CCSM Practice Test 9 — 10 Questions

Question 1

A security administrator manages a distributed Check Point deployment where four Security Gateways send logs to a dedicated Log Server. The administrator needs to grant a junior colleague read-only access to logs and objects in SmartConsole without allowing policy installation or object modification. Which configuration should the administrator apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new administrator account with the 'Read Only' profile in the SmartConsole Administrators section, then assign the appropriate permission profile to that account.. Granting least-privilege access in a distributed deployment is done by creating an administrator account and assigning a permission profile that limits the user to viewing logs and objects. A read-only profile enforces this at the management layer, so the colleague can inspect data without the ability to install policy or change objects, which is exactly what the scenario requires.

Answer

Add the colleague to the 'trusted clients' list on the Log Server so SmartConsole allows the connection without authentication.

Answer

Configure a GuiDBedit session and set the colleague's user object to 'readonly' by editing the internal database directly.

Answer

Enable SmartEvent read-only mode on the Management Server and share the SmartEvent client credentials with the colleague.

Question 2

An administrator is troubleshooting an IPsec VPN that intermittently drops large file transfers while small pings succeed. The gateways are Check Point Security Gateways running R81.20. Which TWO actions should the administrator take to identify and resolve the issue? (Choose two.)

Accepted Answer

Check whether the IPsec packet size exceeds the path MTU and enable MSS clamping or adjust the MTU on the external interface.. Intermittent drops during large transfers while small pings succeed point to an MTU or fragmentation problem. Checking whether IPsec packets exceed the path MTU and applying MSS clamping or MTU adjustments reduces packet size, while verifying DF bit handling and allowing ICMP type 3 code 4 ensures Path MTU Discovery works. Together these actions identify and resolve the size-dependent packet loss.

Answer

Run 'vpn debug ikeon' and analyze ike.elg for Phase 1 and Phase 2 negotiation errors.

Answer

Disable NAT-Traversal on both gateways to eliminate UDP encapsulation overhead.

Answer

Reset the user's certificate and require re-enrollment to refresh the IKE credentials.

Question 3

A Check Point administrator is troubleshooting an IPsec VPN where Phase 2 negotiations fail with the error 'No proposal chosen'. The peer is a Cisco ASA. Both gateways are configured with AES-256 and SHA-256 for Phase 2. What is the most likely cause?

Accepted Answer

The Phase 2 PFS group is not identical on both gateways.. The error 'No proposal chosen' during Phase 2 indicates that the two gateways could not agree on a Phase 2 proposal. PFS group, encryption, and hashing must match exactly. Since encryption and hashing are already aligned, the PFS group setting is the likely culprit and must be identical on both peers.

Answer

The VPN tunnel interface is not configured with the correct IP address.

Answer

The shared secret for the VPN community is incorrect.

Answer

The Phase 1 encryption algorithms do not match between the gateways.

Question 4

An administrator is deploying Threat Extraction on a Check Point R81 Security Gateway to sanitize documents downloaded from the internet. The administrator wants to ensure that the solution meets security and usability requirements. Which two statements are true regarding Threat Extraction? (Choose two.)

Accepted Answer

Threat Extraction can be configured to provide a download link for the original file, allowing users to access it after a warning.. Threat Extraction reconstructs files to remove active content, ensuring safe delivery, and can optionally provide a link to the original file for user access with a warning. These two statements accurately describe its capabilities. The blade operates independently of Threat Emulation and does not rely on Anti-Virus verdicts to decide when to sanitize.

Answer

Threat Extraction only sanitizes files that are determined to be malicious by the Anti-Virus blade.

Answer

Threat Extraction always delivers the original file if the sanitized version cannot be created within a specified timeout.

Answer

Threat Extraction requires the Threat Emulation blade to be enabled because it relies on sandbox verdicts to decide whether to sanitize.

Question 5

A Check Point administrator needs to verify that VPN traffic is being encrypted and decrypted correctly on a Security Gateway. Which command should the administrator use to view the current IPsec SA details?

Accepted Answer

vpn tu. The 'vpn tu' command is specifically designed for VPN troubleshooting on Check Point gateways. It provides a menu to list IPsec SAs, including encryption and authentication algorithms, and can also be used to reset SAs. It is the most direct way to verify that traffic is being encrypted and decrypted correctly.

