CheckPoint 156-585 Online Practice Questions and Exam Preparation

CheckPoint 156-585 Online Questions & Answers

• Question 71:

  Which of the following is contained in the System Domain of the Postgres database?

  A. Saved queries for applications
  B. Configuration data of log servers
  C. Trusted GUI clients
  D. User modified configurations such as network objects
  C. Trusted GUI clients

• Question 72:

  What process monitors, terminates, and restarts critical Check Point processes as necessary?

  A. CPWD
  B. CPM
  C. FWD
  D. FWM
  A. CPWD

  ---

  Explanation/Reference:

  "The Check Point WatchDog (cpwd) is a process that invokes and monitors critical processes such as Check Point daemons on the local computer, and attempts to restart them if they fail." https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/MDSG/cpwd_admin.htm

• Question 73:

  For TCP connections, when a packet arrives at the Firewall Kernel out of sequence or fragmented, which layer of IPS corrects this to allow for proper inspection?

  A. Passive Streaming Library
  B. Protections
  C. Protocol Parsers
  D. Context Management
  A. Passive Streaming Library

• Question 74:

  You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week. Therefore, you need to add a timestamp to the kernel debug and write the output to a file but you can't afford to fill up all the remaining disk space and you only have 10 GB free for saving the debugs. What is the correct syntax for this?

  A. fw ctl kdebug -T -f -m 10 -s 1000000 -o debugfilename
  B. fw ctl kdebug -T -f -m 10 -s 1000000 > debugfilename
  C. fw ctl kdebug -T -m 10 -s 1000000 -o debugfilename
  D. fw ctl debug -T -f -m 10 -s 1000000 -o debugfilename
  A. fw ctl kdebug -T -f -m 10 -s 1000000 -o debugfilename

  ---

  Explanation/Reference:

  https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_NextGenSecurityGateway_Guide/Topics-FWG/Kernel-Debug/Kernel-Debug-Syntax.htm?tocpath=Kernel%20Debug%20on%20Security%20Gateway%7C_____1

• Question 75:

  After kernel debug with "fw ctl debug" you received a huge amount of information It was saved in a very large file that is difficult to open and analyze with standard text editors Suggest a solution to solve this issue.

  A. Use "fw ctl zdebug' because of 1024KB buffer size
  B. Divide debug information into smaller files Use "fw ctl kdebug -f -o "filename" -m 25 - s "1024"
  C. Reduce debug buffer to 1024KB and run debug for several times
  D. Use Check Point InfoView utility to analyze debug output
  C. Reduce debug buffer to 1024KB and run debug for several times

• Question 76:

  What components make up the Context Management Infrastructure?

  A. CMI Loader and Pattern Matcher
  B. CPMI and FW Loader
  C. CPX and FWM
  D. CPM and SOLR
  A. CMI Loader and Pattern Matcher

• Question 77:

  What file contains the RAD proxy settings?

  A. rad_settings.C
  B. rad_services.C
  C. rad_scheme.C
  D. rad_control.C
  A. rad_settings.C

• Question 78:

  What file extension should be used with fw monitor to allow the output file to be imported and read in Wireshark?

  A. .cap
  B. .exe
  C. .tgz
  D. .pcap
  A. .cap

• Question 79:

  Joey is configuring a site-to-site VPN with his business partner. On Joey's site he has a Check Point R80.10 Gateway and his partner uses Cisco ASA 5540 as a gateway.

  Joey's VPN domain on the Check Point Gateway object is manually configured with a group object that contains two network objects:

  VPN_Domain3 = 192.168.14.0/24

  VPN_Domain4 = 192.168.15.0/24

  Partner's site ACL as viewed from "show run"

  access-list JOEY-VPN extended permit ip 172.26.251.0 255.255.255.0 192.168.14.0 255.255.255.0

  access-list JOEY-VPN extended permit ip 172.26.251.0 255.255.255.0 192.168.15.0 255.255.255.0

  When they try to establish VPN tunnel, it fails. What is the most likely cause of the failure given the information provided?

  A. Tunnel falls on partner site. It is likely that the Cisco ASA 5540 will reject the Phase 2 negotiation. Check Point continues to present its own encryption domain as 192.168.14.0/24 and 192.168.15.0/24, but the peer expects the one network 192.168.14.0/23
  B. Tunnel fails on partner site. It is likely that the Cisco ASA 5540 will reject the Phase 2 negotiation. Check Point continues to present its own encryption domain as 192.168.14.0/23, but the peer expects the two distinct networks 192.168.14.0/24 and 192.168.15.0/24.
  C. Tunnel fails on Joey's site, because he misconfigured IP address of VPN peer.
  D. Tunnel falls on partner site. It is likely that the Cisco ASA 5540 will reject the Phase 2 negotiation due to the algorithm mismatch.
  B. Tunnel fails on partner site. It is likely that the Cisco ASA 5540 will reject the Phase 2 negotiation. Check Point continues to present its own encryption domain as 192.168.14.0/23, but the peer expects the two distinct networks 192.168.14.0/24 and 192.168.15.0/24.

• Question 80:

  When a User process or program suddenly crashes, a core dump is often used to examine the problem. Which command is used to enable the core-dumping via GAIA dish?

  A. set core-dump enable
  B. set core-dump per_process
  C. set user-dump enable
  D. set core-dump total
  A. set core-dump enable