The drop_monitor command is useful for

Viewing all drops by Check Point code or the Gaia OS, such as RX-DRP, RX-ERR, and Gaia OS drops.

Monitoring Check Point code drops

Viewing all interface drops such as RX-ERR, RX-DRP, and RX-OVR

Viewing all drops by Check Point code or the Gaia OS, such as RX-DRP, RX-ERR, and Gaia OS drops.

Showing the system temperature in real-time for multiple components, such as CPU, fan, and SSDs.

Possibilities for a failure in a single SGM of a Security Group include.

An administrator imported a hotfix into the CPUSE repository of a single SGM.

A change was made with clish instead of gClish, causing the SGM to handle traffic differently than the other SGMs.

SecureXL is not enabled on the SGM.

An administrator imported a hotfix into the CPUSE repository of a single SGM.

There are too many active SGMs in the SG.

There are two 10Gbps dual-port NIC installed on a 6800 appliance. Which interfaces should be connected to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators?

Port 1 in Slot 1 and Port 1 in Slot 2

Port 1 in Slot 1 and Port 2 in Slot 1

Port 1 in Slot 2 and Port 2 in Slot 1

What is one benefit of a Dual MHO environment?

Dual MHOs can be used to achieve increased scalability and redundancy. .

Dual MHOs provide redundancy to the Maestro environment by increasing throughput by at least 50 percent.

Dual MHOs allow better synchronization to occur between SGMs.

Dual MHOs allow additional SGMs to be added to the SG.

Dual MHOs can be used to achieve increased scalability and redundancy. .

What cannot be a reason for 'Failed to get remote orchestrator interfaces' error message, when clicking on 'Orchestrator' in WebUI

Remote orchestrator has no empty interfaces

Single orchestrator environment, but configured Orchestrator amount is 2

One orchestrator only, but Orchestrator amount is 2 or no Sync in between orchestrators

What Maestro component is automatically designated the SMO Master?

The SGM with the lowest member ID (the first one added to the security group.)

The MDS that pushes policy to the SMO is considered the SMO Master.

The first MHO configured is considered the SMO Master.

The SGM with the highest member ID (the last one added to the security group.)

What is a downlink interface used for?

To connect appliances to customer's infrastructure

To connect appliances to Orchestrators

To connect appliances to customer's infrastructure

To connect in between Orchestrators

To connect Orchestrators to customer's infrastructure

What type of license is required for an MHO?

The MHO does not require a license.

The MHO requires a NGTP license.

The MHO requires a VSX license.

The MHO does not require a license.

A license is needed for each attached SGM.

What Maestro component acts as a load balancer and network switch?

Maestro Hyperscale Orchestrator (MHO)

Security Switching Module (SSM)

Maestro Hyperscale Orchestrator (MHO)

What is an uplink interface used for?

To connect Orchestrators to customer's infrastructure

To connect in between appliances

To connect appliances to customer's infrastructure

To connect Orchestrators to customer's infrastructure

To connect in between Orchestrators

What is a security group?

A solution for Security Gateway redundancy and Load Sharing.

A set of appliances of the same model that are collectively managed by the MHO.

A set of network interfaces and individual SGMs assigned to a logical group.

A set of objects in SmartConsole that are responsible for enforcing an access policy.

What is the Orchestrator?

Manager of compute and network resources, load balancer and network switch

What is the Correction Layer?

Correction Layer is a mechanism which handles asymmetric connections in multi-appliance system. For example, in case of NAT

Correction Layer is a daemon which corrects errors on Backplane interfaces

Correction Layer is a mechanism which handles asymmetric connections in multi-appliance system. For example, in case of NAT

Correction Layer is a mechanism which activated in case of asymmetric routing

Correction Layer is a Layer of GAIA OS which corrects misspelled commands and allows them to execute

What is the Correction Layer mechanism?

Ensures asymmetric traffic is handled properly, especially in the case of NAT or VPNs.

The load-balancing mechanism used by the MHO.

The MHO's distribution algorithm which determines the handling SGM for a given connection.

Enforces the access policy on the SGMs and synchronizes the enforcement verdict to other SGMs in the SG.

At a minimum, how many management and Uplink ports does a SG require?

Only one of the two interfaces is needed for the Security Group.

For the MHO-175, which ports are Management ports?

Ports 1 - 4 are Management ports.

Ports 49 - 55 are Management ports.

Ports 1 - 4 are Management ports.

Ports 27 - 47 are Management ports.

Ports 5 - 26 are Management ports.

What happens if the SMO Master fails?

The Backup SMO Master will take over in the event of a failure with the SMO Master.

The next SGM with the current lowest SGM ID assumes the role of the SMO Master.

The Backup SMO Master will take over in the event of a failure with the SMO Master.

A failover will occur on the MHO and traffic will continue to pass.

The Security Group will no longer pass traffic and the issue must be resolved with the SMO Master.

What does the lldpctl command do?

