156-315.77

156-315.77 practice questions, page 25 of 30, with answer review and explanations.

Question 121

Which Check Point product implements a Consolidation Policy?

  1. SmartLSM
  2. SmartView Tracker
  3. SmartView Monitor
  4. SmartReporter

Question 122

You have selected the event Port Scan from Internal Network in SmartEvent, to detect an event when 30 port scans have occurred within 60 seconds. You also want to detect two port scans from a host within 10 seconds of each other. How would you accomplish this?

  1. Define the two port-scan detections as an exception.
  2. You cannot set SmartEvent to detect two port scans from a host within 10 seconds of each other.
  3. Select the two port-scan detections as a sub-event.
  4. Select the two port-scan detections as a new event.

Question 123

When do modifications to the Event Policy take effect?

  1. As soon as the Policy Tab window is closed.
  2. When saved on the SmartEvent Server and installed to the Correlation Units.
  3. When saved on the Correlation Units, and pushed as a policy.
  4. When saved on the SmartEvent Client, and installed on the SmartEvent Server.

Question 124

To back up all events stored in the SmartEvent Server, you should back up the contents of which folder(s)?

  1. $FWDIR/distrib
  2. $FWDIR/distrib_db and $FWDIR/events
  3. $RTDIR/distrib and $RTDIR/events_db
  4. $RTDIR/events_db

Question 125

To clean the system of all SmartEvent events, you should delete the files in which folder(s)?

  1. $RTDIR/events_db
  2. $FWDIR/distrib_db and $FWDIR/events
  3. $RTDIR/distrib and $RTDIR/events_db
  4. $FWDIR/distrib