|
Please Forward me dump of this above exam urgently
|
Question 1. Which of the following can help assure customers that the information they provide to you will remain private? A. Implement and post a privacy policy. B. Provide an opt-out link for all e-mail sent to customers. C. Post the company security policy. D. Create a data backup policy. Answer: A Question 2. Which of the following pieces of information will best help you determine the number of transactions your database server can accommodate? A. The number of concurrent user connections B. Maximum uptime requirements C. The number of database tables required D. Minimum installation requirements Answer: A Question 3. To perform at the maximum level of security, digital certificates must be: A. issued by a trusted third party. B. issued 30 days before the site goes live. C. verified digitally by a notary public. D. guaranteed by VeriSign. Answer: A Question 4. The purpose of a stress test is to determine: A. whether more system RAM is necessary. B. whether a more powerful CPU is necessary. C. whether a performance bottleneck is present. D. whether visitors can reach the site. Answer: C Question 5. Which of the following is the most effective option for detecting a site attack by someone who wants to modify your customer database? A. Using an intrusion detection system B. Limiting the open ports on the system C. Using antivirus software D. Implementing a firewall Answer: A Question 6. The main purpose of monitoring e-commerce Web server resources and performance (including bandwidth, uptime, downtime and network usage) is to ensure: A. visitor satisfaction. B. cost-effectiveness. C. site availability. D. increased profitability. Answer: C Question 7. A hash encryption function: A. is encrypted with a public key and decrypted with a private key. B. is not used because today's computers can easily hack it. C. is relatively easy to encrypt but difficult to decrypt. D. contains a secret key that is used to encrypt and decrypt. Answer: C Question 8. You need to enable SSL/TLS on a Web server for a virtual directory. You have just installed a signed digital certificate from a certificate authority. What is the next step you should take? A. Place a copy of the certificate in the virtual directory as a hidden file. B. Place the digital certificate in the Trusted Root Certification Authorities store. C. Specify that you want to use SSL/TLS for the Web server's virtual directory. D. Specify that you want to use the certificate to sign the virtual directory. Answer: C Question 9. Which of the following site creation models would be most appropriate for a site needing customer relationship management (CRM) and personalization? A. Online instant storefront B. Mid-level offline instant storefront C. Mid-level online instant storefront D. High-level offline instant storefront Answer: D Question 10. Tomas receives multiple e-mail notices after he successfully places an online order with a book retailer. What is the customary sequence of order e-mail notices? A. Order address verified, order shipped, order charged to the credit card B. Order processed, order status confirmed, order shipped with tracking number C. Order fulfilled, order processed, order shipped with tracking number assigned D. Order shipped, order processed, order charged to the credit card Answer: B
|
Question 1. Which statement is true about the hardware requirements of MPLS? A. Because you do not need to run a routing protocol on P-routers, they require less memory than routers supporting classic IP routing. B. Because of the additional processing and memory requirements needed to build the LFIB, MPLS is only available on high end routers. C. MPLS is available on low end routers, built their use is limited because of the additional processing and memory requirements needed to build the LFIB. D. Because P-routers do not need to carry routes outside the MPLD domain, they require less memory than routers that support the same application using classic IP routing. Answer: C Question 2. If aggregation (summarization) were to be used on a network with ATM LSRs. What would result? A. LSPs would be broken in two. B. There would be extra LFIB entries. C. The size of the LFIB table would increase. D. There would be extra LIB entries Answer: A Question 3. What is true of MPLS TE? A. Only the ingress LSR must see the entire topology of the network. B. Every LSR needs additional information about links in the network, available resources, and constraints. C. Every core router must be able to create an LSP tunnel on demand. D. Both RSVP and CR-LDP are used in conjunction to establish traffic engineering (TE) tunnels and to propagate the labels. Answer: B Question 4. What is a major drawback of using traditional IP routing over an ATM network when connecting multiple sites? A. Each ATM switch in the path has to perform Layer 3 routing lookup. B. ATM virtual circuits have to be established between the different sites. C. There is high ATM management overhead between the ATM switch and the router at each site. D. Each ATM switch has to be manually configured to participate in Layer 3 routing. E. There is high PNNI overhead.- Answer: B Explanation: Drawbacks of Traditional IP Forwarding IP over ATM 1) Layer 2 devices have no knowledge of Layer 3 routing information - virtual circuits must be manually established. 2) Layer 2 topology may be different from Layer 3 topology, resulting in suboprtimal paths and link use. 3) Even if the two topologies overlap, the hub-and-spoke topology is usually used because of easier management. Question 5. What is true of MPLS TE? A. Only the ingress LSR must see the entire topology of the network. B. Every LSR needs additional information about links in the network, available resources, and constraints. C. Every core router must be able to create an LSP tunnel on demand. D. Both RSVP and CR-LDP are used in conjunction to establish traffic engineering (TE) tunnels and to propagate the labels. Answer: B Question 6. In order for MPLS to be implemented on ATM switches, what requirements must the ATM switch meet? Select two. A. become Layer 3 aware by running a routing protocol B. use MPLS LDP or TDP to distribute and receive MPLS label information C. use BGP to exchange MPLS VPN labels in the data plane D. use RSVP to exchange MPLS traffic-engineering labels in the data plane E. establish a full mesh of Layer 2 ATM virtual circuits between all the ATM switches in the MPLS domain F. use cell-mode MPLS and insert MPLS label in the ATM AAL5 header Answer: A, B Question 7. When running basic MPLS in conjunction with VPNs, how many labels does each packet contain? A. Each packet contains one label that identifies the VPN. B. Each packet contains at least two labels. One label identifies the path to the egress router and one that identifies the VPN. C. Each packet contains at least three labels. One label identifies the ingress router, one identifies the egress router and one identifies the path that will be taken. D. Each packet contains at least three labels. One label identifies the ingress router, one label