156-215.77

156-215.77 practice questions, page 9 of 15, with answer review and explanations.

Question 41

Which Check Point address translation method is necessary if you want to connect from a host on the Internet via HTTP to a server with a reserved (RFC 1918) IP address on your DMZ?

  1. Dynamic Source Address Translation
  2. Hide Address Translation
  3. Port Address Translation
  4. Static Destination Address Translation

Question 42

You want to implement Static Destination NAT in order to provide external, Internet users access to an internal Web Server that has a reserved (RFC 1918) IP address. You have an unused valid IP address on the network between your Security Gateway and ISP router. You control the router that sits between the firewall external interface and the Internet. What is an alternative configuration if proxy ARP cannot be used on your Security Gateway?

  1. Publish a proxy ARP entry on the ISP router instead of the firewall for the valid IP address.
  2. Place a static ARP entry on the ISP router for the valid IP address to the firewall's external address.
  3. Publish a proxy ARP entry on the internal Web server instead of the firewall for the valid IP address.
  4. Place a static host route on the firewall for the valid IP address to the internal Web server.

Question 43

After implementing Static Address Translation to allow Internet traffic to an internal Web Server on your DMZ, you notice that any NATed connections to that machine are being dropped by anti-spoofing protections. Which of the following is the MOST LIKELY cause?

  1. The Global Properties setting Translate destination on client side is unchecked. But the topology on the DMZ interface is set to Internal - Network defined by IP and Mask. Check the Global Properties setting Translate destination on client side.
  2. The Global Properties setting Translate destination on client side is unchecked. But the topology on the external interface is set to Others +. Change topology to External.
  3. The Global Properties setting Translate destination on client side is checked. But the topology on the external interface is set to External. Change topology to Others +.
  4. The Global Properties setting Translate destination on client side is checked. But the topology on the DMZ interface is set to Internal - Network defined by IP

Question 44

Which NAT option applicable for Automatic NAT applies to Manual NAT as well?

  1. Allow bi-directional NAT
  2. Automatic ARP configuration
  3. Translate destination on client-side
  4. Enable IP Pool NAT

Question 45

Your main internal network 10.10.10.0/24 allows all traffic to the Internet using Hide NAT. You also have a small network 10.10.20.0/24 behind the internal router. You want to configure the kernel to translate the source address only when network 10.10.20.0 tries to access the Internet for HTTP, SMTP, and FTP services. Which of the following configurations will allow this network to access the Internet?

  1. Configure three Manual Static NAT rules for network 10.10.20.0/24, one for each service.
  2. Configure Automatic Static NAT on network 10.10.20.0/24.
  3. Configure one Manual Hide NAT rule for HTTP, FTP, and SMTP services for network 10.10.20.0/24.
  4. Configure Automatic Hide NAT on network 10.10.20.0/24 and then edit the Service column in the NAT Rule Base on the automatic rule.