156-115.80 questions and answers

Question 1

Single choice

To display status information, such as number of connections currently being handled and the peak number of concurrent connections the instance has handled since inception for each kernel instance, which command would you use?

1. A

   fw ctl multip stat

2. B

   fw ctl affinity -t stat

3. C

   fw ctl affinity -s stat

4. D

   fw ctl multik stat

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_PerformanceTuning_WebAdmin/6731.htm

Question 2

Single choice

Which of the following is NOT a vpn debug command used for troubleshoot?

1. A

   fw ctl debug -m fw + conn drop vm crypt

2. B

   vpn debug trunc

3. C

   mpclient getdata sslvpn

4. D

   vpn debug on TDERROR_ALL_ALL=5

Reveal answer details Close answer details

Correct answerC

Question 3

Single choice

In R80 spoofing is defined as a method of:

1. A

   Disguising an illegal IP address behind an authorized IP address through Port Address Translation

2. B

   Hiding your firewall from unauthorized users

3. C

   Detecting people using false or wrong authentication logins

4. D

   Making packets appear as if they come an authorized IP address

Reveal answer details Close answer details

Correct answerD

Question 4

Single choice

Having a look at the output of the "fwaccel conns" command, the F flag is the indicator for a packet
______________.

1. A

   getting the routing information according to the Forwarding Information Base (FIB)

2. B

   being processed by the firewall kernel module

3. C

   going through the slow path

4. D

   being forced of using the accelerated path

Reveal answer details Close answer details

Correct answerB

Question 5

Single choice

Which kernel table stores information about NAT connections?

1. A

   connections

2. B

   tab_nat_conn

3. C

   xlate

4. D

   fwx_alloc

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk32224

Question 6

Single choice

Which of the following features is supported in Check Point's implementation of IPv6?

1. A

   Security Servers

2. B

   QoS

3. C

   ClusterXL High Availability

4. D

   SAM

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk39374

Question 7

Single choice

What is the command to check the number of CoreXL firewall instances?

1. A

   show corexl stat

2. B

   fw ctl multik stat

3. C

   coreXL_admin stat

4. D

   fw ctl corexl stats

Reveal answer details Close answer details

Correct answerB

Question 8

Single choice

How can you print the session UUID and the UUID of a connection together in fw monitor?

1. A

   The switches -s and -u are mutually exclusive and cannot be printed together

2. B

   fw -s monitor -u -e "accept <FILTER EXPRESSION>;"

3. C

   fw monitor -uids -e "accept <FILTER EXPRESSION>;"

4. D

   fw monitor -s -u -e "accept <FILLTER EXPRESSION>;"

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk30583

Question 9

Single choice

If cluster members are geographically separated and the time to detect a failover needs to be longer, what timer needs to be adjusted?

1. A

   fwha_timer_cpha_res

2. B

   fwha_timer_dist_res

3. C

   fwha_geosync_timer

4. D

   fwha_timer_sync_res

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_ClusterXL_AdminGuide/7298.htm

Question 10

Single choice

Which daemon is responsible for anti-spam?

1. A

   cpmd

2. B

   ctasd

3. C

   ctmd

4. D

   cpemd

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97638

Question 11

Single choice

Which command is used to write a kernel debug to a file?

1. A

   fw ctl debug -T -f > debug.txt

2. B

   fw ctl kdebug -T -l > debug.txt

3. C

   fw ctl debug -S -t > debug.txt

4. D

   fw ctl kdebug -T -f > debug.txt

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://itsecworks.com/2011/08/09/checkpoint-firewall-debugging-basics/

Question 12

Single choice

Which Check Point utility should be used to assist in analyzing the output of vpn and ike debug?

1. A

   cpview

2. B

   cpinfo

3. C

   ikeview

4. D

   vpnview

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_Gaia_WebAdmin/12467.htm

Question 13

Single choice

John works for ABC Corporation. They have enabled CoreXL on their firewall. John would like to identify the cores on which the SND runs and the cores on which the firewall instance is running.

