Ccsa R70 Chapter 4

Front 1

In SmartDashboard, what tab represents includes the physical machines, and logical components such as dynamic objects and address ranges that make up your organization?

Back 1

Network Objects

Front 2

When creating objects, what must the System Administrator consider? (2)

Back 2

1. What are the physical and logical components that make up the org.

2. Who are the users and administrators and how should they be divided into groups.

Front 3

What are the 4 principal panes in SmartDashboard?

Back 3

Rule Base
Objects List
SmartMap
Objects Tree

Front 4

What does the Objects List display?

Back 4

current information for a selected object category

Front 5

What are the the Object Types? (6)

Back 5

Network
Services
Resources
Servers and OPSEC Applications
Users and Administrators
VPN Communities

Front 6

In what columns of the Rule Base are Network Objects generally used?

Back 6

Source, Destination, and Install On

Front 7

What is the graphical display of objects in the system called?

Back 7

SmartMap

Front 8

(T/F) Both physical and logical objects are displayed.

Back 8

False. Only physical

Front 9

What is the main view for adding, editing, and deleting objects?

Back 9

Objects Tree

Front 10

(T/F) Adding, editing, and deleting objects can be performed via menus, toolbars, and other views.

Back 10

True

Front 11

(T/F) You cannot clone host and network objects.

Back 11

False. Right click object, select clone, and enter a new name.

Front 12

The view in the Objects Tree that automatically places each object in a predefined logical category is:

Back 12

Classic View

Front 13

The view in the Object Tree that organizes objects by groups:

Back 13

Group View

Front 14

Which view of the Objects Tree pane opens by default?

Back 14

Classic View

Front 15

Which view of the Objects Tree is suggested for small to medium sized deployments?

Back 15

Classic View

Front 16

How are objects organized in Group View?

Back 16

By the group objects to which they belong.

Front 17

What are the Rule Base options related to Rules? (5)

Back 17

Add Rule (Top, Bottom, Above, Below)
Delete Rule
Disable Rule
Hide
Section Title

Front 18

What are the columns in the rule base?

Back 18

No., Name, Source, Destination, VPN, Service, Action, Track

Front 19

How do you track multiple rules in SmartView Tracker?

Back 19

Use the same name in the Name column for the rules you want to track

Front 20

What tracking option can require large amounts of free space?

Back 20

Account

Front 21

What are the two basic rules used by nearly all Security Gateway administrators?

Back 21

Stealth Rule
Cleanup Rule

Front 22

What is the basic rule that logs and drops all traffic that does not match a rule?

Back 22

Cleanup Rule

Front 23

What should the last rule in the Rule Base always be?

Back 23

Cleanup Rule

Front 24

What rule is used to prevent users from connecting directly to the Security Gateway?

Back 24

Stealth Rule

Front 25

The Stealth Rule should be the first rule with the following exceptions that should appear above the Stealth Rule: (3)

Back 25

Client Authentication
Encryption
Content Vectoring Protocol (CVP) rules

Front 26

What is duress?

Back 26

Interferes with capacity b/c it constitutes circumstances where you are not entering into the arrangement freely.

Front 27

How do you see implied rules in the rulebase?

Back 27

View > Implied Rules

Front 28

(with or without) Implicit rules appear ________ numbering, and explicit rules appear _________ numbering.

Back 28

without, with.

Front 29

How do you see implied rules in the rulebase?

Back 29

View > Implied Rules

Front 30

(with or without) Implicit rules appear ________ numbering, and explicit rules appear _________ numbering.

Back 30

without, with.

Front 31

(T/F) Implied rule traffic will not go over domain based VPNs.

Back 31

True

Front 32

The Gateway enforces two types of implicit rules that enable _______ connections and ________ packets.

Back 32

Control, outgoing

Front 33

The 3 options for implied rule placement in the rule base are:

Back 33

First
Last
Before Last

Front 34

What are the 3 types of control connections

Back 34

gateway specific traffic (logging, mgt, key exchange, etc)
IKE & RDP traffic
Communication with external servers (RADIUS, CVP, etc)

Front 35

How do you access Global Properties?

Back 35

Policy > Global Properties

Front 36

(T/F) If the cleanup rule is the last explicit rule, implied rules with a placement setting of last will still be enforced because they are implied.

