156-315.82 試験問題と解答 - 模擬練習 - 練習問題・模擬試験

Question No : 1
When creating a VPN tunnel with a third party product which object should you create in Smart Console to represent the remote side?

A.Externally Managed VPN Gateway
B.Gateway
C.Host
D.Interoperable Object

正解:

Question No : 2
When a solution is configured with Route-based VPN method what interfaces are used?

A.The Gaia Portal Web User Interface (WebUI)
B.Only the internal interfaces, which are included in a special Route-based Domain (Network Group object).
C.Virtual Tunnel Interfaces (VTI)
D.External interface with a secondary IP address

正解:

Question No : 3
The Gateways has to mutually authenticate during the IPSec negotiation phase. There are two methods for this, namely:

A.Pre-shared secret and PKI Certificate
B.Kerberos and LDAP
C.OCSP and Certificate Revocation List
D.RSA SecurID and Dynamic ID

正解:

Question No : 4
To form a tunnel IKEv2 uses two exchange types - IKE_SA_INIT and IKE_AUTH. How many packets are transferred between the VPN peer gateways during the two exchanges?

A.Each exchange involves two messages, making a total of 4 packets.
B.For a site-to-site VPN on Check Point using IKEv2, the normal exchange is indeed nine packets
C.9 packets unless legacy peers are included in the VPN community, which uses just 6 packets, 3 per exchange.
D.6 packets. There are 4 in the SA_INIT exchange because of the Diffie Hellman process.

正解:

Question No : 5
What is true regarding the number of involved Management Servers in a Management HA environment?

A.You can have one Primary Management Server and one or more Secondary Management Server(s).
B.You can have multiple Primary Management Servers in a Load Sharing Mode HA Environment.
C.You can have one Primary Management Server and one Secondary Management Server.
D.You can have multiple Primary Management Servers behind a Load Balancer, such as the Logical Server, but in this scenario, you can only use Round Robin as the Distribution Mechanism.

正解:

Question No : 6
Can a VPN Gateway be a member of more than one VPN community?

A.No, it could be used only in one VPN Community.
B.Yes, it is possible, but with correct modifications of vpn_route.conf file on each VPN Gateway
C.Yes, if it doesn’t pair with another VPN Gateway in more than one VPN Community.
D.Yes, it could be used in more than one VPN Community, if all VPN Gateways are managed with the same Security Management.

正解:

Question No : 7
Internet Key Exchange (IKE) a standard key management protocol that is used to do what exactly?

A.Renew both Phase 1 and Phase 2 IPSec keys when they expire.
B.Renew the Phase 2 key when it expires, after 60 minutes by default.
C.Update the VPN Domain information and renew expired keys when they expire.
D.Create the VPN tunnels by, Authenticating peers, agreeing on keys and methods to be used for encryption.

正解:

Question No : 8
Alice & Bob are concurrently logged in to the SmartConsole under Logs & Servers to check for the IKE “Key Install” between a working VPN Site-to-Site Tunnel between site Alpha and site Bravo .
Which of the following IKE versions are available?

A.IKE
B.IKEv1 & IKEv3
C.IKEv1 & IKEv2
D.IKEv2 & IKEv4

正解:

Question No : 9
According to the policy installation, the transfer state (CPTA) is invoked by the FWM (Firewall) process which initiates the Transfer/Commit phase. On the Security Gateway side a process receives them and first stores them into a temporary directory .
Which process is true for receiving these files?

A.FWD
B.CPD
C.FWM
D.RAD

正解:

Question No : 10
According to the policy installation flow, the transfer state (CPTA) is invoked by the FWM (Firewall) process which initiates the Transfer/Commit phase. On the Security Gateway side a process receives them and first stores them into a temporary directory .
Which directory for the Transfer is correct for receiving these files?

A.$FWDIR/state/local/FW1
B.$FWDIR/state/_tmp/FW1
C.$FWDIR/state/_tmp/FW-1
D.$CPDIR/state/_tmp/FWM1

正解:

Question No : 11
Which Management Server Process receives an install command if it comes to install a policy?

A.The CPM process is involved in installing a policy to the gateway.
B.The CPWD process invokes the install function.
C.The FWM process is involved in installing the policy.
D.The FWD process is involved in installing a policy.

正解:

Question No : 12
What does the CPTA (Check Point Transfer Agent) do?

A.CPTA communicates with the ThreatCloud to transfer anonymized attack log data and download new signatures.
B.CPTA transfers the policy files from the Security Management Server to the Security Gateway for policy installation.
C.CPTA is the agent built into Gaia that downloads new software updates, including JHFAs and major version installation packages.
D.CPTA is the process that finds and downloads licenses and contracts from the UserCenter to the Security Management Server.

正解:

Question No : 13
What is crucial in translating services (destination ports) in a NAT rule?

A.This can only be accomplished with the Automatic NAT Rule with “Translate Destination on Server Side” enabled
B.This can only be accomplished with Automatic NAT Rule in conjunction with Bi-Directional NAT
C.This can only be accomplished with the Automatic NAT Rule with “Automatic ARP Configuration” enabled.
D.This has to be done with a Manual NAT Rule.

正解:

Question No : 14
Which daemon makes the decision if Modern Dump or Legacy Dump should be used during Policy Installation?

A.FWM (Firewall Management)
B.CPTA (Check Point Transfer Agent)
C.CPD (Check Point Daemon)
D.CPM (Check Point Management)

正解:

Question No : 15
During the policy installation, the CPM process needs to make a decision for Full Installation Policy or Fast Installation Policy. Depending on the decision the CPM process decides what kind of dump will be used .
Which statement is true for the Fast Installation Policy?

A.Modern Dump always combines the Legacy Dump in which the pre-verified and pre-generated code is included
B.Modern Dump files never include the pre-verified and pre-generated code
C.Modern Dump files are sent to the FWM (Firewall) process, which is responsible for code generation and compilation
D.Modern Dump files already include the pre-verified and pre-generated code

正解:

Check Point 156-315.82 問題練習