The Best Practice Test Preparation for the 156-587 Certification Exam
156-587 Exam Dumps, Practice Test Questions BUNDLE PACK
NEW QUESTION # 32
Captive Portal, PDP and PEP run in what space?
- A. CPM
- B. Kernel
- C. User
- D. FWD
Answer: C
NEW QUESTION # 33
SmartEvent utilizes the Log Server, Correlation Unit and SmartEvent Server to aggregate logs and identify security events. The three main processes that govern these SmartEvent components are:
- A. fwd, secu, sesrv
- B. cpcu, cplog, cpse
- C. cpsemd, cpsead, and DBSync
- D. eventiasv, eventiarp,eventiacu
Answer: D
Explanation:
SmartEvent is a unified security event management and analysis solution that collects and analyzes data from multiple sources to identify and respond to security threats. SmartEvent consists of three main components:
Log Server, Correlation Unit, and SmartEvent Server1. The three main processes that govern these SmartEvent components are:
* eventiasv: This process is responsible for indexing the logs received from the Log Server and storing them in the SmartEvent database. It also performs log consolidation and compression to optimize the disk space usage2.
* eventiarp: This process is responsible for running the predefined and custom correlation rules on the indexed logs and generating security events based on the rule criteria. It also sends notifications and triggers automatic responses for the security events3.
* eventiacu: This process is responsible for providing the web-based user interface for SmartEvent, which allows the administrators to view, analyze, and manage the security events. It also provides the SmartEvent API for external integration4. References: Check Point Processes and Daemons5, SmartEvent Administration Guide1
1: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.
10_SmartEvent_AdminGuide/html_frameset.htm 2: https://sc1.checkpoint.com/documents/R81.10
/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent- Components.htm#_Toc64167467 3: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN
/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.
htm#_Toc64167468 4: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.
10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.htm#_Toc64167469 5:
https://supportcenter.checkpoint.com/supportcenter/portal?
eventSubmit_doGoviewsolutiondetails=&solutionid=sk97638
NEW QUESTION # 34
What is NOT a benefit of the 'fw ctl zdebug' command?
- A. Clean the buffer
- B. Collect debug messages from the kernel
- C. Automatically allocate a 1MB buffer
- D. Cannot be used to debug additional modules
Answer: D
Explanation:
The fw ctl zdebug command is a powerful tool that can be used to collect debug messages from the kernel, clean the buffer, and automatically allocate a 1MB buffer. However, it cannot be used to debug additional modules, such as SecureXL, CoreXL, or VPN. For those modules, other commands or tools are needed, such as fwaccel dbg, fw ctl affinity, or vpn debug.
References:
* 2: "fw ctl zdebug" - Helpful Command Combinations
* 3: How to use " fw ctl zdebug" command
Troubleshooting Expert R81.1 (CCTE) Course Outline) - Module 4: Debugging Tools and Methods
NEW QUESTION # 35
You modified kernel parameters and after rebooting the gateway, a lot of production traffic gets dropped and the gateway acts strangely What should you do"?
- A. Remove all kernel parameters from fwkem.conf and reboot
- B. Run command fw ctl set int fw1_kernel_all_disable=1
- C. run fw unloadlocal to remove parameters from kernel
- D. Restore fwkem.conf from backup and reboot the gateway
Answer: D
Explanation:
If you have modified kernel parameters (in fwkern.conf, for example) and the gateway starts dropping traffic or behaving abnormally after a reboot, the best practice is to restore the original or a known-good configuration from backup. Then, reboot again so that the gateway loads the last known stable settings.
* Option A (fw ctl set int fw1_kernel_all_disable=1) is not a standard or documented method for
"undoing" all kernel tweaks.
* Option B (Restore fwkem.conf from backup and reboot the gateway) is the correct and straightforward approach.
* Option C (fw unloadlocal) removes the local policy but does not revert custom kernel parameters that have already been loaded at boot.
* Option D (Remove all kernel parameters from fwkem.conf and reboot) might help in some cases, but you risk losing other beneficial or necessary parameters if there were legitimate custom settings.
Restoring from a known-good backup is safer and more precise.
Hence, the best answer:"Restore fwkem.conf from backup and reboot the gateway." Check Point Troubleshooting References
* sk98339 - Working with fwkern.conf (kernel parameters) in Gaia OS.
* sk92739 - Advanced System Tuning in Gaia OS.
* Check Point Gaia Administration Guide - Section on kernel parameters and system tuning.
* Check Point CLI Reference Guide - Explanation of using fw ctl, fw unloadlocal, and relevant troubleshooting commands.
NEW QUESTION # 36
Your users have some issues connecting with Mobile Access VPN to your gateway. How can you debug the tunnel establishment?
- A. run vpn debug truncon
- B. run fw ctl zdebug -m sslvpn all
- C. in the file $CVPNDIR/conf/httpd.conf change the line Loglevel .. To LogLevel debug and run cvpnrestart
- D. in the file $VPNDIR/conf/httpd.conf change the line Loglevel .. To LogLevel debug and run vpn restart
Answer: C
NEW QUESTION # 37
What is the best way to resolve an issue caused by a frozen process?
