CheckPoint 156-587 Deluxe Study Guide with Online Test Engine
156-587 dumps review - Professional Quiz Study Materials
NEW QUESTION # 15
Which of the following inputs is suitable for debugging HTTPS inspection issues?
- A. fw debug tls on TDERROR_ALL_ALL=5
- B. vpn debug cptls on
- C. fw ctl debug -m fw + conn drop cptls
- D. fw diag debug tls enable
Answer: A
Explanation:
The input that is suitable for debugging HTTPS inspection issues is fw debug tls on TDERROR_ALL_ALL=5. This input will enable the TLS debug mode and set the debug level to 5, which is the highest level of verbosity. The fw debug command is used to control the debug features of the firewall modules, such as TLS, CPTLS, HTTP, etc. The tls option will enable the debug mode for the TLS module, which is responsible for handling the HTTPS inspection feature. The TDERROR_ALL_ALL environment variable will set the debug level to 5, which will generate the most detailed and comprehensive debug output. The debug output will be written to the $FWDIR/log/tls.elg file, which can be collected and analyzed with the TLSView tool1 to see the details of the HTTPS inspection process, such as certificate validation, SSL
/TLS negotiation, encryption/decryption, etc. The other options are incorrect because:
* fw ctl debug -m fw + conn drop cptls will enable the kernel debug mode for the firewall module, with the flags conn, drop, and cptls. The kernel debug mode will generate the kdebug.txt file in the $FWDIR
/log directory, which contains information about the firewall traffic processing in the kernel. The kernel debug mode is useful for troubleshooting issues related to policy, NAT, routing, and inspection, but not for issues related to HTTPS inspection, which is handled by the TLS module in the user space2.
* vpn debug cptls on will enable the IKE debug mode for the CPTLS module, which is a component of the VPN module. The IKE debug mode will generate the ike.elg and ikev2.xmll files in the $FWDIR
/log directory, which contain information about the IKE negotiation, authentication, and key exchange between the VPN peers. The CPTLS module is responsible for handling the SSL/TLS encryption
/decryption for the VPN traffic, but not for the HTTPS inspection traffic3.
* fw diag debug tls enable is not a valid command and will not enable the TLS debug mode. The fw diag command is used to control the diagnostic features of the firewall, such as packet capture, core dump, etc. The debug option is not a valid option for the fw diag command, and the tls option is not a valid option for the debug option. References:
* How to use the TLSView tool
* How to debug the Firewall kernel (fw) module
* How to debug VPN issues on Quantum Spark (SMB) Appliances
* [fw diag - Check Point CLI Reference Card]
NEW QUESTION # 16
An administrator receives reports about issues with log indexing and text searching regarding an existing Management Server. In trying to find a solution she wants to check if the process responsible for this feature is running correctly. What is true about the related process?
- A. fwm manaqes this database after initialization of the 1CA
- B. fwssd crashes can affect therefore not show in the list
- C. cpd needs to be restarted manual to show in the list
- D. solr is a child process of cpm
Answer: D
Explanation:
The process responsible for log indexing and text searching is solr, which is a child process of cpm. The solr process is responsible for indexing the logs and providing the search engine for SmartLog and SmartConsole.
The solr process is started by the cpm process and can be monitored by the command cpwd_admin list. The solr process uses the PostgreSQL database to store the indexed data and the Lucene library to perform the text search. The solr process can be affected by various factors, such as the size and number of log files, the hardware resources, the network connectivity, and the configuration settings. If the solr process is not running correctly, the administrator may experience issues with log indexing and text searching, such as slow performance, missing logs, or incorrect results.
NEW QUESTION # 17
You were asked by security team to debug Mobile Access VPN. What processes will you debug?
- A. IKED
- B. SNX daemon
- C. HTTPD and CPVND
- D. VPND and IKED
Answer: C
NEW QUESTION # 18
In Mobile Access VPN, clientless access is done using a web browser. The primary communication path for these browser based connections is a process that allows numerous processes to utilize port 443 and redirects traffic to a designated port of the respective process.
Which daemon handles this?
- A. HTTPS Inspection Daemon (HID)
- B. Connectra VPN Daemon (cvpnd)
- C. Mobile Access Daemon (MAD)
- D. Multi-portal Daemon
Answer: D
NEW QUESTION # 19
What is the name of the VPN kernel process?
- A. VPNK
- B. CVPND
- C. FWK
- D. VPND
Answer: D
NEW QUESTION # 20
As a security administrator/engineer in your company, you have noticed that your HQ Check Point Security Management Server is not receiving logs from your HQ Check Point Gateway/Cluster.
To investigate this issue in the command line, you will need to verify which process is running?
- A. fwd
- B. cpm
- C. fwm
- D. cpd
Answer: A
NEW QUESTION # 21
What are the four main database domains?
- A. System. Global. Log. Event
- B. System, User, Host, Network
- C. System, User, Global. Log
- D. Local, Global, User, VPN
Answer: C
NEW QUESTION # 22
The Check Point Firewall Kernel is the core component of the Gaia operating system and an integral part of the traffic inspection process. There are two procedures available for debugging the firewall kernel. Which procedure/command is used for troubleshooting packet drops and other kernel activities while using minimal resources (1 MB buffer)?
