Checkpoint 156-836 Practice Test - Questions Answers

The drop_monitor command is a tool that monitors and displays the packets that are dropped by the Check Point code or the Gaia OS on the orchestrator and the appliances. It can help troubleshoot network issues and optimize performance. The command shows the drop reason, source, destination, protocol, and port of the dropped packets, as well as the interface and the module that dropped them.

Reference

* R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates1

* Support, Support Requests, Training ... - Check Point Software2

* Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge

One of the possible causes of a failure in a single SGM of a Security Group is that an administrator imported a hotfix into the CPUSE repository of a single SGM, instead of using the orchestrator to distribute the hotfix to all the SGMs in the Security Group. This can create a mismatch in the software versions and configurations of the SGMs, and lead to unexpected behavior and errors.

Reference

* Maestro Expert (CCME) Course - Check Point Software, page 251

* sk172923: The /var/log/messages file does not save Maestro Gaia Clish commands2

* sk180418: Security Gateway Member (SGM) is stuck after it is added to a Security Group with image auto cloning enabled on the Single Management Object (SMO)

The correct interfaces to connect to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators are Port 1 in Slot 1 and Port 1 in Slot 2. This is because each slot represents a different NIC, and each port represents a different physical link. By connecting two ports from different slots, the appliance can have redundant connections to the same orchestrator, and avoid a single point of failure in case of a NIC or link failure.

Reference

* Check Point 156-835 Certification Flashcards | Quizlet1

* Maestro Expert (CCME) Course - Check Point Software, page 182

* Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 163

One of the benefits of a Dual MHO environment is that it can provide both scalability and redundancy to the Maestro system. Scalability means that the system can handle more traffic and SGMs as the demand grows, and redundancy means that the system can survive the failure of one or more components without losing functionality or performance. Dual MHOs can achieve these benefits by distributing the load and the management tasks among two orchestrators, and by providing backup and failover mechanisms for each other.

Reference

* Maestro Expert (CCME) Course - Check Point Software, page 251

* CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 22

* Check Point Certified Maestro Expert (CCME) R81.X, page 23

One of the possible reasons for the ''Failed to get remote orchestrator interfaces'' error message, when clicking on ''Orchestrator'' in WebUI, is that the remote orchestrator has no empty interfaces that can be assigned to a security group. This can happen if all the interfaces on the remote orchestrator are already part of configured security groups, or if the remote orchestrator has no physical interfaces at all. In this case, the WebUI cannot display the unassigned interfaces of the remote orchestrator, and shows the error message.

Reference

* Not able to see unassigned interfaces on checkpoint Orchestrator

* Maestro 140 not detecting Interfaces

* Maestro Expert (CCME) Course - Check Point Software, page

The SMO Master is the SGM that is responsible for synchronizing the configuration and policy with the other SGMs in the security group. The SMO Master is automatically designated as the SGM with the lowest member ID, which is usually the first one added to the security group. The SMO Master can be changed manually if needed.

* Maestro Frequently Asked Questions (FAQ), under ''What is a Single Management Object (SMO)?''

* Check Point Jump Start Course: Maestro, under ''Maestro Security Groups''

The MHO (Maestro Hyperscale Orchestrator) does not require a license by itself, but each SGM (Security Group Module) that is attached to the MHO needs a license. The license type depends on the features and blades that are enabled on the SGM. For example, if the SGM is running VSX, it needs a VSX license.

* Maestro Expert (CCME) Course - Check Point Software, page 71

* Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline

* The Quantum Maestro Orchestrator uses the Distribution Mode to assign incoming traffic to Security Group Members.

*

Reference: Working with the Distribution Mode