156-582 Real Exam Questions and Verified Answers

Question 1 Single choice

Running tcpdump causes a significant increase on CPU usage, what other option should you use?

A
fw monitor
B
Wait for out of business hours to do a packet capture
C
cppcap
D
You need to use tcpdump with -e option to decrease the length of packet in captures and it will utilize the less CPU

Show answer and explanation

Correct answer: C

Question 2 Single choice

The communication between the Security Management Server and Security Gateway to forward logs is done using the following process and port number:

A
fwd, TCP 257
B
cpm, 19009
C
fwm, TCP 18190
D
fwm, TCP 257

Show answer and explanation

Correct answer: A

Question 3 Single choice

What is the impact of an expired or missing contract file?

A
The existing protection settings will be removed in SmartConsole but protections are still being enforced by the Security Gateway.
B
The existing protection settings display in SmartConsole remain and during policy install the Security Gateway asks the administrator to put a new contract file during policy install.
C
The existing protection settings display in SmartConsole remain and the Security Gateway will use a
14-day EVAL free license instead.
D
The existing protection settings display in SmartConsole remain but are not being enforced by the Security Gateway.

Show answer and explanation

Correct answer: D

Question 4 Single choice

Select the correct statement about service contracts.

A
Valid service contracts must be stored only on the Security Gateways that have Threat Prevention blades enabled
B
Service contracts are provided on paper only
C
Valid service contracts are only stored and required on the Primary Security Management Server and never downloaded on any other system
D
Valid service contracts must be stored on the Security Management Server before they can be downloaded to a Security Gateway

Show answer and explanation

Correct answer: D

Question 5 Single choice

How do you verify that Proxy ARP entries are loaded into the kernel?

A
fw ctl arp
B
show arp dynamic all
C
This information can be viewed in the logs, under NAT section of log, field: Proxy ARP entry
D
fw ctl get arp list all

Show answer and explanation

Correct answer: A

Question 6 Single choice

What are some measures you can take to prevent IPS false positives?

A
Capture packets, Update the IPS database, and Back up custom IPS files
B
Use Recommended IPS profile
C
Use IPS only in Detect mode
D
Exclude problematic services from being protected by IPS (sip, H.323, etc.)

Show answer and explanation

Correct answer: B

Question 7 Single choice

To verify that communication is working between the Security Management Server and the Security Gateway, which service port should be checked?

A
257
B
18209
C
259
D
19009

Show answer and explanation

Correct answer: A

Question 8 Single choice

The URL filtering cache limit exceeded.

What issues can this cause?

A
When URL filtering cache exceeds the limit, it will be disabled temporarily to overcome instability of the system
B
RAD process will spawn multiple times to help populate the cache
C
Resource Advisor (RAD) process on the Security Gateway consumes close to 100 percent of the CPU
D
Nothing, the Security Gateway dynamically raises the cache when needed

Show answer and explanation

Correct answer: C

Question 9 Single choice

After deploying a new Static NAT configuration, traffic is not getting through.

What command would you use to verify that the proxy ARP configuration has been loaded?

A
fw ctl conn
B
fw ctl arp
C
fw arp ctl
D
cp ctl arp

Show answer and explanation

Correct answer: B

Question 10 Single choice

After deploying a new Static NAT configuration, traffic is not getting through.

What command would you use to troubleshoot internal problems with the NAT traffic?

A
fw ctl kdebug + xlate xltrc nat
B
cp ctl zdebug + xlate xltrc nat
C
fw ctl zdebug + xlate xltrc nat
D
cp ctl kdebug + xlate xltrc nat

Show answer and explanation

Correct answer: C