File Info
| Exam | IBM Certified Associate Administrator - Security QRadar SIEM V7.2.8 |
| Number | 156-730 |
| File Name | Checkpoint.156-730.TestKing.2019-02-21.40q.vcex |
| Size | 21 KB |
| Posted | Feb 21, 2019 |
| Download | Checkpoint.156-730.TestKing.2019-02-21.40q.vcex |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
Which protocols are supported by the THREAT EMULATION blade?
- CIFS, FTP, and optional HTTP and SMTP support
- HTTP(S), SMTP/TLS only
- HTTP and SMTP only, there is no SSL/TLS security support
- HTTP(S), SMTP/TLS with optional CIFS
Correct answer: D
Question 2
Which SmartConsole can you use to view Threat Emulation forensics reports?
- SmartView Monitor
- SmartView Reporter
- SmartLog
- SmartDashboard
Correct answer: C
Question 3
How does Threat Extraction work?
- Scan and extract files for Command and Control activity.
- It emulates a document and, if malicious, converts it into a PDF.
- It extracts active content from a document.
- It scans the document for malicious code and removes it.
Correct answer: C
Question 4
What kind of approach or approaches will Check Point SandBlast apply to prevent malicious EXE-files?
- Machine learning algorithm
- Signature
- Exploit
- Whitelist and Exploit
Correct answer: C
Question 5
You have installed the SandBlast Agent with forensics. An attack has occurred, which triggered the Forensics Blade to collect information. You clicked to open the forensics report but for some reason it is not showing the report as it should. What could be the issue?
- The attack was based on a macro and the Forensics Blade only supports executables.
- There is a Microsoft update missing which causes the report not to show as it should.
- There was no real attack and this is a false positive.
- Threat Emulation is disabled.
Correct answer: B
Question 6
The file reclassifier is a Threat Emulation component used to perform which function on files in the stream?
- Count the hits of each file extension, used as part of the reporting mechanism.
- Used to measure Threat Emulation usage and reporting back to Check Point.
- Used to rename files extension so they are processed using the correct application based on the file magic.
- Used to rename files extension so they are processed using the correct application based on the current file extension.
Correct answer: D
Question 7
Which of the following is FALSE about the SandBlast Agent capabilities?
- Stop data exfiltration to prevent disclosure of sensitive information, and quarantine infected systems to limit spread of malware.
- Detect and block command and control communications, even when working remotely.
- Connect to remote offices via virtual private networking in order to gain secure access to local resources.
- Get unparalleled visibility into specific endpoint and processes to enable faster recovery post-infection.
Correct answer: C
Question 8
With regard to SandBlast Cloud emulation, which statement is INCORRECT?
- SandBlast Cloud licensing offers fair usage caps which customers should never reach.
- SandBlast Cloud licensing requires a license SKU per gateway.
- Only new files not seen before are emulated on the cloud and count against fair usage cap.
- For simplicity, SandBlast Cloud offers a single license SKU per User Center, covering all files sent from all gateways in that User Center.
Correct answer: D
Question 9
Threat Emulation Cloud offers pods to perform emulation, in which geographies are these pods located
- USA and Germany only
- Germany, Israel, USA
- UK, USA, South America
- Israel, Germany, Russia
Correct answer: B
Question 10
You can restrict a user from downloading an original file if it is getting a malicious verdict from Threat Emulation?
- True – This is possible through the SmartDashboard Threat extraction settings.
- False – Due to security concerns, a user will never be able to download a file found to be malicious.
- True – Under Threat emulation settings you can configure this option.
- False – Threat Emulation provides a recommendation verdict. The user can download the file even if it is found to be malicious.
Correct answer: C
