Which situation triggers an IPS bypass under load on a 24-core Check Point appliance?

any of the CPU cores is above the threshold for more than 10 seconds

all CPU core most be above the threshold for more than 10 seconds

a single CPU core must be above the threshold for more than 10 seconds, but is must be the same core during this time

the average cpu utilization over all cores must be above the threshold for 1 second

Which of the following inputs is suitable for debugging HTTPS inspection issues?

fw ctl debug –m fw + conn drop cptls

fw debug tls on TDERROR_ALL_ALL=5

If IPS protections that prevent SecureXL from accelerating traffic, such as Network Quota, Fingerprint Scrambling. TTL Masking etc, have to be used, what is a recommended practice to enhance the performance of the gateway?

Use the IPS exception mechanism

Disable SecureXL and use CoreXL

Upgrade the hardware to include more Cores and Memory

Where will the usermode core files be located?

SCPDIR/var/log/dump/usermodeAnswer: A

What are the four ways to insert an FW Monitor into the firewall kernel chain?

Relative position using geolocation, relative position using inertial navigation, absolute position, all positions

Relative position using location, relative position using alias, absolute position, all positions

Absolute position using location, absolute position using alias, relative position, all positions

Absolute position using location, relative position using alias, general position, all positions

Relative position using geolocation, relative position using inertial navigation, absolute position, all positions

Where do Protocol parsers register themselves for IPS?

Other handlers register to Protocol parser

Context Management Infrastructure

Which of the following is NOT a vpn debug command used for troubleshooting?

fw ctl debug -m fw + conn drop vm crypt

The management configuration stored in the Postgres database is partitioned into several relational database Domains, like - System, User, Global and Log Domains. The User Domain stores the network objects and security policies. Which of the following is stored in the Log Domain?

Log Domain is not stored in Postgres database, it is part of Solr indexer only

Configuration data of Log Servers and saved queries for applications

Active Logs received from Security Gateways and Management Servers

Active and past logs received from Gateways and Servers

Log Domain is not stored in Postgres database, it is part of Solr indexer only

After kernel debug with "fw ctl debug" you received a huge amount of information It was saved in a very large file that is difficult to open and analyze with standard text editors Suggest a solution to solve this issue.

Reduce debug buffer to 1024KB and run debug for several times

Use "fw ctl zdebug' because of 1024KB buffer size

Divide debug information into smaller files Use "fw ctl kdebug -f -o "filename" -m 25 - s "1024"

Reduce debug buffer to 1024KB and run debug for several times

Use Check Point InfoView utility to analyze debug output

How many captures does the command "fw monitor -p all" take?

1 from every inbound and outbound module of the chain

All 15 of the inbound and outbound modules

All 4 points of the fw VM modules

1 from every inbound and outbound module of the chain

The -p option takes the same number of captures, but gathers all of the data packet

What is NOT a benefit of the fw ctl zdebug command?

Cannot be used to debug additional modules

Collect debug messages from the kernel

Automatically allocate a 1MB buffer

If the cpsemd process of SmartEvent has crashed or is having trouble coming up. then it usually indicates that___________.

The SmartEvent core on the Solr mdexer has been deleted

Cpd daemon is unable to connect to the log server

The SmartEvent core on the Solr mdexer has been deleted

The logged in administrator does not have permissions to run SmartEvent

Which command can be run in Expert mode lo verify the core dump settings?

cat /etc/sysconfig/coredump/cdm conf

Jenna has to create a VPN tunnel to a CISCO ASA but has to set special property to renegotiate the Phase 2 tunnel after 10 MB of transferee1 dat a. This can not be configured in the smartconsole, so how can she modify this property?

she need to run GUIDBEDIT from CLISH which opens a graphical window on the smartcenter

using GUIDBEDIT located in same directory as Smartconsole on the Windows client

she need to install GUIDBEDIT which can be downloaded from the Usercenter

she need to run GUIDBEDIT from CLISH which opens a graphical window on the smartcenter

this cant be done anymore as GUIDBEDIT is not supported in R80 anymore

Troubleshooting issues with Mobile Access requires the following:

Standard VPN debugs, packet captures, and debugs of cvpnd' process on Security Gateway

Standard VPN debugs and packet captures on Security Gateway, debugs of "cvpnd' process on Security Management

'ma_vpnd' process on Secunty Gateway

Debug logs of FWD captured with the command - 'fw debug fwd on TDERROR_MOBILE_ACCESS=5'

What is the simplest and most efficient way to check all dropped packets in real time?

tail -f SFWDIR/log/fw log |grep drop in expert mode

fw ctl zdebug * drop in expert mode

tail -f SFWDIR/log/fw log |grep drop in expert mode

If you run the command "fw monitor -e accept src=10.1.1.201 or src=172.21.101.10 or src=192.0.2.10;" from the cli sh What will be captured?

