CheckPoint 156-585 Online Practice Questions and Exam Preparation

CheckPoint 156-585 Online Questions & Answers

• Question 31:

  In Security Management High Availability, if the primary and secondary managements, running the same version of R80.x, are in a state of `Collision', how can this be resolved?

  A. Administrator should manually synchronize the servers using SmartConsole
  B. The Collision state does not happen in R80.x as the synchronizing automatically on every publish action
  C. Reset the SIC of the secondary management server
  D. Run the command `fw send synch force' on the primary server and `fw get sync quiet' on the secondary server
  A. Administrator should manually synchronize the servers using SmartConsole

• Question 32:

  Which of the following inputs is suitable for debugging HTTPS inspection issues?

  A. vpn debug cptls on
  B. fw ctl debug 璵 fw + conn drop cptls
  C. fw diag debug tls enable
  D. fw debug tls on TDERROR_ALL_ALL=5
  B. fw ctl debug 璵 fw + conn drop cptls

  ---

  Explanation/Reference:

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk108202

• Question 33:

  If you run the command "fw monitor -e accept src=10.1.1.201 or src=172.21.101.10 or src=192.0.2.10;" from the cli sh What will be captured?

  A. Packets from 10 1 1 201 going to 192.0 2.10
  B. Packets destined to 172 21 101 10 from 10.1.1.101
  C. Only packet going to 192.0.2.10
  D. fw monitor only works in expert mode so no packets will be captured
  C. Only packet going to 192.0.2.10

• Question 34:

  Which Daemon should be debugged for HTTPS Inspection related issues?

  A. FWD
  B. HTTPD
  C. WSTLSO
  D. VPND
  C. WSTLSO

  ---

  Explanation/Reference:

  WSTLSD is the daemon responsible for HTTPS inspection https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=andsolutionid=sk105559

• Question 35:

  The management configuration stored in the Postgres database is partitioned into several relational database Domains, like - System, User, Global and Log Domains. The User Domain stores the network objects and security policies. Which of the following is stored in the Log Domain?

  A. Configuration data of Log Servers and saved queries for applications
  B. Active Logs received from Security Gateways and Management Servers
  C. Active and past logs received from Gateways and Servers
  D. Log Domain is not stored in Postgres database, it is part of Solr indexer only
  D. Log Domain is not stored in Postgres database, it is part of Solr indexer only

• Question 36:

  John works for ABC Corporation. They have enabled CoreXL on their firewall John would like to identify the cores on which the SND runs and the cores on which the firewall instance is running. Which command should John run to view the CPU role allocation?

  A. fw ctl affinity -v
  B. fwaccel stat -I
  C. fw ctl affinity -I
  D. fw ctl cores
  C. fw ctl affinity -I

• Question 37:

  How many tiers of pattern matching can a packet pass through during IPS inspection?

  A. 2
  B. 1
  C. 5
  D. 9
  A. 2

• Question 38:

  What are the four ways to insert an FW Monitor into the firewall kernel chain?

  A. Relative position using location, relative position using alias, absolute position, all positions
  B. Absolute position using location, absolute position using alias, relative position, all positions
  C. Absolute position using location, relative position using alias, general position, all positions
  D. Relative position using geolocation, relative position using inertial navigation, absolute position, all positions
  A. Relative position using location, relative position using alias, absolute position, all positions

  ---

  Explanation/Reference:

  Page 22: relative position using a number relative position using an alias absolute position all positions

  https://downloads.checkpoint.com/fileserver/SOURCE/direct/ID/9068/FILE/How_to_use_FW_Monitor.pdf Start explanation from page 19

• Question 39:

  Which command do you need to execute to insert fw monitor after TCP streaming (out) in the outbound chain using absolute position? Given the chain was 1ffffe0, choose the correct answer.

  A. fw monitor -po -0x1ffffe0
  B. fw monitor -p0 ox1ffffe0
  C. fw monitor -po 1ffffe0
  D. fw monitor -p0 -ox1ffffe0
  A. fw monitor -po -0x1ffffe0

  ---

  Explanation/Reference:

  https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Perform anceTuning_AdminGuide/Content/Topics-PTG/CLI/fw-monitor.htm

• Question 40:

  What is the simplest and most efficient way to check all dropped packets in real time?

  A. fw ctl zdebug * drop in expert mode
  B. Smartlog
  C. cat /dev/fwTlog in expert mode
  D. tail -f SFWDIR/log/fw log |grep drop in expert mode
  D. tail -f SFWDIR/log/fw log |grep drop in expert mode