CheckPoint 156-587 Real Exam Questions Test Engine Dumps Training With 111 Questions
156-587 Actual Questions Answers PDF 100% Cover Real Exam Questions
CheckPoint 156-587 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 26
SmartEvent utilizes the Log Server, Correlation Unit and SmartEvent Server to aggregate logs and identify security events. The three main processes that govern these SmartEvent components are:
- A. eventiasv, eventiarp,eventiacu
- B. cpsemd, cpsead, and DBSync
- C. fwd, secu, sesrv
- D. cpcu, cplog, cpse
Answer: B
NEW QUESTION # 27
What is the Security Gateway directory where an administrator can find vpn debug log files generated during Site-to-Site VPN troubleshooting?
- A. $FWDIR/conf/
- B. $FWDIR/log/
- C. $CPDIR/conf/
- D. /opt/CPsuiteR80/vpn/log/
Answer: B
NEW QUESTION # 28
After kernel debug with "fw ctl debug you received a huge amount of information It was saved in a very large file that is difficult to open and analyze with standard text editors Suggest a solution to solve this issue
- A. Divide debug information into smaller files. Use " fw ctl kdebug -f -o "filename -m 25 - s ''1024''
- B. Use Check Point InfoView utility to analyze debug output
- C. Use "fw ctl zdebug because of 1024KB buffer size
- D. Reduce debug buffer to 1024KB and run debug for several times
Answer: A
Explanation:
One possible solution to solve the issue of having a very large file that is difficult to open and analyze with standard text editors is to divide the debug information into smaller files. This can be done by using the fw ctl kdebug command with the -f, -o, -m, and -s options. The -f option means to write the debug output to a file instead of the screen. The -o option specifies the name of the output file. The -m option sets the maximum number of files to be created. The -s option sets the maximum size of each file in KB. For example, the command fw ctl kdebug -f -o debug -m 25 -s 1024 will create up to 25 files named debug.0, debug.1, ..., debug.24, each with a maximum size of 1024KB. This way, the debug information can be split into more manageable chunks that can be opened and analyzed more easily with standard text editors.
Reference:
1: How to use "fw ctl kdebug" command
2: How to debug Check Point firewalls
3: Check Point CLI Reference Card
NEW QUESTION # 29
Which of the following file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?
- A. CPMIL dump
- B. tcpdump
- C. fw monitor
- D. core dump
Answer: D
Explanation:
When troubleshooting crashes on a Security Gateway (or any Linux-based system), the file type that is typically generated and used for in-depth analysis is a core dump.
A core dump captures the memory state of a process at the time it crashed and is critical for root-cause analysis.
Other options:
A . tcpdump: A packet capture file, not a crash-related file.
C . fw monitor: A Check Point packet capture tool, but not for crash debugging.
D . CPMIL dump: Not a common or standard crash dump reference in Check Point.
NEW QUESTION # 30
What cli command is run on the GW to verify communication to the Identity Collector?
- A. show idc connections
- B. pep connections idc
- C. pdp connections idc
- D. fwd connected
Answer: C
NEW QUESTION # 31
What command is used to find out which port Multi-Portal has assigned to the Mobile Access Portal?
- A. netstat getdata sslvpn
- B. mpclient getdata mobi
- C. mpclient getdata sslvpn
- D. netstat -nap | grep mobile
Answer: C
NEW QUESTION # 32
Which of the following would NOT be a flag when debugging a unified policy?
- A. rulebase
- B. connection
- C. tls
- D. clob
Answer: C
NEW QUESTION # 33
You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week.
Therefore you need to add a timestamp to the kernel debug and write the output to a file but you cant afford to fill up all the remaining disk space and you only have 10 GB free for saving the debugs What is the correct syntax for this?
- A. A fw ctl kdebug -T -f -m 10 -s 1000000 -o debugfilename
- B. fw ctl kdebug -T -f -m 10 -s 1000000 > debugfilename
- C. fw ctl kdebug -T -m 10 -s 1000000 -o debugfilename
- D. fw ctl debug -T -f-m 10 -s 1000000 -o debugfilename
Answer: A
NEW QUESTION # 34
RAD is initiated when Application Control and URL Filtering blades are active on the Security Gateway. What is the purpose of the following RAD configuration file $FWDIR/conf/rad_settings.C?
- A. This file contains the information on how the Security Gateway reaches the Security Management Server's RAD service for Application Control and URL Filtering
- B. This file contains RAD proxy settings
- C. This file contains the location information for Application Control and/or URL Filtering entitlements
- D. This file contains all the host name settings for the online application detection engine
Answer: B
Explanation:
The Resource Application Daemon (RAD) is a critical component in Check Point's Application Control and URL Filtering blades, responsible for processing and categorizing web traffic. The configuration file $FWDIR/conf/rad_settings.C on the Security Gateway defines settings related to RAD's operation.
