CheckPoint 156-585 Online Practice Questions and Exam Preparation

CheckPoint 156-585 Online Questions & Answers

• Question 91:

  You have configured IPS Bypass Under Load function with additional kernel parameters ids_tolerance_no_stress=15 and ids_tolerance_stress-15 For configuration you used the *fw ctl set' command After reboot you noticed that these parameters returned to their default values

  What do you need to do to make this configuration work immediately and stay permanent?

  A. Set these parameters again with "fw ctl set" and edit appropriate parameters in $FWDIR/boot/modules/ fwkern.conf
  B. Use script $FWDIR/bin IpsSetBypass.sh to set these parameters
  C. Set these parameters again with "fw ctl set" and save configuration with "save config"
  D. Edit appropriate parameters in $FWDIR/boot/modules/fwkern.conf
  A. Set these parameters again with "fw ctl set" and edit appropriate parameters in $FWDIR/boot/modules/ fwkern.conf

  ---

  Explanation/Reference:

  To set the desired value for this kernel parameter permanently:

  For Gaia / SecurePlatform OS:

  [Expert@HostName]# touch $FWDIR/boot/modules/fwkern.conf

  https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk62848

• Question 92:

  What is the most efficient way to view large fw monitor captures and run filters on the file?

  A. wireshark
  B. CLISH
  C. CLI
  D. snoop
  A. wireshark

• Question 93:

  Which is the correct "fw monitor" syntax for creating a capture file for loading it into WireShark?

  A. fw monitor -e "accept;" >> Output.cap
  B. This cannot be accomplished as it is not supported with R80.10
  C. fw monitor -e "accept;" -file Output.cap
  D. fw monitor -e "accept;" -o Output.cap
  D. fw monitor -e "accept;" -o Output.cap

• Question 94:

  Where will the usermode core files be located?

  A. /var/log/dump/usermode
  B. /var/suroot
  C. SFWDlR/var'log/dump/usermode
  D. SCPDIR/var/log/dump/usermode
  A. /var/log/dump/usermode

  ---

  Explanation/Reference:

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk92764

• Question 95:

  If the cpsemd process of SmartEvent has crashed or is having trouble coming up. then it usually indicates that___________.

  A. Postgres database ts down
  B. Cpd daemon is unable to connect to the log server
  C. The SmartEvent core on the Solr mdexer has been deleted
  D. The logged in administrator does not have permissions to run SmartEvent
  A. Postgres database ts down

  ---

  Explanation/Reference:

  cpsemd is the process responsible for logging into the SmartEvent GUI. Therefore, you need to check the status of this process and debug it, if necessary. Usually, the issue with the cpsemd process is that it is crashing, or not coming up. What causes this process to crash or not come up is that the PostgreSQL database is down. Therefore, in order to run the cpsemd process successfully, you need to run the PostgreSQL database successfully.

• Question 96:

  Some users from your organization have been reported some connection problems with CIFS since this morning.

  You suspect an IPS Issue after an automatic IPS update last night. So you want to perform a packet capture on uppercase I only directly after the IPS module (position 4 in the chain) to check if the packets pass the IPS. What command do you need to run?

  A. fw monitor -ml -pl 5 -e
  B. fw monitor -pi 5 -e
  C. tcpdump -eni any
  D. fw monitor -pl asm
  A. fw monitor -ml -pl 5 -e

  ---

  Explanation/Reference:

• Question 97:

  Which command is used to write a kernel debug to a file?

  A. fw ctl debug -T -f > debug.txt
  B. fw ctl kdebug -T -l > debug.txt
  C. fw ctl debug -S -t > debug.txt
  D. fw ctl kdebug -T -f > debug.txt
  D. fw ctl kdebug -T -f > debug.txt

• Question 98:

  What command is used to find out which port Multi-Portal has assigned to the Mobile Access Portal?

  A. mpclient getdata sslvpn
  B. netstat -nap | grep mobile
  C. mpclient getdata mobi
  D. netstat getdata sslvpn
  D. netstat getdata sslvpn

• Question 99:

  What table does command "fwaccel conns" pull information from?

  A. fwxl_conns
  B. SecureXLCon
  C. cphwd_db
  D. sxl_connections
  A. fwxl_conns

• Question 100:

  URL Filtering is an essential part of Web Security in the Gateway. For the Security Gateway to perform a URL lookup when a client makes a URL request, where is the sync- request forwarded from if a sync-request is required''

  A. RAD Kernel Space
  B. URLF Kernel Client
  C. URLF Online Service
  D. RAD User Space
  B. URLF Kernel Client