156-115.77無料問題集「CheckPoint Check Point Certified Security Master」

質問 1

When troubleshooting and trying to understand which chain is causing a problem on the Security Gateway, you should use the command:

（A）fw monitor -e "accept;" -p all

（B）fw tab -t connections

（C）fw ctl chain

（D）fw ctl zdebug drop

正解：A 解答を投票する

質問 2

The command fw ctl kdebug <params> is used to:

（A）list enabled debug parameters.

（B）enable kernel debugging.

（C）read the kernel debug buffer to obtain debug messages.

（D）select specific kernel modules for debugging.

正解：C 解答を投票する

質問 3

In a production environment, your gateway is configured to apply a Hide NAT for all internal traffic destined to the Internet. However, you are setting up a VPN tunnel with a remote gateway, and you are concerned about the encryption domain that you need to define on the remote gateway. Does the remote gateway need to include your production gateway's external IP in its encryption domain?

（A）Yes - all packets destined to go through the VPN tunnel will have the payload encapsulated in an ESP packet and after decryption at the remote site, the packet will contain the source IP of the Gateway because of Hide NAT.

（B）No - all packets destined through a VPN will leave with original source and destination packets without translation.

（C）No - all packets destined to go through the VPN tunnel will have the payload encapsulated in an ESP packet and after decryption at the remote site, will have the same internal source and destination IP addresses.

（D）Yes - The gateway will apply the Hide NAT for this VPN traffic.

正解：C 解答を投票する

質問 4

When configuring a Numbered VPN-Tunnel, what parameters are necessary?

（A）VPN Tunnel ID, Local Address, Remote Address

（B）Peer, Local Address, Remote Address

（C）VPN Tunnel ID, Peer, Local Address, Remote Address

（D）VPN Tunnel ID, Peer, Physical Device

正解：C 解答を投票する

質問 5

Certain rules will disable connection rate acceleration (templates) in the Rule Base. What command should be used to determine on what rule templates are disabled?

（A）cpconfig

（B）fwaccel stat

（C）cphaprob -a if

（D）fw ctl pstat

正解：B 解答を投票する

質問 6

When you perform an install database, the status window is filled with large amounts of text. What could be the cause?

（A）There is an active debug on the FWM process.

（B）There is an active debug on the SmartConsole.

（C）There is an environment variable of TDERROR_ALL_ALL set on the gateway.

（D）There is an active fw monitor running.

正解：A 解答を投票する

質問 7

You are configuring VTIs in a clustered environment. On Peer A the VTI name is VT_Cluster_GWA and on Peer B the VTI name is VT_Cluster_GWB. You find that the route-based tunnel is not coming up. What could be the cause?

（A）You have not issued the command "vpn write config' command.

（B）The names for your peers have been reversed.

（C）You have not licensed your gateways for VTIs.

（D）All VTIs going to the same remote peer must have the same name.

正解：D 解答を投票する

質問 8

What would the following command fw monitor tell you?

（A）Only OSPF and FTP traffic between 10.10.10.86 and 192.168.10.4

（B）Only accepted traffic between 10.10.10.86 and 192.168.10.4, or any accepted FTP traffic, or any accepted OSPF traffic

（C）Any communication between 10.10.10.86 and 192.168.10.4, or any FTP traffic, or any OSPF traffic

（D）Only traffic between 10.10.10.86 and 192.168.10.4 on port 21 or port 89

正解：C 解答を投票する

質問 9

Which of the following items is NOT part of the columns of the chain modules?

（A）Inbound/Outbound chain

（B）Chain position

（C）Function Pointer

（D）Module location

正解：A 解答を投票する

質問 10

How do you disable IPv6 on an IPSO gateway?

（A）Run $FWDIR/scripts/fwipv6_enable off and reboot.

（B）Remove the IPv6 license from the gateway.

（C）In IPSO go to System Management > System Configuration, set IPv6 Support to off, and click Apply.

（D）You cannot disable IPv6.

正解：A 解答を投票する

質問 11

Which command will you run to list established VPN tunnels?

