CheckPoint Check Point Security Administration NGX II (156-315.1) Sample Questions:

1. You want only RAS signals to pass through H.323 Gatekeeper and other H.323 protocols, passing directly between end points. Which routing mode in the VoIP Domain Gatekeeper do you select?

A) Direct
B) Call Setup
C) Call Setup and Call Control
D) Direct and Call Setup

2. Stephanie wants to reduce the encryption overhead and improve performance for her mesh VPN Community. The Advanced VPN Properties screen below displays adjusted page settings:What can Stephanie do to achieve her goal?

A) Reduce the setting "Renegotiate IKE security associations every" to "720".
B) Check the box "Support IP compression".
C) Check the box "Use Perfect Forward Secrecy".
D) Change the setting "Use Diffie-Hellman group" to "Group 5 (1536 bit)".
E) Check the box "Use aggressive mode".

3. You want to upgrade a cluster with two members to VPN-1 NGX. The SmartCenter Server and both members are version VPN-1/FireWall-1 NG FP3, with the latest Hotfix. What is the correct upgrade procedure?
1. Change the version, in the General Properties of the gateway-cluster object.
2. Upgrade the SmartCenter Server, and reboot after upgrade.
3. Run cpstop on one member, while leaving the other member running. Upgrade one member at a time, and reboot after upgrade.
4. Reinstall the Security Policy.

A) 1, 2, 3, 4
B) 1, 3, 2, 4
C) 2, 4, 3, 1
D) 3, 2, 1, 4
E) 2, 3, 1, 4

4. You must set up SIP with a proxy for your network. IP phones are in the 172.16.100.0 network. The Registrar and proxy are installed on host 172.16.100.100. To allow handover enforcement for outbound calls from SIP-net to network Net_B on the Internet, you have defined the following objects:
Network object: SIP-net: 172.16.100.0/24
SIP-gateway: 172.16.100.100
VoIP Domain object: VoIP_domain_A
1.End-point domain: SIP-net
2.VoIP gateway installed at: SIP-gateway host object
How would you configure the rule?

A) SIP-Gateway/Net_B/sip_any/accept
B) VoIP_domain_A/Net_B/sip_any/accept
C) VoIP_domain_A/Net_B/sip_any, and sip/accept
D) SIP-Gateway/Net_B/sip/accept
E) VoIP_Gateway_A/Net_B/sip/accept

5. You want to block corporate-internal-net and localnet from accessing Web sites containing inappropriate content. You are using WebTrends for URL filtering. You have disabled VPN-
1 Control connections in the Global properties. Review the diagram and the Security Policies for GW_A and GW_B in the exhibit provided.
Corporate users and localnet users receive message "Web cannot be displayed". In SmartView Tracker, you see the connections are dropped with message "content security is not reachable". What is the problem, and how do you fix it?

A) The connection from GW_B to the WebTrend server is not allowed in the Policy.
Fix: Add a rule in GW_B's Policy with Source GW_B, destination WebTrends server, service TCP port 18182, and action accept.
B) The connection from GW_B to the internal WebTrends server is not allowed in the Policy.
Fix: Add a rule in GW_A's Policy to allow source WebTrends Server, destination GW_B, service TCP port 18182, and action accept.
C) The connection from GW_A to the WebTrends server is not allowed in the Policy.
Fix: Add a rule in GW_A's Policy to allow source GW_A, destination WebTrends server, service TCP port 18182, and action accept.
D) The connection from GW_A to the WebTrends server is not allowed in the Policy.
Fix: Add a rule in GW_B's Policy with source GW_A, destination: WebTrends server, service TCP port 18182, and action accept.
E) The connection from GW_A to the WebTrends server is not allowed in the Policy.
Fix: Add a rule in GW_B's Policy with source WebTrends server, destination GW_A, service TCP port 18182, and action accept.

Solutions: