Ccse Ngx Ch. 6 - Remote Access Vpns

Front 1

What three things does SecuRemote/SecureClient guarantee when connected via a VPN tunnel?

Back 1

Authenticity, by using standard authentication methods
Privacy, by encrypting data
Integrity, by using industry-standard integrity-assurance methods

Front 2

T/F - SecuRemote works with UTM Edge Gateways

Back 2

True

Front 3

In regards to Security, in what three ways does SecureClient extend on SecuRemote?

Back 3

Desktop Security Policy
Logging and alerts
Secure Configuration Verification

Front 4

In regards to Connectivity, in what three ways does SecureClient extend on SecuRemote?

Back 4

Office Mode addresses
Visitor Mode
Hub Mode

Front 5

In regards to Management, in what three ways does SecureClient extend on SecuRemote?

Back 5

Automatic software distribution
Advanced packaging-and-distribution options
Diagnostic tools

Front 6

In Remote Access VPN, what is Connect Mode?

Back 6

During Connect Mode, the remote user deliberately initiates a VPN link to a specific gateway. Subsequent connections to any host behind other gateways will transparently initiate additional VPN links, as required.

Front 7

What five Modes/features does Connect Mode offer?

Back 7

Office Mode
Visitor Mode (over TCP 443)
Hub Mode
Auto connect - user is prompted to initiate a VPN link when traffic is destined behind the gateway
User profiles (Location Profiles)

Front 8

What is the basic purpose of Office Mode?

Back 8

Office Mode enables a VPN-1 Gateway to assign a remote client an IP address.

Front 9

When does a user receive an IP address from Office Mode?

Back 9

After the user connects and authenticates.

Front 10

From what types of pools can Office Mode IP addresses come from?

Back 10

A general IP pool or from an IP pool specified per user group.

Front 11

T/F - Office Mode can be enabled for specific user groups

Back 11

true

Front 12

With which of the following is Office Mode supported?
SecureClient
SSL Network Extender
Crypto
L2TP

Back 12

all of them

Front 13

T/F - A remote user with only SecuRemote is supported in Office Mode

Back 13

False, Office Mode is only supported in SecureClient

Front 14

In Office Mode planning, what would be a reason to choose DHCP instead of IP pool?

Back 14

Some administrators may perfer to manage all of their dynamic IP addresses from the same location. Moreover, DHCP allows a cluster to assign all the addresses from a single pool, rather than have a different pool per cluster member as you have to with gateway IP pools.

Front 15

In Office Mode planning, what would be a reason to choose IP pool over DHCP?

Back 15

Purchasing a DHCP server can be viewed by some as an unnecessary financial burden.

Front 16

What routing table modification must be made when implementing Office Mode?

Back 16

IP addresses assigned by Office Mode need to be routed by the internal LAN routers to the gateway that assigned the address. This is to make sure packets, destined to remote-access Office Mode users, reach the gateway to be encapsulated and returned to the client machine.

Front 17

In Office Mode, under what conditions might you have to enable the Multiple External Interfaces option?

Back 17

The gateway has multiple external interfaces and Office Mode packets are routed to the wrong external interface.

Front 18

When is a list of Policy Servers downloaded to a SecureClient machine?

Back 18

When a user creates a site in SecureClient

Front 19

When is a policy downloaded to SecureClient from a Policy Server?

Back 19

When the SecureClient machine connects to the site

Front 20

The Desktop Security Policy is only valid for a certain period of time. When does the remote client query the Policy Server for a renewal/update?

Back 20

After half the period set has elapsed (222)

Front 21

During a Desktop Secure Policy update, what files are being uploaded to the Policy Server?

Back 21

Mobile user log files

Front 22

How can SecureClient be manually prepackaged to include a default Policy?

Back 22

Open the SecureClient tar.gz file. Place the Policy files (local.scv, local.dt, local.lp, etc.) in the tar.gz directory. Specify initialpolicy.bat in the install section of product.ini. Repackage the client using the packaging tool (or running setup from the tar.gz). Install SecureClient from the generated package/tar.gz directory. The policy becomes active when the client is started for the first time.

Front 23

How do you activate Policy Server High Availability?

Back 23

Set the use_profile_ps_configuration option as true in the userc.c file

Front 24

How is Wireless Hotspot/Hotel Registration restricted?

Back 24

By time, number of IP addresses, and ports. SecureClient records the IP addresses and ports that were accessed during the registration phase.

Front 25

What method does SecureClient Mobile use to enable handheld devices to securely access resources behind Check Point Gateways?

Back 25

SSL (HTTPS) tunneling

Front 26

What two modes of operation does SecureClient Mobile support?

Back 26

Centrally Managed Mode and SSL Network Extender Mode.