Option A: Incorrect. The rad_settings.C file does not store entitlement information for Application Control or URL Filtering. Entitlements are managed by the Security Management Server and stored in licensing databases, not in this file.
Option B: Incorrect. The rad_settings.C file does not specify how the Security Gateway communicates with the Security Management Server's RAD service. Communication settings are typically handled by SIC (Secure Internal Communication) and other configuration files, such as $FWDIR/conf/fwopsec.conf.
Option C: Correct. The rad_settings.C file contains proxy settings for the RAD daemon, such as HTTP proxy configurations used for accessing external services (e.g., Check Point's online URL Filtering database). This is critical when the Gateway requires a proxy to reach external resources for URL categorization.
Option D: Incorrect. Hostname settings for the online application detection engine are not stored in rad_settings.C. These are typically managed by the Application Database (application_db.C) or resolved via DNS.
Reference:
The Check Point R81.20 Security Gateway Administration Guide discusses the RAD daemon and its configuration, noting that $FWDIR/conf/rad_settings.C is used for proxy settings related to Application Control and URL Filtering. The CCTE R81.20 course covers troubleshooting Application Control and URL Filtering, including the role of configuration files like rad_settings.C.
For precise details, refer to:
Check Point R81.20 Security Gateway Administration Guide, section on "Application Control and URL Filtering" (available via Check Point Support Center).
CCTE R81.20 Courseware, which includes modules on RAD configuration and troubleshooting (available through authorized training partners like Arrow Education or Red Education).
NEW QUESTION # 35
When URL category is not found in the kernel cache, what action will GW do?
- A. RAD in kernel space will forward request to the cloud
- B. RAD forwards this request to CMI which is the brain of inspection
- C. GW will update kernel cache during next policy install
- D. RAD In user space will forward request to the cloud
Answer: D
NEW QUESTION # 36
How does Identity Collector connect to Windows Server?
- A. LDAP connection
- B. ADQuery is needed for connection
- C. via Windows API
- D. It uses a PDP demon to connect
Answer: C
NEW QUESTION # 37
Which of the following is a component of the Context Management Infrastructure used to collect signatures in user space from multiple sources such as Application Control and IPS. and compiles them together into unified Pattern Matchers?
- A. CMI Loader
- B. PSL - Passive Signature Loader
- C. cpas
- D. Context Loader
Answer: B
NEW QUESTION # 38
You receive reports from multiple users that they cannot browse. Upon further discovery you identify that Identity Awareness cannot identify the users properly and apply the configured Access Roles. What commands you can use to troubleshoot all identity collectors and identity providers from the command line?
- A. on the management: pdp debug on IDC all
- B. on the gateway: pdp debug set AD all and IDC all
- C. on the management: pdp debug set all all
- D. Ion the gateway: pdp debug set IDC all IDP all
Answer: D
NEW QUESTION # 39
What version of Check Point can Security Gateways begin dynamically distributing Logs between log servers?
- A. R77
- B. R81
- C. R75
- D. R30
Answer: B
Explanation:
Dynamic log distribution is a feature that allows the Security Gateway to distribute logs between the active Log Servers, instead of sending a copy of every log to each Log Server. This feature was introduced in Check Point R81.10 version, and it requires both the Management and the Gateways to be at least on version R81.10 for this to be supported12. With dynamic log distribution, the Gateway can optimize the disk space usage and network bandwidth consumption of the Log Servers, and also improve the performance and reliability of the logging system3. Reference: Dynamic logs distribution - Check Point CheckMates1, (CCTE) - Check Point Software2, SmartLog and SmartEvent R81.10 Administration Guide3
1: https://community.checkpoint.com/t5/Management/Dynamic-logs-distribution/td-p/142732 2: https://www.checkpoint.com/downloads/training/DOC-Training-Data-Sheet-CCTE-R81.10-V1.0.pdf 3: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_LoggingAndMonitoring_AdminGuide/html_frameset.htm
NEW QUESTION # 40
You run cpwd_admin list on a Security Gateway and notice that the CPM process is not listed. Select the best answer.
- A. CPM is not there because it has its own monitoring system. Only lower processes are monitored by WatchDog.
- B. If you want to monitor CPM, you have to manually add it to WatchDog.
- C. The output is different between Gateway and Management Server.
- D. CPM is not running and can't be monitored by WatchDog.