Only packet going to 192.0.2.10

Packets from 10 1 1 201 going to 192.0 2.10

Packets destined to 172 21 101 10 from 10.1.1.101

Only packet going to 192.0.2.10

fw monitor only works in expert mode so no packets will be captured

You have configured IPS Bypass Under Load function with additional kernel parameters ids_tolerance_no_stress=15 and ids_tolerance_stress-15 For configuration you used the *fw ctl set' command After reboot you noticed that these parameters returned to their default values What do you need to do to make this configuration work immediately and stay permanent?

Set these parameters again with “fw ctl set” and edit appropriate parameters in $FWDIR/boot/modules/ fwkern.conf

Use script $FWDIR/bin IpsSetBypass.sh to set these parameters

Set these parameters again with “fw ctl set” and save configuration with “save config”

Edit appropriate parameters in $FWDIR/boot/modules/fwkern.conf

Some users from your organization have been reporting some connection problems with CIFS since this morning You suspect an IPS issue after an automatic IPS update last night. So you want to perform a packet capture on uppercase I only directly after the IPS chain module (position 4 in the chain) to check If the packets pass the IPS. What command do you need to run?

tcpdump -eni any <filterexpression>

fw monitor -ml -pi 5 -e <filterexperession>

fw monitor -pi 5 -e <filterexptession>

tcpdump -eni any <filterexpression>

fw monitor -pi asm <filtefexpfession>

The two procedures available for debugging in the firewall kernel are i fw ctl zdebug ii fw ctl debug/kdebug Choose the correct statement explaining the differences in the two

(i) is used to debug only issues related to dropping of traffic, however (n) can be used for any firewall issue including NATing, clustering etc.

(i) Is used for general debugging, has a small buffer and is a quick way to set kernel debug flags to get an output via command line whereas (11) is useful when there is a need for detailed debugging and requires additional steps to set the buffer and get an output via command line

(i) is used to debug the access control policy only, however (n) can be used to debug a unified policy

(i) is used to debug only issues related to dropping of traffic, however (n) can be used for any firewall issue including NATing, clustering etc.

(i) is used on a Security Gateway, whereas (11) is used on a Security Management Server

You are running R80.XX on an open server and you see a high CPU utilization on your 12 CPU cores You now want to enable Hyperthreading to get more cores to gain some performance. What is the correct way to achieve this?

Hyperthreading is not supported on open servers, on on Check Point Appliances

just turn on HAT in the bios of the server and boot it

just turn on HAT in the bios of the server and after it has booted enable it in cpconfig

You are trying to establish a VPN tunnel between two Security Gateways but fail. What initial steps will you make to troubleshoot the issue

capture traffic on both tunnel members and collect debug of IKE and VPND daemon

capture traffic on both tunnel members and collect kernel debug for fw module with vm, crypt, conn and drop flags, then collect debug of IKE and VPND daemon

collect debug of IKE and VPND daemon and collect kernel debug for fw module with vm, crypt, conn and drop flags

capture traffic on both tunnel members and collect kernel debug for fw module with vm, crypt, conn and drop flags

An administrator receives reports about issues with log indexing and text searching regarding an existing Management Server. In trying to find a solution she wants to check if the process responsible for this feature is running correctly. What is true about the related process?

fwm manages this database after initialization of the ICA

cpd needs to be restarted manual to show in the list

fwssd crashes can affect therefore not show in the list

When debugging is enabled on firewall kernel module using the ‘fw ctl debug’ command with required options, many debug messages are provided by the kernel that help the administrator to identify issues. Which of the following is true about these debug messages generated by the kernel module?

Messages are written to console and also /var/log/messages file

Messages are written to a buffer and collected using ‘fw ctl kdebug’

Messages are written to console and also /var/log/messages file

Messages are written to /etc/dmesg file

Messages are written to $FWDIR/log/fw.elg

Checkpoint 156-585 Practice Test 2 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Checkpoint 156-585 Practice Test 2

Question

Checkpoint 156-585 Practice Tests

Practice Tests