Pass Your Next 156-587 Certification Exam Easily & Hassle Free
Free CheckPoint 156-587 Exam Question Practice Exams
NEW QUESTION # 14
Troubleshooting issues with Mobile Access requires the following:
- A. Standard VPN debugs, packet captures and debugs of cvpnd1 process on Security Gateway
- B. Standard VPN debugs and packet captures on Security Gateway, debugs of 'cvpnd' process on Security Management
- C. 'ma_vpnd' process on Security Gateway
- D. Debug logs of FWD captured with the command - 'fw debug fwd on TDERROR_MOBILE_ACCESS=5'
Answer: A
NEW QUESTION # 15
URL Filtering is an essential part of Web Security in the Gateway. For the Security Gateway to perform a URL lookup when a client makes a URL request, where is the sync-request forwarded from if a sync-request is required?
- A. RAD User Space
- B. URLF Kernel Client
- C. URLF Online Service
- D. RAD Kernel Space
Answer: B
Explanation:
URL Filtering is an essential part of Web Security in the Gateway that allows the administrator to control the access to web sites based on the site categorization and reputation. For the Security Gateway to perform a URL lookup when a client makes a URL request, the following steps are involved12:
* The URLF Kernel Client is the component that intercepts the URL request from the client and extracts the URL information, such as the host name, the path, and the query parameters. The URLF Kernel Client then checks the local cache to see if the URL has been previously categorized. If the URL is found in the cache, the URLF Kernel Client returns the cached category to the Security Policy and enforces the relevant action. If the URL is not found in the cache, the URLF Kernel Client sends a sync- request to the URLF User Space.
* The URLF User Space is the component that handles the sync-request from the URLF Kernel Client and performs the URL lookup. The URLF User Space first checks the local database to see if the URL has been previously categorized. If the URL is found in the database, the URLF User Space returns the database category to the URLF Kernel Client. If the URL is not found in the database, the URLF User Space sends an async-request to the URLF Online Service.
* The URLF Online Service is the component that handles the async-request from the URLF User Space and performs the URL lookup. The URLF Online Service is a cloud-based service that provides the most updated and accurate URL categorization and reputation. The URLF Online Service queries the Check Point cloud servers to get the category and reputation of the URL, and returns the result to the URLF User Space. The URLF Online Service also updates the local database and cache with the new URL information.
Therefore, the sync-request is forwarded from the URLF Kernel Client to the URLF User Space, if a sync- request is required.
References: Application Control Administration Guide1, (CCTE) - Check Point Software2
1: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.
10_ApplicationControl_AdminGuide/html_frameset.htm 2: https://www.checkpoint.com/downloads/training
/DOC-Training-Data-Sheet-CCTE-R81.10-V1.0.pdf
NEW QUESTION # 16
Which of the following is contained in the System Domain of the Postgres database?
- A. Saved queries for applications
- B. User modified configurations such as network objects
- C. Configuration data of log servers
- D. Trusted GUI clients
Answer: D
NEW QUESTION # 17
How can you start debug of the Unified Policy with all possible flags turned on?
- A. fw ctl debug -m UP
- B. fw ctl debuq -m UnifiedPolicv all
- C. fw ctl debug -m fw + UP
- D. fw ctl debug -m UP all
Answer: D
NEW QUESTION # 18
Which process is responsible for the generation of certificates?
- A. cpm
- B. dbsync
- C. fwm
- D. cpca
Answer: D
NEW QUESTION # 19
What is the best way to resolve an issue caused by a frozen process?
- A. Power off the machine
- B. Kill the process
- C. Restart the process
- D. Reboot the machine
Answer: B
Explanation:
* When a process is frozen (hung or unresponsive), the typical method to resolve it is to kill the process.
On Check Point, you can use cpwd_admin kill -name <ProcessName> or a standard Linux kill -9
<PID> command if necessary. You then allow CPWD (the Check Point watchdog) to restart it, or manually restart it if needed.
Other options:
* A. Power off the machine: This is too drastic and not recommended just for a single frozen process.
* B. Restart the process: While this sounds viable, you typically must kill the frozen process first, then let WatchDog or an admin restart it.
* C. Reboot the machine: Similar to powering off-too disruptive for just one stuck process.
Hence, the most direct and standard approach:"Kill the process."
Check Point Troubleshooting References
* sk97638 - Explanation of CPWD (Check Point WatchDog) and how to manage processes.
* sk43807 - How to gracefully stop or kill a Check Point process.
* Check Point CLI Reference Guide - Details on using cpwd_admin commands to kill or restart processes.
NEW QUESTION # 20
Which of the following commands can be used to see the list of processes monitored by the Watch Dog process?
- A. cpstat fw -f watchdog
- B. fw ctl get str watchdog
- C. ps -ef | grep watchd
- D. cpwd_admin list
Answer: D
Explanation:
To see the list of processes monitored by the WatchDog process (CPWD), you use the cpwd_admin list command.
