156-836 Practice Exams and Training Solutions for Certifications
Dumps Free Test Engine Player Verified Answers
CheckPoint 156-836 (Check Point Certified Maestro Expert - R81 (CCME)) Certification Exam is designed to validate the skills and knowledge of experienced IT professionals in the area of Check Point's Maestro solution. Check Point Certified Maestro Expert - R81 (CCME) certification exam is intended for those who have already achieved the CCSE R81 certification and now wish to advance their expertise in the Maestro solution. The CCME certification demonstrates that an IT professional has the ability to design, implement and manage complex Maestro environments in a highly secure and efficient manner.
NEW QUESTION # 13
Which command do you use to find bottlenecks in the system that are affecting performance, even functionality in some cases?
- A. asg diag verify
- B. asg monitor
- C. asg stat -v
- D. asg perf -v
Answer: D
Explanation:
The asg perf -v command is used to find bottlenecks in the system that are affecting performance, even functionality in some cases. The asg perf -v command displays the performance statistics of the Security Group Modules (SGMs) in the Security Group, such as throughput, packet rate, CPU utilization, memory usage, and more. The asg perf -v command also shows the distribution mode and the correction rate of each SGM, which can indicate potential issues with asymmetric routing or load balancing. The asg perf -v command can help identify which SGMs are overloaded, underutilized, or misconfigured, and provide insights for troubleshooting and optimization.
References =
*Check Point Maestro R81.X Administration Guide, page 67, section "asg perf" 1
*Check Point Maestro R81.X Getting Started Guide, page 29, section "asg perf" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 26
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2: https://sc1.
checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frameset.htm
2: https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%
20Maestro%20under%20the%20hood%202022.pptx
NEW QUESTION # 14
Which command should be used to restart Orchestrator service only?
- A. cpstop; cpstart
- B. reboot
- C. orchd restart
- D. service orchestrator restart
Answer: C
Explanation:
Explanation
Page 313 from the training manual:
- Restart the service:
orchd restart
- Restart the service without confirmation
service orchd restart
NEW QUESTION # 15
What will happen in case of NAT of the traffic passing through Management network?
- A. Since Management traffic is always going to SMO, it will take a care for Correction Layer and will re- distribute traffic to other Appliances
- B. This traffic will pass with no inspection
- C. Orchestrator will disable NAT and traffic will pass with no issue
- D. This traffic will not pass correction, since it will be dropped
Answer: C
Explanation:
According to the Check Point MAESTRO R80.20SP Administration Manual1, NAT is not supported on the management network. If you configure NAT on the management network, the Orchestrator will disable NAT and allow the traffic to pass without translation. This is to ensure that the management traffic can reach the Security Group members and the SmartConsole without any issues.
References
*Check Point MAESTRO R80.20SP Administration Manual, page 291
NEW QUESTION # 16
What command will be used for updating fwkern.conf file on all Appliances within Security Group?
- A. g_update_conf_file
- B. g_all update_conf_file
- C. g_update_kernel
- D. vi
Answer: A
NEW QUESTION # 17
After you import the R81.10 software package, what do you use to verify that it is possible to upgrade an MHO or SG?
- A. Nothing. CPUSE will run a verification during the upgrade process to ensure the package is compatible.
- B. The package is verified during the import process and a warning or error will be displayed at that time.
- C. Run the Pre-Upgrade Verifier to make sure it is possible to upgrade
- D. Run HCP. One of the tests will list upgrade eligibility status for the MHO or SG.
Answer: C
Explanation:
The Pre-Upgrade Verifier is a tool that checks the compatibility and readiness of the Maestro environment for the upgrade process. It verifies the current version, the target version, the hardware requirements, the configuration settings, and the license validity of the Maestro Orchestrators and the Security Groups. It also identifies any potential issues or risks that might affect the upgrade and provides recommendations on how to resolve them. The Pre-Upgrade Verifier should be run before importing the R81.10 software package and before performing the actual upgrade.
References =
*Check Point R81.10 for Scalable Platforms - Check Point Software
*CHECK POINT MAESTRO EXPERT
NEW QUESTION # 18
Common Layer 1 issues include
- A. Routing
- B. Distribution
- C. Loose or bad cables
- D. MAC addresses
Answer: C
NEW QUESTION # 19
HealthCheck Point _____
- A. can be used to let you visualize the Firewall topology for the SG and view live statistics, which includes throughput, problem notes, and CPU utilization.