identifies the path to the egress router, and one identifies the VPN. Answer: B Question 8. On ingress, a label is imposed to a packet. Which process is responsible for this function? A. LDP process. B. Control plane process C. Penultimate hop process. D. Forwarding plane process. Answer: B Question 9. How could you check for potential MTU size issues on the path taken by a PE-to-PE LSP? A. Because MPLS packets are label switched, MTU problems can only be detected by the user applications. B. Use the ping vrf command with packet size set to the largest MTU along the path and DF bit set from the local PE-router to ping the remote PE-router. C. Use the ping vrf command with packet size set to the smallest MTU along the path and DF bit set from the local PE-router to ping the remote PE-router. D. Because MPLS packets are label switched, packets are automatically fragmented and reassembled by the PE-routers. Therefore, there are no potential MTU issues. Answer: B Question 10. Which one of the following is true regarding MPLS independent control label allocations? A. The LSR can always assign a label for a destination prefix, even if it has no downstream label. B. The LSR can assign a label for a destination prefix only if it has already receives a label from the next-hop LSR, otherwise, it must request a label from the next-hop LSR. C. The LSR will assign a label to a destination prefix only when asked for a label by an upstream LSR. D. The label for a destination prefix is allocated and advertised to all LDP peers, regardless of whether the LDP peers are upstream or downstream LSRs for the destination prefix. E. The LSR stores the receives label in its LIB, even when the label is not received from the next-hop LSR. F. The LSR stores only the labels received from the next-hop LSR, all other labels are ignored. Answer: A
|
Question 1. You have two Nokia Appliances one IP530 and one IP380. Both Appliances have IPSO 39 and VPN-1 Pro NGX installed in a distributed deployment Can they be members of a gateway cluster? A. No, because the Gateway versions must not be the same on both security gateways B. Yes, as long as they have the same IPSO version and the same VPN-1 Pro version C. No, because members of a security gateway cluster must be installed as stand-alone deployments D. Yes, because both gateways are from Nokia, whether they have the same VPN-1 PRO version or not E. No, because the appliances must be of the same model (Both should be IP530orIP380.) Answer: B Question 2. You want VPN traffic to match packets from internal interfaces. You also want the traffic to exit the Security Gateway, bound for all site-to-site VPN Communities, including Remote Access Communities. How should you configure the VPN match rule? A. Internal_clear>- All_GwToGw B. Communities >- Communities C. Internal_clear>- External_Clear D. Internal_clear>- Communitis E. Internal_clear>-All_communitis Answer: E Question 3. Review the following rules and note the Client Authentication Action properties screen, as shown in the exhibit. After being authenticated by the Security Gateway when a user starts an HTTP connection to a Web site the user tries to FTP to another site using the command line. What happens to the user? The.... A. FTP session is dropped by the implicit Cleanup Rule. B. User is prompted from the FTP site only, and does not need to enter username and password for the Client Authentication. C. FTP connection is dropped by rule 2. D. FTP data connection is dropped, after the user is authenticated successfully. E. User is prompted for authentication by the Security Gateway again. Answer: B Question 4. After being authenticated by the Security Gateway, When a user starts an HTTP connection to a Web site, the user tries to FTP to another site using the command line. What happens to the user? The: A. FTP session is dropped by the implicit Cleanup Rule B. user is prompted from that FTP site on~, and does not need to enter username and password for Client Authentication C. FTP connection is dropped by rule2 D. FTP data connection is dropped, after the user is authenticated successfully E. User is prompted for authentication by the Security Gateway aqain Answer: B Question 5. You want to upgrade a SecurePlatform NG with Application Intelligence (AI) R55 Gateway to SecurePlalform NGX R60 via SmartUpdate. Which package is needed in the repository before upgrading? A. SVN Foundation and VPN-1 Express/Pro B. VPN-1 and FireWall-1 C. SecurePlalform NGX R60 D. SVN Foundation E. VPN-1 ProfExpress NGX R60 Answer: C Explanation: SecurePlatform Upgrade An IBM e305 server is configured as a SecurePlatform firewall with NG-AI HFA- 12. A new VPN-1 Pro/Express Gateway object is created in SmartDashboard. SIC is initialized and NG and NGX licenses are attached to the module.The starting point for the upgrade is illustrated in Figure 13.16. Figure 13.16 The Package Management View SecurePlatform Pre-Upgrade The next step is to add the SecurePlatform NGX to the Package Repository using the Add Package From CD option. Insert NGX CD1 containing the SmartUpdate client and click the Add Package From CD button in the toolbar to open a browse window. Select the appropriate drive and the packages are listed as displayed in Figure 13.17. p480, Configuring Check Point NGX VPN-1/FireWall-1, Syngress, 1597490318 Question 6. What is the command to see the licenses of the Security Gateway ITCertKeys from your SmartCenter Server? A. print ITCertKeys B. fw licprint ITCertKeys C. fw tab -t fwlic ITCertKeys D. cplic print ITCertKeys E. fw lic print ITCertKeys Answer: D Explanation: cplic print - prints details of Check Point licenses on the local machine. On a Module, this command will print all licenses that are installed on the local machine - both Local and Central licenses. P456, . NG COMMAND LINE INTERFACE Advanced Technical Reference Guide - NG FP3 Question 7. You set up a mesh VPN Community, so your internal network can access your partners network, and vice versa . Your Security Policy encrypts only FTP and HTTP traffic through a VPN tunnel. All traffic among your internal and partner networks is sent in clear text. How do you configure VPN Community? A. Disable 'accept all encrypted traffic', and put FTP and http in the Excluded services in the Community object Add a rule in the Security Policy for services FTP and http, with the Community object in the VPN field B. Disable "accept all encrypted traffic" in the Community, and add FTP and http services to the Security Policy, with that Community object in the VPN field C. Enable "accept all encrypted traffic", but put FTP and http in the Excluded services in the Community. Add a rule in the Security Policy with services FTP and http, and the Community object in theVPN field D. Put FTP and http in the Excluded services in the Community object Then add a rule in the Security Policy to allow any as the service, with the Community object in the VPN field Answer: B Question 8. Ophelia is the security Administrator for a shipping company. Her company uses a custom application to update the distribution database. The custom application