Option A (cpstat fw -f watchdog): Shows firewall status and statistics for the "fw" context, not necessarily the list of monitored processes.
Option B (fw ctl get str watchdog): Not a valid parameter for retrieving the list of monitored processes; "fw ctl" deals with kernel parameters.
Option C (cpwd_admin list): Correct command that lists all processes monitored by CPWD, their status, and how many times they have been restarted.
Option D (ps -ef | grep watchd): This will list any running process that matches the string "watchd" but will not specifically detail which processes are being monitored by CPWD.
Therefore, the best answer is cpwd_admin list.
Check Point Troubleshooting Reference
sk97638: Explains Check Point WatchDog (CPWD) usage and the cpwd_admin utility.
R81.20 CLI Reference Guide: Describes common troubleshooting commands including cpwd_admin list.
Check Point Gaia Administration Guide: Provides instructions for monitoring system processes and verifying CPWD.
NEW QUESTION # 21
RAD is initiated when Application Control and URL Filtering blades are active on the Security Gateway. What is the purpose of the following RAD configuration file $FWDIR/conf/rad_settings.C?
- A. This file contains the location information for Application Control and/or URL Filtering entitlements
- B. This file contains RAD proxy settings
- C. This file contains the information on how the Security Gateway reaches the Security Management Server's RAD service for Application Control and URL Filtering
- D. This file contains all the host name settings for the online application detection engine
Answer: B
Explanation:
The Resource Application Daemon (RAD) is a critical component in Check Point's Application Control and URL Filtering blades, responsible for processing and categorizing web traffic. The configuration file $FWDIR/conf/rad_settings.C on the Security Gateway defines settings related to RAD's operation.
Option A: Incorrect. The rad_settings.C file does not store entitlement information for Application Control or URL Filtering. Entitlements are managed by the Security Management Server and stored in licensing databases, not in this file.
Option B: Incorrect. The rad_settings.C file does not specify how the Security Gateway communicates with the Security Management Server's RAD service. Communication settings are typically handled by SIC (Secure Internal Communication) and other configuration files, such as $FWDIR/conf/fwopsec.conf.
Option C: Correct. The rad_settings.C file contains proxy settings for the RAD daemon, such as HTTP proxy configurations used for accessing external services (e.g., Check Point's online URL Filtering database). This is critical when the Gateway requires a proxy to reach external resources for URL categorization.
Option D: Incorrect. Hostname settings for the online application detection engine are not stored in rad_settings.C. These are typically managed by the Application Database (application_db.C) or resolved via DNS.
Reference:
The Check Point R81.20 Security Gateway Administration Guide discusses the RAD daemon and its configuration, noting that $FWDIR/conf/rad_settings.C is used for proxy settings related to Application Control and URL Filtering. The CCTE R81.20 course covers troubleshooting Application Control and URL Filtering, including the role of configuration files like rad_settings.C.
For precise details, refer to:
Check Point R81.20 Security Gateway Administration Guide, section on "Application Control and URL Filtering" (available via Check Point Support Center).
CCTE R81.20 Courseware, which includes modules on RAD configuration and troubleshooting (available through authorized training partners like Arrow Education or Red Education).
NEW QUESTION # 22
What is the shorthand reference for a classification object?
- A. CLOB
- B. classobj
- C. COBJ
- D. class.obj
Answer: C
NEW QUESTION # 23
Your users are having trouble opening a Web page and you need to troubleshoot it. You open the Smart Console, and you get the following message when you navigate to the Logs and Monitor
"SmartLog is not active or Failed to parse results from server". What is the first thing you can try to resolve it?
- A. smartlog_server restart
- B. Run the commands on the SMS: smartlogstart and smartlogstop
- C. cpmstop and cpmstart
- D. smartlog debug on and smartlog debug off
Answer: B
NEW QUESTION # 24
As a security administrator/engineer in your company, you have noticed that your HQ Check Point Security Management Server is not receiving logs from your HQ Check Point Gateway/Cluster.
To investigate this issue in the command line, you will need to verify which process is running?
- A. cpd
- B. cpm
- C. fwm
- D. fwd
Answer: D
NEW QUESTION # 25
Which of the following inputs is suitable for debugging HTTPS inspection issues?