- B. performs a system health check and is meant to replace both a CPInfo and the health check script.
- C. is a self-updatable suite of tools for MHOs with the capability to assess the health of the system and provide a timeline of critical and informative events that might have occurred in a production system.
- D. is a self-updatable suite of tools for SGMs with the capability to assess the health of the system, visualize the Firewall topology, provide a timeline of critical and informative events that might have occurred in a production system.
Answer: D
Explanation:
Explanation
HealthCheck Point (HCP) is a tool that can perform various tests and checks on the system components of the Security Group Modules (SGMs), such as hardware, software, network, clock,ARP, and more. It can also display the performance statistics of the SGMs, such as throughput, packet rate, CPU utilization, memory usage, and more. Additionally, HCP can provide a graphical representation of the Firewall topology for the Security Group, showing the connections and statuses of the SGMs and the Orchestrators. Furthermore, HCP can generate a report of the critical and informative events that occurred on the system, such as configuration changes, errors, warnings, and alerts. HCP can help identify and troubleshoot any issues or errors that may affect the system functionality or performance.
References =
*HealthCheck Point (HCP) Release Updates - Check Point Software 1
*Professional Services Healthcheck - Check Point Software 2
*HealthCheck Point - Check Point CheckMates 3
NEW QUESTION # 20
What command can be run to show which SGM is selected to receive traffic?
- A. asg monitor
- B. asg calc
- C. g_tcpdump
- D. dxl calc
Answer: B
Explanation:
The asg calc command is a tool to show which SGM is selected to receive traffic based on the distribution mode and the packet parameters. It takes the port number, the source IP, the destination IP, and optionally the source port and the destination port as arguments and returns the SGM ID and the hash value. For example, asg calc 1 10.0.0.1 20.0.0.2 1234 80 will show which SGM will receive the traffic from 10.0.0.1:1234 to
20.0.0.2:80 on port 1.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.1: asg calc, page 4-5
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: asg calc, page 4-5
*asg calc - Check Point Software
NEW QUESTION # 21
What kinds of transceivers are supported on Orchestrator MHO-140?
- A. SFP+, SFP28, QSFP
- B. SFP, QSFP, QSFP28
- C. SFP, SFP+, SFP28
- D. SFP, SFP+, QSFP, QSFP28
Answer: D
Explanation:
The Maestro Hyperscale Orchestrator MHO-140 supports a variety of transceivers to provide high-speed and high-density connectivity. Specifically, it supports SFP, SFP+, QSFP, and QSFP28 transceivers, which cater to different port speeds and connectivity requirements in the Maestro environment.
Exact Extract:
"The Orchestrator MHO-140 supports SFP, SFP+, QSFP, and QSFP28 transceivers on its ports. SFP stands for Small Form-factor Pluggable, SFP+ supports up to 10 Gbps, QSFP (Quad Small Form-factor Pluggable) supports up to 40 Gbps, and QSFP28 supports up to 100 Gbps per port."
-Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 1: Introduction to Check Point Maestro, Lesson 1.2: Maestro Licensing and Hardware, page 1-8
-Check Point R81 Maestro Administration Guide, Chapter 1: Introduction to Check Point Maestro, Section:
Maestro Licensing, page 1-6
-Check Point Quantum Maestro Orchestrator Datasheet, page 3
Explanation of Options:
* A. SFP, QSFP, QSFP28: Incorrect, as it omits SFP+, which is supported by the MHO-140.
* B. SFP+, SFP28, QSFP: Incorrect, as SFP28 is not explicitly listed as supported on the MHO-140, and SFP is missing.
* C. SFP, SFP+, SFP28: Incorrect, as SFP28 is not supported, and QSFP and QSFP28 are omitted.
* D. SFP, SFP+, QSFP, QSFP28: Correct, as this option includes all transceivers supported by the MHO-
140, as per the official documentation.
