Latest CheckPoint 156-587 Exam questions and answers
BootcampPDF 156-587 Exam Practice Test Questions (Updated 101 Questions)
NEW QUESTION # 60
PostgreSQL is a powerful, open source relational database management system. Check Point offers a command for viewing the database to interact with Postgres interactive shell. Which command do you need to enter the PostgreSQL interactive shell?
- A. mysql_client cpm postgres
- B. psql_client postgres cpm
- C. mysql -u root
- D. psql_client cpm postgres
Answer: D
NEW QUESTION # 61
What does CMI stand for in relation to the Access Control Policy?
- A. Content Matching Infrastructure
- B. Context Manipulation Interface
- C. Context Management Infrastructure
- D. Content Management Interface
Answer: C
NEW QUESTION # 62
In Mobile Access VPN. clientless access is done using a web browser. The primary communication path for these browser based connections is a process that allows numerous processes to utilize port
443 and redirects traffic to a designated port of the respective process Which daemon handles this?
- A. Multi-portal Daemon (MPD)
- B. Connectra VPN Daemon (cvpnd)
- C. HTTPS Inspection Daemon (HID)
- D. Mobile Access Daemon (MAD)
Answer: A
Explanation:
The Multi-portal Daemon (mpdaemon) is responsible for handling the clientless access connections in Mobile Access VPN. It listens on port 443 and redirects the traffic to the appropriate port of the process that handles the specific connection type, such as cvpnd for SSL Network Extender, MAD for Mobile Access Portal, or HID for HTTPS Inspection. The mpdaemon also performs authentication and authorization for the clientless access connections. Reference: Check Point Processes and Daemons1, Mobile Access Blade Administration Guide
1: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97638 : https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Mobile_Access_AdminGuide/html_frameset.htm
NEW QUESTION # 63
You are seeing output from the previous kernel debug. What command should you use to avoid that?
- A. fw ctl debug = 0
- B. fw ctl debug 0
- C. fw ctl zdebug disable
- D. fw ctl clean buffer = 0
Answer: B
Explanation:
To reset all debug flags and enable only the default debug flags in all kernel modules:
fw ctl debug 0
https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_QoS_AdminGu ide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_QoS_Admin Guide/202665
NEW QUESTION # 64
When viewing data for CPMI objects in the Postgres database, what table column should be selected to query for the object instance?
- A. GuiDBedit
- B. fwset
- C. CpmiHostCkp
- D. CPM Global M
Answer: C
Explanation:
The CpmiHostCkp table in the Postgres database contains the data for CPMI objects, such as gateways, clusters, and servers. The table column that should be selected to query for the object instance is the objid column, which is the primary key of the table and uniquely identifies each object. The objid column can be used to join with other tables that reference CPMI objects, such as CpmiClusterMember, CpmiCluster, and CpmiServer. The objid column can also be used to retrieve the object name, IP address, type, and other attributes from the CpmiHostCkp table itself. References:
* Check Point Database Tool (GuiDBedit Tool) - Section: How to use the Check Point Database Tool (GuiDBedit Tool) - Subsection: How to view the data in the database
* Check Point Certified Troubleshooting Expert (CCTE) - Exam Topics - Module 6: Advanced Management Server Troubleshooting
* [Check Point R81 Database Schema] - Section: CPMI Tables - Subsection: CpmiHostCkp Table
NEW QUESTION # 65
What are the four main database domains?
- A. System. Global. Log. Event
- B. System, User, Host, Network
- C. System, User, Global. Log
- D. Local, Global, User, VPN
Answer: C
NEW QUESTION # 66
John has renewed his NPTX License but he gets an error (contract for Anti-Bot expired). He wants to check the subscription status on the CLI of the gateway, what command can he use for this?
- A. show license status
- B. cpstat antimalware-f subscription status
- C. fwm lie print
- D. fw monitor license status
Answer: A
Explanation:
The correct command to check the subscription status on the CLI of the gateway is show license status. This command displays the current license information, such as the license type, expiration date, and subscription status for various blades, such as Anti-Bot, Anti-Virus, IPS, etc. The command also shows the contract status for each blade, such as valid, expired, or invalid. If John has renewed his NPTX license, but he gets an error that the contract for Anti-Bot expired, he can use this command to verify the contract status and the subscription status for the Anti-Bot blade.
The other commands are incorrect because:
* A. fwm lie print is not a valid command. The correct command is fwm lic print, which displays the license information on the Security Management Server, not on the gateway. This command does not show the subscription status or the contract status for the blades.
* B. fw monitor license status is not a valid command. The correct command is fw monitor, which is a tool for capturing network traffic on the gateway, not for checking the license status.
* C. cpstat antimalware-f subscription status is not a valid command. The correct command is cpstat antimalware -f subscription_status, which displays the subscription status for the Anti-Virus blade, not for the Anti-Bot blade. This command does not show the contract status for the blade.
