Online Access Free 156-215.71 Practice Test

Which of these attributes would be critical for a site-to-site VPN?

• A.Strong authentication
• B.Scalability to accommodate user groups
• C.Strong data encryption
• D.Centralized management

What is a Stealth rule used for?

• A.To permit implied rules
• B.To drop all traffic to the management server that is not explicitly permitted
• C.To prevent users from connecting directly to the gateway
• D.To permit management traffic

The customer has a small Check Point installation which includes one Windows XP workstation as the SmartConsole, one Solaris server working as Security Management Server, and a third server running SecurePlatform as Security Gateway. This is an example of a(n):

• A.Distributed Installation.
• B.Unsupported configuration
• C.Hybrid Installation.
• D.Stand-Alone Installation.

An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R70 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every 1 minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.
Which of the following is the BEST explanation for this behavior?

• A.The Log Server is failing to log GRE traffic property because it is VPN traffic. Disable all VPN configurations to the partner site to enable proper logging.
• B.The setting Log does not capture this level of details for GRE Set the rule tracking a action to audit since certain types of traffic can only tracked this way.
• C.The log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt. Because it is encrypted, the R71 Security Gateway cannot distinguish between GRE sessions. This is a known issue with the GRE. Use IPSEC instead of the non GRE protocol for encapsulation.
• D.The Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.

For VPN routing to succeed, what must be configured?

• A.No rules need to be created; implied rules that cover inbound and outbound traffic on the central (HUB) Gateway are already in place from Policy > Properties > Accept VPN-1 Control Connections.
• B.VPN routing is not configured in the Rule Base or Community objects. Only the native-routing mechanism on each Gateway can direct the traffic via its VTI configured interfaces.
• C.A single rule in the Rule Base must cover all traffic on the central (HUB) Security Gateway for the VPN domain.
• D.At least two rules in the Rule Base must be created, one to cover traffic inbound and the other to cover traffic outbound on the central (HUB) Security Gateway.