Updated Check Point 156-585 Exam Questions

dumps2021-12-20T08:59:39+08:00

156-585 Check Point Certified Troubleshooting Expert updated questions are available, which can make sure you pass the test easily. With studying all of Check Point 156-585 exam updated questions and answers, you can pass the test easily. Free updated Check Point 156-585 exam questions are available below.

Page 1 of 2

1. What command is usually used for general firewall kernel debugging and what is the size of the buffer that is automaticallyenabled when using the command?

fw ctl debug, buffer sizeis 1024 KB

fw ell zdebug. buffer size is 32768 KB

fw dl zdebug, buffer size is 1 MB

fw ctl kdeoug. buffer sizeis 32000 KB

2. If the cpsemd process of SmartEvent has crashed or is having trouble coming up. then it usually indicates that___________.

Postgres database ts down

Cpd daemon is unable to connect to the log server

The SmartEvent core on the Solr mdexer has been deleted

The logged in administrator does not have permissions to run SmartEvent

3. If you run the command "fw monitor -e accept src=10.1.1.201 or src=172.21.101.10 or src=192.0.2.10;" from the cli sh What will be captured?

Packets from 10 1 1 201 going to 192.0 2.10

Packets destined to 172 21 101 10 from 10.1.1.101

Only packet going to 192.0.2.10

fw monitor only works in expert mode so no packets will be captured

4. Which situation triggers an IPS bypass under load on a 24-core Check Point appliance?

any of the CPU cores is above the threshold for more then 10 seconds

all CPU core most be above the threshold for more than 10 seconds

a single CPU core must be above the threshold for more than 10 seconds, but is must be the same core during this time

the average cpu utilization over all cores must be above the threshold for 1 second

5. What acceleration mode utlizes multi-core processing to assist with traffic processing?

CoreXL

SecureXL

HyperThreading

Traffic Warping

6. Which one of the following is NOT considered a Solr core partition:

CPM_0_Revisions

CPM_Global_A

CPM_Gtobal_R

CPM_0_Disabled

7. How many captures does the command "fw monitor -p all" take?

All 15 of the inbound and outbound modules

All 4 points of the fw VM modules

1 from every inbound and outbound module of the chain

The -p option takes the same number of captures, but gathers all of the data packet

8. VPN's allow traffic to pass through the Internet securely byencryptingthe traffic as it enters the VPN tunnel and then decrypting the exists.

Which process is responsible for Mobile VPN connections?

cvpnd

vpnd

vpnk

fwk

9. If IPS protections that prevent SecureXL from accelerating traffic, such as Network Quota, Fingerprint Scrambling.

TTL Masking etc, have to be used, what is a recommended practice to enhance the performance of the gateway?

Use the IPS exception mechanism

Disable all such protections

Disable SecureXL and use CoreXL

Upgrade the hardware to include more Cores and Memory

10. What is the purpose of the Hardware Diagnostics Tool?

Verifying that Check Point Appliance hardware is functioning correctly

Verifying the Security Management Server hardware is functioning correctly

Verifying that Security Gateway hardware is functioning correctly

Verifying that Check Point Appliance hardware is actually broken

11. You need to runa kernel debug over a longer period of time as the problem occurs only once or twice a week. Therefore you need to add a timestamp to the kernel debug and write the output to a file

What is the correct syntax for this?

fw ctl kdebug -T -f > filename debug

fw ctl kdebug -T > filename debug

fw ctl debug -T -f > filename debug

fw ctl kdebug -T -f -o filename debug

12. Jenna has to create a VPN tunnel to a CISCO ASA but has to set special property to renegotiate the Phase 2 tunnel after 10 MB of transferee1 data.

This can not be configured in the smartconsole, so how can she modify this property?

using GUIDBEDIT located in same directoryas Smartconsole on the Windows client

she need to install GUIDBEDIT which can be downloaded from the Usercenter

she need to run GUIDBEDIT from CLISH which opens a graphical window on the smartcenter

this cant be done anymore as GUIDBEDIT is not supported in R80 anymore

13. RAD is initiated when Application Control and URL Filtering blades are active on the Security Gateway What is the purpose of the following RAD configuration file SFWDIR/conf/rad_settings.C?

