CheckPoint Checkpoint Certifications 156-585 Questions & Answers

• Question 91:

  What are the main components of Check Point's Security Management architecture?

  A. Management server, management database, log server, automation server

  B. Management server, Security Gateway. Multi-Domain Server, SmartEvent Server

  C. Management Server. Log Server. LDAP Server, Web Server

  D. Management server Log server, Gateway server. Security server

  Correct Answer: A

• Question 92:

  Which command is used to write a kernel debug to a file?

  A. fw ctl debug -T -f > debug.txt

  B. fw ctl kdebug -T -l > debug.txt

  C. fw ctl debug -S -t > debug.txt

  D. fw ctl kdebug -T -f > debug.txt

  Correct Answer: D

• Question 93:

  Which of the following is NOT a vpn debug command used for troubleshooting?

  A. fw ctl debug -m fw + conn drop vm crypt

  B. vpn debug trunc

  C. pclient getdata sslvpn

  D. vpn debug on TDERROR_ALL_ALL=5

  Correct Answer: C

• Question 94:

  The two procedures available for debugging in the firewall kernel are i fw ctl zdebug ii fw ctl debug/kdebug Choose the correct statement explaining the differences in the two

  A. (i) Is used for general debugging, has a small buffer and is a quick way to set kernel debug flags to get an output via command line whereas

  (ii) is useful when there is a need for detailed debugging and requires additional steps to set the buffer and get an output via command line

  B. (i) is used to debug the access control policy only, however

  (ii) can be used to debug a unified policy

  C. (i) is used to debug only issues related to dropping of traffic, however

  (ii) can be used for any firewall issue including NATing, clustering etc.

  D. (i) is used on a Security Gateway, whereas

  (ii) is used on a Security Management Server

  Correct Answer: A

  According to the study material, this should be A:

  The Zdebug has a 1 MB buffer, cleans the buffer, enable flags and collects debug messages from the kernel for you.

  According to C, it is used for drop traffic, this is completely false

  You can set modules on it as well, such as CCP, cluster, fw, drop etc.

  Debug requires more configuration to be effective, but gives you more opportunities to play with, therefore, A is the correct answer.

• Question 95:

  John works for ABC Corporation. They have enabled CoreXL on their firewall John would like to identify the cores on which the SND runs and the cores on which the firewall instance is running. Which command should John run to view the CPU role allocation?

  A. fw ctl affinity -v

  B. fwaccel stat -I

  C. fw ctl affinity -I

  D. fw ctl cores

  Correct Answer: C

• Question 96:

  During firewall kernel debug with fw ctl zdebug you received less information than expected. You noticed that a lot of messages were lost since the time the debug was started. What should you do to resolve this issue?

  A. Increase debug buffer; Use fw ctl debug -buf 32768

  B. Redirect debug output to file; Use fw ctl zdebug -o ./debug.elg

  C. Increase debug buffer; Use fw ctl zdebug -buf 32768

  D. Redirect debug output to file; Use fw ctl debug -o ./debug.elg

  Correct Answer: A

  Reference: https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_PerformanceTuning_AdminGuide/Content/Topics-PTG/Kernel-Debug/Kernel-Debug-Procedure.htm

• Question 97:

  The Check Point Firewall Kernel is the core component of the Gala operating system and an integral part of traffic inspection process. There are two procedures available for debugging the firewall kernel. Which procedure/command is used for detailed troubleshooting and needs more resources?

  A. fw ctl debug/kdebug

  B. fw ctl zdebug

  C. fw debug/kdebug

  D. fw debug/kdebug ctl

  Correct Answer: A

  fw ctl zdebug is only for drops and fw ctl debug/kdebug are more detailed and flexible

• Question 98:

  PostgreSQL is a powerful, open source relational database management system Check Point offers a command for viewing the database to interact with Postgres interactive shell Which command do you need to enter the PostgreSQL interactive shell?

  A. psql_client cpm postgres

  B. mysql_client cpm postgres

  C. psql_c!ieni postgres cpm

  D. mysql -u root

  Correct Answer: A

• Question 99:

  Which Threat Prevention Daemon is the core Threat Emulation engine and responsible for emulation files and communications with Threat Cloud?

  A. ctasd

  B. in.msd

  C. ted

  D. scrub

  Correct Answer: C

• Question 100:

  How can you start debug of the Unified Policy with all possible flags turned on?

  A. fw ctl debug -m UP all

  B. fw ctl debug -m UnifiedPolicy all

  C. fw ctl debug -m fw + UP

  D. fw ctl debug -m UP *

  Correct Answer: D