CheckPoint CCTE 156-585 Questions & Answers

• Question 101:

  What is NOT a benefit of the fw ctl zdebug command?

  A. Cannot be used to debug additional modules

  B. Collect debug messages from the kernel

  C. Clean the buffer

  D. Automatically allocate a 1MB buffer

  Correct Answer: A

• Question 102:

  How can you increase the ring buffer size to 1024 descriptors?

  A. set interface eth0 rx-ringsize 1024

  B. fw ctl int rx_ringsize 1024

  C. echo rx_ringsize=1024>>/etc/sysconfig/sysctl.conf

  D. dbedit>modify properties firewall_properties rx_ringsize 1024

  Correct Answer: A

• Question 103:

  What does SIM handle?

  A. Accelerating packets

  B. FW kernel to SXL kernel hand off

  C. OPSEC connects to SecureXL

  D. Hardware communication to the accelerator

  Correct Answer: D

• Question 104:

  Your users have some issues connecting Mobile Access VPN to the gateway. How can you debug the tunnel establishment?

  A. in the file $CVPNDIR/conf/httpd.conf change the line loglevel .. To LogLevel debug and run cvpnrestart

  B. run vpn debug truncon

  C. run fw ctl zdebug -m sslvpn all

  D. in the file $VPNDIR/conf/httpd.conf the line Loglevel .. To LogLevel debug and run vpn restart

  Correct Answer: A

• Question 105:

  What components make up the Context Management Infrastructure?

  A. CMI Loader and Pattern Matcher

  B. CPMI and FW Loader

  C. CPX and FWM

  D. CPM and SOLR

  Correct Answer: A

• Question 106:

  To check the current status of hyper-threading, which command would you execute in expert mode?

  A. cat /proc/hypert_status

  B. cat /proc/smt_status

  C. cat /proc/hypert_stat

  D. cat /proc/smt_stat

  Correct Answer: B

• Question 107:

  After kernel debug with "fw ctl debug" you received a huge amount of information It was saved in a very large file that is difficult to open and analyze with standard text editors Suggest a solution to solve this issue.

  A. Use "fw ctl zdebug' because of 1024KB buffer size

  B. Divide debug information into smaller files Use "fw ctl kdebug -f -o "filename" -m 25 - s "1024"

  C. Reduce debug buffer to 1024KB and run debug for several times

  D. Use Check Point InfoView utility to analyze debug output

  Correct Answer: C

• Question 108:

  What are some measures you can take to prevent IPS false positives?

  A. Exclude problematic services from being protected by IPS (sip, H 323, etc )

  B. Use IPS only in Detect mode

  C. Use Recommended IPS profile

  D. Capture packets. Update the IPS database, and Back up custom IPS files

  Correct Answer: D

  “Take the following measure s to prevent false positives: Import Snort signatures Back up custom IPS files Update the IPS database Import IPS profiles Capture packets Analyze advanced SmartEvent Configure Geo Protections”

• Question 109:

  Which kernel process is used by Content Awareness to collect the data from contexts?

  A. dlpda

  B. PDP

  C. cpemd

  D. CMI

  Correct Answer: A

  Content Awareness process dlpda collects the data from those contexts and decides if the file is matched by some Data Type.

  https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk119715

• Question 110:

  VPN's allow traffic to pass through the Internet securely by encrypting the traffic as it enters the VPN tunnel and then decrypting the exists. Which process is responsible for Mobile VPN connections?

  A. cvpnd

  B. vpnd

  C. vpnk

  D. fwk

  Correct Answer: C