Checkpoint Interview Questions and Answers 2020

Question 1. What Is Anti-spoofing?

Answer :

Anti-Spoofing is the feature of Checkpoint Firewall. which the help of that we can avoid attacks in which attacker who generate IP Packet with Fake or Spoof source address. It will determine that whether traffic is legitimate or not. If the traffic is not legitimate then firewall block that traffic on interface of firewall.

Question 2. What Is Asymmetric Encryption?

Answer :

In the Asymmetric Encryption there are two different key used for encrypt and decrypt to packet. Means that one key is used for Encrypt packet, and second key used to for decrypt packet. Same key can not encrypt and decrypt.

Question 3. What Is Stealth Rule In Checkpoint Firewall?

Answer :

Stealth Rule will Protect Checkpoint firewall from direct access any traffic. It’s rule should be on the top of Security rule base. In this rule administrator is going to denied all traffic to access checkpoint firewall.

Question 4. What Is Cleanup Rule In Checkpoint Firewall?

Answer :

Cleanup rule are placed at last of the security rule base, Its used to drop all traffic which not match with above rule and Logged. Cleanup rule mainly created for log purpose. In this rule administrator is going to denied all the traffic and enable log.

Networking Tutorial

Question 5. What Is Nat?

Answer :

NAT stand for Network Address Translation. here private IP address are mapped with Public IP Address and Public IP address map with Private IP Address. Mainly its used for offer Security to the private Network and Servers from Internet. NAT is also for to connect Internet with Private IP Address. Because Private IP not route able on Internet.
Question 6. What Is Source Nat?

Answer :

Source NAT is for initiate traffic from internal network to external network. In the source NAT only source IP will translated in public IP address.

Question 7. What Is Vpn (virtual Private Network)?

Answer :

VPN is used to create secure connection between two private network over Internet. It is for Encryption authentication to secure data while transmission. There are two type of VPN

Site to Site VPN.
Remote Access VPN.
CCNA Interview Questions

Question 8. What Is Ip Sec?

Answer :

IP Sec (IP Security) is nothing but set of protocol. which is for make secure communication between two host machine, or network over public network such as Internet. IPSec is for Confidentiality , Integrity, Authenticity and Anti Replay protection. There is two IPSec protocol which provide security

ESP (Encapsulation Security Payload)
AH (Authentication Header).

Question 9. Explain Esp And Ah Ipsec Protocol?

Answer :

ESP:ESP Protocol is nothing but the part of IPsec suit , Its provide Confidentiality, Integrity and Authenticity. It is used in 2 mode
1. Transport mode
2.Tunnel mode.

AH: AH is the most important part of IPsec suit, Its provide only Authentication and Integrity, Its does not provide Encryption. It is also used to two mode Transport mode and Tunnel mode.

Question 10. What Is Explicit Rule In Checkpoint Firewall?

Answer :

Explicit rules are the rules which are created manually by network security administrator .

Question 11. What Is Hide Nat?

Answer :

Hide NAT is for translate multiple private IP or Network with single public IP address. Means many to one translation. Its can be used in source NAT translation. we can not use hide NAT while configuring Destination NAT.

Question 12. What Is Destination Nat?

Answer :
Destination NAT is nothing but when we need to translate Destination IP address with internal private network from public IP address. Only static NAT is their in Destination NAT.

Question 13. Difference Between Automatic Nat And Manual Nat?

Answer :

Automatic NAT:

Automatic created by Firewall Network Security Administrator
Can not modify
Can not create “No NAT” rule
Can not create Dual NAT
Port forwarding not possible
Proxy ARP by default enabled
Manual NAT:

Manually Created by Network Security
Can be Modify
Can be Create “No NAT” rule
Can be Create Dual NAT
Port forwarding possible
Proxy ARP by default not enable

Question 14. What Is Difference Between Standalone Deployment Distributed Deployment?

Answer :

Standalone : In standalone deployment, Security Gateway and Security management server installed on same Machine.

Distributed : In Distributed deployment, Security Gateway and Security Management Server installed on different machine.

Question 15. What Is Sic?

Answer :

SIC stands for “Secure Internal Communication”. Its a firewall feature that is used to make secure communication between Checkpoint firewall component. we can used while Security Gateway and Security management server installed in Distributed deployment. Its Authentication and Encryption for secure communication.

Question 16. What Is three-Tier Architecture Component Of Checkpoint Firewall?

Answer :

Smart Console.
Security Management.
Security Gateway.

Question 17. What Is The Packet Flow Of Checkpoint Firewall?

Answer :

SAM Database.
Address Spoofing.
Session Lookup.
Policy Lookup.
Destination NAT.
Route Lookup.
Source NAT.
Layer 7 Inspection.
VPN.
Routing.

Question 18. What Advantage Of Nat?

Answer :

Save Public IP to save cost.
Security with hide Internal Network.
Avoid Routing.
Publish Server over Internet.
Overlapping Network.
Access Internet from Private IP address.