- A. fw ctl debug -m fw + conn drop cptls
- B. fw diag debug tls enable
- C. fw debug tls on TDERROR_ALL_ALL=5
- D. vpn debug cptls on
Answer: C
Explanation:
The input that is suitable for debugging HTTPS inspection issues is fw debug tls on TDERROR_ALL_ALL=5. This input will enable the TLS debug mode and set the debug level to 5, which is the highest level of verbosity. The fw debug command is used to control the debug features of the firewall modules, such as TLS, CPTLS, HTTP, etc. The tls option will enable the debug mode for the TLS module, which is responsible for handling the HTTPS inspection feature. The TDERROR_ALL_ALL environment variable will set the debug level to 5, which will generate the most detailed and comprehensive debug output. The debug output will be written to the $FWDIR/log/tls.elg file, which can be collected and analyzed with the TLSView tool1 to see the details of the HTTPS inspection process, such as certificate validation, SSL
/TLS negotiation, encryption/decryption, etc. The other options are incorrect because:
* fw ctl debug -m fw + conn drop cptls will enable the kernel debug mode for the firewall module, with the flags conn, drop, and cptls. The kernel debug mode will generate the kdebug.txt file in the $FWDIR
/log directory, which contains information about the firewall traffic processing in the kernel. The kernel debug mode is useful for troubleshooting issues related to policy, NAT, routing, and inspection, but not for issues related to HTTPS inspection, which is handled by the TLS module in the user space2.
* vpn debug cptls on will enable the IKE debug mode for the CPTLS module, which is a component of the VPN module. The IKE debug mode will generate the ike.elg and ikev2.xmll files in the $FWDIR
/log directory, which contain information about the IKE negotiation, authentication, and key exchange between the VPN peers. The CPTLS module is responsible for handling the SSL/TLS encryption
/decryption for the VPN traffic, but not for the HTTPS inspection traffic3.
* fw diag debug tls enable is not a valid command and will not enable the TLS debug mode. The fw diag command is used to control the diagnostic features of the firewall, such as packet capture, core dump, etc. The debug option is not a valid option for the fw diag command, and the tls option is not a valid option for the debug option. References:
* How to use the TLSView tool
* How to debug the Firewall kernel (fw) module
* How to debug VPN issues on Quantum Spark (SMB) Appliances
* [fw diag - Check Point CLI Reference Card]
NEW QUESTION # 26
What are the main components of Check Point's Security Management architecture?
- A. Management server, Log server. Gateway server. Security server
- B. Management server, management database, log server, automation server
- C. Management server. Security Gateway. Multi-Domain Server. SmartEvent Server
- D. Management server. Log Server, LDAP Server, Web Server
Answer: B
NEW QUESTION # 27
When viewing data for CPMI objects in the Postgres database, what table column should be selected to query for the object instance?
- A. CpmiHostCkp
- B. GuiDBedit
- C. fwset
- D. CPM Global M
Answer: A
Explanation:
The CpmiHostCkp table in the Postgres database contains the data for CPMI objects, such as gateways, clusters, and servers. The table column that should be selected to query for the object instance is the objid column, which is the primary key of the table and uniquely identifies each object. The objid column can be used to join with other tables that reference CPMI objects, such as CpmiClusterMember, CpmiCluster, and CpmiServer. The objid column can also be used to retrieve the object name, IP address, type, and other attributes from the CpmiHostCkp table itself. References:
* Check Point Database Tool (GuiDBedit Tool) - Section: How to use the Check Point Database Tool (GuiDBedit Tool) - Subsection: How to view the data in the database
* Check Point Certified Troubleshooting Expert (CCTE) - Exam Topics - Module 6: Advanced Management Server Troubleshooting
* [Check Point R81 Database Schema] - Section: CPMI Tables - Subsection: CpmiHostCkp Table
NEW QUESTION # 28
User defined URLS and HTTPS Inspection User defined URLs on the Security Gateway are stored in which database file?
- A. urlf_https.bin
- B. https_db.bin
- C. urlf_db.bin
- D. https_urlf.bin
Answer: C
NEW QUESTION # 29
The Unified Access Control policy eliminates the need to maintain policies for different access control features However, you need to start a general debug of the Unified Policy with all flags turned on Which of the following is the correct syntax?
- A. fw ctl kdebug -m UP all
- B. fw ctl debug -m UP all
- C. fwm ctl debug -m UP all
- D. fw ctl debug -m UP + all flags
Answer: B
NEW QUESTION # 30
Which of the following file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?
- A. tcpdump
- B. fw monitor
- C. CPMIL dump
- D. core dump
Answer: D
Explanation:
When troubleshooting crashes on a Security Gateway (or any Linux-based system), the file type that is typically generated and used for in-depth analysis is a core dump.
A core dump captures the memory state of a process at the time it crashed and is critical for root-cause analysis.
Other options:
A . tcpdump: A packet capture file, not a crash-related file.
C . fw monitor: A Check Point packet capture tool, but not for crash debugging.
D . CPMIL dump: Not a common or standard crash dump reference in Check Point.
NEW QUESTION # 31
......
Ace 156-587 Certification with 111 Actual Questions: https://www.troytecdumps.com/156-587-troytec-exam-dumps.html
PASS CheckPoint 156-587 EXAM WITH UPDATED DUMPS: https://drive.google.com/open?id=1osajx6nK1pAwkjcqHYnxQtp0fn6RacMv