Ccsa R70 Chapter 5

Front 1

What provides visual tracking, monitoring, and accounting information for all connections logged by Check Point components?

Back 1

SmartView Tracker

Front 2

What is the API for exporting Security Gateway log data to other applications, such as spreadsheets or databases?

Back 2

Log Export Application (LEA)

Front 3

(T/F) Reporting and event-analysis applications are available from multiple OPSEC partners.

Back 3

True

Front 4

What types of logs are defined in SmartView Tracker? (2)

Back 4

Predefined
Custom

Front 5

What are the 3 SmartView Tracker tabs?

Back 5

Network & Endpoint
Active
Management

Front 6

What SmartView Tracker tab displays the default view and shows all security related events?

Back 6

Network & Endpoint

Front 7

What SmartView Tracker tab displays currently open connections?

Back 7

Active

Front 8

(T/F) Switching to Active mode will not have an effect on system resource utilization.

Back 8

False.

Front 9

What SmartView Tracker tab displays changes made to objects in the rule base and tracks general SmartDashboard use?

Back 9

Management

Front 10

(T/F) When using 'Save Log File As' only records that match the selection criteria (visible and non-visible) will be saved to the files.

Back 10

True

Front 11

In Tracker, when you create a new log file using the current file is _________ and ________________ with a name that includes the ____________ and __________.

Back 11

Closed
Written to disk
Current time
Current date

Front 12

How many log files can be open in Tracker at a time?

Back 12

one

Front 13

What is the default log file path and name for log mode?

Back 13

$FWDIR/log/fw.log

Front 14

What is the default log file path and name for audit mode?

Back 14

$FWDIR/log/fwadt.log

Front 15

How do you configure a name other the default name for a log?

Back 15

Clear the default box and specify a new name.

Front 16

On the Tracker toolbar, which option will allow you to transfer log files from a remote machine to the current machine?

Back 16

Remote Files Management

Front 17

On the Tracker toolbar, which option toggles the display of the Files Fetch Progress Window?

Back 17

Show or hide Fetch Progress

Front 18

On the Tracker toolbar, what can you do by selecting Query Options? (4)

Back 18

Toggle the dispolay of the query tree pane.
Open an existing query
Save a custom query
Save a custom query under a new name

Front 19

What format are log entries saved as when using the File > Export?

Back 19

*.txt

Front 20

In Tracker, how do you delete all entries in the log file regardless of which entries are selected.

Back 20

File > Purge Active File

Front 21

What are some of the entries you will find in Administrator Auditing? (6)

Back 21

Administrator login, administrator logout, Object creation, object deletion, object editing, and changes in the rule base.

Front 22

(T/F) Using the Management Tab in Tracker, it is not possible see changes made by a specific administrator.

Back 22

False

Front 23

(T/F) Using the Management Tab in Tracker, it is possible to see who modified an object and what changes were made.

Back 23

True

Front 24

Where can the Global Properties - Log and Alert window be found?

Back 24

Policy > Global Policies > Log and Alert

Front 25

allez-vous d'étudier les options à partir de la page 229?

Back 25

Oui!

Front 26

What specifies the minimum amount of time between successive logs of similar packets?

Back 26

Excessive log grace period.

Front 27

What aspects of "similar" packets are the same? (5)

Back 27

Source address, source port, destination address, destination port, and protocol.

Front 28

How do you change the frequency with which the SMS queries Check Point Gateways for status information?

Back 28

Policy > Global Properties > Log and Alert > Time Settings > Status Fetching Interval

Front 29

What function in Tracker do you use to terminate an active connection and block further connections from and to specific IP addresses?

Back 29

Block Intruder

Front 30

What Tracker mode must you be in to terminate and block active connections?

Back 30

Active Mode

Front 31

How do you block an active connection with Block Intruder?

Back 31

Active Mode > Select Connection > Tools > Block Intruder

Front 32

What are the 3 options for Blocking Scope in the Block Intruder tool?

Back 32

Block all connections with the same source, destination, and service.
Block access from this source
Block access to this destination

Front 33

What are the 2 options for Blocking Timeout in the Block Intruder tool?

Back 33

Indefinite
For <#> minutes

Front 34

What are the 2 options for the "Force this blocking" field in the Block Intruder tool?

Back 34

Only on <gateway>
On any Security Gateway

Front 35

How do you unblock a connection in Tracker?

Back 35

Tools > Clear Blocking

Front 36

What provides a single, central interface for monitoring network activity, and performance of Check Point applications?

Back 36

SmartView Monitor

Front 37

(T/F) SmartView Monitor is not capable of custom views.