This file contains the location information tor Application Control and/or URL Filtering entitlements

This file contains the information on how the Security Gateway reaches the Security Managers RAD service for Application Control and URL Filtering

This file contains RAD proxy settings

This file contains all the host name settings for the online application detection engine

14. What is the main SecureXL database for trackingthe acceleration status of traffic?

cphwd_db

cphwd_tmp1

cphwd_dev_conn_table

cphwd_dev_identity_table

15. What file extension should be used with fw monitor to allow the output file to be imported and read in Wireshark?

.cap

.exe

.tgz

.pcap

16. What is the name of the VPN kernel process?

VPNK

VPND

CVPND

FWK

17. Check Point Threat Prevention policies can contain multiple policy layers and each layer consists of its own Rule Base

Which Threat Prevention daemon is used for Anti-virus?

in.emaild.mta

in.msd

ctasd

in emaild

18. Select the technology that does the following actions

- provides reassembly via streaming for TCP

- handles packet reordering and congestion

- handles payload overlap

- provides consistent stream of data to protocol parsers

Passive Streaming Library

Context Management

Pre-Protocol Parser

fwtcpstream

19. How can you start debug of the Unified Policy with all possible flags turned on?

fw ctl debug -m UP all

fw ctl debug -m UnifiedPolicy all

fw ctl debug -m fw + UP

fw ctl debug -m UP *

20. The Check Pom! Firewall Kernel is the core component of the Gaia operating system and an integral part of the traffic inspection process There are two procedures available for debugging the firewall kernel

Which procedure/command is used for troubleshooting packet drops and other kernel activites while using minimal resources (1 MB buffer)?

fw ctl zdebug

fw ctl debug/kdebug

fwk ctl debug

fw debug ctl

Page 2 of 2

21. What command is usedtofind out which port Multi-Portal has assigned to the Mobile Access Portal?

mpclient getdata sslvpn

netstat -nap | grep mobile

mpclient getdata mobi

netstat getdata sslvpn

22. What is the simplest and most efficient way to check all dropped packets in real time?

fw ctl zdebug * drop in expert mode

Smartlog

cat /dev/fwTlog in expert mode

tail -f SFWDIR/log/fw log |grep drop in expert mode

23. What table does the command "fwaccel conns" pull information from?

fwxl_conns

SecureXLCon

cphwd_db

sxl_connections

24. What is the kernel process for Content Awareness that collects the data from the contexts received from the CMI and decides if the file is matched by a data type?

dlpda

dlpu

cntmgr

cntawmod

25. Where do Protocol parsers register themselves for IPS?

Passive Streaming Library

Other handlers register to Protocol parser

Protections database

Context Management Infrastructure

26. Which command do you need to execute to insert fw monitor after TCP streaming (out) in the outbound chain using absolute position? Given the chain was 1ffffe0, choose the correct answer.

fw monitor Cpo -0x1ffffe0

fw monitor Cp0 ox1ffffe0

fw monitor Cpo 1ffffe0

fw monitor Cp0 Cox1ffffe0

27. What are the four ways to insert an FW Monitor into the firewallkernel chain?

Relative position using location, relativepositionusing alias, absolute position, all positions

Absolute position using location, absolute position using alias, relative position, all positions

Absolute position using location, relative position using alias, general position, all positions

Relative position using geolocation relative position using inertial navigation, absolute position all positions

28. Rules within the Threat Prevention policy use the Malware database and network objects.

Which directory is used for the Malware database?

$FWDIR/conf/install_manager_tmp/ANTIMALWARE/conf/

$CPDIR/conf/install_manager_lmp/ANTIMALWARE/conf/

$FWDlR/conf/install_firewall_imp/ANTIMALWARE/conf/

$FWDlR/log/install_manager_tmp/ANTIMALWARBlog?

29. Check Point's PostgreSQL is partitioned into several relational database domains.

Which domain contains network objects and security policies?

User Domain

System Domain

Global Domain

Log Domain

30. During firewall kernel debug with fw ctl zdebug you received less information than expected. You noticed that a lot of messages were lost since the time the debug was started.

What should you do to resolve this issue?

Increase debug buffer; Use fw ctl debug Cbuf 32768

Redirect debug output to file; Use fw ctl zdebug Co ./debug.elg

Increase debug buffer; Use fw ctl zdebug Cbuf 32768

Redirect debug output to file; Use fw ctl debug Co ./debug.elg

Updated Check Point 156-585 Exam Questions

Updated Check Point 156-585 Exam Questions

Share this post

Leave a Reply Cancel reply

Related Posts