Back 36

False. Rules listed after the cleanup rule will not be enforced.

Front 37

(T/F) Implied rules cannot be directly modified in the rule base.

Back 37

True

Front 38

How are implied rules modified?

Back 38

By editing the parameters of the Firewall Implied Rules page of the Global Properties window.

Front 39

How do you configure logging for implied rules?

Back 39

Click 'Log Implied Rules' in the Track section of the Firewall Implied Rules page of the Global Properties window.

Front 40

What is spoofing?

Back 40

When packets are altered such that they appear to be coming from a part of the network with higher access privileges.

Front 41

What does CP Anti-spoofing do?

Back 41

Verifies that packets are coming from, and going to, the correct interfaces on the Gateway.

Front 42

What is needed to properly configure ant-spoofing

Back 42

networks that are reachable forma particular interface need to be defined properly.

Front 43

What is suggested for anti-spoofing to be most effective? (2)

Back 43

It should be configured on all gateway interfaces.
Spoof tracking should be defined for interfaces.

Front 44

(T/F)Anti-spoofing rules are enforced before rules in the rule base.

Back 44

True

Front 45

Where do you configure anti-spoofing in SmartDashboard

Back 45

The Topology tab of the Interface Properties window.
Edit object > Topology > edit interface > Topology

Front 46

(T/F) Only managed objects are available for policy installation

Back 46

True

Front 47

Policy verification checks for: (2)

Back 47

Rules are consistent
No redundant rules

Front 48

What is the order rules are processed? (6)

Back 48

IP Spoofing/IP Options
First
Explicit
Before Last
Last
Implicit Drop (no logging)

Front 49

What are the 3 questions you should ask before creating a rule base?

Back 49

1. Which objects are in the network?
2. Which user permissions and auth schemes are needed?
3. Which services are allowed?

Front 50

(T/F) In general, the policy is enforced from top to bottom.

Back 50

True. Exception is when user auth is present.

Front 51

What is the general guideline with regard to restrictive and generalized rules?

Back 51

Most restrictive should be above generalized

Front 52

What are the first 2 rules you should add to a policy?

Back 52

Stealth and Cleanup

Front 53

What happens when the Reject action is used?

Back 53

A message is returned to the source address.

Front 54

What should be used if several versions of a security policy are needed, but the object database needs to stay the same?

Back 54

Policy Packages

Front 55

What is included in the Policy Package?

Back 55

Security, NAT, Desktop and QoS policy rules.

Front 56

What allows you to associate each Policy Package with the appropriate set of Gateways?

Back 56

Predefined installation targets.

Front 57

What allows you to visually break your rule base into subjects?

Back 57

Section Titles

Front 58

What tool provides versatile search capabilities for both objects and the rules in which they are used?

Back 58

Queries

Front 59

(T/F) Global properties can change for different Policy Packages.

Back 59

False

Front 60

(T/F) Using File > Save as is the suggested method for backing up a Policy Package prior to modifying it.

Back 60

False. Database Revision Control feature is the suggested method.

Front 61

What is used to set the component selection for a given Policy Package, eliminating the need to repeat the selection each time policy is installed?

Back 61

Installation Targets.

Front 62

Where can rule base queries be used? (4)

Back 62

Security, Desktop, QoS, and Web access rule bases.

Front 63

(T/F) Rules that do not match a query are hidden, but they are still enforced.

Back 63

True

Front 64

How do you set a rule base query clause to be an "OR" clause?

Back 64

Choose more than one item in the list, and verify that "at least one" is selected in the Clause Statement.

Front 65

How do you set a rule base query clause to be an "AND" clause?

Back 65

Choose more than one item in the list, and verify that "all" is selected in the Clause Statement.

Front 66

How do you set a rule base query clause to be an "NOT" clause?

Back 66

Choose at least one item in the list, and verify that "Negate" is checked.

Front 67

Is it true that the default rule base query matches "any" and groups if the selected item is included in the group? If so, can that be disabled?

Back 67

Yes. Yes.
You can disable the default behavior by choosing Explicit in the Query Clause.

Front 68

What are the steps for opening a Network Object query?

Back 68

Search > Query Network Objects

Front 69

What are the steps for opening a rule base query?

Back 69

Search > Query Network Objects
Right click a column and choose Query.

Front 70

(T/F) You cannot create a group using the Network Object query function.