References:
* How to check the contract status and expiration date of the Check Point products
* How to check the subscription status of the blades on the Security Gateway
* sk163417 - Check Point Software
NEW QUESTION # 67
The FileApp parser in the Content Awareness engine does not extract text from which of the following file types?
- A. PDF
- B. Microsoft Office Powerpoint files
- C. Microsoft Office .docx files
- D. Microsoft Office Excel files
Answer: A
NEW QUESTION # 68
What are the four main database domains?
- A. System. Global. Log. Event
- B. System, User, Host, Network
- C. System, User, Global. Log
- D. Local, Global, User, VPN
Answer: C
Explanation:
The four main database domains are System, User, Global, and Log. Each domain contains different types of data and serves different purposes123. The System domain contains the configuration data of the Security Management Server (SMS), such as the SMS name, IP address, licensing, and installed products. The User domain contains the configuration data of the security policy, such as the objects, rules, services, and VPN communities. The Global domain contains the configuration data of the global policy, such as the global objects, rules, and services. The Log domain contains the log data of the security events, such as the source, destination, action, and time of each event123. References:
* 1: CCTE Courseware, Module 3: Management Database and Processes, Slide 4
* 2: Check Point R81 Security Management Administration Guide, Chapter 2: Security Management Server, Page 14
* 3: Check Point R81 Security Management Administration Guide, Chapter 2: Security Management Server, Page 15
NEW QUESTION # 69
When a User Mode process suddenly crashes, it may create a core dump file. Which of the following information is available in the core dump and may be used to identify the root cause of the crash?
i. Program Counter
ii. Stack Pointer
iii. Memory management information
iv. Other Processor and OS flags / information
- A. iii and iv only
- B. Only lii
- C. i and ii only
- D. i, ii, iii and iv
Answer: D
Explanation:
A core dump file is essentially a snapshot of the process's memory at the time of the crash. This snapshot includes crucial information that can help diagnose the cause of the crash. Here's why all the options are relevant:
i. Program Counter: This register stores the address of the next instruction the CPU was supposed to execute. It pinpoints exactly where in the code the crash occurred.
ii. Stack Pointer: This register points to the top of the call stack, which shows the sequence of function calls that led to the crash. This helps trace the program's execution flow before the crash.
iii. Memory management information: This includes details about the process's memory allocations, which can reveal issues like memory leaks or invalid memory access attempts.
iv. Other Processor and OS flags/information: This encompasses various registers and system information that provide context about the state of the processor and operating system at the time of the crash.
By analyzing this information within the core dump, you can often identify the root cause of the crash, such as a segmentation fault, null pointer dereference, or stack overflow.
Check Point Troubleshooting Reference:
While core dumps are a general concept in operating systems, Check Point's documentation touches upon them in the context of troubleshooting specific processes like fwd (firewall) or cpd (Check Point daemon). The fw ctl zdebug command, for example, can be used to trigger a core dump of the fwd process for debugging purposes.
NEW QUESTION # 70
What is the proper command for allowing the system to create core files?
- A. set core-dump enable
>save config - B. service core-dump start
- C. # set core-dump enable
# save config - D. SFWDIR/scripts/core-dump-enable.sh
Answer: A
NEW QUESTION # 71
You modified kernel parameters and after rebooting the gateway, a lot of production traffic gets dropped and the gateway acts strangely What should you do"?
- A. Run command fw ctl set int fw1_kernel_all_disable=1
- B. Restore fwkem.conf from backup and reboot the gateway
- C. run fw unloadlocal to remove parameters from kernel
- D. Remove all kernel parameters from fwkem.conf and reboot
Answer: B
Explanation:
If you have modified kernel parameters (in fwkern.conf, for example) and the gateway starts dropping traffic or behaving abnormally after a reboot, the best practice is to restore the original or a known-good configuration from backup. Then, reboot again so that the gateway loads the last known stable settings.
* Option A (fw ctl set int fw1_kernel_all_disable=1) is not a standard or documented method for
"undoing" all kernel tweaks.
* Option B (Restore fwkem.conf from backup and reboot the gateway) is the correct and straightforward approach.
* Option C (fw unloadlocal) removes the local policy but does not revert custom kernel parameters that have already been loaded at boot.
* Option D (Remove all kernel parameters from fwkem.conf and reboot) might help in some cases, but you risk losing other beneficial or necessary parameters if there were legitimate custom settings.
Restoring from a known-good backup is safer and more precise.
Hence, the best answer:"Restore fwkem.conf from backup and reboot the gateway." Check Point Troubleshooting References
* sk98339 - Working with fwkern.conf (kernel parameters) in Gaia OS.
* sk92739 - Advanced System Tuning in Gaia OS.