- A. fw debug ctl
- B. fw ctl debug/kdebug
- C. fw ctl zdebug
- D. fwk ctl debug
Answer: B
NEW QUESTION # 23
Your users are having trouble opening a Web page and you need to troubleshoot it. You open the Smart Console, and you get the following message when you navigate to the Logs and Monitor "SmartLog is not active or Failed to parse results from server". What is the first thing you can try to resolve it?
- A. smartlog debug on and smartlog debug off
- B. Run the commands on the SMS: smartlogstart and smartlogstop
- C. smartlog_server restart
- D. cpmstop and cpmstart
Answer: C
Explanation:
The error message "SmartLog is not active or Failed to parse results from server" indicates that there is a problem with the SmartLog server process, which is responsible for indexing and querying the logs. One possible cause of this problem is a corrupted log file or a mismatched IP address in the logging configuration files. Another possible cause is a communication failure between the SmartLog server and the CPM process or the SmartConsole client. To resolve this issue, the first thing to try is to restart the SmartLog server process by running the command smartlog_server restart on the Security Management Server or the Log Server. This command will stop the SmartLog server, clean the buffer, and start it again. This may fix the corrupted log file or the communication issue. If the problem persists, other steps may be needed, such as checking the network connectivity, the firewall rules, the logging configuration files, the CPM process, or the SmartConsole client.
References:
* 1: "SmartLog is not active or unreachable" warning when trying to connect with SmartLog GUI to SmartLog Server
* 2: "SmartLog is not active" errors
* 3: Solved: Activate SmartLog in R80.10
* 4: Troubleshooting Check Point logging issues when Security Management Server / Log Server is not receiving logs from Security Gateway
* Troubleshooting Expert R81.1 (CCTE) Course Outline) - Module 9: Logging and Status Troubleshooting.
NEW QUESTION # 24
The two procedures available for debugging in the firewall kernel are
i. fw ctl zdebug
ii. fw ctl debug/kdebug
Choose the correct statement explaining the differences in the two
- A. (i) is used to debug only issues related to dropping of traffic, however (ii) can be used for any firewall issue including NATing, clustering etc.
- B. (i) is used to debug the access control policy only, however (ii) can be used to debug a unified policy
- C. (i) is used for general debugging, has a small buffer and is a quick way to set kernel debug flags to getan output via command line whereas (ii) is useful when there is a need for detailed debugging and requires additional steps to set the buffer and get an output via command line
- D. (i) is used on a Security Gateway, whereas (ii) is used on a Security Management Server
Answer: C
NEW QUESTION # 25
What is the buffer size set by the fw ctl zdebug command?
- A. 1 MB
- B. 1 GB
- C. 8 MB
- D. 8GB
Answer: A
NEW QUESTION # 26
When a User process or program suddenly crashes, a core dump is often used to examine the problem Which command is used to enable the core-dumping via GAIA clish?
- A. set core-dump total
- B. set user-dump enable
- C. set core-dump per_process
- D. set core-dump enable
Answer: D
Explanation:
In Check Point Gaia, you can enable core dumping through the command line interface (clish) using the following command:
set core-dump enable
This command activates the core dump mechanism, allowing the system to generate core dump files when user processes crash. Remember to save the configuration after enabling core dumps with the command:
save config
Why other options are incorrect:
B . set core-dump total: This command is used to set the total disk space limit for core dump files, not to enable core dumping itself.
C . set user-dump enable: There is no such command in Gaia clish for enabling core dumps.
D . set core-dump per_process: This command sets the maximum number of core dump files allowed per process, but it doesn't enable core dumping.
Check Point Troubleshooting Reference:
Check Point R81.20 Security Administration Guide: This guide provides comprehensive information about Gaia clish commands, including those related to system configuration and troubleshooting.
Check Point sk92764: This knowledge base article specifically addresses core dump management in Gaia, explaining how to enable and configure core dumps.
Enabling core dumps is a crucial step in troubleshooting process crashes as it provides valuable information for analysis and debugging.
NEW QUESTION # 27
You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week.
Therefore you need to add a timestamp to the kernel debug and write the output to a file but you cant afford to fill up all the remaining disk space and you only have 10 GB free for saving the debugs What is the correct syntax for this?
- A. fw ctl kdebug -T -m 10 -s 1000000 -o debugfilename
- B. fw ctl kdebug -T -f -m 10 -s 1000000 > debugfilename
- C. A fw ctl kdebug -T -f -m 10 -s 1000000 -o debugfilename
- D. fw ctl debug -T -f-m 10 -s 1000000 -o debugfilename
Answer: C
NEW QUESTION # 28
The packet processing infrastructure consists of 4 components. Which component contains the CLOB, the object that contains information about the packet that is needed to make security decisions?
- A. Classifiers
- B. Observers
- C. Manager
- D. Handlers
Answer: A
NEW QUESTION # 29
How can you start debug of the Unified Policy with all possible flags turned on?
