CCTE 156-587 Practice Test Engine: Try These 111 Exam Questions
Guaranteed Success in CCTE 156-587 Exam Dumps
NEW QUESTION # 12
In some scenarios it is very helpful to use advanced Linux commands for troubleshooting purposes. Which command displays information about resource utilization for running processes and shows additional information for core utilization and memory?
- A. mpstat
- B. cptop
- C. top
- D. vmstat
Answer: C
NEW QUESTION # 13
Troubleshooting issues with Mobile Access requires the following:
- A. Standard VPN debugs and packet captures on Security Gateway, debugs of 'cvpnd' process on Security Management
- B. Debug logs of FWD captured with the command - 'fw debug fwd on
TDERROR_MOBILE_ACCESS=5' - C. 'ma_vpnd' process on Security Gateway
- D. Standard VPN debugs, packet captures and debugs of cvpnd1 process on Security Gateway
Answer: D
NEW QUESTION # 14
What are the three main component of Identity Awareness?
- A. Identity Awareness Blade on Security Gateway, User Database on Security Management Server and Active Directory
- B. User, Active Directory and Access Role
- C. Identity Source, Identity Server (PDP) and Identity Enforcement (PEP)
- D. Client, SMS and Secure Gateway
Answer: C
NEW QUESTION # 15
When viewing data for CPMI objects in the Postgres database, what table column should be selected to query for the object instance?
- A. fwset
- B. GuiDBedit
- C. CpmiHostCkp
- D. CPM Global M
Answer: C
Explanation:
The CpmiHostCkp table in the Postgres database contains the data for CPMI objects, such as gateways, clusters, and servers. The table column that should be selected to query for the object instance is the objid column, which is the primary key of the table and uniquely identifies each object. The objid column can be used to join with other tables that reference CPMI objects, such as CpmiClusterMember, CpmiCluster, and CpmiServer. The objid column can also be used to retrieve the object name, IP address, type, and other attributes from the CpmiHostCkp table itself. Reference:
Check Point Database Tool (GuiDBedit Tool) - Section: How to use the Check Point Database Tool (GuiDBedit Tool) - Subsection: How to view the data in the database Check Point Certified Troubleshooting Expert (CCTE) - Exam Topics - Module 6: Advanced Management Server Troubleshooting
[Check Point R81 Database Schema] - Section: CPMI Tables - Subsection: CpmiHostCkp Table
NEW QUESTION # 16
The packet processing infrastructure consists of 4 components. Which component contains the CLOB, the object that contains information about the packet that is needed to make security decisions?
- A. Handlers
- B. Observers
- C. Manager
- D. Classifiers
Answer: D
NEW QUESTION # 17
Which of the following inputs is suitable for debugging HTTPS inspection issues?
- A. fw debug tls on TDERROR_ALL_ALL=5
- B. fw ctl debug -m fw + conn drop cptls
- C. vpn debug cptls on
- D. fw diag debug tls enable
Answer: A
Explanation:
The input that is suitable for debugging HTTPS inspection issues is fw debug tls on TDERROR_ALL_ALL=5. This input will enable the TLS debug mode and set the debug level to 5, which is the highest level of verbosity. The fw debug command is used to control the debug features of the firewall modules, such as TLS, CPTLS, HTTP, etc. The tls option will enable the debug mode for the TLS module, which is responsible for handling the HTTPS inspection feature. The TDERROR_ALL_ALL environment variable will set the debug level to 5, which will generate the most detailed and comprehensive debug output. The debug output will be written to the $FWDIR/log/tls.elg file, which can be collected and analyzed with the TLSView tool1 to see the details of the HTTPS inspection process, such as certificate validation, SSL
/TLS negotiation, encryption/decryption, etc. The other options are incorrect because:
* fw ctl debug -m fw + conn drop cptls will enable the kernel debug mode for the firewall module, with the flags conn, drop, and cptls. The kernel debug mode will generate the kdebug.txt file in the $FWDIR
/log directory, which contains information about the firewall traffic processing in the kernel. The kernel debug mode is useful for troubleshooting issues related to policy, NAT, routing, and inspection, but not for issues related to HTTPS inspection, which is handled by the TLS module in the user space2.