* Check Point Gaia Administration Guide - Section on kernel parameters and system tuning.
* Check Point CLI Reference Guide - Explanation of using fw ctl, fw unloadlocal, and relevant troubleshooting commands.
NEW QUESTION # 72
You receive reports from multiple users that they cannot browse Upon further discovery you identify that Identity Awareness cannot identify the users properly and apply the configuredAccess Roles What commands you can use to troubleshoot all identity collectors and identity providers from the command line?
- A. on the management: pdp debug set all
- B. on the gateway: pdp debug set AD all and IDC all
- C. on the management: pdp debug on IDC all
- D. on the gateway: pdp debug set IDC all IDP all
Answer: D
Explanation:
To troubleshoot Identity Awareness issues related to user identification and Access Role application, you need to enable debugging for both Identity Collectors (IDC) and Identity Providers (IDP). The command pdp debug set IDC all IDP all on the gateway achieves this.
Here's why this is the correct answer and why the others are not:
A . on the gateway: pdp debug set IDC all IDP all: This correctly enables debugging for all Identity Collectors and Identity Providers, allowing you to see detailed logs and messages related to user identification and Access Role assignment. This helps pinpoint issues with user mapping, authentication, or authorization.
B . on the gateway: pdp debug set AD all and IDC all: This command only enables debugging for Active Directory (AD) as an Identity Provider and all Identity Collectors. It might miss issues related to other Identity Providers if they are in use.
C . on the management: pdp debug on IDC all: This command has two issues. First, it should be executed on the gateway, not the management server, as the gateway is responsible for user identification and policy enforcement. Second, it only enables debugging for Identity Collectors, not Identity Providers.
D . on the management: pdp debug set all: While this command might seem to enable debugging for everything, it's not specific enough for Identity Awareness troubleshooting. It might generate excessive logs unrelated to the issue and make it harder to find the relevant information.
Check Point Troubleshooting Reference:
Check Point Identity Awareness Administration Guide: This guide provides detailed information about Identity Awareness components, configuration, and troubleshooting.
Check Point sk113963: This article explains how to troubleshoot Identity Awareness issues using debug commands and logs.
Check Point R81.20 Security Administration Guide: This guide covers general troubleshooting and debugging techniques, including the use of pdp debug commands.
NEW QUESTION # 73
When a user space process or program suddenly crashes, what type of file is created for analysis
- A. coredebug
- B. core dump
- C. core analyzer
- D. kernel_memory_dump dbg
Answer: B
Explanation:
When a user space process crashes unexpectedly, the operating system often creates a core dump file. This file is a snapshot of the process's memory at the time of the crash, including information such as:
* Program counter: This indicates where the program was executing when it crashed.
* Stack pointer: This shows the function call stack, which can help trace the sequence of events leading to the crash.
* Memory contents: This includes the values of variables and data structures used by the process.
* Register values: This shows the state of the processor registers at the time of the crash.
Core dump files can be analyzed using debuggers like GDB to understand the cause of the crash.
Why other options are incorrect:
* B. kernel_memory_dump dbg: This refers to a kernel memory dump, which is generated when the operating system kernel itself crashes.
* C. core analyzer: This is a tool used to analyze core dump files, not the file itself.
* D. coredebug: This is not a standard term for any type of crash dump file.
Check Point Troubleshooting References:
Check Point's documentation mentions core dumps in the context of troubleshooting various processes, such as fwd (firewall) and cpd (Check Point daemon). You can find information on enabling core dumps and analyzing them in the Check Point administration guides and knowledge base articles.
NEW QUESTION # 74
As a security administrator/engineer in your company, you have noticed that your HQ Check Point Security Management Server is not receiving logs from your HQ Check Point Gateway/Cluster.
To investigate this issue in the command line, you will need to verify which process is running?
- A. cpd
- B. cpm
- C. fwm
- D. fwd
Answer: D
NEW QUESTION # 75
In some scenarios it is very helpful to use advanced Linux commands for troubleshooting purposes. Which command displays information about resource utilization for running processes and shows additional information for core utilization and memory?
- A. cptop
- B. top
- C. mpstat
- D. vmstat
Answer: B
NEW QUESTION # 76
What component is NOT part of Unified policy manager?
- A. Handle
- B. Observer
- C. CMI
- D. Classifier
Answer: B
NEW QUESTION # 77
Like a Site-to-Site VPN between two Security Gateways, a Remote Access VPN relies on the Internet Key Exchange (IKE) what types of keys are generated by IKE during negotiation?
- A. Produce a symmetric key on both sides
- B. Produce a pair of public and private keys
- C. Symmetric keys based on pre-shared secret
- D. Produce an asymmetric key on both sides
Answer: B
NEW QUESTION # 78
How can you start debug of the Unified Policy with all possible flags turned on?
