nerdexam
Check_Point

156-215.80 · Question #430

Consider the Global Properties following settings: The selected option "Accept Domain Name over UDP (Queries)" means:

The correct answer is A. UDP Queries will be accepted by the traffic allowed only through interfaces with external anti-. The 'Accept Domain Name over UDP (Queries)' Global Properties setting implicitly permits DNS UDP queries only through interfaces that have external anti-spoofing topology configured.

Security Policy Management

Question

Consider the Global Properties following settings:

The selected option "Accept Domain Name over UDP (Queries)" means:

Exhibit

156-215.80 question #430 exhibit

Options

  • AUDP Queries will be accepted by the traffic allowed only through interfaces with external anti-
  • BAll UDP Queries will be accepted by the traffic allowed through all interfaces and this will be done
  • CNo UDP Queries will be accepted by the traffic allowed through all interfaces and this will be done
  • DAll UDP Queries will be accepted by the traffic allowed by first explicit rule written by

How the community answered

(27 responses)
  • A
    81% (22)
  • B
    4% (1)
  • C
    4% (1)
  • D
    11% (3)

Why each option

The 'Accept Domain Name over UDP (Queries)' Global Properties setting implicitly permits DNS UDP queries only through interfaces that have external anti-spoofing topology configured.

AUDP Queries will be accepted by the traffic allowed only through interfaces with external anti-Correct

This setting creates an implicit accept rule that is scoped exclusively to interfaces configured with an external anti-spoofing topology designation. By limiting DNS UDP acceptance to those external-facing interfaces rather than all interfaces, Check Point avoids opening DNS traffic globally while still permitting legitimate external DNS resolution queries through the correct gateway interfaces.

BAll UDP Queries will be accepted by the traffic allowed through all interfaces and this will be done

This is incorrect because the setting does not apply universally to all interfaces - it is specifically scoped to interfaces with external anti-spoofing configuration, not every interface on the gateway.

CNo UDP Queries will be accepted by the traffic allowed through all interfaces and this will be done

This is incorrect because the setting explicitly accepts UDP DNS queries rather than blocking them - a description of 'No UDP Queries' directly contradicts the function of the 'Accept' option.

DAll UDP Queries will be accepted by the traffic allowed by first explicit rule written by

This is incorrect because the acceptance behavior is governed by interface anti-spoofing topology configuration, not by the position of the first explicit rule in the policy rulebase.

Concept tested: Check Point Global Properties implicit DNS UDP rule scoping

Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Content/Topics-SECMG/Global-Properties.htm

Topics

#Global Properties#implied rules#DNS over UDP#anti-spoofing interfaces

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 156-215.80 Practice