Free 156-726.77 sample questions

Correct answer: Browser-Based Authentication, Active Directory Query, Identity Agents, Terminal Servers (Users have same source IP), RADIUS Accounting

Check Point Identity Awareness supports multiple identity source methods to accommodate diverse network environments. Browser-Based Authentication provides web-based user identification, Active Directory Query enables integration with Microsoft AD for automated user lookup, Identity Agents offer transparent identification without user interaction, Terminal Servers support environments where multiple users share the same source IP, and RADIUS Accounting allows integration with existing authentication infrastructure. The other options are incomplete as they exclude critical identification methods like RADIUS Accounting or Browser-Based Authentication that are essential for comprehensive identity management in enterprise environments.

Correct answer: pdp monitor all

The "pdp monitor all" command displays comprehensive information about all currently identified users and machines along with their complete activity records on the Check Point gateway. PDP (Policy Decision Point) is the Identity Awareness component responsible for user identification and access control decisions. This command provides real-time visibility into user sessions, authentication status, and policy enforcement activities. The other commands either use incorrect syntax (pep monitor-a, fw monitor pdp all) or non-existent commands (pdp control monitor all) that do not provide the required user identification monitoring functionality.

Correct answer: only view events from one blade

SmartEvent Intro is a limited version of Check Point SmartEvent that only provides event viewing capabilities for one software blade at a time, restricting comprehensive security analysis across multiple threat prevention technologies. Unlike the full SmartEvent solution which correlates events across all blades simultaneously, SmartEvent Intro limits administrators to analyzing threats from individual blades in isolation. The other options are incorrect: SmartEvent Intro does require a license (not free), it has not been discontinued, and it requires more than just a contract - it needs proper licensing and deployment.

Correct answer: number of megabytes used

SmartEvent groups Application Control events by the number of megabytes used, providing bandwidth consumption analysis to identify applications consuming the most network resources. This grouping method helps administrators prioritize bandwidth management policies and identify potential bandwidth abuse or unexpected application usage patterns. Analyzing by data volume is crucial for Application Control because it reveals the actual network impact of different applications beyond simple connection counts. The other grouping methods (date/time, rule applied, risk) do not provide the bandwidth utilization perspective that is essential for effective Application Control policy management and network optimization.

Correct answer: Can cause data leakage or malware infection without user knowledge

Risk Level 4 (High) indicates applications that can cause data leakage or malware infection without user knowledge, representing severe security threats that operate silently in the background. These applications pose immediate danger because they can compromise systems or exfiltrate sensitive data without any visible indication to the user, making detection and prevention critical. Check Point Application Control uses this risk classification to help administrators prioritize security policies and blocking decisions. The other risk levels describe different threat categories: bypassing security (Risk Level 5), non-business applications (lower risk levels), and applications that require user interaction to cause harm (lower risk classifications).

Correct answer: Deploy the outbound certificate in the company, thus the clients will trust the CA.

To inspect HTTPS traffic without SSL error messages, the outbound certificate must be deployed to company clients so they trust the Check Point gateway acting as a Certificate Authority (CA). When the gateway intercepts SSL connections for inspection, it presents its own certificate to clients - without proper CA trust, browsers display security warnings. Deploying the gateway outbound certificate to the corporate certificate store enables transparent SSL inspection without user interruption. The other options are incorrect: bypass lists defeat the purpose of inspection, official certificates are not required for internal CA functionality, and automatic trust does not occur without proper certificate deployment.