Which command should John run to view the CPU role allocation?

1. A

   fw ctl affinity -v

2. B

   fwaccel stat -l

3. C

   fwaccel stat -l

4. D

   fw ctl cores

Reveal answer details Close answer details

Correct answerC

Question 14

Single choice

Which of the following is NOT a feature of ClusterXL?

1. A

   Transparent upgrades

2. B

   Zero downtime for mission-critical environments with State Synchronization

3. C

   Enhanced throughput in all ClusterXL modes (2 gateway cluster compared with 1 gateway)

4. D

   Transparent failover in case of device failures

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_ClusterXL_AdminGuide/7292.htm

Question 15

Single choice

By default, how long does the UDP connection remain on the state table?

1. A

   30 Seconds

2. B

   30 minutes

3. C

   60 minutes

4. D

   40 Seconds

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-Connection-Table/td-p/41581#:~:text=For%20example%2C%20the%20default%20session,(TCP%20to%203600%20seconds)
.

Question 16

Single choice

Consider an IKE debug file that has been generated when debugging an issue with site to site VPN.

What is the purpose of a NONCE?

1. A

   Randomly generated part of key generation

2. B

   Vendor ID and Remote Gateway ID

3. C

   Protocol 50 and 51 representations

4. D

   Fixed hex value of Phase 2 keys with PFS

Reveal answer details Close answer details

Correct answerA

Question 17

Single choice

When running a debug with fw monitor, which parameter will create a more verbose output?

1. A

   -l

2. B

   -i

3. C

   -D

4. D

   -d

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk30583

Question 18

Single choice

In order to test ClusterXL failovers which command would you use on one of the ClusterXL nodes to initiate a failover?

1. A

   clusterXL_admin down -p

2. B

   cluster XL_admin up -p

3. C

   cphaprob -d TEST -s ok register

4. D

   cphaprob -d TEST -s problem unregister

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://sc1.checkpoint.com/documents/R76/CP_R76_ClusterXL_AdminGuide/7298.htm#o97358

Question 19

Single choice

Which process is responsible for the generation of certificates?

1. A

   cpm

2. B

   cpca

3. C

   dbsync

4. D

   fwm

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97638#Security%20Management%20Software%20Blades%20and%20Features%20-%20SmartLog

Question 20

Single choice

What file extension should be used with fw monitor to allow the output file to be imported and read in Wireshark?

1. A

   .cap

2. B

   .exe

3. C

   .tgz

4. D

   .pcap

Reveal answer details Close answer details

Correct answerA

Question 21

Single choice

What is the correct command to turn off an IKE debug?

1. A

   vpn debug ikeoff

2. B

   fw ctl debug ikeoff

3. C

   vpn debug ikeoff 0

4. D

   fw ctl vpn debug ikeoff

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://community.checkpoint.com/docs/DOC-3023-vpn-troubleshooting-commands

Question 22

Single choice

Which of the following file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?

1. A

   core dump

2. B

   CPMIL dump

3. C

   fw monitor

4. D

   tcpdump

Reveal answer details Close answer details

Correct answerA

Question 23

Single choice

After determining that the IPS Blade is causing high resource utilization in the gateway, which would be an appropriate strategy to improve IPS performance?

1. A

   Enabling CoreXL

2. B

   Enable Bypass mode

3. C

   Disabling SecureXL

4. D

   Enabling SecureXL

Reveal answer details Close answer details

Correct answerA

Question 24

Single choice

You verified that Performance Pack is disabled and need to distribute the affinity interfaces.

What command would you run to use static affinity to balance the interfaces between the SND cores?

1. A

   cpmq set

2. B

   sim affinity -s

3. C

   fw ctl affinity -a -l -v

4. D

   fw ctl affinity -s

Reveal answer details Close answer details

Correct answerC