Answer: C
Explanation:
The cpwd_admin list command is used to display the status of processes monitored by the Check Point WatchDog Daemon (CPWD). The CPM (Check Point Management) process is a core process on the Security Management Server, responsible for management operations. However, on a Security Gateway, the CPM process is not typically present, as it is specific to management functions.
Option A: Correct. The output of cpwd_admin list differs between a Security Gateway and a Security Management Server. On a Security Gateway, processes like FWD, VPND, and PEP are monitored, but CPM is not present because it runs on the Management Server. Thus, CPM will not appear in the cpwd_admin list output on a Gateway.
Option B: Incorrect. While it's true that CPM is not running on the Security Gateway, the reason it's not listed is not because it "can't be monitored" by CPWD. On a Management Server, CPM is indeed monitored by CPWD, but this question pertains to a Gateway.
Option C: Incorrect. CPM is automatically monitored by CPWD on systems where it runs (e.g., Management Server). There is no need to manually add it to WatchDog's monitoring list.
Option D: Incorrect. CPM does not have its own separate monitoring system. On a Management Server, CPM is monitored by CPWD like other critical processes. The statement about "only lower processes" being monitored is inaccurate.
Reference:
The Check Point R81.20 Gaia Administration Guide explains the role of CPWD and the processes it monitors on different Check Point systems (Gateway vs. Management Server). The CCTE R81.20 course (as per and) emphasizes understanding the differences in process monitoring between Gateways and Management Servers, including the use of cpwd_admin commands for troubleshooting.https://edu.arrow.com/uk/training/course-detail/90175/Check-Point-Certified-Troubleshooting-Expert-%28CCTE%29-R81.20-%28includes-180-days%27-lab-access%29/False Reference:
The Check Point R81.20 Gaia Administration Guide explains the role of CPWD and the processes it monitors on different Check Point systems (Gateway vs. Management Server). The CCTE R81.20 course (as per and) emphasizes understanding the differences in process monitoring between Gateways and Management Servers, including the use of cpwd_admin commands for troubleshooting.https://edu.arrow.com/uk/training/course-detail/90175/Check-Point-Certified-Troubleshooting-Expert-%28CCTE%29-R81.20-%28includes-180-days%27-lab-access%29/False
https://www.koenig-solutions.com/ccte-r81-20-language-course
For precise details, refer to:
Check Point R81.20 Gaia Administration Guide, section on "CPWD and Process Monitoring" (available via Check Point Support Center).
CCTE R81.20 Courseware, which covers advanced troubleshooting of Security Gateway and Management Server processes (available through authorized training partners).
NEW QUESTION # 41
In the Security Management Architecture, what port and process does SmartConsole use to communicate with the Security Management Server?
- A. CPM and 19009
- B. CPM, 19009, and 18191
- C. CPM and 18190
- D. FWM and 19009
Answer: C
Explanation:
In Check Point's Security Management Architecture, SmartConsole is the graphical user interface used to manage the Security Management Server. The communication between SmartConsole and the Security Management Server relies on specific processes and ports, which are critical for troubleshooting connectivity issues.
The CPM (Check Point Management) process is the primary process on the Security Management Server responsible for handling management operations, including interactions with SmartConsole. The default port for this communication is 18190 (TCP), used for the SIC (Secure Internal Communication) and management GUI connections.
Option A: Correct. SmartConsole communicates with the Security Management Server using the CPM process over port 18190. This port is used for GUI client connections to the management server.
Option B: Incorrect. The FWM (Firewall Management) process is an older process used in earlier Check Point versions (pre-R80) for management tasks. In R81.20, CPM has largely replaced FWM for SmartConsole communications. Additionally, port 19009 is used for other purposes, such as the Check Point REST API, not SmartConsole.
Option C: Incorrect. While CPM is the correct process, port 19009 is not used for SmartConsole communication. Port 19009 is associated with the Check Point Management API (e.g., for mgmt_cli or REST API calls).
Option D: Incorrect. While CPM is involved, SmartConsole does not use both ports 19009 and 18191. Port 18191 is typically used for log server communications (e.g., SmartConsole to Log Server), not direct management server communication.
Reference:
The Check Point R81.20 Security Management Administration Guide explicitly details the ports used in the management architecture. According to the guide:
Port 18190/TCP is used for SmartConsole to Security Management Server communication via the CPM process.
The CCTE R81.20 course (as referenced in and) covers advanced management server troubleshooting, including understanding the CPM process and its associated ports.https://www.koenig-solutions.com/ccte-r81-20-language-course
https://www.rededucation.com/events/1056-check-point-troubleshooting-expert-ccte-r81-20-spanish-language/region-US/ For exact extracts, refer to:
Check Point R81.20 Security Management Administration Guide, section on "Communication Ports" (available via Check Point Support Center).