Answer

cpstat vpn

Answer

ike debug on

Answer

fw monitor

Question 6

A Check Point administrator configures Threat Emulation to run on a Security Gateway. Files submitted for emulation are taking too long, and the administrator wants to ensure that users are not blocked indefinitely while still protecting them. Which Threat Emulation configuration best addresses this?

Accepted Answer

Configure a timeout value and a fallback action for files that exceed it.. Configuring a timeout and a fallback action is the correct approach because it bounds how long a file can be held and defines what happens if emulation does not complete. This prevents indefinite user delays while still applying a security decision. Detect-only, Hold mode, or size reduction either remove protection or fail to address the blocking problem.

Answer

Reduce the maximum file size submitted to emulation to speed up analysis.

Answer

Set the emulation action to 'Detect' so files are never blocked.

Answer

Enable 'Hold' mode so files wait until emulation completes, regardless of duration.

Question 7

An administrator is configuring Threat Extraction on an R81 Security Gateway. Users complain that PDF files received via email are being sanitized, but they need the original formatting for legal reasons. The administrator wants to ensure that only files from untrusted sources are sanitized while files from a specific trusted partner domain are delivered unmodified. What should the administrator do?

Accepted Answer

Create a Threat Extraction exception rule that bypasses extraction for the trusted partner's domain.. Threat Extraction exceptions are designed to bypass sanitization for trusted sources. By configuring an exception for the partner's domain, the administrator ensures that files from that domain are delivered in their original form, satisfying legal requirements. Other traffic continues to be sanitized, maintaining security. This granular approach is preferred over global changes.

Answer

Configure the partner's domain as a trusted source in the Anti-Virus blade settings.

Answer

Disable Threat Extraction globally and rely solely on Anti-Virus scanning for all email.

Answer

Modify the Threat Extraction policy to only sanitize files with active content, such as macros.

Question 8

A security operations team wants to correlate ThreatCloud verdicts with local logs. They observe that a file downloaded from an external site was blocked by Threat Emulation, but the SmartLog record shows the verdict as 'Malicious' with no forensic report attached. The administrator confirms the file was submitted successfully. Which statement best explains the missing forensic report?

Accepted Answer

The file was blocked before full emulation completed, so only the preliminary ThreatCloud verdict is available.. Threat Emulation can act on a preliminary verdict derived from reputation or an abbreviated analysis, blocking the file quickly and logging the malicious determination. In that case the deeper forensic report is not attached because the full sandbox analysis did not complete. Recognizing the difference between an early block and a completed analysis clarifies why some log entries carry rich forensics and others do not.

Answer

Forensic reports are only generated when the file is allowed, not when it is blocked.

Answer

The forensic report requires SandBlast Agent to be deployed on the endpoint that downloaded the file.

Answer

Forensic reports are stored only in ThreatCloud and never surfaced in SmartLog.

Question 9

A security administrator is investigating why a specific rule in the Security Policy is not matching traffic as expected. The administrator wants to see how the firewall is processing packets against the rulebase, including which rule matches and what actions are taken. Which command provides a real-time debug of the policy matching process?

Accepted Answer

fw ctl zdebug + rule. The correct command is fw ctl zdebug + rule, which activates a debug that logs rule matching decisions in real time. It shows which rule number matches each packet and the action taken, helping to diagnose policy misconfigurations. Other commands either capture packets without rule context, show drop reasons only, or debug management processes, not the data plane rule engine.

Answer

fw debug fwm

Answer

fw ctl zdebug drop

Answer

fw monitor

Question 10

A Check Point administrator is reviewing Threat Prevention logs and notices a high number of 'Detect' alerts for the protection 'Suspicious_Executable_Download' but no 'Prevent' actions. The administrator wants to ensure that this protection blocks malicious downloads in the future. What should the administrator do?

Accepted Answer

Change the action of the 'Suspicious_Executable_Download' protection to 'Prevent' in the Threat Prevention profile.. To enforce blocking instead of just logging, the administrator must change the action of the specific protection from 'Detect' to 'Prevent' within the Threat Prevention profile. This ensures that the protection actively blocks malicious executable downloads while maintaining granular control over the policy.

Answer

Enable the 'Strict' profile mode in the Threat Prevention policy.

Answer

Create a new Threat Prevention rule that blocks all executable downloads.

Answer

Modify the Anti-Bot blade settings to block executable downloads.