includes a service used only to notify remote sites that the distribution database is malfunctioning. The perimeter Security Gateways Rule Base includes a rule to accept this traffic. Ophelia needs to be notified, via a text message to her cellular phone, whenever traffic is accepted on this rule. Which of the following options is MOST appropriate for Ophelia's requirement? A. User-defined alert script B. Logging implied rules C. SmartViewMonitor D. Pop-up API E. SNMP trap Answer: A Question 9. You are reviewing SmartView Tracker entries, and see a Connection Rejection on a Check Point QoS rule. What causes the Connection Rejection? A. No QoS rule exists to match the rejected traffic B. The number of guaranteed connections is exceeded. The rule's action properties are not set to accept additional connections C. The Constant Bit Rate for a Low Latency Class has been exceeded by greater than 10%, and the Maximal Delay is set below requirements D. Burst traffic matching the Default Rule is exhausting the Check Point QoS global packet buffers E. The guarantee of one of the rule's sub-rules exceeds the guarantee in the rule itself Answer: B Explanation: QoS rules with the track field set to Log can generate the following types of log events: QoS rejects a connection when the number of guaranteed connections is exceeded, and/or when the rule's action properties are not set to accept additional connections. 359, accel_ccse_ngx Question 10. Choose the BEST sequence for configuring user management on Smart Dash board, for use with an LDAP server A. Enable LDAP in Global Properties, configure a host-node object for the LDAP Server, and configure a server object for the LDAP Account Unit B. Configure a workstation object for the LDAP server, configure a server object for the LDAP Account Unit, and enable LDAP in Global Properties C. Configure a server object for the LDAP Account Unit, enable LDAP in Global Properties, and create an LDAP server using an OPSEC application D. Configure a server object for the LDAP Account Unit, enable LDAP in Global Properties, and create an LDAP resource object E. Configure a server object for the LDAP Account Unit, and create an LDAP resource object Answer: A Explanation:
|
Question 1. You work a network administrator for ITCertKeys.com. You configure a Check Point QoS Rule Base with two rules: an H.323 rule with a weight of 10, and the Default Rule with a weight of 10. The H.323 rule includes a per-connection guarantee of 384 Kbps, and a per-connection limit of 512 Kbps. The per-connection guarantee is for four connections, and no additional connections are allowed in the Action properties. If traffic passing through the QoS Module matches both rules, which of the following is true? A. Neither rule will be allocated more than 10% of available bandwidth. B. The H.323 rule will consume no more than 2048 Kbps of available bandwidth. C. 50% of available bandwidth will be allocated to the H.323 rule. D. 50% of available bandwidth will be allocated to the Default Rule E. Each H.323 connection will receive at least 512 Kbps of bandwidth. Answer: B Question 2. ITCertKeys.com has many VPN-1 Edge gateways at various branch offices, to allow VPN-1 SecureClient users to access ITCertKeys.com resources. For security reasons, ITCertKeys.com's Secure policy requires all Internet traffic initiated behind the VPN-1 Edge gateways first be inspected by your headquarters' VPN-1 Pro Security Gateway. How do you configure VPN routing in this star VPN Community? A. To the Internet an other targets only B. To the center and other satellites, through the center C. To the center only D. To the center, or through the center to other satellites, then to the Internet and other VPN targets Answer: D Explanation: This configuration option can be found in the properties window under Advanced Settings > VPN Routing for a Star Community VPN Object (see screenshot) From the help file on this properties page: Three options are available: * To center only. No VPN routing actually occurs. Only connections between the Satellite Gateways and Central Gateway go through the VPN tunnel. Other connections are routed in the normal way * To center and to other satellites through center. Use VPN routing for connection between satellites. Every packet passing from a Satellite Gateway to another Satellite Gateway is routed through the Central Gateway. Connection between Satellite Gateways and Gateways that do not belong to the community are routed in the normal way. * To center, or through the center to other satellites, to internet and other VPN targets. Use VPN routing for every connection a Satellite Gateway handles. Packets sent by a Satellite Gateway pass through the VPN tunnel to the Central Gateway before being routed to the destination address. Question 3. You are preparing to configure your VoIP Domain Gatekeeper object. Which two other object should you have created first? A. An object to represent the IP phone network, AND an object to represent the host on which the proxy is installed. B. An object to represent the PSTN phone network, AND an object to represent the IP phone network C. An object to represent the IP phone network, AND an object to represent the host on which the gatekeeper is installed. D. An object to represent the Q.931 service origination host, AND an object to represent the H.245 termination host E. An object to represent the call manager, AND an object to represent the host on which the transmission router is installed. Answer: C Question 4. Which Check Point QoS feature is used to dynamically allocate relative portions of available bandwidth? A. Guarantees B. Differentiated Services C. Limits D. Weighted Fair Queuing E. Low Latency Queing Answer: D Explanation: Bandwidth Allocation and Rules A rule can specify three factors to be applied to bandwidth allocation for classified connections: Weight Weight is the relative portion of the available bandwidth that is allocated to a rule. To calculate what portion of the bandwidth the connections matched to a rule receive, use the following formula: This rule's portion = this rule's weight / total weight of all rules with open connections For example, if this rule's weight is 12 and the total weight of all the rules under which connections are currently open is 120, then all the connections open under this rule are allocated 12/120 (or 10%) of the available bandwidth. In practice, a rule may get more than the bandwidth allocated by this formula, if other rules are not using their maximum allocated bandwidth. Unless a per connection limit or guarantee is defined for a rule, all connections under a rule receive equal weight. Allocating bandwidth according to weights ensures full utilization of the line even if a specific class is not using all of its bandwidth. In such a case, the left over bandwidth is divided among the remaining classes in accordance with their relative weights. Units are configurable, see "Defining QoS Global Properties" on page 94. Default Rule Chapter 4 Basic QoS Policy Management 35 Guarantees A guarantee allocates a minimum bandwidth to the connections