CCTE R81.20 Courseware, which includes modules on management server diagnostics and communication protocols (available through authorized training partners).
NEW QUESTION # 42
What is the simplest and most efficient way to check all dropped packets in real time?
- A. Smartlog
- B. fw ctl zdebug + drop in expert mode
- C. cat /dev/fw1/log in expert mode
- D. tail -f $FWDIR/log/fw.log |grep drop in expert mode
Answer: B
Explanation:
The simplest and most efficient way to check all dropped packets in real time is C. fw ctl zdebug + drop in expert mode. This command is a shortcut command that sets the kernel debug flags to a predefined value and prints the debug output to the standard output. It is useful for general debugging of common issues, such as traffic drops, NAT, VPN, or clustering. It has a small buffer size and does not require additional steps to start or stop the debugging. However, it has some limitations, such as it cannot be used with SecureXL, it cannot filter the output by chain modules, and it cannot save the output to a file12.
The other commands are not as simple or efficient as the fw ctl zdebug + drop command. The command tail -f $FWDIR/log/fw.log |grep drop in expert mode will only show the drops that are logged in the fw.log file, which may not include all the drops that occur in the kernel. The command cat /dev/fw1/log in expert mode will show the raw binary data of the kernel debug buffer, which is not human-readable and may contain irrelevant information. The command Smartlog will show the drops that are indexed and stored in the SmartEvent database, which may not be in real time and may depend on the log server performance12.
1: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_AdvancedTechnicalReferenceGuide/html_frameset.htm 2: https://www.checkpoint.com/downloads/training/DOC-Training-Data-Sheet-CCTE-R81.10-V1.0.pdf The Check Point R81.20 Gaia Administration Guide describes fw ctl zdebug as a key troubleshooting tool for real-time packet analysis, particularly for drops. The CCTE R81.20 course emphasizes using fw ctl zdebug for kernel-level debugging, including monitoring dropped packets.
For precise details, refer to:
Check Point R81.20 Gaia Administration Guide, section on "fw ctl zdebug" (available via Check Point Support Center).
CCTE R81.20 Courseware, which covers advanced troubleshooting techniques for packet drops (available through authorized training partners).
NEW QUESTION # 43
What are the four main database domains?
- A. System, User, Host, Network
- B. Local, Global, User, VPN
- C. System, User, Global. Log
- D. System. Global. Log. Event
Answer: C
NEW QUESTION # 44
Where will the usermode core files located?
- A. $FWDIRVar/log/dump/usermode
- B. /var/log/dump/usermode
- C. $CPDIR/var/log/dump/usermode
- D. /var/suroot
Answer: C
Explanation:
Usermode core files are generated when a user mode process crashes. They are located in the $CPDIR/var/log/dump/usermode directory on the Security Gateway or Security Management server. The core files can be used to analyze the cause of the crash and troubleshoot the issue. The core files are named according to the process name, date, and time of the crash. For example, cpd_2023_02_03_16_40_55.core is a core file for the cpd process that crashed on February 3, 2023 at 16:40:55
NEW QUESTION # 45
In some scenarios it is very helpful to use advanced Linux commands for troubleshooting purposes. Which command displays information about resource utilization for running processes and shows additional information for core utilization and memory?
- A. mpstat
- B. cptop
- C. top
- D. vmstat
Answer: C
Explanation:
The top command is a Linux command that displays information about resource utilization for running processes and shows additional information for core utilization and memory. The top command provides a dynamic real-time view of the system, showing the processes that are consuming the most CPU, memory, and other resources. The top command also shows the total number of processes, the system load average, the uptime, and the CPU usage by user, system, and idle. The top command can be customized by using various options and interactive commands to change the display, sort the processes, filter the output, and kill processes.
The other commands are incorrect because:
B : vmstat is a Linux command that displays information about the virtual memory, CPU, disk, and system activity. It does not show information about individual processes or core utilization.
C : cptop is a Check Point command that displays information about the firewall kernel activity, such as the number of connections, packets, drops, and rejects. It does not show information about other processes or memory usage.
D : mpstat is a Linux command that displays information about the CPU utilization by each processor or core. It does not show information about processes or memory usage.
Reference:
top(1) - Linux manual page
vmstat(8) - Linux manual page
cptop - Check Point Software
mpstat(1) - Linux manual page
NEW QUESTION # 46
PostgreSQL is a powerful, open source relational database management system. Check Point offers a command for viewing the database to interact with Postgres interactive shell. Which command do you need to enter the PostgreSQL interactive shell?
