Checkpoint 156-587 Practice Test - Questions Answers

If you have modified kernel parameters (in fwkern.conf, for example) and the gateway starts dropping traffic or behaving abnormally after a reboot, the best practice is to restore the original or a known-good configuration from backup. Then, reboot again so that the gateway loads the last known stable settings.

Option A (fw ctl set int fw1_kernel_all_disable=1) is not a standard or documented method for ''undoing'' all kernel tweaks.

Option B (Restore fwkem.conf from backup and reboot the gateway) is the correct and straightforward approach.

Option C (fw unloadlocal) removes the local policy but does not revert custom kernel parameters that have already been loaded at boot.

Option D (Remove all kernel parameters from fwkem.conf and reboot) might help in some cases, but you risk losing other beneficial or necessary parameters if there were legitimate custom settings. Restoring from a known-good backup is safer and more precise.

Hence, the best answer: ''Restore fwkem.conf from backup and reboot the gateway.''

Check Point Troubleshooting Reference

sk98339 -- Working with fwkern.conf (kernel parameters) in Gaia OS.

sk92739 -- Advanced System Tuning in Gaia OS.

Check Point Gaia Administration Guide -- Section on kernel parameters and system tuning.

Check Point CLI Reference Guide -- Explanation of using fw ctl, fw unloadlocal, and relevant troubleshooting commands.

CPWD (Check Point WatchDog) is the process that monitors, terminates (if necessary), and restarts critical Check Point processes (e.g., FWD, FWM, CPM) when they stop responding or crash.

CPM (Check Point Management process) is a process on the Management Server responsible for the web-based SmartConsole connections, policy installations, etc.

FWD (Firewall Daemon) handles logging and communication functions in the Security Gateway.

FWM (FireWall Management) is an older reference to the management process on the Management Server for older versions.

Therefore, the best answer is CPWD.

Check Point Troubleshooting Reference

sk97638: Check Point WatchDog (CPWD) process explanation and commands.

R81.20 Administration Guide -- Section on CoreXL, Daemons, and CPWD usage.

sk105217: Best Practices -- Explains system processes, how to monitor them, and how CPWD is utilized.

When a process is frozen (hung or unresponsive), the typical method to resolve it is to kill the process. On Check Point, you can use cpwd_admin kill -name <ProcessName> or a standard Linux kill -9 <PID> command if necessary. You then allow CPWD (the Check Point watchdog) to restart it, or manually restart it if needed.

Other options:

A . Power off the machine: This is too drastic and not recommended just for a single frozen process.

B . Restart the process: While this sounds viable, you typically must kill the frozen process first, then let WatchDog or an admin restart it.

C . Reboot the machine: Similar to powering off---too disruptive for just one stuck process.

Hence, the most direct and standard approach: ''Kill the process.''

Check Point Troubleshooting Reference

sk97638 -- Explanation of CPWD (Check Point WatchDog) and how to manage processes.

sk43807 -- How to gracefully stop or kill a Check Point process.

Check Point CLI Reference Guide -- Details on using cpwd_admin commands to kill or restart processes.

When troubleshooting crashes on a Security Gateway (or any Linux-based system), the file type that is typically generated and used for in-depth analysis is a core dump.

A core dump captures the memory state of a process at the time it crashed and is critical for root-cause analysis.

Other options:

A . tcpdump: A packet capture file, not a crash-related file.

C . fw monitor: A Check Point packet capture tool, but not for crash debugging.

D . CPMIL dump: Not a common or standard crash dump reference in Check Point.

A core dump file is essentially a snapshot of the process's memory at the time of the crash. This snapshot includes crucial information that can help diagnose the cause of the crash. Here's why all the options are relevant:

i. Program Counter: This register stores the address of the next instruction the CPU was supposed to execute. It pinpoints exactly where in the code the crash occurred.

ii. Stack Pointer: This register points to the top of the call stack, which shows the sequence of function calls that led to the crash. This helps trace the program's execution flow before the crash.

iii. Memory management information: This includes details about the process's memory allocations, which can reveal issues like memory leaks or invalid memory access attempts.

iv. Other Processor and OS flags/information: This encompasses various registers and system information that provide context about the state of the processor and operating system at the time of the crash.

By analyzing this information within the core dump, you can often identify the root cause of the crash, such as a segmentation fault, null pointer dereference, or stack overflow.

Check Point Troubleshooting

Reference:

While core dumps are a general concept in operating systems, Check Point's documentation touches upon them in the context of troubleshooting specific processes like fwd (firewall) or cpd (Check Point daemon). The fw ctl zdebug command, for example, can be used to trigger a core dump of the fwd process for debugging purposes.

Usermode core files are generated when a user mode process crashes. They are located in the $CPDIR/var/log/dump/usermode directory on the Security Gateway or Security Management server. The core files can be used to analyze the cause of the crash and troubleshoot the issue. The core files are named according to the process name, date, and time of the crash. For example, cpd_2023_02_03_16_40_55.core is a core file for the cpd process that crashed on February 3, 2023 at 16:40:55