- A. fw ctl debug -m fw + UP
- B. fw ctl debug -m UP
- C. fw ctl debug -m UP all
- D. fw ctl debuq -m UnifiedPolicv all
Answer: C
NEW QUESTION # 30
The Check Point Watch Daemon (CPWD) monitors critical Check Point processes, terminating them or restarting them as needed to maintain consistent, stable operating conditions. When checking the status/output of CPWD you are able to see some columns like APP, PID, STAT, START, etc. What is the column "STAT" used for?
- A. Shows the status of the monitored process
- B. Shows what monitoring method Watch Dog is using to track the process
- C. Shows the Watch Dog name of the monitored process
- D. Shows how many times the Watch Dog started the monitored process
Answer: A
NEW QUESTION # 31
Where will the usermode core files located?
- A. /var/suroot
- B. $FWDIR/var/log/dump/usermode
- C. $CPDIR/var/log/dump/usermode
- D. /var/log/dump/usermode
Answer: D
NEW QUESTION # 32
What does CMI stand for in relation to the Access Control Policy?
- A. Context Management Infrastructure
- B. Content Management Interface
- C. Context Manipulation Interface
- D. Content Matching Infrastructure
Answer: A
Explanation:
CMI stands for Context Management Infrastructure, which is a component of the Access Control Policy that enables the Security Gateway to inspect traffic based on the context of the connection. Context includes information such as user identity, application, location, time, and device. CMI allows the Security Gateway to apply different security rules and actions based on the context of the traffic, and to dynamically update the context as it changes. CMI consists of three main elements: Unified Policy, Identity Awareness, and Content Awareness.
NEW QUESTION # 33
You are using the Identity Collector with Identity Awareness in large environment. Users report that they cannot access resources on Internet. You identify that the traffic is matching the cleanup rule instead of the proper rule with Access Roles using the IDC. How can you check if IDC is working?
- A. pdp connections idc
- B. pep debug idc on
- C. pdp debug set IDP all all
- D. ad query | debug on
Answer: A
NEW QUESTION # 34
What component is NOT part of Unified policy manager?
- A. CMI
- B. Observer
- C. Classifier
- D. Handle
Answer: B
NEW QUESTION # 35
You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week. Therefore you need to add a timestamp to the kernel debug and write the output to a file but you cant afford to fill up all the remaining disk space and you only have 10 GB free for saving the debugs What is the correct syntax for this?
- A. fw ctl kdebug -T -m 10 -s 1000000 -o debugfilename
- B. fw ctl kdebug -T -f -m 10 -s 1000000 > debugfilename
- C. A fw ctl kdebug -T -f -m 10 -s 1000000 -o debugfilename
- D. fw ctl debug -T -f-m 10 -s 1000000 -o debugfilename
Answer: C
NEW QUESTION # 36
Which of the following is contained in the System Domain of the Postgres database?
- A. User modified configurations such as network objects
- B. Trusted GUI clients
- C. Configuration data of log servers
- D. Saved queries for applications
Answer: B
NEW QUESTION # 37
Where do you enable log indexing on the SMS?
- A. SMS object under "Logs"
- B. SMS object under "Advanced"
- C. SMS object under "General Properties"
- D. SMS object under "Other"
Answer: A
Explanation:
Log indexing is a feature that enables faster and more efficient log searches in SmartLog and SmartEvent. To enable log indexing on the Security Management Server (SMS), you need to edit the SMS object in SmartConsole and go to the "Logs" tab. There you can configure the log indexing settings, such as the index location, the index size, the index frequency, and the index retention123. References:
* 1: CCTE Courseware, Module 2: Advanced Logs and Monitoring, Slide 9
* 2: Check Point R81 Logging and Monitoring Administration Guide, Chapter 2: Log Indexing, Page 17
* 3: Check Point R81 Logging and Monitoring Administration Guide, Chapter 2: Log Indexing, Page 18
NEW QUESTION # 38
Troubleshooting issues with Mobile Access requires the following:
- A. Debug logs of FWD captured with the command - 'fw debug fwd on TDERROR_MOBILE_ACCESS=5'
- B. Standard VPN debugs and packet captures on Security Gateway, debugs of 'cvpnd' process on Security Management
- C. 'ma_vpnd' process on Security Gateway
- D. Standard VPN debugs, packet captures and debugs of cvpnd1 process on Security Gateway
Answer: D
NEW QUESTION # 39
Which of the following commands can be used to see the list of processes monitored by the Watch Dog process?
- A. ps -ef | grep watchd
- B. cpstat fw -f watchdog
- C. cpwd_admin list
- D. fw ctl get str watchdog
Answer: C
NEW QUESTION # 40
......
Exam Questions Answers Braindumps 156-587 Exam Dumps PDF Questions: https://www.dumpexams.com/156-587-real-answers.html
156-587 Test Prep Training Practice Exam Questions Practice Tests: https://drive.google.com/open?id=1cSu1wPyZU54z6sSaiUdOKKHnKXjROf3m