Online Access Free 156-215.71 Exam Questions

For VPN routing to succeed, what must be configured?

• A.A single rule in the Rule Base must cover all traffic on the central (HUB) Security Gateway for the VPN domain.
• B.No rules need to be created; implied rules that cover inbound and outbound traffic on the central (HUB) Gateway are already in place from Policy > Properties > Accept VPN-1 Control Connections.
• C.VPN routing is not configured in the Rule Base or Community objects. Only the native-routing mechanism on each Gateway can direct the traffic via its VTI configured interfaces.
• D.At least two rules in the Rule Base must be created, one to cover traffic inbound and the other to cover traffic outbound on the central (HUB) Security Gateway.

You are creating an output file with the following command: fw monitor -e "accept (src=10.20.30.40 or dst=10.20.30.40);" -o ~/output
Which tool do you use to analyze this file?

• A.You cannot analyze it with any tool as the syntax should be:fw monitor -e accept ([12,b]=10.20.30.40 or [16,b]=10.20.30.40); -o ~/output.
• B.You can analyze the output file with any ASCI editor.
• C.You can analyze it with Wireshark or Ethereal.
• D.The output file format is CSV, so you can use MS Excel to analyze it.

Your company is still using traditional mode VPN configuration on all Gateways and policies. Your manager now requires you to migrate to a simplified VPN policy to benefit from the new features. This needs to be done with no downtime due to critical applications which must run constantly. How would you start such a migration?

• A.Convert the required Gateway policies using the simplified VPN wizard, check their logic and then migrate Gateway per Gateway.
• B.This cannot be done without downtime as a VPN between a traditional mode Gateway and a simplified mode Gateway does not work.
• C.You first need to completely rewrite all policies in simplified mode and then push this new policy to all Gateways at the same time.
• D.This can not be done as it requires a SIC- reset on the Gateways first forcing an outage.

An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R70 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every 1 minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install).
Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval.
If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep-alive packet every minute.
Which of the following is the BEST explanation for this behavior?

• A.The log unification process is using a LUUID (Log Unification Unique Identification) that has become corrupt. Because it is encrypted, the R71 Security Gateway cannot distinguish between GRE sessions. This is a known issue with the GRE. Use IPSEC instead of the non GRE protocol for encapsulation.
• B.The setting Log does not capture this level of details for GRE Set the rule tracking a action to audit since certain types of traffic can only tracked this way.
• C.The Log Server is failing to log GRE traffic property because it is VPN traffic. Disable all VPN configurations to the partner site to enable proper logging.
• D.The Log Server log unification process unifies all log entries from the Security Gateway on a specific connection into only one log entry in the SmartView Tracker. GRE traffic has a 10 minute session timeout, thus each keep-alive packet is considered part of the original logged connection at the beginning of the day.

Peter is your new Security Administrator. On his first working day, he is very nervous and sets the wrong password three times. His account is locked. What can be done to unlock Peter's account? Give the BEST answer.

• A.You can unlock Peter's account by using the command fwm unlock_admin -u Peter on the Security Management Server.
• B.You can unlock Peter's account by using the command fwm unlock_admin -u Peter on the Security Gateway.
• C.You can unlock Peter's account by using the command fwm lock_admin -u Peter on the Security Management Server.
• D.It is not possible to unlock Peter's account. You have to install the firewall once again or abstain from Peter's help.