CheckPoint CCTE 156-585 Questions & Answers

• Question 21:

  What table does the command "fwaccel conns" pull information from?

  A. fwxl_conns

  B. SecureXLCon

  C. cphwd_db

  D. sxl_connections

  Correct Answer: A

• Question 22:

  Select the technology that does the following actions

  - provides reassembly via streaming for TCP

  - handles packet reordering and congestion

  - handles payload overlap

  - provides consistent stream of data to protocol parsers

  A. Passive Streaming Library

  B. Context Management

  C. Pre-Protocol Parser

  D. fwtcpstream

  Correct Answer: A

• Question 23:

  What file contains the RAD proxy settings?

  A. rad_settings.C

  B. rad_services.C

  C. rad_scheme.C

  D. rad_control.C

  Correct Answer: A

• Question 24:

  What does CMI stand for in relation to the Access Control Policy?

  A. Content Matching Infrastructure

  B. Content Management Interface

  C. Context Management Infrastructure

  D. Context Manipulation Interface

  Correct Answer: C

• Question 25:

  What table does command "fwaccel conns" pull information from?

  A. fwxl_conns

  B. SecureXLCon

  C. cphwd_db

  D. sxl_connections

  Correct Answer: A

• Question 26:

  Which one of the following is NOT considered a Solr core partition:

  A. CPM_0_Revisions

  B. CPM_Global_A

  C. CPM_Gtobal_R

  D. CPM_0_Disabled

  Correct Answer: D

  CPM_0_Active - Contains SMC_User Damain, system domain information from both public data and private session CPM_0_Revision - contains revision and public data CPM_Global_A - Contains CP_Data log, APPI, IPS, global domain information for both public data and private session CPM_Global_R - Contail Global revision and pubic data CPM_0_Log - Contains Log data Solr has 2 of these cores CPM_Global_M - contains statuses of SmarView New revision are transfer from active core to revision core once a day at midnight

  Reference: http://dkcheckpoint.blogspot.com/2019/12/check-point-certified-security-master.html

• Question 27:

  Which Daemon should be debugged for HTTPS Inspection related issues?

  A. FWD

  B. HTTPD

  C. WSTLSO

  D. VPND

  Correct Answer: C

  WSTLSD is the daemon responsible for HTTPS inspection https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk105559

• Question 28:

  What process monitors, terminates, and restarts critical Check Point processes as necessary?

  A. CPWD

  B. CPM

  C. FWD

  D. FWM

  Correct Answer: A

  "The Check Point WatchDog (cpwd) is a process that invokes and monitors critical processes such as Check Point daemons on the local computer, and attempts to restart them if they fail." https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/MDSG/cpwd_admin.htm

• Question 29:

  Vanessa is reviewing ike.elg file to troubleshoot failed site-to-site VPN connection After sending Mam Mode Packet 5 the response from the peer is PAYLOAD-MALFORMED" What is the reason for failed VPN connection?

  A. The authentication on Phase 1 is causing the problem.Pre-shared key on local gateway encrypted by the hash algorithm created in Packet 3 and Packet 4 doesn't match with the hash on the peer gateway generated by encrypting its preshared key

  B. The authentication on Phase 2 is causing the problem Pre-shared key on local gateway encrypted by the hash algorithm created in Packets 1 and 2 doesn't match with the hash on the peer gateway generated by encrypting its pre-shared key

  C. The authentication on Quick Mode is causing the problem Pre-shared key on local gateway encrypted by the hash algorithm created in Packets 3 and 4 doesn't match with the hash on the peer gateway generated by encrypting its preshared key

  D. The authentication on Phase 1 is causing the problem Pre-shared key on local gateway encrypted by the hash algorithm doesn't match with the hash on the peer gateway generated by encrypting its pre-shared key created in Packet 1 and Packet 2

  Correct Answer: B

• Question 30:

  Joey is configuring a site-to-site VPN with his business partner. On Joey's site he has a Check Point R80.10 Gateway and his partner uses Cisco ASA 5540 as a gateway.

  Joey's VPN domain on the Check Point Gateway object is manually configured with a group object that contains two network objects:

  VPN_Domain3 = 192.168.14.0/24

  VPN_Domain4 = 192.168.15.0/24

  Partner's site ACL as viewed from "show run"

  access-list JOEY-VPN extended permit ip 172.26.251.0 255.255.255.0 192.168.14.0 255.255.255.0

  access-list JOEY-VPN extended permit ip 172.26.251.0 255.255.255.0 192.168.15.0 255.255.255.0

  When they try to establish VPN tunnel, it fails. What is the most likely cause of the failure given the information provided?

  A. Tunnel falls on partner site. It is likely that the Cisco ASA 5540 will reject the Phase 2 negotiation. Check Point continues to present its own encryption domain as 192.168.14.0/24 and 192.168.15.0/24, but the peer expects the one network 192.168.14.0/23

  B. Tunnel fails on partner site. It is likely that the Cisco ASA 5540 will reject the Phase 2 negotiation. Check Point continues to present its own encryption domain as 192.168.14.0/23, but the peer expects the two distinct networks 192.168.14.0/24 and 192.168.15.0/24.

  C. Tunnel fails on Joey's site, because he misconfigured IP address of VPN peer.

  D. Tunnel falls on partner site. It is likely that the Cisco ASA 5540 will reject the Phase 2 negotiation due to the algorithm mismatch.

  Correct Answer: B