Actual exam questions.

Hope they help

---

These questions were in the CCSA NG
exam this morning (16/09/02).

Q. What component of CheckPoint NG allows you to export Logs to an external program such as Access or Excel.


A. ELA
B. LEA
C. Logs cannot be exported to external programs.
D. ULLLS
E. something else


Q. Customer has created a rule so that
everytime a user wants to go to the Internet that user must be authenticated. FIREWALL LOAD IS A CONCERN FOR THE CUSTOMER. What authentication
method does not result in any additional connections to the firewall?

A.Client
B.User
C.Session
D. Something else
E. None of above


Session is the answer.

Q. Which is not a step in Session Authentication?

A. The user initiates a connection directly to the server.
B.
The Session Authentication agent prompts the user for the authentication data and returns this information to the Inspection Module.
C. If the
authentication is sucessful , then the VPN-1/Firewall-1 NG module allows the connection to pass through the gateway, and continue to the target
server.
D. The Session Authentication agent prompts the user for authentication data and returns this information to the Inspection Module.
E.
The Session Authentication agent prompts the user for authentication data after a valid check of (something) and returns this information to the
Inspection Module.

E is the correct answer.

Q. What is not a a feature of the SVN Foundation.

A. Watch dog for critical services
B.
Cpstart/CPstop
C. CPMAD
D. Check Point Registry
E. something else

Q. What mode would you use to check if someone is pinging the firewall.


A. Security Log
B. Log Viewer
C. Active Connections
D. Accounting Log
E. Audit Log

Answer Log Viewer

Q. The system display
status displays a firewall with "!", what does this mean?

A. The firewall is defined as external
B. The firewall has been turned off
C.
Nothing is wrong
D. The firewall is unprotected, no security policy is loaded
E. something else

D is the answer.

Q. If you want a user
to authenticate everytime they use the internet what authentication scheme would you use?

A.User
B.Client
C.Session
D.something else

E.something else

Answer is User.

Q. What is true of the Enforcement Module.

A. Usually installed on a multihomed machine
B. Manages
logging
C. Is installed on a host enforcement point
D. Examines all communications according to a Enterprise Security Policy
E. Can provide
authentication and Content Security features at the application level

Answer A, C, D, E

Q. What can NAT be performed on?

A. Domains,
Networks & Workstations
B. Domains & Networks
C. Security Servers & Networks
D. something else.

I guess A is the right answer, the wording
is exactly as in the exam.

Q. What Implicit Rules are allowed by default in the Global Properties?

A. Accept RIP
B. Accept Firewall
Control Connections
C. Accept Domain Name over UDP (Queries)
D. Accept ICMP Requests
E. Accept CPRID connections (SecureUpdate)

Answer B &
E

Q. You have 72 privately addresses internal addresses. How would you reduce the time it takes to install a policy?

A. Create an object for
all the networks and use this in the rule base rather than the 72 individual networks.

Q. How does the firewall implement Transparent
authentication?

A. The firewall allows the connection but hides the fact that the user is connected to the firewall, the user will always be
prompted for a username even if the username is not recognised by the user database.

Q. When can Hide Mode not be used.

A. Where the port
number cannot be changed
B. Where the port number can be changed
C. Where the external server must distinguish between clients based on their IP
address
D. something else

Answer A & C


Q. To block an active connection with Block Intruder, select the connection you want to block,
and then select Block Intruder from the Select mune. The following default options are available from the Block Intruder window:

A. Block access
to this gateway
B. Block access from this source
C. Block only this connection
D. Block access for specific packets to the destination
E.
Block access to this destination

Answer B, C & E

Q. User Authentication can be used to authenticate which services?

A.HTTP
B.HTTPS

C.RLOGIN
D.FTP
E.TELNET

Answer B

Q. Doctors in your building want to be able to get access to files on an ftp server on the DMZ (there
is a diagram in the exam). The doctors move around PC's in the building, what is the best authentication scheme to use so they can access the FTP
server?

A. Session
B. User
C. Reverse
D. Client
E. IKE

Answer B

Q. (With Diagram) What level of the OSI model does the Firewall
Module sit.

A. Presentation
B. Data
C. Network
D. Physical
E. Session

Answer C

Q. The ICA creates certificates for the VPN-
1/FireWall-1 Modules and any other communicating component are created via initialisation of the Policy Editor. The ICA creates, signs, and delivers
a certificate to the communicating component. When would the certificate become invalid?

A. If you rename the gateway
B. If you rename the
rule base
C. When you Reset the ICA
D. Delete the Module object from the Policy Editor
E. something else

Answer C & D

Q. You
Enterprise Security Policy is made up off:

A. Explicit rules created by the user
B. Implicit rules created by VPN-1/Firewall-1, and are
derived from the security properties
C. something else
D. something else
E. something else

Answer A & B

Q. Within the Secure Internal
Communications (SIC) framework the Management Server and Modules are identified by their SIC name. What is this commonly known as:

A. IP Address

B. Host Name
C. Friendly Name given by Administrator
D. Distinguished Name (DN)
E. Workstation Name

Answer D.

Q. Which is false
about SIC communications?

A.VPN Certificates, such as those for IKE are used for secure communications
B.The Policy Editior initiates an SSL
based connection with the Management Server
C. The Policy Editor must be defined as being authorised to use the Management Server
D. The
Management Server verifies that the Clients IP address belongs to an authorised Policy Editor Client

Answer A is false.

Q. With SecureUpdate
you are able to:

A. Change Central Licenses to Local Licenses
B. Track current installed versions of Check Point and OPSEC products
C.
Update Check Point and OPSEC software remotely from a central location
D. Centrally manage Licenses
E. Perform a new installation of VPN-1/FW-1
remotely

Answer B, C, D