CheckPoint 156-585 Online Practice Questions and Exam Preparation

CheckPoint 156-585 Online Questions & Answers

• Question 51:

  What are some measures you can take to prevent IPS false positives?

  A. Exclude problematic services from being protected by IPS (sip, H 323, etc )
  B. Use IPS only in Detect mode
  C. Use Recommended IPS profile
  D. Capture packets. Update the IPS database, and Back up custom IPS files
  D. Capture packets. Update the IPS database, and Back up custom IPS files

  ---

  Explanation/Reference:

  “Take the following measure s to prevent false positives: Import Snort signatures Back up custom IPS files Update the IPS database Import IPS profiles Capture packets Analyze advanced SmartEvent Configure Geo Protections”

• Question 52:

  You are running R80.XX on an open server and you see a high CPU utilization on your 12 CPU cores You now want to enable Hyperthreading to get more cores to gain some performance. What is the correct way to achieve this?

  A. Hyperthreading is not supported on open servers, on on Check Point Appliances
  B. just turn on HAT in the bios of the server and boot it
  C. just turn on HAT in the bios of the server and after it has booted enable it in cpconfig
  D. in dish run set HAT on
  A. Hyperthreading is not supported on open servers, on on Check Point Appliances

• Question 53:

  What is the buffer size set by the fw ctl zdebug command?

  A. 1 MB
  B. 1 GB
  C. 8MB
  D. 8GB
  A. 1 MB

• Question 54:

  What command sets a specific interface as not accelerated?

  A. noaccel-s
  B. fwaccel exempt state
  C. nonaccel -s
  D. fwaccel -n
  C. nonaccel -s

• Question 55:

  The customer is using Check Point appliances that were configured long ago by third-party administrators. Current policy includes different enabled IPS protections and Bypass Under Load function. Bypass Under Load is configured to disable IPS inspections of CPU and Memory usage is higher than 80%. The Customer reports that IPS protections are not working at all regardless of CPU and Memory usage.

  What is the possible reason of such behavior?

  A. The kernel parameter ids_assume_stress is set to 0
  B. The kernel parameter ids_assume_stress is set to 1
  C. The kernel parameter ids_tolerance_no_stress is set to 10
  D. The kernel parameter ids_tolerance_stress is set to 10
  B. The kernel parameter ids_assume_stress is set to 1

  ---

  Explanation/Reference:

  B: ids_assume_stress, 1 = IDS mechanism assumes that the Security Gateway is under stress, regardless of the actual utilization of CPU and memory. ref sk62848: How to tune the "Bypass under Load" IPS settings

• Question 56:

  Check Point Access Control Daemons contains several daemons for Software Blades and features

  Which Daemon is used for Application and Control URL Filtering?

  A. rad
  B. cprad
  C. pepd
  D. pdpd
  C. pepd

  ---

  Explanation/Reference:

• Question 57:

  Which of the following is NOT a vpn debug command used for troubleshooting?

  A. fw ctl debug -m fw + conn drop vm crypt
  B. vpn debug trunc
  C. pclient getdata sslvpn
  D. vpn debug on TDERROR_ALL_ALL=5
  C. pclient getdata sslvpn

• Question 58:

  Which command is most useful for debugging the fwaccel module?

  A. fw zdebug
  B. securexl debug
  C. fwaccel dbg
  D. fw debug
  C. fwaccel dbg

• Question 59:

  How can you start debug of the Unified Policy with all possible flags turned on?

  A. fw ctl debug -m UP all
  B. fw ctl debug -m UnifiedPolicy all
  C. fw ctl debug -m fw + UP
  D. fw ctl debug -m UP *
  D. fw ctl debug -m UP *

• Question 60:

  To check the current status of hyper-threading, which command would you execute in expert mode?

  A. cat /proc/hypert_status
  B. cat /proc/smt_status
  C. cat /proc/hypert_stat
  D. cat /proc/smt_stat
  B. cat /proc/smt_status