CheckPoint Check Point Security Administration NGX II (156-315.1) 認定 156-315 試験問題:

1. Jerry is concerned that a denial-of-service (DoS) attack may affect his VPN Communities.
He decides to implement IKE DoS protection. Jerry needs to minimize the performance impact of implementing this new protection. Which of the following configurations is MOST appropriate for Jerry?

A) Set Support IKE DoS protection from identified source to "Stateless," and Support IKE DoS protection from unidentified source to "Puzzles".
B) Set Support IKE DoS protection from identified source to "Puzzles", and Support IKE DoS protection from unidentified source to "Stateless".
C) Set Support IKE Dos Protection from identified source, and Support IKE DoS protection from unidentified source to "Puzzles".
D) Set Support IKE DoS protection from identified source to "Stateless", and Support IKE DoS protection from unidentified source to "None".
E) Set "Support IKE DoS protection" from identified source, and "Support IKE DoS protection" from unidentified source to "Stateless".

2. Regarding QoS guarantees and limits, which of the following statements is FALSE?

A) If both a rule and per-connection limit are defined for a rule, the per-connection limit must not be greater than the rule limit.
B) If a guarantee is defined in a sub-rule, a guarantee must be defined for the rule above it.
C) If both a limit and guarantee per rule are defined in a QoS rule, the limit must be smaller than the guarantee.
D) The guarantee of a sub-rule cannot be greater than the guarantee defined for the rule above it.
E) A rule guarantee must not be less than the sum defined in the guarantees' sub-rules.

3. How can you prevent delay-sensitive applications, such as video and voice traffic, from being dropped due to long queues when using a Check Point QoS solution?

A) guaranteed per connection
B) DiffServ rule
C) Weighted Fair Queuing
D) Low latency class
E) guaranteed per VoIP rule

4. VPN-1 NGX supports VoIP traffic in all of the following environments, except which environment?

A) H.323
B) SCCP
C) H.509-b
D) SIP
E) MGCP

5. Yoav is a Security Administrator preparing to implement a VPN solution for his multi-site organization. To comply with industry regulations, Yoav's VPN solution must meet the following requirements:
Portability: Standard
Key management: Automatic, external PKI
Session keys: Changed at configured times during a connection's lifetime Key length: No less than 128-bit Data integrity: Secure against inversion and brute-force attacks What is the most appropriate setting Yoav should choose?

A) IKE VPNs: SHA1 encryption for IKE Phase 1, and MD5 encryption for Phase 2; AES hash
B) IKE VPNs: CAST encryption for IKE Phase 1, and SHA1 encryption for Phase 2; DES hash
C) IKE VPNs: AES encryption for IKE Phase 1, and DES encryption for Phase 2; SHA1 hash
D) IKE VPNs: AES encryption for IKE Phase 1, and AES encryption for Phase 2; SHA1 hash
E) IKE VPNs: DES encryption for IKE Phase 1, and 3DES encryption for Phase 2; MD5 hash

質問と回答：