CheckPoint 156-585 Online Practice Questions and Exam Preparation

CheckPoint 156-585 Online Questions & Answers

• Question 41:

  James is using the same filter expression in fw monitor for CITRIX very often and instead of typing this all the time he wants to add it as a macro to the fw monitor definition file.

  What's the name and location of this file?

  A. $FWDIR/lib/fwmonltor.def
  B. $FWDIR/conf/fwmonltor.def
  C. $FWDIR/lib/tcpip.def
  D. $FWDIR/lib/fw.monitor
  A. $FWDIR/lib/fwmonltor.def

  ---

  Explanation/Reference:

• Question 42:

  What is the kernel process for Content Awareness that collects the data from the contexts received from the CMI and decides if the file is matched by a data type?

  A. dlpda
  B. dlpu
  C. cntmgr
  D. cntawmod
  D. cntawmod

• Question 43:

  What is the purpose of the Hardware Diagnostics Tool?

  A. Verifying that Check Point Appliance hardware is functioning correctly
  B. Verifying the Security Management Server hardware is functioning correctly
  C. Verifying that Security Gateway hardware is functioning correctly
  D. Verifying that Check Point Appliance hardware is actually broken
  B. Verifying the Security Management Server hardware is functioning correctly

• Question 44:

  What acceleration mode utilizes multi-core processing to assist with traffic processing?

  A. CoreXL
  B. SecureXL
  C. HyperThreading
  D. Traffic Warping
  C. HyperThreading

• Question 45:

  Which Threat Prevention Daemon is the core Threat Emulation engine and responsible for emulation files and communications with Threat Cloud?

  A. ctasd
  B. in.msd
  C. ted
  D. scrub
  C. ted

• Question 46:

  Select the technology that does the following actions

  - provides reassembly via streaming for TCP

  - handles packet reordering and congestion

  - handles payload overlap

  - provides consistent stream of data to protocol parsers

  A. Passive Streaming Library
  B. Context Management
  C. Pre-Protocol Parser
  D. fwtcpstream
  A. Passive Streaming Library

• Question 47:

  An administrator receives reports about issues with log indexing and text searching regarding an existing Management Server. In trying to find a solution she wants to check if the process responsible for this feature is running correctly. What is true about the related process?

  A. fwm manages this database after initialization of the ICA
  B. cpd needs to be restarted manual to show in the list
  C. fwssd crashes can affect therefore not show in the list
  D. solr is a child process of cpm
  D. solr is a child process of cpm

• Question 48:

  During firewall kernel debug with fw ctl zdebug you received less information than expected. You noticed that a lot of messages were lost since the time the debug was started. What should you do to resolve this issue?

  A. Increase debug buffer; Use fw ctl debug -buf 32768
  B. Redirect debug output to file; Use fw ctl zdebug -o ./debug.elg
  C. Increase debug buffer; Use fw ctl zdebug -buf 32768
  D. Redirect debug output to file; Use fw ctl debug -o ./debug.elg
  A. Increase debug buffer; Use fw ctl debug -buf 32768

  ---

  Explanation/Reference:

  Reference: https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_PerformanceTuning_AdminGuide/Content/Topics-PTG/Kernel-Debug/Kernel-Debug-Procedure.htm

• Question 49:

  What does SIM handle?

  A. Accelerating packets
  B. FW kernel to SXL kernel hand off
  C. OPSEC connects to SecureXL
  D. Hardware communication to the accelerator
  D. Hardware communication to the accelerator

• Question 50:

  What is the main SecureXL database for tracking acceleration status of traffic?

  A. cphwd_db
  B. cphwd_tmp1
  C. cphwd_dev_conn_table
  D. cphwd_dev_identity_table
  B. cphwd_tmp1