CheckPoint 156-215.71 問題集

質問 1：
Which of the following explanations best describes the command fw logswitch [-h target] [+ | -] [oldlog]?
A. Control Kernel
B. Create a new Log file. The old log has moved
C. Display protocol Hosts
D. Display a remote machine's log-file list.
正解：B

質問 2：
Your R71 enterprise Security Management Server is running abnormally on Windows 2003 Server. You decide to try reinstalling the Security Management Server, but you want to try keeping the critical Security Management Server configuration settings intact (i.e., all Security Policies, databases, SIC, licensing etc.) What is the BEST method to reinstall the Server and keep its critical configuration?
A. 1) Download the latest upgrade_export utility and run it from a \ temp directory to export the
Configuration.
2) Perform any requested upgrade verification suggested steps.
3) Uninstall all R71 packages via Add/Remove Programs and reboot
4) Use smartUpdate to reinstall the Security Management server and reboot
5) Transfer the .tgz file back to the local \ temp.
6) Run upgrade_import to import the configuration.
B. 1) Download the latest upgrade_export utility and run it from a \ temp directory to export the
Configuration.
2) Transferee .tgz file to another network machine
3) Uninstall all R71 packages via Add/Remove Programs and reboot
4) Install again using the R71 CD ROM as a primary security management server
5) Reboot and than transfer the .tgz file back to the local\ tem p
6) Run upgcade_import to import the configuration.
C. 1) Insert the R71 CD-ROM. and select the option to export the configuration into a . tgz file
2) Skip any upgrade verification warnings since you are not upgrading.
3) Transfer the. tgz file to another networked machine.
4) Download and run the cpclean utility and reboot.
5) Use the R71 CD_ROM to select the upgrade__import option to import the c
D. 1) Run the latest upgrade_export utility to export the configuration
2) Leave the exported - tgz file in %FWDIR\bin.
3) Install the primary security Management Server on top of the current installation
4) Run upgrade_import to Import the configuration.
正解：A

質問 3：
What happens in relation to the CRL cache after a cpstop and cpstart have been initiated?
A. The Gateway retrieves a new CRL on startup, and discards the old CRL as invalid.
B. The Gateway continuous to use the old CRL even if it is not valid, until a new CRL is cashed.
C. The Gateway issues a crl_zap on startup, which empties the cache and forces certificate retrieval.
D. The Gateway continues to use the old CRL, as long as it is valid.
正解：D

質問 4：
An internal host initiates a session to www.google.com and is set for Hide NAT behind the Security Gateway. The initiating traffic is an example of __________.
A. Source NAT
B. None of these
C. Destination NAT
D. Client side NAT
正解：A

質問 5：
You are evaluating the configuration of a mesh VPN Community used to create a site-to-site VPN. This graphic displays the VPN properties in this mesh Community.

Checkpoint 156-215-71 Exam
Which of the following would be the most valid conclusion?
A. Changing the setting Perform IPsec data encryption with from AES-128 to 3DES will increase the encryption overhead.
B. Change the data-integrity settings for this VPN CommunitybecauseMD5 is incompatible with AES.
C. The VPN Community will perform IKE Phase 1 key-exchange encryption using the longest key Security Gateway R71 supports.
D. Changing the setting Perform key exchange encryption with 3DES to DES will enhance the VPN Community's security, and reduce encryption overhead.
正解：A

質問 6：
You have configured a remote site Gateway that supports your boss's access from his home office using a DSL dialup connection. Everything worked fine yesterday, but today all connectivity is lost. Your initial investigation results in "nobody has touched anything", which you can support by taking a look in SmartView Tracker Management. What is the problem and what can be done about it?
A. You cannot use NAT and a dialup connection.
B. The NAT configuration is not correct; you can only use private IP addresses in a static NAT setup.
C. According to published limitations of Security Gateway R71, there's a bug with NAT. A restart of the Gateway will help here.
D. A static NAT setup may not work with DSL, since the external IP may change. Hide NAT behind the Gateway is the preferred method here.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Which authentication type requires specifying a contact agent in the Rule Base?
A. Session Authentication
B. User Authentication
C. Client Authentication with Manual Sign On
D. Client Authentication with Partially Automatic Sign On
正解：A

質問 8：
What happens when you select File / Export from the SmartView Tracker menu?
A. Current logs are exported to a new *.log file.
B. Exported log entries are deleted from fw.log.
C. Exported log entries are not viewable in SmartView Tracker.
D. Logs in fw.log are exported to a file that can be opened by Microsoft Excel.
正解：D