156-215.77

156-215.77 practice questions, page 13 of 15, with answer review and explanations.

Question 61

You enable Automatic Static NAT on an internal host node object with a private IP address of 10.10.10.5, which is NATed into 216.216.216.5. (You use the default settings in Global Properties / NAT.) When you run fw monitor on the R77 Security Gateway and then start a new HTTP connection from host 10.10.10.5 to browse the Internet, at what point in the monitor output will you observe the HTTP SYN-ACK packet translated from 216.216.216.5 back into 10.10.10.5?

  1. o=outbound kernel, before the virtual machine
  2. I=inbound kernel, after the virtual machine
  3. O=outbound kernel, after the virtual machine
  4. i=inbound kernel, before the virtual machine

Question 62

You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate destination on client site from Global Properties > NAT. Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?

  1. No extra configuration is needed.
  2. A proxy ARP entry, to ensure packets destined for the public IP address will reach the Security Gateway's external interface.
  3. The NAT IP address must be added to the external Gateway interface anti-spoofing group.
  4. A static route, to ensure packets destined for the public NAT IP address will reach the Gateway's internal interface.

Question 63

You just installed a new Web server in the DMZ that must be reachable from the Internet. You create a manual Static NAT rule as follows: SourcE. Any || Destination: web_public_IP || ServicE. Any || Translated SourcE. original || Translated Destination: web_private_IP || ServicE. Original "web_public_IP ? is the node object that represents the new Web server's public IP address. "web_private_IP ? is the node object that represents the new Web site's private IP address. You enable all settings from Global Properties > NAT. When you try to browse the Web server from the Internet you see the error "page cannot be displayed ?. Which of the following is NOT a possible reason?

  1. There is no Security Policy defined that allows HTTP traffic to the protected Web server.
  2. There is no ARP table entry for the protected Web server's public IP address.
  3. There is no route defined on the Security Gateway for the public IP address to the Web server's private IP address.
  4. There is no NAT rule translating the source IP address of packets coming from the protected Web server.

Question 64

You are responsible for the configuration of MegaCorp's Check Point Firewall. You need to allow two NAT rules to match a connection. Is it possible? Give the BEST answer.

  1. No, it is not possible to have more than one NAT rule matching a connection. When the firewall receives a packet belonging to a connection, it compares it against the first rule in the Rule Base, then the second rule, and so on. When it finds a rule that matches, it stops checking and applies that rule.
  2. Yes, it is possible to have two NAT rules which match a connection, but only in using Manual NAT (bidirectional NAT).
  3. Yes, there are always as many active NAT rules as there are connections.
  4. Yes, it is possible to have two NAT rules which match a connection, but only when using Automatic NAT (bidirectional NAT).

Question 65

You have created a Rule Base for firewall, websydney. Now you are going to create a new policy package with security and address translation rules for a second Gateway. What is TRUE about the new package's NAT rules? Exhibit:

  1. Rules 1, 2, 3 will appear in the new package.
  2. Only rule 1 will appear in the new package.
  3. NAT rules will be empty in the new package.
  4. Rules 4 and 5 will appear in the new package.