Front 27

What does SecureClient Mobile's Centrally Managed Mode do?

Back 27

Client connects to a gateway configured for SecureClient Mobile, and downloads a set of Policies that were sent to the gateway from the SmartCenter Server.

Front 28

How does SecureClient Mobile's SSL Network Extender Mode differ from Centrally Managed Mode?

Back 28

In this mode, the client does not download Policies, but enforces a set of Policies predefined upon client installation.

Front 29

In what two ways can VPN Routing be configured?

Back 29

Directly through SmartDashboard or by editing the VPN routing configuration files on the gateways.

Front 30

What Mode enables VPN routing for remote access clients?

Back 30

Hub Mode

Front 31

How does Hub Mode work?

Back 31

In Hub mode, all traffic is directed through a central hub. The central hub acts as a kind of router for the remote client. Once traffic from the remote access clients is directed through a hub, connectivity with other clients is possible, as well as the ability to inspect the subsequent traffic for content.

Front 32

Why should you enable Office Mode when using Hub Mode?

Back 32

If the remote client is using an IP address supplied by an ISP, this address might not be fully routable.

Front 33

In addition to the usual requirements of remote access clients, what are three special demands users accessing the organization from remote locations?

Back 33

Connectivity - must be able to access the organization from various locations, even if behind a NAT, proxy, or security gateway.

Secure connectivity - guaranteed by the combination of authentication, confidentiality, and data integrity for every connection

Usability - installation must be easy. No configuration should be required as a result of network modification; should be seamless for the connecting user

Front 34

In regards to installation and configuration, what are some advantages to SSL Network Extender?

Back 34

Thin client installation - much smaller size
Server-side configuration only
Downloaded as an ActiveX component
Easier to deploy newer versions

Front 35

T/F - To enable connectivity for clients using SSL Network Extender, VPN-1 must be configured to support SecuRemote/SecureClient

Back 35

true

Front 36

What are the two ways to install SSL Network Extender from a browser?

Back 36

ActiveX or the Java Applet

Front 37

What are four SSL Network Extender server-side prerequisites?

Back 37

SNX must be enabled on the gateway

The specific gateway must be configured as a member of the Remote Access Community

The same access rules are configured for both SecureClient and SNX users

If you want to use Integrity Clientless Security (ICS), you shoudl install the ICS server or ICS configuration tool

Front 38

Which VPN-1 authentication schemes are supported in SNX?

Back 38

all of them

Front 39

At the end of the SNX session, what information about the user or gateway remains on the client machine?

Back 39

none

Front 40

What logging capabilities differ between SNX and SecureClient?

Back 40

none

Front 41

T/F - SSL Network Extender is supported in IPSO

Back 41

true

Front 42

T/F - SNX supports Hub Mode

Back 42

true

Front 43

What are the two clear phases of Clientless VPN?

Back 43

Establishing a Secure Channel and Communication Phase

Front 44

T/F - User Authentication is supported in Clientless VPN

Back 44

true

Front 45

What is invoked by the gateway to handle Clientless VPN connections?

Back 45

The Clientless VPN Security Server daemon. It continues to run as a background process.

Front 46

What takes place in the Communication Phase of Clientless VPN?

Back 46

The VPN Security Server opens a connection to the Web server. The client connects to the server via the VPN-1 gateway. From now on, all connections from the client to the gateway are encrypted.

Since the gateway now sees the packet int he clear, it can be inspected for content.

Front 47

What are three special considerations for Clientless VPN?

Back 47

Which Certificate does the gateway present?

How many Security Servers should be run?

What level of encryption is required?

Front 48

What must be done by the administrator if he chooses to present a certificate from an external CA in Clientless VPN?

Back 48

Obtain the CA certificate
Configure the SmartCenter Server to trust this CA
Obtain and configure a certificate for the gateway
Supply the CA certificate to the client

Instruct the user to configure the client to trust this CA

Front 49

How many Security Servers can be run on a single gateway?

Back 49

10

Front 50

Up to how many active users does Check Point recommend to use each VPN Security Server?

Back 50

Up to 150 active users

Front 51

For the most part, Clientless VPN is configured on the gateway. What are two exceptions, and how are they configured?

Back 51

1) The gateway authenticates itself to the client using a certificate that is not one of the client's default certificates.

2) User Authentication via certificates is required.

In both cases, the relevant certificates must be supplied to the client out-of-band and the client configured to work with them

Front 52

What must be done in the Rule Base to allow Clientless VPN when User Authentication is not required?

Back 52

A URI resource must be defined in the Rule to force the Security Server to be employed on every connection

Front 53

What 3 things does a VPN guarantee?

