CheckPoint 156-585 Online Practice Questions and Exam Preparation

CheckPoint 156-585 Online Questions & Answers

• Question 81:

  Check Point Threat Prevention policies can contain multiple policy layers and each layer consists of its own Rule Base

  Which Threat Prevention daemon is used for Anti-virus?

  A. in.emaild.mta
  B. in.msd
  C. ctasd
  D. in emaild
  D. in emaild

  ---

  Explanation/Reference:

• Question 82:

  What are four main database domains?

  A. System, Global, Log, Event
  B. System, User, Host, Network
  C. Local, Global, User, VPN
  D. System, User, Global, Log
  D. System, User, Global, Log

• Question 83:

  What is connect about the Resource Advisor (RAD) service on the Security Gateways?

  A. RAD has a kernel module that looks up the kernel cache, notifies client about hits and misses and forwards a-sync requests to RAD user space module which is responsible for online categorization
  B. RAD is completely loaded as a kernel module that looks up URL in cache and if not found connects online for categorization There is no user space involvement in this process
  C. RAD functions completely in user space The Pattern Matter (PM) module of the CMI looks up for URLs in the cache and if not found, contact the RAD process in user space to do online categorization
  D. RAD is not a separate module, it is an integrated function of the 'fw1 kernel module and does all operations in the kernel space
  C. RAD functions completely in user space The Pattern Matter (PM) module of the CMI looks up for URLs in the cache and if not found, contact the RAD process in user space to do online categorization

• Question 84:

  VPN issues may result from misconfiguration, communication failure, or incompatible default configurations between peers Which basic command syntax needs to be used for troubleshooting Site-to-Site VPN Issues?

  A. vpn debug truncon
  B. fw debug truncon
  C. cp debug truncon
  D. vpn truncon debug
  A. vpn debug truncon

  ---

  Explanation/Reference:

• Question 85:

  Which one of the following is NOT considered a Solr core partition:

  A. CPM_0_Revisions
  B. CPM_Global_A
  C. CPM_Gtobal_R
  D. CPM_0_Disabled
  D. CPM_0_Disabled

  ---

  Explanation/Reference:

  CPM_0_Active - Contains SMC_User Damain, system domain information from both public data and private session CPM_0_Revision - contains revision and public data CPM_Global_A - Contains CP_Data log, APPI, IPS, global domain information for both public data and private session CPM_Global_R - Contail Global revision and pubic data CPM_0_Log - Contains Log data Solr has 2 of these cores CPM_Global_M - contains statuses of SmarView New revision are transfer from active core to revision core once a day at midnight

  Reference: http://dkcheckpoint.blogspot.com/2019/12/check-point-certified-security-master.html

• Question 86:

  What is the function of the Core Dump Manager utility?

  A. To generate a new core dump for analysis
  B. To limit the number of core dump files per process as well as the total amount of disk space used by core files
  C. To determine which process is slowing down the system
  D. To send crash information to an external analyzer
  B. To limit the number of core dump files per process as well as the total amount of disk space used by core files

• Question 87:

  Your fwm constantly crashes and is restarted by the watchdog. You can't find any coredumps related to this process, so you need to check If coredumps are enabled at all

  How can you achieve that?

  A. in dish run show core-dump status
  B. in expert mode run show core-dump status
  C. in dish run set core-dump status
  D. in dish run show coredumb status
  D. in dish run show coredumb status

  ---

  Explanation/Reference:

• Question 88:

  Which situation triggers an IPS bypass under load on a 24-core Check Point appliance?

  A. any of the CPU cores is above the threshold for more than 10 seconds
  B. all CPU core most be above the threshold for more than 10 seconds
  C. a single CPU core must be above the threshold for more than 10 seconds, but is must be the same core during this time
  D. the average cpu utilization over all cores must be above the threshold for 1 second
  A. any of the CPU cores is above the threshold for more than 10 seconds

• Question 89:

  What is the correct syntax to turn a VPN debug on and create new empty debug files?

  A. vpn debug truncon
  B. vpndebug trunc on
  C. vpn kdebug on
  D. vpn debug trunkon
  D. vpn debug trunkon

• Question 90:

  How many captures does the command "fw monitor -p all" take?

  A. All 15 of the inbound and outbound modules
  B. All 4 points of the fw VM modules
  C. 1 from every inbound and outbound module of the chain
  D. The -p option takes the same number of captures, but gathers all of the data packet
  C. 1 from every inbound and outbound module of the chain