Back 37

False

Front 38

What protocol does the Management Server use to collect information about specific gateways that are installed?

Back 38

Application Monitoring (AMON)

Front 39

In the collection of status information for Monitor's Gateway Status View the __________ is the client and the __________ is the server.

Back 39

Management Server
Gateway

Front 40

What do System Counters provide in Gateway Status View?

Back 40

in-depth details on Gateway use and activity.

Front 41

What can you generate system status information about in Gateway Status View? (3)

Back 41

Resource user
Gateway performance statistics
Detect & monitor suspicious activity

Front 42

What are some of the things that can be monitored in Monitor's Tunnels View? (3)

Back 42

Tunnel Status
VPN Community
Gateways associated with a tunnel

Front 43

(T/F) Monitor recognizes tunnel malfunctions and connectivity problems by constantly monitoring and analyzing the status of an organization's tunnels.

Back 43

True

Front 44

In Monitor's Tunnels View, what are used to generate fully detailed reports that include information about all tunnels that fulfill specific conditions?

Back 44

Tunnel queries

Front 45

What Monitor view is uses to keep track of VPN remote users currently logged in?

Back 45

Remote Users View

Front 46

Which Monitor view utilizes the Integrity Server compliance capability to verify connections arriving from various hosts across the internal network?

Back 46

Cooperative Enforcement

Front 47

(T/F) Cooperative enforcement does not test all hosts initiating a connection for compliance.

Back 47

False

Front 48

Where can you view logs related to Cooperative Enforcement that are generated for both authorized or unauthorized hosts?

Back 48

SmartView Monitor

Front 49

What are security rules that enable the administrator to instantly block suspicious connections that are not restricted by the currently enforced security policy?

Back 49

Suspicious Activity Rules

Front 50

(T/F) Suspicious Activity Rules require a policy push to be enforced.

Back 50

False

Front 51

What is the path of a Monitor alert? (3)

Back 51

Gateway > SMS > SmartView Monitor (SmartConsole)

Front 52

Under what conditions are alerts sent?

Back 52

When traffic matches a rule with Alert is set as the Action.
When a system event surpasses a configured threshold.

Front 53

(T/F) Administrators can define alerts to be sent for different gateways

Back 53

True

Front 54

What is the default location for an alert to be sent?

Back 54

SmartView Monitor on the admin's desktop.

Front 55

(T/F) It is possible to define alerts for QoS that would not apply to Connectra

Back 55

True

Front 56

(T/F) Alerts can be Global or per Gateway.

Back 56

True

Front 57

SmartView Monitors gathers status information about Check Point objects and __________.

Back 57

OPSEC objects

Front 58

After reviewing the status of certain clients in Monitor you decide to take decisive action for a client or cluster member. What are your choices? (2)

Back 58

Disconnect client
Start/Stop Cluster Member

Front 59

How do you start or stop a cluster member in Monitor?

Back 59

Right click the object and choose stop or start member

Front 60

Where do you configure alerts in SmartDashboard?

Back 60

Policy > Global Properties > Log and Alerts > Alert Commands

Front 61

How do you view active alerts in Monitor?

Back 61

Tools > Alerts

Front 62

(T/F) Studying the scenarios on 248 will give you a better perspective.

Back 62

True

Front 63

(Tracker/Monitor) What would be used to endure network components are operating properly

Back 63

Tracker (That's what the book says. I disagree)

Front 64

(Tracker/Monitor) What would be used to troubleshoot system and security (rules) issues.

Back 64

Tracker

Front 65

(Tracker/Monitor) What would be used to gather information for legal or audit purposes.

Back 65

Tracker

Front 66

(Tracker/Monitor) What would be used to generate reports to analyze network-traffic patterns.

Back 66

Tracker

Front 67

(Tracker/Monitor) What would be used to temporarily or permanently terminate connections form specific IP addresses.

Back 67

Tracker

Front 68

(Tracker/Monitor) What would be used to centrally view Check Point and OPSEC devices

Back 68

Monitor

Front 69

(Tracker/Monitor) What would be used to present a complete picture of changes to gateways, tunnels, remote users, and security activities.

Back 69

Monitor

Front 70

(Tracker/Monitor) What would be used to immediately identify changes in traffic flow patterns that may signify malicious activity.

Back 70

Monitor

Front 71

(Tracker/Monitor) What would be used to maintain high network availability?

Back 71

Monitor

Front 72

(Tracker/Monitor) What would be used to improve efficiency of bandwidth use.

Back 72

Monitor

Front 73

(Tracker/Monitor) What would be used to track SLA compliance

Back 73

Monitor