matched with a rule. Guarantees can be defined for: the sum of all connections within a rule A total rule guarantee reserves a minimum bandwidth for all the connections under a rule combined. The actual bandwidth allocated to each connection depends on the number of open connections that match the rule. The total bandwidth allocated to the rule can be no less than the guarantee, but the more connections that are open, the less bandwidth each one receives. individual connections within a rule A per connection guarantee means that each connection that matches the particular rule is guaranteed a minimum bandwidth. Although weights do in fact guarantee the bandwidth share for specific connections, only a guarantee allows you to specify an absolute bandwidth value. Limits A limit specifies the maximum bandwidth that is assigned to all the connections together. A limit defines a point beyond which connections under a rule are not allocated bandwidth, even if there is unused bandwidth available. Limits can also be defined for the sum of all connections within a rule or for individual connections within a rule. Question 5. Which operating system is NOT supported by VPN-1 SecureClient? A. IPSO 3.9 B. Windows XP SP2 C. Windows 2000 Professional D. RedHat Linux 8.0 E. MacOS X Answer: A Explanation: RedHat 8 is also not currently supported according to the docs, but A is the most correct answer.. http://www.checkpoint.com/products/downloads/vpn-1_clients_datasheet.pdf Question 6. You want to upgrade a SecurePlatform NG with Application Intelligence (AI) R55 Gateway to SecurePlatform NGX R60 via SmartUpdate. Which package is needed in the repository before upgrading? A. SVN Foundation and VPN-1 Express/Pro B. VNP-1 and FireWall-1 C. SecurePlatform NGX R60 D. SVN Founation E. VPN-1 Pro/Express NGX R60 Answer: C Explanation: SmartCenter Upgrade on SecurePlatform R54, R55 and Later Versions Upgrading to NGX R60 over a SecurePlatform operating system requires updating both operating system and software products installed. SecurePlatform users should follow the relevant SecurePlatform upgrade process. The process described in this section will result with an upgrade of all components (Operating System and software packages) in a single upgrade process. No further upgrades are required. Refer to NGX R60 SecurePlatform Guide for additional information. If a situation arises in which a revert to your previous configuration is required refer to "Revert to your Previous Deployment" on page 52 for detailed information. Using a CD ROM The following steps depict how to upgrade SecurePlatform R54 and later versions using a CD ROM drive. 1 Log into SecurePlatform (Expert mode is not necessary). 2 Apply the SecurePlatform NGX R60 upgrade package: # patch add cd. 3 At this point you will be asked to verify the MD5 checksum. 4 Answer the following question: Do you want to create a backup image for automatic revert? Yes/No If you select Yes, a Safe Upgrade will be performed. Safe Upgrade automatically takes a snapshot of the entire system so that the entire system (operating system and installed products) can be restored if something goes wrong during the Upgrade process (for example, hardware incompatibility). If the Upgrade process detects a malfunction, it will automatically revert to the Safe Upgrade image. When the Upgrade process is complete, upon reboot you will be given the option to manually choose to start the SecurePlatform operating system using the upgraded version image or using the image prior to the Upgrade process. Question 7. Exhibit: The exhibit displays the cphaprob state command output from a New Mode High Availability cluster member. Which machine has the highest priority? A. 192.168.1.2, since its number is 2. B. 192.168.1.1, because its number is 1. C. This output does not indicate which machine has the highest priority. D. 192.168.1.2, because its stats is active Answer: B Reference: ClusterXL.pdf page 76 Question 8. Exhibit: ITCertKeys tries to configure Directional VPN Rule Match in the Rule Base. But the Match column does not have the option to see the Directional Match. ITCertKeys sees the screen displayed in the exhibit. What is the problem? A. Jack must enable directional_match(true) in the object_5_0.c file on SmartCenter server. B. Jack must enable Advanced Routing on each Security Gateway C. Jack must enable VPN Directional Match on the VPN Advanced screen, in Global properties. D. Jack must enable a dynamic-routing protocol, such as OSPF, on the Gateways. E. Jack must enable VPN Directional Match on the gateway object's VPN tab. Answer: C Reference: VPN.pdf page 145 Question 9. Where can a Security Administator adjust the unit of measurement (bps, Kbps or Bps), for Check Point QoS bandwidth? A. Global Properties B. QoS Class objects C. Check Point gateway object properties D. $CPDIR/conf/qos_props.pf E. Advanced Action options in each QoS rule. Answer: A Reference: R60 CheckPointQoS.pdf page 94 Question 10. ITCertKeys is the Security Administrator for ITCertKeys.com. ITCertKeys.com FTP servers have old hardware and software. Certain FTP commands cause the FTP servers to malfunction. Upgrading the FTP Servers is not an option this time. Which of the following options will allow ITCertKeys to control which FTP commands pass through the Security Gateway protecting the FTP servers? A. Global Properties->Security Server ->Security Server->Allowed FTP Commands B. SmartDefense->Application Intelligence->FTP Security Server C. Rule Base->Action Field->Properties D. Web Intelligence->Application Layer->FTP Settings E. FTP Service Object->Advanced->Blocked FTP Commands Answer: B Reference: Surf to that location in Smart Dashboard
|
Question 1. Which VPN-1 NGX feature or command allows Security Administrators to revert to earlier versions of the same Security Policy? A. Policy Package management B. cpinfo C. cpconfig D. Database Revision Control E. upgrade_export/import Answer: D Question 2. In SmartView Tracker, you see an entry for an outbound connection showing address translation. But when setting SmartView Tracker to show all entries for that connection, only outbound entries show. What is the possible cause for this? A. The entry is for a Manual Dynamic NAT connection, from a specific host infected by a worm. B. The entry is for a Manual Static NAT connection, where inbound traffic is managed by a separate rule. C. The entry is for a Static NAT connection, from a specific host that has been infected by a worm. D. The entry is for a Dynamic NAT connection from a specific host. Answer: B Question 3. Which of the following commands is used to restore VPN-1 NGX configuration information? A. gunzip B. cpconfig C. fw ctl pstat D. cpinfo E. upgrade_import Answer: E Question 4. Which OPSEC server is used to prevent users from accessing certain Web sites? A. CVP B. DEFENDER C. URI D. FTP E. UFP Answer: E Question 5. Your organization ITCertKeys.com's security infrastructure separates Security Gateways geographically. You must request a central license for one remote Security Gateway. How would you request and apply the license? A. Request