Back 53

Authenticity
Privacy
Integrity

Front 54

How are users managed for SecureRemote/Client? (2)

Back 54

Internal Database
LDAP server

Front 55

What kinds of gateways does SecureRemote work with?

Back 55

VPN-1
UTM

Front 56

What Security features are added by SecureClient compared to SecuRemote? (3)

Back 56

Desktop Security
Logging and alerts
Secure Config Verification

Front 57

What connectivity features are added by SecureClient compared to SecuRemote? (3)

Back 57

Office Mode addresses
Visitor Mode
Hub Mode

Front 58

What management features are added by SecureClient compared to SecuRemote? (3)

Back 58

Automatic Software distribution
Advanced packaging-and-distribution options
Diagnostic tools

Front 59

When is Visitor mode used?

Back 59

When the client needs to tunnel all client-to-gateway traffic through a regular TCP connection on port 443

Front 60

What is done with traffic in Hub mode?

Back 60

All traffic is routed through the gateway to achieve higher levels of security and connectivity.

Front 61

(T/F) The IP assignment in Office Mode is lease-renewed as long as the user is connected?

Back 61

True

Front 62

For Office mode, what are the 2 different ways an IP address can be taken from an IP pool?

Back 62

General Pool
User Group Pool

Front 63

What are the 2 ways the address can be specified in Office Mode?

Back 63

Per User
DHCP

Front 64

In Office mode, what service does DHCP enable?

Back 64

DNS name-resolution service

Front 65

In Office mode, what does DNS name resolution service make easier?

Back 65

accessing the remote client from within the corporate network.

Front 66

(T/F) It is not possible to enable office mode for specific user groups.

Back 66

False. It's possible to enable OM for specific groups or for all users.

Front 67

What remote access methods support Office Mode?

Back 67

SecureClient
SSL Network Extender
Crypto
L:2TP

Front 68

(T/F) A remote user with only SecuRemote is supported in Office Mode.

Back 68

False

Front 69

What routing-table modification needs to be made to support Office Mode?

Back 69

internal LAN routers must route Office Mode IP addresses to the gateway/cluster that assigned the addresses.

Front 70

What happens when the Multiple External Interfaces feature is enabled?

Back 70

Routing decisions are performed after the packets are encapsulated using IPSEC to prevent routing problems.

Front 71

Since there is a performance impact, when is Multiple External Interfaces recommended?

Back 71

The gateway has multiple interfaces
Office Mode packets are routed to the wrong external interface.

Front 72

What IP configuration is the basic configuration for Office Mode?

Back 72

IP Pools

Front 73

In Desktop Security, what happens when the renewal process continually fails?

Back 73

The current policy expires and the remote client remains with the previous policy.

Front 74

(T/F) During the security policy update the mobile user log files are being uploaded to the policy server.

Back 74

True

Front 75

How do you prepackage SecureClient to include a default policy? (5)

Back 75

1. Open the SecureClient SC tar.gz file.
2. Place the policy files in the tar.gz directory (local.scv, local.dt, local.1p, etc.)
3. specify initialpolicy.bat in the install section of product.ini
4. repackage using tar tool or run setup from the tar.gz
5. install SecureClient from the generated package/tar.gz

Front 76

How do you enable Policy Server HA?

Back 76

Set the use_profile_ps_configuration to true in the userc.c file.

Front 77

(T/F) SecureClient does not record the IP addresses and ports that were accessed during the registration phase.

Back 77

False

Front 78

(T/F) Enabling logging with locally save all the activity on a remote host.

Back 78

True

Front 79

(T/F) Log files do not include confidential info.

Back 79

False

Front 80

SecureClient's Mobile VPN is based on:

Back 80

SSL (HTTPS) tunneling

Front 81

(T/F) SecureClient acan be triggered/controlled by third-party applications.

Back 81

True

Front 82

What is Centrally Managed Mode?

Back 82

The client conencts to a gateway configured for SecureClient Mobile and downloads a set of policies that were sent to that gateway by the SCS. The client then enforces these policies.

Front 83

What is the oldest version that supports Centrally Managed Mode?

Back 83

R60_HFA4

Front 84

What is the oldest version that supports Centrally Managed Mode without patching the SCS and gateway?

Back 84

R65

Front 85

When using Hub mode, what should you also use?

Back 85

Office Mode

Front 86

Is Office Mode supported in SecuRemote?

Back 86

No

Front 87

What are the 3 special demands of remote clients?

Back 87

Connectivity (various locations & networks)
Secure Connectivity
Usability

Front 88

How is SSL Network Extender implemented on the user's machine?

Back 88

A thin client is installed on the user's machine.

Front 89

How is SSL Network Extender activated?