* vpn debug cptls on will enable the IKE debug mode for the CPTLS module, which is a component of the VPN module. The IKE debug mode will generate the ike.elg and ikev2.xmll files in the $FWDIR
/log directory, which contain information about the IKE negotiation, authentication, and key exchange between the VPN peers. The CPTLS module is responsible for handling the SSL/TLS encryption
/decryption for the VPN traffic, but not for the HTTPS inspection traffic3.
* fw diag debug tls enable is not a valid command and will not enable the TLS debug mode. The fw diag command is used to control the diagnostic features of the firewall, such as packet capture, core dump, etc. The debug option is not a valid option for the fw diag command, and the tls option is not a valid option for the debug option. References:
* How to use the TLSView tool
* How to debug the Firewall kernel (fw) module
* How to debug VPN issues on Quantum Spark (SMB) Appliances
* [fw diag - Check Point CLI Reference Card]
NEW QUESTION # 18
What command(s) will turn off all vpn debug collection?
- A. vpn debug -a off
- B. vpn debug off and vpn debug ikeoff
- C. vpn debug off
- D. fw ctl debug 0
Answer: B
NEW QUESTION # 19
The Check Point Watch Daemon (CPWD) monitors critical Check Point processes, terminating them or restarting them as needed to maintain consistent, stable operating conditions. When checking the status/output of CPWD you are able to see some columns like APP, PID, STAT, START, etc. What is the column "STAT" used for?
- A. Shows the Watch Dog name of the monitored process
- B. Shows the status of the monitored process
- C. Shows what monitoring method Watch Dog is using to track the process
- D. Shows how many times the Watch Dog started the monitored process
Answer: B
Explanation:
The STAT column in the output of the cpwd_admin list command shows the status of the monitored process.
The possible values are E for established, meaning that the process is running, or T for terminated, meaning that the process is not running. The STAT column is useful for quickly checking if any critical process has crashed or failed to start. If the value is T, the process should be restarted and the reason for the termination should be investigated. The STAT column does not show the Watch Dog name, the number of times the process was started, or the monitoring method of the Watch Dog.
NEW QUESTION # 20
What is correct about the Resource Advisor (RAD) service on the Security Gateways?
- A. RAD is not a separate module, it is an integrated function of the 'fw' kernel module and does all operations in the kernel space
- B. RAD has a kernel module that looks up the kernel cache notifies client about hits and misses and forwards a-sync requests to RAD user space module which is responsible for online categorization
- C. RAD functions completely in user space The Pattern Matter (PM) module of the CMI looks up for URLs in the cache and if not found, contact the RAD process in user space to do online categorization
- D. RAD is completely loaded as a kernel module that looks up URL in cache and if not found connects online for categorization There is no user space involvement in this process
Answer: B
Explanation:
The Resource Advisor (RAD) service on the Security Gateways is responsible for online categorization of URLs and resources for Application Control and Threat Prevention blades. RAD has two components: a kernel module and a user space module. The kernel module looks up the kernel cache for URLs and resources, notifies the client about hits and misses, and forwards asynchronous requests to the user space module. The user space module handles the communication with the Check Point online web service and updates the kernel cache with the results. RAD can operate in three modes: hold, background, and custom, depending on the configuration of the blades and the policy. Reference:
Check Point Processes and Daemons - Section: Security Gateway Software Blades and Features - Subsection: URL Filtering Blade Solved: Re: RAD's high utilization - Post by @PhoneBoy Check Point Certified Troubleshooting Expert (CCTE) - Exam Topics - Module 5: Advanced Access Control
NEW QUESTION # 21
PostgreSQL is a powerful, open source relational database management system. Check Point offers a command for viewing the database to interact with Postgres interactive shell. Which command do you need to enter the PostgreSQL interactive shell?