a central license, using the remote Security Gateway's IP address. Apply he license locally with the fwputlic command. B. Request a central license, using the SmartCenter Server's IP address. Apply the license locally on the remote Gateway with the fwputlic command. C. Request a central license, using your SmartCenter Server's IP address. Attach the license to the remote Gateway via SmartUpdate. D. Request a central license, using the remote Gateway's IP address. Attach the license to the remote Gateway via SmartUpdate. E. Request local licenses for all Gateways separately. Apply the license locally on the remote Gateways with the fwputlic command. Answer: C Question 6. How do you create more granular control over commands, such as CWD and FIND, in FTP data connections? A. Use Global Properties > Security Server settings. B. Use the gateway object's Security Server settings. C. Use the Service field of the Rule Base. D. Use an FTP resource object. E. Use FTP Security Server settings in SmartDefense. Answer: E Question 7. Which of the following is the final step in a VPN-1 NGX backup? A. Test restoration in a non-production environment, using the upgrade_import command. B. Move the *.tgz file to another location. C. Copy the conf directory to another location. D. Run the upgrade_export command. E. Run the cpstop command. Answer: B Question 8. Choose the BEST sequence for configuring user management on SmartDashboard, for use with an LDAP server: A. Configure a server object for the LDAP Account Unit, enable LDAP in Global Properties, and create an LDAP server using an OPSEC application. B. Configure a server object for the LDAP Account Unit, enable LDAP in Global Properties, and create an LDAP resource object. C. Enable LDAP in Global Properties, configure a host-node object for the LDAP Server, and configure a server object for the LDAP Account Unit. D. Configure a server object for the LDAP Account Unit, and create an LDAP resource object. E. Configure a workstation object for the LDAP server, configure a server object for the LDAP Account Unit, and enable LDAP in Global Properties. Answer: C 340, Check Point Security Administration NGX I Student Handbook Question 9. You want to create an IKE VPN between two VPN-1 NGX Security Gateways, to protect two networks. The network behind one Gateway is 10.15.0.0/16, and network 192.168.9.0/24 is behind the peer's Gateway. Which type of address translation should you use, to ensure the two networks access each other through the VPN tunnel? A. Hide NAT B. None C. Dynamic NAT D. Static NAT E. Manual NAT Answer: B Question 10. Yoav is a Security Administrator preparing to implement a VPN solution for his multisite organization. To comply with industry regulations, Yoav's VPN solution must meet the following requirement: * Portability: Standard * Key management: Automatic, external PKI * Session keys: Changed at configured times during a connection's lifetime * Key length: No less that 128-bit * Data integrity: Secure against inversion and brute-force attacks What is the most appropriate setting Yoav should choose? A. IKE VPNs: AES encryption for IKE Phase 1, and DES encryption for Phase 2; SHA1 hash B. IKE VPNs: SHA1 encryption for IKE Phase 1, and MD5 encryption for Phase 2; AES hash C. IKE VPNs: CAST encryption for IKE Phase 1, and SHA1 encryption for Phase 2; DES hash D. IKE VPNs: DES encryption for IKE Phase 1, and 3DES encryption for Phase 2; MD5 hash E. IKE VPNs: AES encryption for IKE Phase 1, and AES encryption for Phase 2; SHA1 hash Answer: E
|
Question 1. Exhibit: What operating system tools can be used to collect capacity planning data? (Choose two.) A. lsmod B. vmstat C. iostat D. fuser Answer: B, C Question 2. In order for pam_ldap to be capable of changing a user's password in Active Directory, the pam_password parameter must be set to A. win B. ldap C. ad D. active_directory Answer: C Question 3. OpenLDAP is capable of using the __________ framework to provide integrity and confidentiality protections. A. TLS,SASL,SSL B. There is no such thing. Answer: A Question 4. In capacity planning exercise, what tools assist in identifying processes of interest from other processes? (Choose two.) A. w B. pstree C. acpid D. lsof Answer: B, D Question 5. What type of object class is sambaSamAccount? A. auxiliary B. structural C. extended D. abstract Answer: A Question 6. Which of the following resources would be measured for capacity planning? (Choose two.) A. CPU Usage B. Disk Usage C. Application load time D. Memory usage Answer: A, D Question 7. After finishing configuration of a UNIX client to authenticate with a Microsoft Active Directory server, login attempts are unsuccessful. Which of the following is most likely the cause? A. The slapd daemon is not running B. The user account in Active Director has the remote login setting disabled C. The PAM library is searching the directory with the default search filter D. Unix Client support is disabled in the Active Directory Configuration Answer: C Question 8. CORRECT TEXT Which configuration directive must be used in the example below to setup replication to a slave server? Uri=ldaps://slave.example.com:636 binddn="cn=Replicator,dc=example,dc=com" bindmethod=simple credentials=secret Answer: REPLICA Question 9. Which of the following procedures will test the TLS configuration of your LDAP server? A. Verify the TLS negotiation process in the /var/log/ldap_auth.log file B. Run the ldapsearch command with the -ZZ option, while watching network traffic with a packet analyzer C. Run the slapcat command, while watching network traffic with a packet analyzer D. Verify the TLS negotiation process in the /var/log/auth.log file E. Run the ldapsearch command with the -x option, while watching network traffic with a packet analyzer Answer: B Question 10. CORRECT TEXT All entries in an LDAP directory must have the ______________ attribute. Answer: OBJECTCLASS
|
Question 1. What is the minimum number of partitions you need to install Linux? Answer: 1 Explanation: At a bare minimum, Linux requires just one partition to install and boot. This is the root partition, which is known as the / partition. However, a minimum of two partitions is recommended: one for the root partition and one for the swap partition. Reference: Roderick W. Smith. Sybex Linux + Study Guide: page 37. Question 2. What file contains the default environment variables when using the bash shell? A. ~/.profile B. /bash C. /etc/profile D. ~/bash Answer: C Explanation: The file /etc/profile contains shell commands that are executed at login time for any user whose entry in /etc/passwd has a shell specified in the shell field whose name ends in sh. Reference: http://docsrv.caldera.com/cgi-bin/man/man?profile+4 Incorrect Answers A: The ~/.profile is the profile file stored in each user's home directory. This file contains settings that apply to that user only. B: The default environment variables are stored in the /etc/profile file, not the /bash file. D: The default environment variables are stored in the /etc/profile file, not the ~/bash file. Question 3. Exhibit: You need to delete