Back 70

False. After clicking apply, click "Define query results as group"

Front 71

What are the 3 options for sorting in the Object Tree and Object List panes?

Back 71

Type
Name
Color

Front 72

What is included when using Database Revision Control to backup your policies?

Back 72

All Policies, objects, users, global properties, and SmartDefense settings.

Front 73

(T/F) You can create a database-revision entry with unsaved changes in SmartDashboard

Back 73

False

Front 74

(T/F) You can configure SmartDashboard to create a database-revision entry whenever policy is pushed.

Back 74

True

Front 75

NAT is defined in what RFC?

Back 75

3022

Front 76

What are the main reasons enterprises employ NAT?

Back 76

Private IP addresses used in internal networks.
Limiting external network addresses.
Ease and flexibility of network administration.

Front 77

(T/F) Network Address Translation can be used to translate either IP address in a connection

Back 77

True

Front 78

In NAT, translating the "client" address initiating a connection is called:

Back 78

Source NAT

Front 79

In NAT, translating the address of the machine receiving the connection is called:

Back 79

Destination NAT

Front 80

What type of NAT is a many-to-one relationship?

Back 80

Hide NAT

Front 81

What type of NAT has multiple hosts represented by a single IP address?

Back 81

Hide NAT

Front 82

What is another name for Hide NAT?

Back 82

Dynamic NAT

Front 83

What type of NAT is a one-to-one relationship?

Back 83

Static NAT

Front 84

What is the effect of a withdrawal of a partner?

Apparent Authority?

Back 84

The partnership usually buys out the partner for fair value and continues without her. A withdrawing partner is liable to existing creditors unless released, for 2 years to subsequent creditors who reasonably believed that she was a partner and were unaware of the withdrawal, and to other partners if the withdrawal was wrongful.

Apparent Authority of Withdrawn Partner - For one year after withdrawal to a 3P who was unaware of the withdrawal. But the Partnership can protect itself by notifying potential creditors of the withdrawal

Front 85

In CP, what kinds of objects can NAT be configured on? (5)

Back 85

Hosts, nodes, networks, address ranges, and dynamic objects.

Front 86

What does Static NAT allow?

Back 86

Connections can be initiated internally or externally.

Front 87

What do Manual NAT rules allow? (2)

Back 87

Translation of both source and destination.
Translation of services.

Front 88

What are the Class A private network addresses?

Back 88

10.0.0.0 - 10.255.255.255

Front 89

What are the Class B private network addresses?

Back 89

172.16.0.0 - 172.31.255.255

Front 90

What are the Class C private network addresses?

Back 90

192.168.0.0 - 192.168.255.255

Front 91

Which address is hide NAT is translated?

Back 91

source

Front 92

In the i, I, o, O series where is the packet processed by the firewall kernel?

Back 92

between i and I and between o and O.

Front 93

For a server side translation, where does the translation occur? (i, I, o, O)

Back 93

O

Front 94

What CLI command is used to view packets on the gateway?

Back 94

fw monitor

Front 95

How does the Gateway handle packets from overlapping IP networks coming from different interfaces?

Back 95

Packets are translated to a virtual IP network and then translated back to their original address when leaving the Gateway.

Front 96

What was required when server side translation was the default for destination NAT?

Back 96

a host route to route packets to the desired server.

Front 97

Since NGX what is the default NAT method for Destination NAT? (client side/server side)

Back 97

client side

Front 98

For a client side translation, where does the translation occur? (i, I, o, O)

Back 98

I

Front 99

For Static NAT defaults in R70, the original packet has the destination translated at ___ and the reply packet has the source translated at____.

Back 99

I, O

Front 100

What type of NAT should not be used if the port number cannot be changed?

Back 100

Hide NAT

Front 101

When an external server must distinguish between clients based on their IP address, what type of NAT should be used?

Back 101

Static

Front 102

What type of NAT should be used if connections must be initiated from external sources?

Back 102

Static

Front 103

In Hide NAT, it is possible to hide behind: (2)

Back 103

interface of the gateway
specified IP address

Front 104

What is the the benefit of using the Gateway address for hide NAT?

Back 104

If the external IP address changes then the NAT rules do not need to be changed.

Front 105

In what 3 areas can NAT be configured?

