Check Point Certified Security Expert (CCSE) Sample Questions

Bypassing the Check Point Certified Security Expert (CCSE) R80.X exam, you will demonstrate that you have the knowledge and abilities required to build and administer Check Point Next-Generation Firewalls effectively. Exercises and practise help you learn how to upgrade Management Servers, optimise VPN performance, and debug firewall operations. The ability to create, modify, deploy, and debug Check Point Security Systems on the GAiA operating system will be validated by obtaining the CCSE – Check Point Certified Expert certification.The article provides a list of Check Point Certified Security Expert (CCSE) Sample Questions that cover core exam topics including –

• Check Point Technology Overview
• Deployment Platforms and Security Policies
• Monitoring Traffic and Connections
• Network Address Translations
• User Management and Authentication
• Using SmartUpdate
• Implementing Identity Awareness
• Configuring VPN Tunnels
• Resolving Security Administration Issues

Advanced Sample Questions

Which of the following is not a valid type of Check Point gateway?

• a. Security Gateway
• b. Threat Prevention Gateway
• c. Management Gateway
• d. SmartEvent Gateway

Answer: d. SmartEvent Gateway

Explanation: SmartEvent Gateway is not a valid type of Check Point gateway. The valid types are Security Gateway, Threat Prevention Gateway, and Management Gateway.

Which of the following is not a valid type of Check Point cluster?

• a. Load Sharing
• b. High Availability
• c. Clustering
• d. Multicast

Answer: c. Clustering

Explanation: Clustering is not a valid type of Check Point cluster. The valid types are Load Sharing, High Availability, and Multicast.

Which of the following is not a valid type of Check Point object?

• a. Host
• b. Network
• c. Group
• d. Policy

Answer: d. Policy

Explanation: Policy is not a valid type of Check Point object. The valid types are Host, Network, and Group.

Which of the following is not a valid type of Check Point rule?

• a. Access Control
• b. NAT
• c. VPN
• d. Authentication

Answer: d. Authentication

Explanation: Authentication is not a valid type of Check Point rule. The valid types are Access Control, NAT, and VPN.

Which of the following is not a valid type of Check Point logging and reporting tool?

• a. SmartView Monitor
• b. SmartReporter
• c. SmartEvent
• d. SmartLog

Answer: a. SmartView Monitor

Explanation: SmartView Monitor is not a valid type of Check Point logging and reporting tool. The valid tools are SmartReporter, SmartEvent, and SmartLog.

Which of the following is not a valid type of Check Point VPN topology?

• a. Site-to-Site
• b. Remote Access
• c. Mesh
• d. Star

Answer: c. Mesh

Explanation: Mesh is not a valid type of Check Point VPN topology. The valid types are Site-to-Site, Remote Access, and Star.

Which of the following is not a valid type of Check Point access control rule?

• a. Source NAT
• b. Destination NAT
• c. Accept
• d. Reject

Answer: c. Accept

Explanation: Accept is not a valid type of Check Point access control rule. The valid types are Source NAT, Destination NAT, and Reject.

Which of the following is not a valid type of Check Point cluster synchronization mode?

• a. Multicast
• b. Unicast
• c. Broadcast
• d. Hybrid

Answer: d. Hybrid

Explanation: Hybrid is not a valid type of Check Point cluster synchronization mode. The valid types are Multicast, Unicast, and Broadcast.

Which of the following is not a valid type of Check Point Threat Prevention profile?

• a. IPS
• b. Anti-Bot
• c. Anti-Virus
• d. Encryption

Answer: d. Encryption

Explanation: Encryption is not a valid type of Check Point Threat Prevention profile. The valid types are IPS, Anti-Bot, and Anti-Virus.

Which of the following is not a valid type of Check Point management high availability mode?

• a. Legacy
• b. New Mode
• c. State Synchronization
• d. Load Sharing

Answer: a. Legacy

Explanation: Legacy is not a valid type of Check Point management high availability mode. The valid types are New Mode, State Synchronization, and Load Sharing.

Basic Sample Questions

Q1)Which of the following DOES NOT constitute a necessary component of VPN communication inside a network?

• A. VPN key
• B. VPN community
• C. VPN trust entities
• D. VPN domain

Correct Answer: A

Q2)As the company’s firewall administrator, Vanessa oversees Check Point firewalls that are administered centrally by R80 Security Management Server at both central and distant locations. R77.30 Gateway is set up at one central place on an Open server. Check Point UTM-1 570 series device with R71 is being used at the remote location. Which encryption is employed in Secure Internal Communication (SIC) between the firewall at each location and central management?

• A. While 3DES encryption is utilised for SIC on remote firewalls, AES128 encryption is used for SIC on central firewalls.
• B. The same encryption is applied to SIC on both firewalls. AES-GCM-256 is used here. 
• C. The encryption suite that SIC will utilise can be chosen by the firewall administrator.

• D. While AES128 encryption is utilised for SIC on remote firewalls, AES256 encryption is used for SIC on central firewalls.

Correct Answer: A

Q3)Which of the following traffic flows DOES NOT belong to SecureXL?