the group dataproject. Which two of the following tasks should you do first before deleting the group? A. A and C B. A and D C. B and C D. B and D Answer: B. Explanation: You can delete a group by editing the /etc/group file and removing the relevant line for the group. It's generally better to use groupdel, though, because groupdel checks to see if the group is any user's primary group. If it is, groupdel refuses to remove the group; you must change the user's primary group or delete the user account first. As with deleting users, deleting groups can leave "orphaned" files on the computer. It's usually best to delete the files or assign them other group ownership using the chown or chgrp commands. Reference: Roderick W. Smith. Sybex Linux + Study Guide: page 274. Incorrect Answers A: It is not necessary to assign new login names to the members listed in the /etc/group file. C: It is not necessary to assign new login names to the members listed in the /etc/group file. D: It is only necessary to change the users' default group if the default group is the dataproject group. Question 4. All groups are defined in the /etc/group file. Each entry contains four fields in the following order. A. groupname, password, GID, member list B. GID, groupname, password, member list C. groupname, GID, password, member list D. GID, member list, groupname, password Answer: A Explanation: A typical line in the /etc/group file looks like the following: project1:x:501:sally,sam,ellen,george Each field is separated from the others by a colon. The meanings of the four fields are as follows: Group name The first field (project1 in the preceding example) is the name of the group. Password The second field (x in the preceding example) is the group password. Distributions that use shadow passwords typically place an x in this field; others place the encrypted password directly in this field. GID The group ID number goes in this field. User list The final field is a comma-separated list of group members. Reference: Roderick W. Smith. Sybex Linux + Study Guide: page 273. Incorrect Answers B: This is the incorrect order of fields. C: This is the incorrect order of fields. D: This is the incorrect order of fields. Question 5. You issue the following command useradd -m bobm But the user cannot logon. What is the problem? A. You need to assign a password to bobm's account using the passwd command. B. You need to create bobm's home directory and set the appropriate permissions. C. You need to edit the /etc/passwd file and assign a shell of bobm's account. D. The username must be at least five characters long. Answer: A Explanation: When you add a user, the account is disabled until you specify a password for the account. You can use the -p option with the useradd command, but that requires you to enter an encrypted password. For this reason it is easier to use the passwd command. This enables you to enter a plain text password which will then be automatically encrypted. Reference: Roderick W. Smith. Sybex Linux + Study Guide: page 262. Incorrect Answers B: The home directory will be created automatically with the useradd command. C: The user will use the default shell. D: The username does not have to be five characters long. Question 6. You create a new user account by adding the following line to your /etc/passwd file. Bobm:baddog:501:501:Bob Morris:/home/bobm:/bin/bash Bob calls you and tells you that he cannot logon. You verify that he is using the correct username and password. What is the problem? A. The UID and GID cannot be identical. B. You cannot have spaces in the line unless they are surrounded with double quotes. C. You cannot directly enter the password; rather you have to use the passwd command to assign a password to the user. D. The username is too short, it must be at least six characters long. Answer: C Explanation: The password saved in the /etc/passwd file is encrypted. For this reason, you cannot directly enter the password in this file. Rather, you must use the passwd command. The passwd command will take the plain text password and save it in encrypted form in the /etc/passwd file. Reference: Roderick W. Smith. Sybex Linux + Study Guide: page 262. Incorrect Answers A: The UID and the GID can be the same. B: You can have spaces because each field is separated by a colon (:). D: The username does not have to be at least six characters long. Question 7. Which field in the passwd file is used to define the user's default shell? Answer: command Explanation: The last field, known as the command field or login command, is used to specify what shell the user will use when he/she logs in. Question 8. There are seven fields in the /etc/passwd file. Which of the following lists all the fields in the correct order? A. username, UID, password, GID, home directory, command, comment B. username, password, UID, GID, comment, home directory, command C. UID, username, GID, home directory, password, comment, command D. username, password, UID, group name, GID, home directory, comment Answer: B Explanation: The first field contains the username. The second field contains the encrypted password or an 'x' if a shadow password file is used. The third field is the User ID number. The fourth field is the primary Group ID number. The fifth field is the comments field. The sixth field is the home directory field. The seventh field is the command field which specifies the user's default shell. Reference: http://www.unet.univie.ac.at/aix/files/aixfiles/passwd_etc.htm Incorrect Answers A: The order of these fields is not correct. C: The order of these fields is not correct. D: The order of these fields is not correct. Question 9. What file defines the levels of messages written to system log files? Answer: syslog.conf Explanation: The file /etc/syslog.conf contains information used by the system log daemon, syslogd to forward a system message to appropriate log files and/or users. Reference: http://www.unidata.ucar.edu/cgi-bin/man-cgi?syslog.conf+4 Question 10. Which utility can you use to automate rotation of logs? Answer: logrotate Explanation: The logrotate utility is used to manipulate log files. This includes the rotation of log files and the creation of new log files. Reference: http://www.oreillynet.com/linux/cmd/l/logrotate.html
|