Back 105

Global Properties
Object Properties
Address-translation rules

Front 106

What is the global NAT setting that configures Gateways to check all NAT rules to see if there is a source match in one rule and a destination match in another and applies both concurrently?

Back 106

Allow bi-directional NAT

Front 107

What is the global NAT setting that forces the translation of destination IP addresses in the kernel nearest the client.

Back 107

Translate Destination on the client side.

Front 108

What is the global NAT setting that automatically updates ARP tables on Security Gateways so they accept packets whose destination addresses differ from the addresses configured on its interfaces?

Back 108

Automatic ARP configuration

Front 109

What ARP setting in Global Properties configures gateways to maintain the definitions of both the local.arp file and entries related to Automatic ARP configuration?

Back 109

Merge manual proxy ARP

Front 110

What happens if Automatic ARP configuration is enabled and Merge manual proxy ARP is not enabled?

Back 110

Gateways ignore the entries in the local.arp file.

Front 111

What happens if Automatic ARP configuration and Merge manual proxy ARP are enabled and there is conflict?

Back 111

The manual configuration is used.

Front 112

(T/F) All boxes for NAT Global Properties are check by default in new istallations.

Back 112

True

Front 113

(T/F) All boxes for NAT Global Properties are unchecked by default when upgrading from FW-1 4.1 or earlier.

Back 113

True

Front 114

What are the 2 elements of address-translation rules?

Back 114

Original packet and translated packet.

Front 115

What is the purpose of the original packet element of address-translation rules?

Back 115

To identify which packets match a rule.

Front 116

What is the purpose of the translated packet element of address-translation rules?

Back 116

To define how the Gateway will modify the packets.

Front 117

What rules are created when a object is configured for automatic Hide NAT?

Back 117

1. Prevents translation of packets traveling from the translated object to itself.
2. Translates packets from private addresses to the IP address of the exiting interface (or configured IP)

Front 118

(T/F) Automatic hide NAT requires a 3rd rule for reply packets.

Back 118

False

Front 119

For Automatic Hide NAT, what is used to modify the destination IP address and destination port of reply packets?

Back 119

The Gateway's state tables.

Front 120

What is the best practice regarding external IP addresses for Hide NAT?

Back 120

The NAT IP should not be the interface IP.

Front 121

(T/F) The Hide or Static NAT address should be on the same subnet as the interface IP.

Back 121

True

Front 122

(T/F) The address-translation rules added for automatic Static NAT are the same as for Hide NAT.

Back 122

False. Both rules are translating rules in automatic Static NAT.

Front 123

For Automatic Hide NAT, what is used to modify the destination IP address and destination port of reply packets?

Back 123

The Gateway's state tables.

Front 124

What is the best practice regarding external IP addresses for Hide NAT?

Back 124

The NAT IP should not be the interface IP.

Front 125

(T/F) The Hide or Static NAT address should be on the same subnet as the interface IP.

Back 125

True

Front 126

(T/F) The address-translation rules added for automatic Static NAT are the same as for Hide NAT.

Back 126

False. Both rules are translating rules in automatic Static NAT.

Front 127

Are you going to study page 208?

Back 127

YUP!

Front 128

What is the only global property for Manual NAT rules?

Back 128

Translate destination on client side

Front 129

What must be considered when creating a manual NAT rule? (3)

Back 129

Anti-spoofing issues.
ARP entries
routing-table entries

Front 130

What ARP table editing must be done for HIDE NAT, Security Gateway in Translated Pack Source Field?

Back 130

None

Front 131

What ARP table editing must be done for HIDE NAT hiding being an adress not assigned to the Security Gateway?

Back 131

Add ARP table entry for the hiding address.

Front 132

What ARP table editing must be done for Static NAT?

Back 132

Add ARP table entry for all hiding addresses.

Front 133

As long as ____________________ is implemented, no ant-spoofing issues exist with Manual NAT rules.

Back 133

client-side translation

Front 134

(T/F) If client-side translation is not implemented for Manual NAT Rules, traffic flow should be used to determine which IP addresses will be seen on which interfaces to properly configure anti-spoofing.

Back 134

True

Front 135

Where can an administrator configure a list of multicast address ranges to accept or drop?

Back 135

The Multicast Restrictions tab in the Interface Properties window.

Front 136

(T/F) A rule is required in the rule base to allow configured multicast groups.

Back 136

True