Question 19. What Is Smart Dashboard?

Answer :

Its tool of smart console. we can use this for Configure Rule, Policy object, Create NAT Policy, Configure VPN and Cluster.

Question 20. Which Applications In Check Point Technology Can Be Used To Configure Security Objects?

Answer :

SmartDashboard

Question 21.What’s the Table Checkpoints?
Answer :

Table Checkpoint is nothing but which checks the information with in a table.

Question 22.Where you can view the results of the checkpoint?
Answer :
we can view the results of the checkpoints in the Test Result Window.

Question 23.What’s the Standard Checkpoint?
Answer :
property value of an object in your application or web page is checked by standard checkpoint.

Question 24.Which environment are supported by Standard Checkpoint?
Answer :
All add-in environments are supported by Standard Checkpoint.
Question 25.What’s the Bitmap Checkpoint?
Answer :
In checkpoint Bitmap checks the bitmap images in your web page or application.

Question 26.Which environments are supported by Image Checkpoint?
Answer :
Image Checkpoint are supported only Web environment.

Question 27.Which environments are supported by Table Checkpoint?
Answe-
Table Checkpoints are supported only ActiveX environment.

Question 28.How Checkpoint Component communicate and Syns with each other?
Ans-
Secure Internal Communications (SIC) is the firewall feature that ensures components, such as Security Gateways, SmartCenter Server, SmartConsole, etc. can communicate with each other securely using a simple communication-initialization process.

Question 29.What are the major differences between SPLAT and GAIA?
Ans-
Gaia is the latest version of firewall which is a combination of SPLAT and IPSO. Following are the benefits of Gaia as compare to SPLAT/IPSO.

1. Web-Based user interface with Search Navigation
2. Full Software Blade support
3. High connection capacity
4. Role-Based administrative Access
5. Intelligent Software updates
6. Native IPv4 and IPv6 Support
7. ClusterXL or VRRP Clusters
8. Manageable Dynamic Routing Suite
9. Full Compatibility with IPSO and SecurePlatform.
Question

30.Checkpoint Packet flow for SNAT and DNAT?
Ans.
In case of SNAT
Antispoofing
Session lookup
Policy lookup
Routing
Netting
In case of DNAT
Antispoofing
Session lookup
Policy lookup
Netting

Question 31. Explain functions of CPD, FWM, and FWD processes.
Ans-
CPD – In hierarchical chain CPD is on high and helps to execute many services, such as Secure Internal Communication (SIC), Licensing and status report.

FWM – The FWM is responsible for the execution of the database activities of the SmartCenter server. Management High Availability (HA) Synchronization, Policy installation,saving the Policy, Database Read/Write action, Log Display, etc. all are the responsibilities of FWM.

FWD – The FWD is responsible for logging. It will execute in relation to logging, Security Servers and communication with OPSEC applications.

Question 32.How SIC work? What are the different ports of SIC?
Ans-
Secure Internal Communication (SIC) helps CheckPoint platforms and products authenticate with each other. The Secure Internal Communication procedure creates a trusted status between gateways, management servers and other Check Point components. SIC is most important to install polices on gateways and to send logs between gateways and management servers.

These security measures are required for the safety of SIC:

1. Certificates for authentication
2. For the creation of the secure channel we need Standards-based SSL.
3. 3DES for encryption

The Internal Certificate Authority (ICA)

While installation process of the Security Management server the ICA is created . The ICA is important for issuing certificates for authentication. For ex. ICA issues certificates such as Secure Internal Communication (SIC) certificates for authentication purposes to administrators and VPN certificates to users and gateways.

Initializing the Trust Establishment Process

During Initializing Communication establishes a trust between the Security Management server and the Check Point gateways. This trust lets Check Point components communicate securely. Trust established when the gateways and the server have SIC certificates.

The Internal Certificate Authority is created when the Security Management server is installed. The ICA issues and certificate delivers to the Security Management server.

To initialize SIC:

1. Decide on an alphanumeric Activation Key.
2. In SmartDashboard, open the gateway network object. In General Properties page of the gateway, click Communication to initialize the SIC procedure.
3.Enter the Activation Key that you created in step 2 in the Communication window of the object.
4. Click Initialize.

The ICA signs & issues a certificate to the gateway. Trust state is Initialized but not trusted. The certificate issued for the gateway but it will not yet delivered.

SSL negotiation takes place. The 2 communicating peers authenticated with their Activation Key.

The certificate is now downloaded securely & stored on the gateway.
After Initialization, the gateway is able to communicate with any Check Point node that possesses a SIC certificate, signed by the same ICA. The Activation Key is deleted. The SIC process their is no any requirement of the Activation Key, only the SIC certificates.

Checkpoint SIC Ports

PORT TYPE SERVICE DESCRIPTION
18209 tcp NGX Gateway <> ICAs (status, issue, or revoke).
18210 tcp Pulls Certificates from an ICA.
18211 tcp Use by cpd daemon (on the gateway) to receive Certificates.