References:
Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 1: Introduction to Check Point Maestro, Lesson 1.2: Maestro Licensing and Hardware, page 1-8 Check Point R81 Maestro Administration Guide, Chapter 1: Introduction to Check Point Maestro, Section:
Maestro Licensing, page 1-6
Check Point Quantum Maestro Orchestrator Datasheet, page 3
NEW QUESTION # 22
In a Maestro Dual Site environment, what is the definition of the term Active Site.
- A. There is no such thing as an active site. In a Dual Site environment, traffic is load balanced.
- B. The Active Site is the site where the SMO Master exists.
- C. The Active Site is the site currently handling the enforcement on traffic passing for a specific SG.Connections are synced within the SGMs in the Active Site.
- D. The Active Site is the site that is not handling any traffic for the specific SG, but itsconnections are synced to its SGMs from the MHOs to be ready in the event of a failover.
Answer: C
Explanation:
Explanation
In a Maestro Dual Site environment, there are two sites that can host Security Group Members (SGMs) for each Security Group (SG). The Active Site is the one that is currently processing the traffic for a specific SG, while the Standby Site is the one that is ready to take over in case of a failover. The Active Site and the Standby Site can be different for different SGs, depending on the load balancing and failover policies. The Active Site and the Standby Site are synchronized by the Maestro Orchestrators (MHOs) using the Site-Sync port and VLANs.
References =
*Solved: Maestro dual site failover - Check Point CheckMates
*Maestro Dual Site configuration with a direct connection through L2 switches
NEW QUESTION # 23
When working with Maestro, what is the difference between using Clish and gClish?
- A. Clish commands are for testing purposes only and cannot be saved, gClish commands apply to all SG members, by default.
- B. Clish commands apply to all UP SG members, by default. gClish commands apply to all SG members, by default.
- C. Clish commands apply only to a specific SG member. gClish commands apply to all UP SG members, by default.
- D. Clish commands are run on the SG members. gClish commands are run on the MHO and applied to all connected SG members in a specified group.
Answer: C
Explanation:
Explanation
This is the correct answer because it describes the difference between using Clish and gClish when working with Maestro. Clish is the Check Point command line shell that allows users to configure and manage the SG members individually. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. UP SG members are theones that are in the UP state and have the same policy installed as the SMO Master.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
NEW QUESTION # 24
What does the lldpctl command do?
- A. Show all devices discovered by LLDP protocol on downlink ports
- B. Show all devices discovered by LLDP protocol on uplink ports
- C. Discover orchestrators
- D. Show all devices discovered by LLDP protocol on all ports
Answer: D
Explanation:
The lldpctl command is a tool to display information about the devices discovered by the Link Layer Discovery Protocol (LLDP) on all ports of the Maestro Orchestrator and the Security Group Members. LLDP is a protocol that enables devices to exchange information about their identity, capabilities, and configuration.
LLDP can help to discover the topology and connectivity of the Maestro environment.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.2: LLDP, page 4-9
*Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
LLDP, page 3-9
NEW QUESTION # 25
Where should sx_api_ports_dump.py command be ran?
- A. SMO Appliance
- B. Orchestrator
- C. Security Group
- D. Management server
Answer: B
Explanation:
The sx_api_ports_dump.py command should be run on the Orchestrator, which is the device that manages the communication and the configuration of the Security Groups and the SGMs. The command shows the port mapping and the traffic distribution for each Security Group, as well as the backplane bonds and the Orchestrator ports. The command does not work on the Management server, the Security Group, or the SMO Appliance, as they do not have the same role and functionality as the Orchestrator.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*Maestro Expert (CCME) Course - Check Point Software, page 31
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, page 3
NEW QUESTION # 26
What Maestro component acts as a load balancer and network switch?
- A. Security Group (SG)
- B. Maestro Hyperscale Orchestrator (MHO)
- C. Security Gateway Module (SGM)
- D. Security Switching Module (SSM)
Answer: B
Explanation:
Explanation
*The Quantum Maestro Orchestrator uses the Distribution Mode to assign incoming traffic to Security Group Members.
*Reference: Working with the Distribution Mode
NEW QUESTION # 27
What is the purpose of g_tcpdump command?