- A. mysql_client cpm postgres
- B. psql_client cpm postgres
- C. psql_client postgres cpm
- D. mysql -u root
Answer: B
NEW QUESTION # 22
SmartEvent utilizes the Log Server, Correlation Unit and SmartEvent Server to aggregate logs and identify security events. The three main processes that govern these SmartEvent components are:
- A. cpsemd, cpsead, and DBSync
- B. eventiasv, eventiarp,eventiacu
- C. cpcu, cplog, cpse
- D. fwd, secu, sesrv
Answer: B
Explanation:
SmartEvent is a unified security event management and analysis solution that collects and analyzes data from multiple sources to identify and respond to security threats. SmartEvent consists of three main components: Log Server, Correlation Unit, and SmartEvent Server1. The three main processes that govern these SmartEvent components are:
eventiasv: This process is responsible for indexing the logs received from the Log Server and storing them in the SmartEvent database. It also performs log consolidation and compression to optimize the disk space usage2.
eventiarp: This process is responsible for running the predefined and custom correlation rules on the indexed logs and generating security events based on the rule criteria. It also sends notifications and triggers automatic responses for the security events3.
eventiacu: This process is responsible for providing the web-based user interface for SmartEvent, which allows the administrators to view, analyze, and manage the security events. It also provides the SmartEvent API for external integration4. Reference: Check Point Processes and Daemons5, SmartEvent Administration Guide1
1: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/html_frameset.htm 2: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.htm#_Toc64167467 3: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.htm#_Toc64167468 4: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.htm#_Toc64167469 5: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97638
NEW QUESTION # 23
How can you start debug of the Unified Policy with all possible flags turned on?
- A. fw ctl debug -m UnifiedPolicy all
- B. fw ctl debug -m fw + UP
- C. fw ctl debug -m UP all
- D. fw ctl debug -m UP *
Answer: C
NEW QUESTION # 24
When viewing data for CPMI objects in the Postgres database, what table column should be selected to query for the object instance?
- A. CpmiHostCkp
- B. GuiDBedit
- C. CPM Global M
- D. fwset
Answer: D
NEW QUESTION # 25
John has renewed his NPTX License but he gets an error (contract for Anti-Bot expired). He wants to check the subscription status on the CLI of the gateway, what command can he use for this?
- A. fwm lie print
- B. cpstat antimalware-f subscription status
- C. fw monitor license status
- D. show license status
Answer: D
Explanation:
The correct command to check the subscription status on the CLI of the gateway is show license status. This command displays the current license information, such as the license type, expiration date, and subscription status for various blades, such as Anti-Bot, Anti-Virus, IPS, etc. The command also shows the contract status for each blade, such as valid, expired, or invalid. If John has renewed his NPTX license, but he gets an error that the contract for Anti-Bot expired, he can use this command to verify the contract status and the subscription status for the Anti-Bot blade.
The other commands are incorrect because:
A . fwm lie print is not a valid command. The correct command is fwm lic print, which displays the license information on the Security Management Server, not on the gateway. This command does not show the subscription status or the contract status for the blades.
B . fw monitor license status is not a valid command. The correct command is fw monitor, which is a tool for capturing network traffic on the gateway, not for checking the license status.
C . cpstat antimalware-f subscription status is not a valid command. The correct command is cpstat antimalware -f subscription_status, which displays the subscription status for the Anti-Virus blade, not for the Anti-Bot blade. This command does not show the contract status for the blade.
Reference:
How to check the contract status and expiration date of the Check Point products How to check the subscription status of the blades on the Security Gateway sk163417 - Check Point Software
NEW QUESTION # 26
During firewall kernel debug with fw ctl zdebug you received less information that expected. You noticed that a lot of messages were lost since the time the debug was started. What should you do to resolve this issue?
- A. Redirect debug output to file; Use fw ctl debug -o ./debug.elg
- B. Increase debug buffer; Use fw ctl debug -buf 32768
- C. Redirect debug output to file; Use fw ctl zdebug -o ./debug.elg
- D. Increase debug buffer; Use fw ctl zdebug -buf 32768
Answer: B
NEW QUESTION # 27
What is the most efficient way to read an IKEv2 Debug?
- A. notepad++
- B. IKEview
- C. vi on the cti
- D. any xml editor
Answer: B
Explanation:
IKE view is the most efficient way to read an IKEv2 debug. IKE view is a graphical user interface tool that enables you to analyze the IKEv2 debugs generated by the Security Gateway1. It can parse the debug files and display the information in a structured and readable format. It can also filter the debug messages based on various criteria, such as IP address, encryption domain, or IKEv2 state1. IKE view can help you to troubleshoot the IKEv2 issues and identify the root cause of the problems1. Reference: IKEView: VPN Debugging Tool - Check Point Software
NEW QUESTION # 28
......
Test Engine to Practice 156-587 Test Questions: https://actualtests.dumpsquestion.com/156-587-exam-dumps-collection.html