Question 1. Which two utilities can you use to set up a job to run at a specified time? A. at and crond B. atrun and crontab C. at and crontab D. atd and crond Answer: C Explanation: The 'at' command is used to execute commands at a specified time and optional date. A cron job is a program or script scheduled at a specified time. The 'crontab' program is used to create user cron jobs. Reference: http://www.oreillynet.com/linux/cmd/a/at.html http://www.oreillynet.com/linux/cmd/c/crontab.html Incorrect Answers. A: The Cron daemon (crond) is the program that runs the cron job at the specified time. It is not used to set up a cron job. B: Atrun is used to run jobs scheduled by the 'at' program. It is not used to set up a job to run at a specified time. D: Atd is the 'at' deamon. Similar to the cron daemon, it is the program that runs the jobs scheduled with the 'at' command. Question 2. After creating a backup of the users home directories called backup.cpio you are asked to restore a file called memo.ben. What command should you type? Answer: cpio -iF backup.cpio memo.ben Explanation: The 'cpio' command is used to create backups or restore files from a backup. The -i option is to extract something. The F option is to specify a file. Here we are extracting memo.ben from a file named backup.cpio. Reference: http://www.oreillynet.com/linux/cmd/c/cpio.html Question 3. You wish to restore the file memo.ben which was backed up in the tarfile MyBackup.tar. What command should you type? Answer: tar xf MyBackup.tar memo.ben Explanation: Tarfiles are created using the 'tar' utility. Therefore, you should use the 'tar' utility to extract the files. The x option is to extract and the f option is to specify a filename to extract from. Reference: http://www.oreillynet.com/linux/cmd/t/tar.html Question 4. When is the most important time to restore a file from your backup? A. On a regular scheduled basis to verify that the data is available. B. When the system crashes. C. When a user inadvertently loses a file. D. When your boss asks to see how restoring a file works. Answer: A Explanation: According to 'best practice', you should regularly restore files to verify that your backup procedures are working. It's no good backing up files regularly if you are unable to restore files when needed. Incorrect Answers: B: When the system crashes, you may need to restore your whole system. However, this shouldn't be the only time you restore files. C: When a user loses a file, it will need to be restored. However, you should prepare for this eventuality by regularly testing your backup/restore process to ensure you are able to restore a file when needed. D: When your boss asks to see how restoring a file works, you want it to work when you show him. This is why you should test your backup/restore processes. Question 5. Which one of the following factors does not play a role in choosing the type of backup media to use? A. How frequently a file changes. B. How long you need to retain the backup. C. How much data needs to be backed up. D. How frequently the backed up data needs to be accessed. Answer: A Explanation: Your choice of backup media will depend on its capacity, its shelf life and the time it takes to access the data. The frequency of file changes is irrelevant. Incorrect Answers: B: Different backup media can be kept for varying periods of time. You should find out from the manufacturers how long a backup media can be kept without losing its data. C: Obviously, your choice of backup media will depend on the amount of data to be backed up. For example, a CD-ROM can hold around 700MB of data while tapes can hold up to hundreds of gigabytes of data. D: Your choice of backup media will also depend on the time it takes to retrieve data from the media. Reading data from a CD-ROM or DVD is much quicker than reading data from a tape. Question 6. You attempt to log out but receive an error message that you cannot. When you issue the jobs command, you see a process that is running in the background. How can you fix thus so that you can logout? A. Issue the kill command with the PID of each running command of the pipeline as an argument. B. Issue the kill command with the job number as an argument. C. Issue the kill command with the PID of the last command as an argument. D. Issue the kill command without any arguments. Answer: C Explanation: The kill command is used to send a signal to kill one or more process IDs. You must own the process or be a privileged user, otherwise the kill command will be ignored. Reference: http://www.oreillynet.com/linux/cmd/k/kill.html Incorrect Answers A: You need to end the background process. You know its process ID, therefore you should issue the process ID with the kill command to kill the appropriate process. B: You cannot use the job number with the kill command. You should use the process ID or process name. D: The kill command won't work if it doesn't know what process you want it to kill. Question 7. The top utility can be used to change the priority of a running process? Another utility that can also be used to change priority is_______? Answer: renice Question 8. You need to search the entire directory structure to locate a specific file. How could you do this and still be able to run other commands while the find command is still searching for you file? A. find / -name filename & B. find / -name filename C. bg find / -name filename D. &find / -name filename & Answer: A Explanation: The find command is used to locate files. / is the root directory, so searching from / will search the entire directory tree. The -nameenables you to search for a file named . The ampersand character (&) is used to return control of the shell returning you to the command prompt, without have to wait for the command to execute. Reference: http://www.oreillynet.com/linux/cmd/f/find.html Incorrect Answers B: With no ampersand (&) following the command, you will not be able to run other commands until the find command has completed its search. C: The bg command is used to run a suspended job in the background if job control is enabled. However, the program or command would have to started and then suspended for this to work. D: The ampersand (&) must follow the command, not precede it. Question 9. In order to display the last five commands you have entered using the history command, you would type _______. Answer: history 5 Explanation: The history command is used to display the previously entered commands. If you typed history with no arguments, you would likely get a long scrolling list of commands. By typing a number after 'history', you will display only the last of commands. Reference: http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/getting-started-guide/s1-q-and-a-history-tips.html Question 10. You telnet into several of your servers simultaneously. During the day, you sometimes get confused as to which telnet session is connected to which server. Which of the following commands in your .profile would make it obvious to which server you are attached? A. PS1='\h: \w>' B. PS1='\s: \W>' C. PS1='\!: \t>' D. PS1='\a: \n>' Answer: A Explanation: The PS1 environment variable controls the prompt on the command line, and can be used by users to tell what system they are on, the directory they are currently in, the current date and more depending on how this variable is configured. The \h option is used to specify the hostname and the \w option will give the full path of the current working directory. Reference: http://ctdp.tripod.com/os/linux/tips/tipsps1.html Incorrect Answers: B: The \s option is used to display the shell name. This won't give any indication of which machine you are connected to. C: The \ option is used to display the history number of the current command. This won't give any indication of which machine you are connected to. D: The \a option is used to display a new line. This won't give any indication of which machine you are connected to.
