CheckPoint 156-315 問題集

質問 1：
The following rule contains an FTP resource object in the Service field:
Source: local_net
Destination: Any
Service: FTP-resource object
Action: Accept
How do you define the FTP Resource Properties > Match tab to prevent internal users from sending corporate files to external FTP servers, while allowing users to retrieve files?
A. Disable the "Put" method globally.
B. Disable "Get" and "Put" methods on the Match tab.
C. Enable the "Put" and "Get" methods.
D. Enable the "Get" method on the match tab.
E. Enable the "Put" method only on the match tab.
正解：D

質問 2：
How does ClusterXL Unicast mode handle new traffic?
A. All members receive all packets. The SmartCenter Server decides which member will process the packets. Other members simply drop the packets.
B. All cluster members process all packets, and members synchronize with each other.
C. The pivot machine receives and inspects all new packets, and synchronizes the connections with other members.
D. Only the pivot machine receives all packets. It runs an algorithm to determine which member should process the packets.
正解：D

質問 3：
The following configuration is for VPN-1 NGX:Is this configuration correct for Management High Availability (HA)?

A. No, A VPN-1 NGX SmartCenter Server can only be in a Management HA configuration, if the operating system is Solaris.
B. No, a VPN-1 NGX SmartCenter Server cannot run on Red Hat Linux 7.3.
C. No, the SmartCenter Servers must be installed on the same operating system.
D. No, the SmartCenter Servers must reside on the same network.
E. No, the SmartCenter Servers do not have the same number of NICs.
正解：C

質問 4：
You want only RAS signals to pass through H.323 Gatekeeper and other H.323 protocols, passing directly between end points. Which routing mode in the VoIP Domain Gatekeeper do you select?
A. Call Setup
B. Direct
C. Direct and Call Setup
D. Call Setup and Call Control
正解：B

質問 5：
Problems sometimes occur when distributing IPSec packets to a few machines in a Load Sharing Multicast mode cluster, even though the machines have the same source and destination IP addresses. What is the best Load Sharing method for preventing this type of problem?
A. Load Sharing based on IP addresses, ports, and serial peripheral interfaces (SPI)
B. Load Sharing based on SPIs and ports only
C. Load Sharing based on IP addresses and ports
D. Load Sharing based on IP addresses only
E. Load Sharing based on SPIs only
正解：C

質問 6：
After you add new interfaces to this cluster, how can you check if the new interfaces and associated virtual IP address are recognized by ClusterXL?

A. By running the cpconfig command on both members
B. By running the fw ctl iflist command on both members
C. By running the cphaprob state command on both members
D. By running the cphaprob -I list command on both members
E. By running the cphaprob -a if command on both members
正解：E

質問 7：
If you check the box "Use Aggressive Mode", in the IKE Properties dialog box:
A. The standard six-packet IKE Phase 1 exchange is replaced by a three-packet exchange.
B. The standard six-packet IKE Phase 2 exchange is replaced by a three-packet exchange.
C. The standard three-packet IKE Phase 2 exchange is replaced by a six-packet exchange.
D. The standard three-packet IKE Phase 1 exchange is replaced by a six-packet exchange.
E. The standard six-packet IKE Phase 1 exchange is replaced by a twelve-packet exchange.
正解：A

質問 8：
Barak is a Security Administrator for an organization that has two sites using pre-shared secrets in its VPN. The two sites are Oslo and London. Barak has just been informed that a new office is opening in Madrid, and he must enable all three sites to connect via the VPN to each other. Three Security Gateways are managed by the same SmartCenter Server, behind the Oslo Security Gateway. Barak decides to switch from pre-shared secrets to Certificates issued by the Internal Certificate Authority (ICA). After creating the Madrid gateway object with the proper VPN Domain, what are Barak's remaining steps?
1.Disable "Pre-Shared Secret" on the London and Oslo gateway objects.
2.Add the Madrid gateway object into the Oslo and London's mesh VPN Community.
3.Manually generate ICA Certificates for all three Security Gateways.
4.Configure "Traditional mode VPN configuration" in the Madrid gateway object's VPN screen.
5.Reinstall the Security Policy on all three Security Gateways.
A. 1,2,4,5
B. 1,3,4,5
C. 1, 2,3,4
D. 1,2,3,5
E. 1, 2, 5
正解：E