- A. Kill the process
- B. Reboot the machine
- C. Restart the process
- D. Power off the machine
Answer: A
Explanation:
When a process is frozen (hung or unresponsive), the typical method to resolve it is to kill the process. On Check Point, you can use cpwd_admin kill -name <ProcessName> or a standard Linux kill -9 <PID> command if necessary. You then allow CPWD (the Check Point watchdog) to restart it, or manually restart it if needed.
Other options:
A . Power off the machine: This is too drastic and not recommended just for a single frozen process.
B . Restart the process: While this sounds viable, you typically must kill the frozen process first, then let WatchDog or an admin restart it.
C . Reboot the machine: Similar to powering off-too disruptive for just one stuck process.
Hence, the most direct and standard approach:
"Kill the process."
Check Point Troubleshooting Reference
sk97638 - Explanation of CPWD (Check Point WatchDog) and how to manage processes.
sk43807 - How to gracefully stop or kill a Check Point process.
Check Point CLI Reference Guide - Details on using cpwd_admin commands to kill or restart processes.
NEW QUESTION # 38
You are using the identity Collector with identity Awareness in large environment. Users report that they cannot access resources on Internet You identify that the traffic is matching the cleanup rule Instead of the proper rule with Access Roles using the IDC How can you check if IDC is working?
- A. pep debug idc on
- B. ad query I debug on
- C. pdp debug set IDP all
- D. pdp connections idc
Answer: D
NEW QUESTION # 39
Where will the usermode core files located?
- A. /var/log/dump/usermode
- B. $FWDIR/var/log/dump/usermode
- C. /var/suroot
- D. $CPDIR/var/log/dump/usermode
Answer: A
NEW QUESTION # 40
What version of Check Point can Security Gateways begin dynamically distributing Logs between log servers?
- A. R75
- B. R77
- C. R81
- D. R30
Answer: C
Explanation:
Dynamic log distribution is a feature that allows the Security Gateway to distribute logs between the active Log Servers, instead of sending a copy of every log to each Log Server. This feature was introduced in Check Point R81.10 version, and it requires both the Management and the Gateways to be at least on version R81.10 for this to be supported12. With dynamic log distribution, the Gateway can optimize the disk space usage and network bandwidth consumption of the Log Servers, and also improve the performance and reliability of the logging system3. References: Dynamic logs distribution - Check Point CheckMates1, (CCTE) - Check Point Software2, SmartLog and SmartEvent R81.10 Administration Guide3
1: https://community.checkpoint.com/t5/Management/Dynamic-logs-distribution/td-p/142732 2: https://www.
checkpoint.com/downloads/training/DOC-Training-Data-Sheet-CCTE-R81.10-V1.0.pdf 3: https://sc1.
checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_LoggingAndMonitoring_AdminGuide
/html_frameset.htm
NEW QUESTION # 41
What is the Security Gateway directory where an administrator can find vpn debug log files generated during Site-to-Site VPN troubleshooting?
- A. /opt/CPsuiteR80/vpn/log/
- B. $FWDIR/log/
- C. $FWDIR/conf/
- D. $CPDIR/conf/
Answer: B
NEW QUESTION # 42
What is correct about the Resource Advisor (RAD) service on the Security Gateways?
- A. RAD functions completely in user space The Pattern Matter (PM) module of the CMI looks up for URLs in the cache and if not found, contact the RAD process in user space to do online categorization
- B. RAD is not a separate module, it is an integrated function of the 'fw' kernel module and does all operations in the kernel space
- C. RAD is completely loaded as a kernel module that looks up URL in cache and if not found connects online for categorization There is no user space involvement in this process
- D. RAD has a kernel module that looks up the kernel cache notifies client about hits and misses and forwards a-sync requests to RAD user space module which is responsible for online categorization
Answer: D
Explanation:
The Resource Advisor (RAD) service on the Security Gateways is responsible for online categorization of URLs and resources for Application Control and Threat Prevention blades. RAD has two components: a kernel module and a user space module. The kernel module looks up the kernel cache for URLs and resources, notifies the client about hits and misses, and forwards asynchronous requests to the user space module. The user space module handles the communication with the Check Point online web service and updates the kernel cache with the results. RAD can operate in three modes: hold, background, and custom, depending on the configuration of the blades and the policy. References:
* Check Point Processes and Daemons - Section: Security Gateway Software Blades and Features - Subsection: URL Filtering Blade
* Solved: Re: RAD's high utilization - Post by @PhoneBoy
* Check Point Certified Troubleshooting Expert (CCTE) - Exam Topics - Module 5: Advanced Access Control
NEW QUESTION # 43
You want to fully investigate the VPN establishment, what will you do?
- A. debug FWD because VPND Is child process
- B. use vpn tu command and use option 8 to start debug
- C. vpn debug and use IKEview
- D. use kernel debug with fw ctl debug -m VPN all
Answer: C
NEW QUESTION # 44
Your users have some issues connecting with Mobile Access VPN to your gateway. How can you debug the tunnel establishment?
