Check Point CCSA Exam Cram: Defining Security Policy with SmartDashboard

This chapter is from the book

Check Point CCSA Exam Cram 2 (Exam 156-210.4)

Learn More Buy

This chapter is from the book

This chapter is from the book 

Check Point CCSA Exam Cram 2 (Exam 156-210.4)

Learn More Buy

Exam Prep Questions

1. You have hidden rule 13, which drops all HTTP packets to a particular web server, but packets are still being dropped. What is the likely cause of this problem?

1. You did not push the policy to the enforcement point(s).

2. A rule after rule 13 also blocks access.

3. Hiding a rule does not remove it from the security policy.

4. The server has a network problem.

5. You must save the policy to the SmartCenter Server.

Answer: C. A is not correct because a hidden rule is still compiled into the security policy. B is not correct because rule 13 is still valid and it will therefore block the packet regardless of a successive rule. C is correct because the rule will still be enforced by the gateway, even though it's hidden from view to SmartDashboard. D is not correct because it is the rule causing the drops, not a network problem. E is not correct because saving the policy to the SmartCenter Server has no effect on the enforcement points.

2. Trying to gain privileges by making a packet that is received on one interface look as though it is from a network connected to a different interface is called what?

1. Network Address Translation (NAT)

2. Anti-spoofing

3. Buffer overflow

4. Spoofing

5. Remote Procedure Call (RPC)

Answer: D. A is not correct because NAT is used on the gateway, and is not for gaining privileges. B is not correct because anti-spoofing is used to protect against this attack, not the attack itself. C is not correct because a buffer overflow works by getting a host to execute malicious code by filling unchecked buffers, not by faking addresses. D is correct because spoofing involves manipulating addresses to make a packet look as though it comes from another interface. E is not correct because RPCs are used by applications and operating systems to communicate.

3. Which three of the following are FireWall-1 global properties?

1. Accept RIP

2. Accept HTTPS

3. Accept Control Connections

4. Anti-spoofing

5. Accept Outgoing Packets Originating from Gateway

Answer: A, C, and E. A is correct because there is a FireWall-1 global property that enables the gateway to accept RIP. B is not correct because there is no such option. C is correct because by default, control connections are enabled in the global properties. D is not correct because anti-spoofing is configured at the Check Point level, not the global level. E is correct because there is an option to accept packets originating from the gateway.

4. With reference to the sample policy below, what is the function of rule 1?

Rule #	Source	Destination	Service	Action	Track
1	Any	Firewall	Any	Drop	Log
2	Any	HTTPServer	HTTP	Accept	None




1. Is the cleanup rule

2. Is the stealth rule

3. Prevents firewalls from sending packets

4. Prevents spoofing attacks against the firewall

5. Works with rule 2 to protect HTTPServer

Answer: B. A is not correct because the cleanup rule is the final rule, and drops everything. B is correct because the stealth rule drops packets sent to the firewall. C is not correct because this rule blocks packets into the firewall but does not specify what happens to packets with a source of the firewall. D is not correct because spoofing is not handled through the rule base. E is not correct because rules 1 and 2 are independent.

5. With reference to the sample policy shown here, who can access port 80 on HTTPServer?

Rule #	Source	Destination	Service	Action	Track
1	Any	Firewall	Any	Drop	Log
2	Net1	HTTPServer	HTTP	Drop	None
3	Net2	HTTPServer	HTTPS	Accept	None
4	Any	HTTPServer	HTTP	Accept	Log




1. Net1

2. Net2

3. Net1 and Net2

4. Anyone except Net1

5. Invalid policy; rule 2 masks rule 4

Answer: D. A is not correct because rule 2 explicitly drops any packets from Net1 to HTTPServer on port 80. B is not the correct answer because even though Net2 can access HTTPServer on port 80, it is not the best answer. C is not correct because Net1 cannot connect to the HTTP server. D is correct because rule 2 blocks Net1, and rule 4 allows everyone else. E is not correct because rule 2 does not mask rule 4—it is more specific.

6. Which of the following will have a negative impact on a gateway's throughput? (Choose two.)

1. Small rule base

2. Groups of hosts used instead of network objects

3. Tracking option on all rules set to Log

4. High-traffic rules near the top of the rule base

5. Multiple administrators logged in to SmartConsole

Answer: B and C. A is not correct because a smaller rule base is good for performance, because fewer rules need to be checked on average. B is correct because network objects are more efficient than a group of hosts. C is correct because logging decreases FireWall-1 performance. D is not correct because high-traffic rules should be near the top of the rule base so that fewer rules need to checked on average. E is not correct because the number of administrators logged in to a SmartConsole does not affect the performance of the gateways.

7. Which of the following commands changes the installed security policy to one that will certainly accept control connections?

1. cpstop

2. fw fetch localhost

3. fw unloadlocal

4. fwm unloadlocal

5. fwstop

Answer: C. A is not correct because cpstop will stop all the Check Point services, and no one will be able to connect. B is not correct because it will fetch the latest policy from the management server, which is not guaranteed to allow control connections. C is correct because fw unloadlocal removes the policy from the gateway and allows management connections. D is not correct because unloading the policy is done on the enforcement point through fw, not on the management server through fwm. E is not correct because fwstop will stop the firewall service and will not allow anyone to connect.

8. Where are the global properties located?

1. Global Properties under Management Station Properties

2. View, Global Properties

3. Manage, Global Properties

4. Manage, Policy, Global Properties

5. Policy, Global Properties

Answer: E. A is not correct because the global properties are not a property of the management station. B is not correct because the View menu is for changing the look and feel of the SmartDashboard. C is not correct because the Manage menu is for managing objects. D is not correct for the same reasons as C. E is correct because that is where the Global Properties menu item is found.

9. Which of the following objects may appear in a group together? (Choose three.)

1. Check Points

2. Other groups

3. Time objects

4. Nodes configured as a gateway

5. Services

Answer: A, B, and D. A is correct because a Check Point is another type of network object, and can share a group with other network objects. B is correct because groups can be nested. C is not correct because time objects are not network objects, and thus cannot be grouped with other network objects. D is correct because nodes, whether configured as a host or a gateway, are network objects. E is not correct because services cannot be grouped with network objects.

10. Which of the following have a SIC connection to the SmartCenter Server? (Choose two.)

1. Check Point, Gateway

2. Check Point, Externally Managed Gateway

3. Check Point, Host

4. Nodes, Gateway

5. Nodes, Host

Answer: A and C. A is correct because a Check Point gateway is managed by the SmartCenter Server and has a SIC connection. B is not correct because an externally managed gateway is not managed by the SmartCenter Server, and thus does not have a SIC connection. C is correct because a Check Point host is the same as a Check Point gateway in terms of management. D is not correct because a node does not have a policy and is not managed. E is not correct for the same reasons as D.