CheckPoint CCTE 156-585 Questions & Answers

• Question 1:

  Where will the usermode core files be located?

  A. /var/log/dump/usermode

  B. /var/suroot

  C. SFWDlR/var'log/dump/usermode

  D. SCPDIR/var/log/dump/usermode

  Correct Answer: A

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk92764

• Question 2:

  Your fwm constantly crashes and is restarted by the watchdog. You can't find any coredumps related to this process, so you need to check If coredumps are enabled at all

  How can you achieve that?

  A. in dish run show core-dump status

  B. in expert mode run show core-dump status

  C. in dish run set core-dump status

  D. in dish run show coredumb status

  Correct Answer: D

• Question 3:

  For TCP connections, when a packet arrives at the Firewall Kemel out of sequence or fragmented, which layer of IPS corrects this lo allow for proper inspection?

  A. Passive Streaming Library

  B. Protections

  C. Protocol Parsers

  D. Context Management

  Correct Answer: D

• Question 4:

  What is the most efficient way to view large fw monitor captures and run filters on the file?

  A. wireshark

  B. CLISH

  C. CLI

  D. snoop

  Correct Answer: A

• Question 5:

  When running a debug with fw monitor, which parameter will create a more verbose output?

  A. -i

  B. -i

  C. -0

  D. -d

  Correct Answer: D

• Question 6:

  The management configuration stored in the Postgres database is partitioned into several relational database Domains, like - System, User, Global and Log Domains. The User Domain stores the network objects and security policies. Which of the following is stored in the Log Domain?

  A. Configuration data of Log Servers and saved queries for applications

  B. Active Logs received from Security Gateways and Management Servers

  C. Active and past logs received from Gateways and Servers

  D. Log Domain is not stored in Postgres database, it is part of Solr indexer only

  Correct Answer: D

• Question 7:

  What command is used to find out which port Multi-Portal has assigned to the Mobile Access Portal?

  A. mpclient getdata sslvpn

  B. netstat -nap | grep mobile

  C. mpclient getdata mobi

  D. netstat getdata sslvpn

  Correct Answer: D

• Question 8:

  Where do Protocol parsers register themselves for IPS?

  A. Passive Streaming Library

  B. Other handlers register to Protocol parser

  C. Protections database

  D. Context Management Infrastructure

  Correct Answer: A

• Question 9:

  When a User Mode process suddenly crashes it may create a core dump file. Which of the following information is available in the core dump and may be used to identify the root cause of the crash? i Program Counter ii Stack Pointer

  ii.

  Memory management information iv Other Processor and OS flags / information

  A.

  i, ii, lii and iv

  B.

  i and n only

  C.

  iii and iv only

  D.

  Only iii

  Correct Answer: C

• Question 10:

  RAD is initiated when Application Control and URL Filtering blades are active on the Security Gateway What is the purpose of the following RAD configuration file SFWDIR/conf/rad_settings.C?

  A. This file contains the location information tor Application Control and/or URL Filtering entitlements

  B. This file contains the information on how the Security Gateway reaches the Security Managers RAD service for Application Control and URL Filtering

  C. This file contains RAD proxy settings

  D. This file contains all the host name settings for the online application detection engine

  Correct Answer: B