question 3

How can you recreate the account of the Security Administrator, which was created during initial installation of the Management Server on SecurePlatform?

A. Launch SmartDashboard in the User Management screen, and delete the cpconfig administrator. B. Type cpm -a, and provide the existing Administrator's account name. Reset the Security Administrator's password. C. Launch cpconfig and delete the Administrator's account. Recreate the account with the same name. D. Export the user database into an ASCII file with fwm dbexport. Open this file with an editor, and delete the Administrator Account portion of the file. You will be prompted to create a new account.

Discussion 0

Correct Answer: C Vote an answer

Question 4

In which IKE phase are IKE SA's negotiated?

A. Phase 1 B. Phase 4 C. Phase 3 D. Phase 2

Discussion 0

Correct Answer: A Vote an answer

Question 5

In the SmartView Tracker you receive the error, ...peer send invalid ID information... while trying to establish an IKE VPN tunnel. Where does this error normally result from and how can you solve it? This error normally results from:

A. an invalid IP address configured on one tunnel endpoint; normally the internal one in the General tab. This can be solved with link selection or by changing this IP to the one facing the other tunnel endpoint. B. a mismatch in the authentication algorithms used in IKE phase one and can be corrected by changing them to match. C. an invalid IP address configured on one tunnel endpoint, normally the internal one in the General tab. This can be resolved by adding the correct IPs to the Topology tab of both Gateways on both sites. D. a mismatch in the IPs of the VPN tunnel endpoints and can not be resolved.

Discussion 0

Correct Answer: A Vote an answer

Question 6

When restoring R71 using the upgrade_import command, which of the following items is NOT restored?

A. Global properties B. Licenses C. SIC Certificates D. Route tables

Discussion 0

Correct Answer: D Vote an answer

Question 7

You just installed a new Web server in the DMZ that must be reachable from the Internet. You create a manual Static NAT rule as follows:

"web_public_IP" is the node object that represents the public IP address of the new Web server. "web_private_IP" is the node object that represents the new Web site's private IP address. You enable all settings from Global Properties > NAT.
When you try to browse the Web server from the Internet, you see the error "page cannot be displayed". Which statements are possible reasons for this?
i) There is no route defined on the Security Gateway for the public IP address to the private IP address of the Web server.
ii) There is no Security Policy defined that allows HTTP traffic to the protected Web server.
iii) There is an ARP entry on the Gateway but the settings Merge Manual proxy ARP and Automatic ARP configuration are enabled in Global Properties. The Security Gateway ignores manual ARP entries.
iv) There is no ARP table entry for the public IP address of the protected Web server.

A. (i), (ii) B. (iii) C. (i), (ii), (iii), (iv) D. (i), (ii), (iv)

Discussion 0

Correct Answer: B Vote an answer

Question 8

You want to implement Static Destination NAT in order to provide external, Internet users access to an internal Web Server that has a reserved (RFC 1918) IP address. You have an unused valid IP address on the network between your Security Gateway and ISP router. You control the router that sits between the external interface of the firewall and the Internet.
What is an alternative configuration if proxy ARP cannot be used on your Security Gateway?

A. Publish a proxy ARP entry on the internal Web server instead of the firewall for the valid IP address. B. Place a static host route on the firewall for the valid IP address to the internal Web server. C. Place a static ARP entry on the ISP router for the valid IP address to the firewall's external address. D. Publish a proxy ARP entry on the ISP router instead of the firewall for the valid IP address.

Discussion 0

Correct Answer: C Vote an answer

Question 9

You plan to upgrade from R65 to R71 Software Blades. Do you need new licenses and license strings for this scenario?

A. No, the upgrade will convert all licenses to R71. B. Yes, the upgrade will do an automatic conversion in the User Center, but you will need to reattach the new licenses. C. No, the upgrade will preserve licenses. D. Yes, you need to buy/convert licenses in the User Center first, and then reapply licenses to upgraded systems with the new Software Blades licenses.

Discussion 0

Correct Answer: D Vote an answer

CheckPoint Check Point Certified Security Administrator R71 - 156-215-71 Exam Practice Test