Back 89

Using SmartDashboard to enable the SSL enabled web server on the gateway.

Front 90

For SSL Network Extender, what must be done to enable connectivity for clients?

Back 90

VPN-1 must be configured to support SecuRemote/SecureClient in addition to a minor configuration related to SSL Network Extender.

Front 91

How is SSL Network Extender installed on the user's machine?

Back 91

By downloading it from gateway.

Front 92

What is the oldest version of gateway that a user can use to download SSL Network Extender?

Back 92

R55 HFA10

Front 93

What do first-time installations, uninstalls, and upgrades require on the client machine?

Back 93

admin rights

Front 94

What are the configuration requirements for the server side of SSL Network Extender?

Back 94

1. The gateway must be configured as part of the Remote Access Community
2. Visitor mode must be enabled.
3. The same access rules are configured for SecureClient and SSL Net Ex.

Front 95

What should you do if you want to use Integrity Clientless Security (ICS)?

Back 95

Install the ICS server or ICS configuration tool.

Front 96

What are the d/l and install sizes of SSL Network Extender?

Back 96

400KB package and 650KB installed.

Front 97

The SNX mechanism is based on which 2 modes?

Back 97

Visitor and Office

Front 98

Is automatic proxy detection implemented in SNX?

Back 98

Yes

Front 99

Does SNX support all of CP's auth schemes?

Back 99

Yes

Front 100

What information about the user remains on the client machine?

Back 100

None

Front 101

(T/F) SNX logging is not identical to SecuRemote/SecureClient.

Back 101

False

Front 102

(T/F) HA Clusters and failover are not supported with SNX

Back 102

False

Front 103

(T/F) SNX supports the RC4 encryption method.

Back 103

True

Front 104

(T/F) SNX users can authenticate using certificates issues by any trusted CA.

Back 104

True

Front 105

(T/F) SNX is not supported on IPSO

Back 105

False

Front 106

What does Integrity Clientless Security (ICS) prevent?

Back 106

Threats posed by malware, trojans, hacker tools, key loggers, adware, etc.

Front 107

(T/F) SNX cannot work in hub mode

Back 107

False

Front 108

What is provided by Clientless VPN?

Back 108

1. Secure SSL communication between clients and servers that support HTTPS.
2. accepts any encryption method that is proposed by the client and supported in VPN.
3. Can enforce the use of strong encryption.
4. Supports user authentication

Front 109

What are the 2 clear phases of Clientless VPN?

Back 109

Establishing a secure channel
Communication phase

Front 110

What are the steps in establishing a Secure Channel?

Back 110

1. HTTPS request to the web server.
2. request reaches VPN-1 gateway.
3. the gateway checks the security policy.
4. If a rule is matched and clientless VPN is enabled, the connection is diverted to the Clientless VPN Security Server.
5. SSL negotiation takes place. The gateway uses a cert signed by a CA the client trusts.
6. Secure channel is established.

Front 111

What is the Clientless VPN Security Server?

Back 111

It is a daemon invoked by the gateway to handle Clientless VPN connections that, once invoked, runs as a background process.

Front 112

What are 3 considerations for Clientless VPN?

Back 112

1. Which cert does the gateway present.
2. How many security servers should be run.
3. What level of encryption is required.

Front 113

Which certificate option for Clientless VPN requires no configuration on the client side?

Back 113

The gateway presents a cert signed by a CA trusted by the client.

Front 114

Which certificate option for Clientless VPN supplies a higher level of security?

Back 114

A cert from the ICA.

Front 115

For Clientless VPN, what steps are taken to set up an externally supplied certificate?

Back 115

1. Obtain a CA Certificate
2. Configure the SCS to trust this CA.
3. Obtain and configure the cert for the gateway.
4. Supply the CA certificate to the client and instruct user on the client config

Front 116

How many Security servers can be run on the same gateway?

Back 116

10

Front 117

Check Point recommends running one VPN Security Server per _____ active users.

Back 117

150.

Front 118

For the most part, Clientless VPN is configured on the ____________.

Back 118

Gateway

Front 119

What are the 2 exceptions to configuring Clientless VPN on the gateway?

Back 119

1. The gateway authenticates itself to the the client using a cert that is not one of the client's default certs.
2. User auth is require and is done using certs.

Front 120

For Clientless VPN, if no auth is required a rule must be defined that implements the _______________.

Back 120

URI resource

Front 121

For Clientless VPN, if client auth is required a rule must be defined that lists the _____________ in the service column and ___________ in the Action column.

Back 121

URI resource
Client Authentication

Front 122

For Clientless VPN, if user auth is required a rule must be defined that lists the _____________ in the service column and ___________ in the Action column.

Back 122

service
User auth