Show all devices discovered by LLDP protocol on all ports

Show all devices discovered by LLDP protocol on downlink ports

Show all devices discovered by LLDP protocol on all ports

Show all devices discovered by LLDP protocol on uplink ports

There are two 10Gbps dual-port NICs and one 40Gbps NIC installed on a 23800 Appliance in slots 1, 2 and 3 accordingly. Which interfaces should be connected to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators?

Port 1 in Slot 1 and Port 2 in Slot 1

Port 1 in Slot 2 and Port 2 in Slot 1

This configuration is not supported

Port 1 in Slot 1 and Port 2 in Slot 1

Which licenses should be issued for the Orchestrator?

No licenses are required for Orchestrator

Depends on Software Blades enabled on connected appliances

The Orchestrator is considered a Management server, hence it's licensed the same way

The Orchestrator requires NGTX license

When security policy is installed

The SMO Master receives the policy and performs a policy verification the policy is installed on the SMO Master, the SMO Master broadcasts the available package, other members retrieve the new policy from the SMO Master, then the non-SMO Master SGMs install the policy.

All SGMs receive the security policy and one by one performs an independent policy verification. Then, all SGMs simultaneously install the policy.

The SMO Master receives the policy and performs a policy verification the policy is installed on the SMO Master, the SMO Master broadcasts the available package, other members retrieve the new policy from the SMO Master, then the non-SMO Master SGMs install the policy.

All SGMs receive the security policy and simultaneous policy installation occurs.

The policy is installed on the SMO, the SMO Master broadcasts the available package, other members retrieve the new policy from the SMO Master and perform an independent policy verification, then the non-SMO Master SGMs install the policy.

What happens when you make changes from Clish on the SMO Master?

Changes are only applied on the SMO Master.

The changes are synchronized to the SMS/MDS as a backup.

The changes are synchronized to the MHO as a backup.

Changes are only applied on the SMO Master.

Changes are applied to all members in the SG.

When working with Maestro, what is the difference between using Clish and gClish?

Clish commands are run on the SG members. gClish commands are run on the MHO and applied to all connected SG members in a specified group.

Clish commands are for testing purposes only and cannot be saved, gClish commands apply to all SG members, by default.

Clish commands apply to all UP SG members, by default. gClish commands apply to all SG members, by default.

Clish commands are run on the SG members. gClish commands are run on the MHO and applied to all connected SG members in a specified group.

Clish commands apply only to a specific SG member. gClish commands apply to all UP SG members, by default.

What is the purpose of Management ports located on the Rear Panel of the Orchestrator MHO-140?

Out-of-band interfaces for access to Orchestrator itself

1Gbps connectivity for Security Groups

Reserved for internal purposes. Not in use.

Out-of-band interfaces for access to Orchestrator itself

Additional ports used as uplinks

What happens if you apply a hotfix using gClish?

If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.

If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.

If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.

Logical groups 'A' and 'B' are created. Members of group 'A' install and reboot first. Then members of group 'B' does the same once reboots have finished with group 'A.'

If you apply a hotfix using gclish, the operation will fail because an outage would occur.

What is the purpose of RJ-45 connectors located at the front panel of the Orchestrator MHO-170?

Out-of-band interface for access to Orchestrator itself and Serial Console connector

Two Out-of-band interfaces for access to Orchestrator itself

1Gbps connectivity for Security Groups

Out-of-band interface for access to Orchestrator itself and Serial Console connector

Reserved for internal purposes. Not in use

What does asg monitor command do?

Show real-time cluster status of Appliances in Security Group

Monitor health status of entire system

Monitor traffic on Appliances in Security Group

Show real-time cluster status of Appliances in Security Group

What will happen in case of NAT of the traffic passing through Management network?

Orchestrator will disable NAT and traffic will pass with no issue

This traffic will not pass correction, since it will be dropped

Orchestrator will disable NAT and traffic will pass with no issue

Since Management traffic is always going to SMO, it will take a care for Correction Layer and will re-distribute traffic to other Appliances

This traffic will pass with no inspection

When a VPN tunnel is formed with a Maestro SGM,

SGM 1 analyzes the policy and topology. If encryption is required, it calculates the tunnel owner's IP address. SGM 1 sends a clear packet to the tunnel owner. SGM 2 is now the connection and tunnel owner.

The receiving SGM makes an encryption decision. The SGM then syncs the traffic to two backup SGMs: one for clear traffic and one for encrypted traffic.

SGM 1 analyzes the policy and topology. If encryption is required, it calculates the tunnel owner's IP address. SGM 1 sends a clear packet to the tunnel owner. SGM 2 is now the connection and tunnel owner.

The MHO handles the IKE before distributing the traffic to a SGM to handle all encrypted traffic. This helps to prevent any issues with the correction layer.

The MHO distributes copies of the packets to two different SGMs because SGM 1 will handle the clear traffic IKE exchange packets, while SGM2 handles encrypted packets.