CheckPoint Checkpoint Certifications 156-585 Questions & Answers

• Question 51:

  What is the proper command for allowing the system to create core files?

  A. $FWDIR/scripts/core-dump-enable.sh

  B. # set core-dump enable # save config

  C. service core-dump start

  D. >set core-dump enable >save config

  Correct Answer: D

• Question 52:

  When debugging is enabled on firewall kernel module using the `fw ctl debug' command with required options, many debug messages are provided by the kernel that help the administrator to identify issues. Which of the following is true about these debug messages generated by the kernel module?

  A. Messages are written to a buffer and collected using `fw ctl kdebug'

  B. Messages are written to console and also /var/log/messages file

  C. Messages are written to /etc/dmesg file

  D. Messages are written to $FWDIR/log/fw.elg

  Correct Answer: B

• Question 53:

  Check Point Access Control Daemons contains several daemons for Software Blades and features

  Which Daemon is used for Application and Control URL Filtering?

  A. rad

  B. cprad

  C. pepd

  D. pdpd

  Correct Answer: C

• Question 54:

  Which command is most useful for debugging the fwaccel module?

  A. fw zdebug

  B. securexl debug

  C. fwaccel dbg

  D. fw debug

  Correct Answer: C

• Question 55:

  Check Point Access Control Daemons contains several daemons for Software Blades and features. Which Daemon is used for Application and Control Filtering?

  A. rad

  B. cprad

  C. pepd

  D. pdpd

  Correct Answer: A

• Question 56:

  What file extension should be used with fw monitor to allow the output file to be imported and read in Wireshark?

  A. .cap

  B. .exe

  C. .tgz

  D. .pcap

  Correct Answer: A

• Question 57:

  Which command can be run in Expert mode lo verify the core dump settings?

  A. grep cdm /config/db/coredump

  B. grep cdm /config/db/initial

  C. grep SFWDlR/config/db/initial

  D. cat /etc/sysconfig/coredump/cdm conf

  Correct Answer: C

• Question 58:

  If the cpsemd process of SmartEvent has crashed or is having trouble coming up. then it usually indicates that___________.

  A. Postgres database ts down

  B. Cpd daemon is unable to connect to the log server

  C. The SmartEvent core on the Solr mdexer has been deleted

  D. The logged in administrator does not have permissions to run SmartEvent

  Correct Answer: A

  cpsemd is the process responsible for logging into the SmartEvent GUI. Therefore, you need to check the status of this process and debug it, if necessary. Usually, the issue with the cpsemd process is that it is crashing, or not coming up. What causes this process to crash or not come up is that the PostgreSQL database is down. Therefore, in order to run the cpsemd process successfully, you need to run the PostgreSQL database successfully.

• Question 59:

  For TCP connections, when a packet arrives at the Firewall Kernel out of sequence or fragmented, which layer of IPS corrects this to allow for proper inspection?

  A. Passive Streaming Library

  B. Protections

  C. Protocol Parsers

  D. Context Management

  Correct Answer: A

• Question 60:

  James is using the same filter expression in fw monitor for CITRIX very often and instead of typing this all the time he wants to add it as a macro to the fw monitor definition file.

  What's the name and location of this file?

  A. $FWDIR/lib/fwmonltor.def

  B. $FWDIR/conf/fwmonltor.def

  C. $FWDIR/lib/tcpip.def

  D. $FWDIR/lib/fw.monitor

  Correct Answer: A