156-215.77 Free Practice Test

You want to implement Static Destination NAT in order to provide external, Internet users access to an internal Web Server that has a reserved (RFC 1918) IP address. You have an unused valid IP address on the network between your Security Gateway and ISP router. You control the router that sits between the firewall external interface and the Internet.
What is an alternative configuration if proxy ARP cannot be used on your Security Gateway?

1. A. Publish a proxy ARP entry on the ISP router instead of the firewall for the valid IP address.
2. B. Place a static ARP entry on the ISP router for the valid IP address to the firewall's external address.
3. C. Publish a proxy ARP entry on the internal Web server instead of the firewall for the valid IP address.
4. D. Place a static host route on the firewall for the valid IP address to the internal Web server.

Correct Answer: B

How granular may an administrator filter an Access Role with identity awareness? Per:

1. A. Specific ICA Certificate
2. B. AD User
3. C. Radius Group
4. D. Windows Domain

Correct Answer: B

Which of the following is a viable consideration when determining Rule Base order?

1. A. Grouping IPS rules with dynamic drop rules
2. B. Placing more restrictive rules before more permissive rules
3. C. Grouping authentication rules with QOS rules
4. D. Grouping reject and drop rules after the Cleanup Rule

Correct Answer: B

Identify the correct step performed by SmartUpdate to upgrade a remote Security Gateway. After selecting Packages > Distribute Only and choosing the target Gateway, the:

1. A. selected package is copied from the CD-ROM of the SmartUpdate PC directly to the Security Gateway and the installation IS performed.
2. B. selected package is copied from the Package Repository on the Security Management Server to the Security Gateway and the installation IS performed.
3. C. SmartUpdate wizard walks the Administrator through a distributed installation.
4. D. selected package is copied from the Package Repository on the Security Management Server to the Security Gateway but the installation IS NOT performed.

Correct Answer: D

Which of the following actions do NOT take place in IKE Phase 1?

1. A. Peers agree on encryption method.
2. B. Diffie-Hellman key is combined with the key material to produce the symmetrical IPsec key.
3. C. Peers agree on integrity method.
4. D. Each side generates a session key from its private key and the peer’s public key.

Correct Answer: B