- A. psql_client postgres cpm
- B. mysql_client cpm postgres
- C. mysql -u root
- D. psql_client cpm postgres
Answer: D
Explanation:
The correct command to enter the PostgreSQL interactive shell is psql_client cpm postgres. This command allows the administrator to view and manipulate the database of the Check Point Management (CPM) module, which stores the configuration and policy data. The psql_client command is a Check Point wrapper for the psql command, which is the native PostgreSQL interactive shell. The psql_client command takes two arguments: the first one is the name of the database module, and the second one is the name of the database user. In this case, the database module is cpm and the database user is postgres.
The other commands are incorrect because:
A . mysql_client cpm postgres is not a valid command. The mysql_client command is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL.
B . mysql -u root is not a valid command. The mysql command is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL. Moreover, the -u option specifies the MySQL user name, which is not relevant for Check Point.
D . psql_client postgres cpm is not a valid command. The psql_client command takes the database module name as the first argument, and the database user name as the second argument. In this case, the database module name is cpm and the database user name is postgres. The order of the arguments is reversed in this command.
Reference:
How to use PostgreSQL interactive shell (psql) with Check Point database Check Point Database Tool (GuiDBedit) - Check Point Software (CCTE) - Check Point Software
NEW QUESTION # 47
Troubleshooting issues with Mobile Access requires the following:
- A. Debug logs of FWD captured with the command - 'fw debug fwd on TDERROR_MOBILE_ACCESS=5'
- B. 'ma_vpnd' process on Security Gateway
- C. Standard VPN debugs and packet captures on Security Gateway, debugs of 'cvpnd' process on Security Management
- D. Standard VPN debugs, packet captures and debugs of cvpnd1 process on Security Gateway
Answer: D
NEW QUESTION # 48
For Identity Awareness, what is the PDP process?
- A. Identity server
- B. Log Sifter
- C. UserAuth Database
- D. Captive Portal Service
Answer: A
Explanation:
The PDP process is the Identity server, which is a component of the Identity Awareness blade on the Security Gateway. The PDP process is responsible for collecting and managing identity information from various sources, such as Active Directory, Identity Agents, Captive Portal, Terminal Servers, and RADIUS. The PDP process also communicates with the PEP process, which is the Policy Enforcement Point, to enforce identity-based policies on the traffic passing through the Security Gateway1. The other options, such as Log Sifter, Captive Portal Service, and UserAuth Database, are either not related to Identity Awareness or not processes, but rather files or services. Reference: 1: sk93046: Identity Awareness - How to Configure
NEW QUESTION # 49
When a User Mode process suddenly crashes, it may create a core dump file. Which of the following information is available in the core dump and may be used to identify the root cause of the crash?
i. Program Counter
ii. Stack Pointer
iii. Memory management information
iv. Other Processor and OS flags / information
- A. i and ii only
- B. Only lii
- C. iii and iv only
- D. i, ii, iii and iv
Answer: D
Explanation:
A core dump file is essentially a snapshot of the process's memory at the time of the crash. This snapshot includes crucial information that can help diagnose the cause of the crash. Here's why all the options are relevant:
* i. Program Counter: This register stores the address of the next instruction the CPU was supposed to execute. It pinpoints exactly where in the code the crash occurred.
* ii. Stack Pointer: This register points to the top of the call stack, which shows the sequence of function calls that led to the crash. This helps trace the program's execution flow before the crash.
* iii. Memory management information: This includes details about the process's memory allocations, which can reveal issues like memory leaks or invalid memory access attempts.
* iv. Other Processor and OS flags/information: This encompasses various registers and system information that provide context about the state of the processor and operating system at the time of the crash.
By analyzing this information within the core dump, you can often identify the root cause of the crash, such as a segmentation fault, null pointer dereference, or stack overflow.
Check Point Troubleshooting References:
While core dumps are a general concept in operating systems, Check Point's documentation touches upon them in the context of troubleshooting specific processes like fwd (firewall) or cpd (Check Point daemon).
The fw ctl zdebug command, for example, can be used to trigger a core dump of the fwd process for debugging purposes.
NEW QUESTION # 50
What command is used to find out which port Multi-Portal has assigned to the Mobile Access Portal?
- A. netstat getdata sslvpn
- B. mpclient getdata mobi
- C. mpcient getdata sslvpn
- D. netstat -nap | grep mobile
Answer: C
NEW QUESTION # 51
......
TestBraindump 156-587 Exam Practice Test Questions: https://www.testbraindump.com/156-587-exam-prep.html
156-587 Exam questions and answers: https://drive.google.com/open?id=1AiCvpwkLGX2Puxw2raJcqMnsujzc-rZ1