|
Question 1. What command would load the module msdos.o and all its dependancies? A. modinfo -a msdos B. lsmod -a msdos C. modprobe msdos D. insmod -d msdos Answer: C Explanation: modprobe command is used to load or unload the modules as well as it's dependencies from the kernel. To Load the module: modprobe modulename To unload the module modprobe -r modulename Question 2. What command will unload a kernel module? A. rmmod B. unmod C. delmod D. modprobe E. unloadmod Answer: A Explanation: rmmod is the simple program, which remove the modules from the kernel. To unload module from kernel. rmmod modulename or modprobe modulename Question 3. CORRECT TEXT The _____ command will list the currently loaded kernel modules. Answer: lsmod Explanation: lsmod command displays all modules loaded by kernel as well as modules status on current session. See the sample output of lsmod command Module Size Used by i915 81349 2 md5 4033 1 ipv6 232705 10 parport_pc 24705 1 lp 12077 0 parport 37129 2 parport_pc,lp autofs4 23237 0 sunrpc 157093 1 dm_mod 54741 2 button 6481 0 battery 8901 0 ac 4805 0 raid1 19905 1 uhci_hcd 31065 0 ehci_hcd 30917 0 snd_intel8x0 33769 0 snd_ac97_codec 63889 1 snd_intel8x0 snd_pcm_oss 49017 0 snd_mixer_oss 17985 1 snd_pcm_oss snd_pcm 96841 2 snd_intel8x0,snd_pcm_oss snd_timer 29893 1 snd_pcm snd_page_alloc 9673 2 snd_intel8x0,snd_pcm snd_mpu401_uart 8769 1 snd_intel8x0 snd_rawmidi 26597 1 snd_mpu401_uart snd_seq_device 8137 1 snd_rawmidi snd 54949 9 snd_intel8x0,snd_ac97_codec,snd_pcm_oss,snd_mixer_oss,snd_pcm,snd_timer,snd_mpu401_uart,snd_raw soundcore 9889 1 snd 8139too 25921 0 mii 4673 1 8139too floppy 58481 0 ext3 116809 6 jbd 71257 1 ext3 Question 4. CORRECT TEXT You wish to remove a module from the kernel called fat. Assume this module has no dependancies. Type in the simplest command to do this: Answer: rmmod fat Explanation: rmmod command removes the module from the kernel. If there are other dependencies modules then rmmod command can't remove the module. To remove the fat module from the kernel. rmmod fat Question 5. You have just added new modules to your system. What command would you execute to rebuild the modules.dep file? A. depmod --rebuild B. update-dependancies C. depmod -a D. insmod -dependancies Answer: C Explanation: depmod creates a list of module dependencies, by reading each module under /lib/modules/version and determining what symbols it exports, and what symbols it needs. By default this list is written to modules.dep in the same directory. Question 6. Which of the following correctly describe the relationship between depmod and modprobe? A. depmod creates a dependency file for use by modprobe B. modprobe creates a dependency file for use by depmod C. they have no relationship D. they can replace each other Answer: A Explanation: depmod creates a list of module dependencies, by reading each module under /lib/modules/version and determining what symbols it exports, and what symbols it needs. By default this list is written to modules.dep in the same directory. modprobe command is used to load or unload the modules as well as it's dependencies from the kernel. To Load the module: modprobe modulename To unload the module modprobe -r modulename Question 7. The normal use of depmod is to include which of the following lines in one of the files in /etc/rc.d so the correct module dependencies will be available after booting the system? A. /sbin/depmod -a B. /sbin/depmod -p C. /sbin/depmod -r D. /sbin/depmod -c Answer: A Explanation: depmod creates a list of module dependencies, by reading each module under /lib/modules/version and determining what symbols it exports, and what symbols it needs. By default this list is written to modules.dep in the same directory. The normal use of depmod is to include the line /sbin/depmod -a in one of the files in /etc/rc.d so the correct module dependencies will be available after booting the system. Question 8. What command option of depmod allows you to print a list of all unresolved symbols? A. -e B. -l C. -i D. -a Answer: A Explanation: depmod creates a list of module dependencies, by reading each module under /lib/modules/version and determining what symbols it exports, and what symbols it needs. By default this list is written to modules.dep in the same directory. The normal use of depmod is to include the line /sbin/depmod -a in one of the files in /etc/rc.d so the correct module dependencies will be available after booting the system. depmod -e prints a list of all unresolved symbols. Question 9. Which of the following commands loads the module file into the kernel and changes any symbols that are defined on the command line? A. insmod B. depmod C. modprobe D. setmod Answer: A Explanation: insmod is a system administration command. Load the module file into the kernel, changing any symbols that are defined on the command line. If the module file is named file.o or file.mod, the module will be named file. Question 10. What option of the insmod command can you use to force the loading of module even if problems are encountered? A. -f B. -F C. -u D. -r Answer: A Explanation: insmod is a system administration command. -f: Force loading of module, even if some problems are encountered.
Copyright © 2004 CertsBraindumps.com Inc. All rights reserved.