（A）vpn tu

（B）fw tab -t vpn_routing

（C）vpn compstat

（D）fw tab -t vpn_active

正解：A 解答を投票する

質問 12

When you have edited the local.arp configuration, to support a manual NAT, what must be done to ensure proxy arps for both manual and automatic NAT rules function?

（A）Create and run a script to forward changes to the local.arp tables of your gateway

（B）In Global Properties > NAT tree select Merge manual proxy ARP configuration check box

（C）In Global Properties > NAT tree select Translate on client side check box

（D）Run the command fw ctl ARP -a on the gateway

正解：B 解答を投票する

質問 13

Your company has grown significantly over the past few months. You are seeing that new connections are being dropped but note that the connections table is not full. You suspect that the kernel memory allocated to the firewall has reached its full capacity. To check the "Machine Capacity Summary" statistics, you use command:

（A）top

（B）ps -aux

（C）fw ctl pstat

（D）cat /proc/net/capacity

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 14

Look at the follow Rule Base display. Rule 5 contains a TIME object. What is the effect on the following rules?

Checkpoint 156-115.77 Exam

（A）Rule 6 will be eligible but Rule 7 will not.

（B）All subsequent rules below Rule 5 will not be templated, regardless of the rule

（C）The restriction on one rule does not affect later rules with regards to templates.

（D）No effect. Rules 6 and 7 will be eligible for templating.

正解：B 解答を投票する

質問 15

You are configuring dynamic VPN routing using OSPF. You have defined the gateways, created a fully meshed VPN Community that includes all participating Gateways; created a rule to accept OSPF and configured dynamic routing. OSPF adjacencies are not establishing. Which of the following could explain why?

（A）You have overlapping encryption domains.

（B）You have not configured VTIs.

（C）You must to create a VPN star community.

（D）Check Point does not support dynamic VPN routing using OSPF.

正解：B 解答を投票する

質問 16

What happens to manual changes in the file $FWDIR/conf/local.arp when adding Proxy ARP entries through the GAiA portal or Clish?

（A）They are overwritten.

（B）Nothing.

（C）If the file $FWDIR/conf/local.arp has been edited manually, you are not able to add Proxy ARP entries through the GAiA portal or Clish.

（D）They are merged with the new entries added from the GAiA Portal / Clish.

正解：A 解答を投票する

質問 17

A Security Administrator wants to increase the amount of processing cores on a Check Point Security Gateway. He starts by increasing the number of cores, however the number of kernel instances remain the same way. What is the correct process to increase the number of kernel instances?

（A）Cpconfig- Enable Check Point ClusterXL- Change the number of firewall instances-define how many firewall instances to enable-reboot

（B）Cpconfig- Enable Check Point CoreXL- Change the number of firewall instances-define how many firewall instances to enable-cprestart

（C）Cpconfig- Check Point CoreXL- Change the number of firewall instances-define how many firewall instances to enable-cpstop,cpstart

（D）Cpconfig- Check Point CoreXL- Change the number of firewall instances-define how many firewall instances to enable-reboot

正解：D 解答を投票する

質問 18

You are troubleshooting a Security Gateway, attempting to determine which chain is causing a problem. What command would you use to show all the chains through which traffic passed?

（A）[Expert@HostName]# fw monitor -e "accept;" -p all

（B）[Expert@HostName]# fw ctl chain

（C）[Expert@HostName]# fw ctl zdebug all

（D）[Expert@HostName]# fw ctl debug -m

正解：A 解答を投票する

質問 19

Which command should you use to stop kernel module debugging (excluding SecureXL)?

（A）fw ctl zdebug - all

（B）fw ctl debug 0

（C）fw debug fwd off; vpn debug off

（D）fw debug fwd off

正解：B 解答を投票する

質問 20

Using the default values in R77 how many kernel instances will there be on a 16-core gateway?

（A）12

（B）16

（C）14

（D）8

正解：C 解答を投票する

156-115.77 無料問題集「CheckPoint Check Point Certified Security Master」

弊社を連絡する

関連リンク

トップ試験