- A. run vpn debug truncon
- B. run fw ctl zdebug -m sslvpn all
- C. in the file SCVPNDIR/conf/httpd conf change the line Loglevel To LogLevel debug and run cvpnrestart
- D. in the file $VPNDIR/conf/httpd conf change the line Loglevel To LogLevel debug and run vpn restart
Answer: C
NEW QUESTION # 45
What is the most efficient way to read an IKEv2 Debug?
- A. IKEview
- B. any xml editor
- C. vi on the cti
- D. notepad++
Answer: A
Explanation:
IKE view is the most efficient way to read an IKEv2 debug. IKE view is a graphical user interface tool that enables you to analyze the IKEv2 debugs generated by the Security Gateway1. It can parse the debug files and display the information in a structured and readable format. It can also filter the debug messages based on various criteria, such as IP address, encryption domain, or IKEv2 state1. IKE view can help you to troubleshoot the IKEv2 issues and identify the root cause of the problems1. References: IKEView: VPN Debugging Tool - Check Point Software
NEW QUESTION # 46
Which of the following is a component of the Context Management Infrastructure used to collect signatures in user space from multiple sources such as Application Control and IPS. and compiles them together into unified Pattern Matchers?
- A. PSL - Passive Signature Loader
- B. Context Loader
- C. CMI Loader
- D. cpas
Answer: A
NEW QUESTION # 47
Which of these packet processing components stores Rule Base matching state-related information?
- A. Manager
- B. Classifiers
- C. Handlers
- D. Observers
Answer: C
NEW QUESTION # 48
If the cpsemd process of SmartEvent has crashed or is having trouble coming up, then it usually indicates that __________.
- A. Cpd daemon is unable to connect to the log server
- B. The loqqed in administrator does not have permissions to run SmartEvent
- C. The SmartEvent core on the Solr indexer has been deleted
- D. Postgres database is down
Answer: D
NEW QUESTION # 49
For Identity Awareness, what is the PDP process?
- A. Captive Portal Service
- B. Identity server
- C. UserAuth Database
- D. Log Sifter
Answer: B
Explanation:
The PDP process is the Identity server, which is a component of the Identity Awareness blade on the Security Gateway. The PDP process is responsible for collecting and managing identity information from various sources, such as Active Directory, Identity Agents, Captive Portal, Terminal Servers, and RADIUS. The PDP process also communicates with the PEP process, which is the Policy Enforcement Point, to enforce identity- based policies on the traffic passing through the Security Gateway1. The other options, such as Log Sifter, Captive Portal Service, and UserAuth Database, are either not related to Identity Awareness or not processes, but rather files or services. References: 1: sk93046: Identity Awareness - How to Configure
NEW QUESTION # 50
What Check Point process controls logging?
- A. CPVVD
- B. CPD
- C. CPM
- D. FWD
Answer: D
NEW QUESTION # 51
When a User process or program suddenly crashes, a core dump is often used to examine the problem. Which command is used to enable the core-dumping via GAIA clish?
- A. set core-dump per process
- B. set core-dump enable
- C. set user-dump enable
- D. set core-dump total
Answer: B
NEW QUESTION # 52
Which of the following would NOT be a flag when debugging a unified policy?
- A. rulebase
- B. tls
- C. clob
- D. connection
Answer: B
Explanation:
The Unified Policy is a feature that allows you to create a single policy layer that combines the functionality of Access Control, Threat Prevention, and HTTPS Inspection12. To debug the Unified Policy, you need to use the command fw ctl debug with the module name UP and the flag all or specific flags for different aspects of the Unified Policy inspection34. The possible flags for the Unified Policy module are:
* up_match: Shows the matching process of the Unified Policy rules.
* up_inspect: Shows the inspection process of the Unified Policy rules.
* up_action: Shows the action process of the Unified Policy rules.
* up_log: Shows the logging process of the Unified Policy rules.
* up_tls: Shows the TLS inspection process of the Unified Policy rules.
* up_clob: Shows the CLOB (Content Limitation and Optimization Blade) inspection process of the Unified Policy rules.
* up_rulebase: Shows the rulebase loading process of the Unified Policy rules.
* up_connection: Shows the connection tracking process of the Unified Policy rules.
The flag tls is not a valid flag for the Unified Policy module, as it is used for the TLS Inspection module5.
Therefore, the correct answer is A. tls. The other options are valid flags for the Unified Policy module, as explained above34. References:
* 1: CCTE Courseware, Module 8: Advanced Access Control, Slide 7
* 2: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 5: Unified Policy, Page 29
* 3: CCTE Courseware, Module 8: Advanced Access Control, Slide 17
* 4: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 5: Unified Policy, Page 32
* 5: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 6: TLS Inspection, Page
36
NEW QUESTION # 53
Check Point Access Control Daemons contains several daemons for Software Blades and features. Which Daemon is used for Application & Control URL Filtering?
- A. rad
- B. pdpd
- C. cprac
- D. pepd
Answer: A
Explanation:
https://support.checkpoint.com/results/sk/sk97638
NEW QUESTION # 54
......
Prepare for the Actual CCTE 156-587 Exam Practice Materials Collection: https://vce4exams.practicevce.com/CheckPoint/156-587-practice-exam-dumps.html