- A. Collects traffic dump from Sync network
- B. Collects traffic dump from CIN network
- C. Collects traffic dump from all Active Appliances within Security Group
- D. The same as tcpdump, just on Scalable Platform
Answer: C
Explanation:
Explanation
_tcpdump" probably collects traffic dumps from all active appliances within a security group, aligning with the naming convention and function of similar commands in scalable platforms.
References
*Maestro Expert (CCME) Course - Check Point Software, page 331
*What is 'IN' and 'OUT' of g_tcpdump? - Check Point CheckMates2
*CHECK POINT MAESTRO EXPERT, page 23
NEW QUESTION # 28
What does asg monitor command do?
- A. This command does not exist
- B. Monitor traffic on Appliances in Security Group
- C. Show real-time cluster status of Appliances in Security Group
- D. Monitor health status of entire system
Answer: C
Explanation:
Explanation
The "asg monitor" command generally would show real-time cluster status of appliances in a security group, focusing on health and operational status.
NEW QUESTION # 29
On the MHO, to view connected ports and their functions, use the following command:
- A. orch_stat -p
- B. show ports
- C. orch_stat -c
- D. asg_ifconfig
Answer: A
NEW QUESTION # 30
While looking at your system's correction statistics, you notice you have a correction rate approaching 100 percent. Is this a problem?
- A. If correction rates are higher than 80 percent, latency is expected.
- B. A correction rate above 90 percent indicates a need to disable Layer 4 Distribution.
- C. A correction rate approaching 100 percent of all connections is unusual. This is a cause for concern because the SGMs may fail to process traffic.
- D. In some scenarios, a correction rate approaching 100 percent of all connections is not unusual. This is not usually a cause for concern as the correction mechanism is fast and efficient.
Answer: C
Explanation:
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23 3
*Check Point Maestro Frequently Asked Questions (FAQ), question 9 4
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
4:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
NEW QUESTION # 31
The drop_monitor command is useful for
- A. Monitoring Check Point code drops
- B. Viewing all drops by Check Point code or the Gaia OS, such as RX-DRP, RX-ERR, and Gaia OS drops.
- C. Viewing all interface drops such as RX-ERR, RX-DRP, and RX-OVR
- D. Showing the system temperature in real-time for multiple components, such as CPU, fan, and SSDs.
Answer: B
Explanation:
The drop_monitor command is a tool that monitors and displays the packets that are dropped by the Check Point code or the Gaia OS on the orchestrator and the appliances. It can help troubleshoot network issues and optimize performance. The command shows the drop reason, source, destination, protocol, and port of the dropped packets, as well as the interface and the module that dropped them.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates1
*Support, Support Requests, Training ... - Check Point Software2
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge
NEW QUESTION # 32
What will happen in case of NAT of the traffic passing through Management network?
- A. Since Management traffic is always going to SMO, it will take a care for Correction Layer and will re-distribute traffic to other Appliances
- B. This traffic will pass with no inspection
- C. Orchestrator will disable NAT and traffic will pass with no issue
- D. This traffic will not pass correction, since it will be dropped
Answer: C
Explanation:
Explanation
According to the Check Point MAESTRO R80.20SP Administration Manual1, NAT is not supported on the management network. If you configure NAT on the management network, the Orchestrator will disable NAT and allow the traffic to pass without translation. This is to ensure that the management traffic can reach the Security Group members and the SmartConsole without any issues.
References
*Check Point MAESTRO R80.20SP Administration Manual, page 291
NEW QUESTION # 33
......
To be eligible for the CCME certification exam, candidates must have a minimum of two years of experience in network security and must have completed the Check Point Certified Security Administrator (CCSA) and Check Point Certified Security Expert (CCSE) certifications. 156-836 exam consists of 90 multiple-choice questions and has a time limit of 90 minutes. The passing score for the exam is 70%. Upon passing the exam, candidates will be awarded the CCME certification, which is valid for two years. Check Point Certified Maestro Expert - R81 (CCME) certification can be renewed by passing a renewal exam or by completing continuing education requirements.
Q&As with Explanations Verified & Correct Answers: https://www.troytecdumps.com/156-836-troytec-exam-dumps.html
156-836 Dumps with Free 365 Days Update Fast Exam Updates: https://drive.google.com/open?id=1w4izcsWkjI8WLgG0SYcsErykcU-AT_Ln