CheckPoint 156-215.71 問題集

質問 1：
You administer a large, geographically distributed network. The Internet connection at a remote site failed during the weekend, and the Security Gateway logged locally for over 48 hours. It is possible that the logs may have consumed most of the free space on the Gateway's hard disk. Which SmartConsole application displays the percent of free hard-disk space on the remote Security Gateway?
A. SmartView Monitor
B. SmartView Tracker
C. Eventia Analyzer
D. This information can only be viewed with fw ctl pstat command from the CLI
正解：A

質問 2：
Certificates for Security Gateways are created during a simple initialization from______.
A. SmartUpdate
B. The ICA management tool.
C. sysconfig
D. SmartDashboard
正解：D

質問 3：
What are you required to do before running upgrade__ export?
A. Run a cpstop on the Security Gateway.
B. Close all GUI clients
C. Run cpconfig and set yourself up as a GUI client.
D. Run a cpstop on the Security Management Server
正解：B

質問 4：
Why are certificates preferred over pre-shared keys in an IPsec VPN?
A. Weak performance: PSK takes more time to encrypt than Drffie-Hellman
B. Weak Security: PSK are static and can be brute-forced.
C. Weak scalability: PSKs need to be set on each and every Gateway
D. Weak security: PSKs can only have 112 bit length.
正解：B

質問 5：
You just installed a new Web server in the DMZ that must be reachable from the Internet. You create a manual Static NAT rule as follows:

"web_public_IP" is the node object that represents the public IP address of the new Web server. "web_private_IP" is the node object that represents the new Web site's private IP address. You enable all settings from Global Properties > NAT.
When you try to browse the Web server from the Internet, you see the error "page cannot be displayed". Which statements are possible reasons for this?
i) There is no route defined on the Security Gateway for the public IP address to the private IP address of the Web server.
ii) There is no Security Policy defined that allows HTTP traffic to the protected Web server.
iii) There is an ARP entry on the Gateway but the settings Merge Manual proxy ARP and Automatic ARP configuration are enabled in Global Properties. The Security Gateway ignores manual ARP entries.
iv) There is no ARP table entry for the public IP address of the protected Web server.
A. (i), (ii)
B. (iii)
C. (i), (ii), (iii), (iv)
D. (i), (ii), (iv)
正解：B

質問 6：
Which of the following is a viable consideration when determining Rule Base order?
A. Grouping rules by date of creation
B. Placing frequently accessed rules before less frequently accessed rules
C. Grouping IPS rules with dynamic drop rules
D. Adding SAM rules at the top of the Rule Base
正解：B

質問 7：
What is the bit size of a DES key?
A. 168
B. 112
C. 56
D. 64
正解：C

質問 8：
Which of the following actions do NOT take place in IKE Phase 1?
A. Each side generates a session key from its private key and peer's public key
B. Diffie-Hillman key is combined with the key material to produce the symmetrical IPsec key.
C. Peers agree on integrity method
D. Peers agree on encryption method
正解：B