Free 156-726.77 sample questions

Correct answer: pdp monitor all

The "pdp monitor all" command displays comprehensive information about all currently identified users and machines along with their complete activity records on the Check Point gateway. PDP (Policy Decision Point) is the Identity Awareness component responsible for user identification and access control decisions. This command provides real-time visibility into user sessions, authentication status, and policy enforcement activities. The other commands either use incorrect syntax (pep monitor-a, fw monitor pdp all) or non-existent commands (pdp control monitor all) that do not provide the required user identification monitoring functionality.

Correct answer: only view events from one blade

SmartEvent Intro is a limited version of Check Point SmartEvent that only provides event viewing capabilities for one software blade at a time, restricting comprehensive security analysis across multiple threat prevention technologies. Unlike the full SmartEvent solution which correlates events across all blades simultaneously, SmartEvent Intro limits administrators to analyzing threats from individual blades in isolation. The other options are incorrect: SmartEvent Intro does require a license (not free), it has not been discontinued, and it requires more than just a contract - it needs proper licensing and deployment.

Correct answer: number of megabytes used

SmartEvent groups Application Control events by the number of megabytes used, providing bandwidth consumption analysis to identify applications consuming the most network resources. This grouping method helps administrators prioritize bandwidth management policies and identify potential bandwidth abuse or unexpected application usage patterns. Analyzing by data volume is crucial for Application Control because it reveals the actual network impact of different applications beyond simple connection counts. The other grouping methods (date/time, rule applied, risk) do not provide the bandwidth utilization perspective that is essential for effective Application Control policy management and network optimization.

Correct answer: Can cause data leakage or malware infection without user knowledge

Risk Level 4 (High) indicates applications that can cause data leakage or malware infection without user knowledge, representing severe security threats that operate silently in the background. These applications pose immediate danger because they can compromise systems or exfiltrate sensitive data without any visible indication to the user, making detection and prevention critical. Check Point Application Control uses this risk classification to help administrators prioritize security policies and blocking decisions. The other risk levels describe different threat categories: bypassing security (Risk Level 5), non-business applications (lower risk levels), and applications that require user interaction to cause harm (lower risk classifications).

Correct answer: Deploy the outbound certificate in the company, thus the clients will trust the CA.

To inspect HTTPS traffic without SSL error messages, the outbound certificate must be deployed to company clients so they trust the Check Point gateway acting as a Certificate Authority (CA). When the gateway intercepts SSL connections for inspection, it presents its own certificate to clients - without proper CA trust, browsers display security warnings. Deploying the gateway outbound certificate to the corporate certificate store enables transparent SSL inspection without user interruption. The other options are incorrect: bypass lists defeat the purpose of inspection, official certificates are not required for internal CA functionality, and automatic trust does not occur without proper certificate deployment.

Correct answer: Controls access to web sites based on category

Check Point URL Filtering blade controls access to websites based on predefined and custom categories, providing administrators granular control over web browsing activities. The blade categorizes websites into groups such as social networking, gambling, malware, productivity tools, and business-related sites, enabling policy-based access control. URL Filtering integrates with ThreatCloud for real-time reputation updates and can enforce different access policies for different user groups or time periods. The other options describe different blades: ThreatCloud is the collaborative security network, Application Control blocks web applications, and IPS prevents vulnerability exploits rather than category-based web filtering.