• A. Medium Path
• B. Accelerated Path
• C. High Priority Path
• D. Slow Path

Correct Answer: C

Q4)Which of the following NAT rules has the lowest implementation priority among the automatically generated rules?

• A. Machine Hide NAT
• B. Address Range Hide NAT
• C. Network Hide NAT
• D. Machine Static NAT

Correct Answer: BC

Q5)Which Check Point functionality allows for the detection and scanning of applications?

• A. Application Dictionary
• B. AppWiki
• C. Application Library
• D. CPApp

Correct Answer: B

Q6)What kind of policy are instances of DLP and Geo Policy?

• A. Standard Policies
• B. Shared Policies
• C. Inspection Policies
• D. Unified Policies

Correct Answer: B

Q7)Where are the Security Gateway and Security Management Server installed on the same appliance?

• A. Bridge Mode
• B. Remote
• C. Standalone
• D. Distributed

Correct Answer: C

Q8)Which of the following claims regarding R80 management plug-ins is TRUE?

• A software called the plug-in is installed on the Security Gateway.
• B. Just like with any upgrade procedure, installing a management plug-in necessitates a Snapshot.
• C. To support new products and add new features, a management plug-in communicates with a security management server.
• D. Utilizing a plug-in only makes full central management possible if special licencing is used for certain plug-in functions.

Correct Answer: C

Q9)What programme enables command-line DHCP service configuration on GAIA?

• A. ifconfig
• B. dhcp_cfg
• C. sysconfig
• D. cpconfig

Correct Answer: C

Q10)Which method of VPN routing employs VPN routing for each connection a satellite gateway manages?

• A. To satellites through center only
• B. To center only
• C. To center and to other satellites through center
• D. To center, or through the center to other satellites, to internet and other VPN targets.

Correct Answer: D

Q11)Which software combines logs, identifies security threats, and presents probable attack patterns from all network devices in one place?

• A. SmartView Monitor
• B. SmartEvent
• C. SmartUpdate
• D. SmartDashboard

Correct Answer: B

Q12)Between his corporate office and a branch office, an administrator is establishing an IPsec site-to-site VPN. The same Security Management Server-managed Check Point Security Gateway provides security for both workplaces. The administrator discovered that the check box to enable pre-shared secret is shared and cannot be activated while configuring the VPN community to specify the pre-shared secret. Why is it not possible for him to mention the previously disclosed secret?Between his corporate office and a branch office, an administrator is establishing an IPsec site-to-site VPN. The same Security Management Server-managed Check Point Security Gateway provides security for both workplaces. The administrator discovered that the check box to enable pre-shared secret is shared and cannot be activated while configuring the VPN community to specify the pre-shared secret. Why is it not possible for him to mention the previously disclosed secret?

• A. Both Security Gateways should have the IPsec VPN blade activated.
• B. A VPN must be established between a third-party vendor and the Check Point Security Gateway in order to use pre-shared.
• C. The sole authentication mechanism accessible between two Security Gateways managed by the same SMS is certificate-based authentication.
• D. Security Gateways are R75.40 and earlier.

Q13)Which of the subsequent ClusterXL configurations uses a non-unicast MAC address as the cluster IP address.

• A. High Availability
• B. Load Sharing Multicast
• C. Load Sharing Pivot
• D. Master/Backup

Correct Answer: B

Q14)Which of the following DOES NOT constitute a distinguished name component?

• A. Organizational Unit
• B. Country
• C. Common Name
• D. User container

Correct Answer: D

Q15)Which three authentication techniques does SIC use?

• A. Passwords, Users, and standards-based SSL for the creation of secure channels
• B. Certificates, standards-based SSL for the creation of secure channels, and 3DES or AES128 for encryption
• C. Packet Filtering, certificates, and 3DES or AES128 for encryption
• D. Certificates, Passwords, and Tokens

Correct Answer: B

Q16)You have selected the tracking option for a security rule called “Extended Log.” You still don’t see any data type information, though. What is the MOST probable cause?

• A. Disk space is an issue with logging. Install a database and modify the logging server’s or security management server’s property settings for logging storage.
• B. There is no support for content awareness.
• C. Identity Awareness is not turned on.
• D. Log trimming has been turned on.

Correct Answer: A

Q17)What is the NAT priority hierarchy?

• A. Static NAT, IP pool NAT, hide NAT
• B. IP pool NAT, static NAT, hide NAT
• C. Static NAT, automatic NAT, hide NAT
• D. Static NAT, hide NAT, IP pool NAT

Correct Answer: A

Q18)Which of the following identity acquisition techniques enables a Security Gateway to recognise machines and Active Directory users?

• A. UserCheck
• B. Active Directory Query
• C. Account Unit Query
• D. User Directory Query

Correct Answer: B

Q19)Where should the most popular rules be located to maximise Rule Base effectiveness?

• A. Was taken out of the Rule Base.
• B. In the central portion of the Rule Base.
• C. On the Rule Base’s uppermost level.
• D. In the Rule Base’s final section.

Correct Answer: C

Q20)Which of the following is NOT a way for activating licences?

• A. SmartConsole Wizard
• B. Online Activation
• C. License Activation Wizard
• D. Offline Activation

Correct Answer: A