- A. fw ctl debug -m fw + UP
- B. fw ctl debug -m UnifiedPolicy all
- C. fw ctl debug -m UP all
- D. fw ctl debug -m UP *
Answer: C
NEW QUESTION # 79
You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week. Therefore, you need to add a timestamp to the kernel debug and write the output to a file but you can't afford to fill up all the remaining disk space and you only have 10 GB free for saving the debugs. What is the correct syntax for this?
- A. fw ctl debug -T -f -m 10 -s 1000000 -o debugfilename
- B. fw ctl kdebug -T -f -m 10 -s 1000000 -o debugfilename
- C. fw ctl kdebug -T -f -m 10 -s 1000000 > debugfilename
- D. fw ctl kdebug -T -m 10 -s 1000000 -o debugfilename
Answer: B
NEW QUESTION # 80
You receive complains that Guest Users cannot login and use the Guest Network which is configured with Access Role of Guest Users. You need to verity the Captive Portal configuration. Where can you find the config file?
- A. on the management at SCPNAC_ HOME/conf/httpd_ nac.conf
- B. on the management at SNACPORTAL_ HOME/conf/httpd_ nac.conf
- C. on the gateway at $NACPORTAL_ HOME/conf/httpd_ nac.conf
- D. on the gateway at $CPNAC_ HOME/conf/httpd_ nac.conf
Answer: C
NEW QUESTION # 81
Which of these packet processing components stores Rule Base matching state-related information?
- A. Manager
- B. Handlers
- C. Classifiers
- D. Observers
Answer: D
Explanation:
The Terraform Registry allows any user to publish and share modules. Published modules support versioning, automatically generate documentation, allow browsing version histories, show examples and READMEs, and more. Public modules are managed via Git and GitHub, and publishing a module takes only a few minutes.
Once a module is published, releasing a new version of a module is as simple as pushing a properly formed Git tag1.
References = The information can be verified from the Terraform Registry documentation on Publishing Modules provided by HashiCorp Developer1.
NEW QUESTION # 82
Where will the usermode core files located?
- A. $FWDIRVar/log/dump/usermode
- B. /var/log/dump/usermode
- C. $CPDIR/var/log/dump/usermode
- D. /var/suroot
Answer: C
Explanation:
Usermode core files are generated when a user mode process crashes. They are located in the $CPDIR/var/log
/dump/usermode directory on the Security Gateway or Security Management server. The core files can be used to analyze the cause of the crash and troubleshoot the issue. The core files are named according to the process name, date, and time of the crash. For example, cpd_2023_02_03_16_40_55.core is a core file for the cpd process that crashed on February 3, 2023 at 16:40:55
NEW QUESTION # 83
Check Point Access Control Daemons contains several daemons for Software Blades and features. Which Daemon is used for Application & Control URL Filtering?
- A. rad
- B. pepd
- C. cprac
- D. pdpd
Answer: A
Explanation:
https://support.checkpoint.com/results/sk/sk97638
NEW QUESTION # 84
You receive reports that Users cannot browse internet sites. You are using identity awareness with AD Query and Identity Collector in addition you have the Browser Based Authentication Enabled. What command can be used to debug the problem?
- A. on the gateway: pdp debug nac extended
- B. on the gateway: ad debug on
- C. on the management: ad query debug extended
- D. on the gateway: ad query debug on
Answer: A
Explanation:
Identity Awareness is a feature that enables the Security Gateway to identify users and groups behind IP addresses, and apply security policies based on their identity12. Identity Awareness uses different methods to acquire identities, such as AD Query, Identity Collector, and Browser-Based Authentication12. To debug Identity Awareness issues, you need to use the command pdp debug on the gateway, where pdp stands for Policy Decision Point, the component that handles the identity acquisition and enforcement13. The command pdp debug has different flags for different identity sources, such as adlog for AD Query, ic for Identity Collector, and nac for Browser-Based Authentication13. The flag extended enables more detailed debug output13. Therefore, the correct command to debug the problem of users not being able to browse internet sites with Identity Awareness using AD Query, Identity Collector, and Browser-Based Authentication is pdp debug nac extended on the gateway13. The other options are incorrect because they either use the wrong command (ad debug instead of pdp debug), the wrong flag (ad query instead of nac), or the wrong location (on the management instead of on the gateway). References:
* 1: CCTE Courseware, Module 9: Advanced Identity Awareness Troubleshooting, Slide 4
* 2: Check Point R81 Identity Awareness Administration Guide, Chapter 1: Introduction to Identity Awareness, Page 7
* 3: Check Point R81 Identity Awareness Administration Guide, Chapter 5: Troubleshooting Identity Awareness, Page 49
NEW QUESTION # 85
......
Pass Your CheckPoint Exam with 156-587 Exam Dumps: https://examcollection.bootcamppdf.com/156-587-exam-actual-tests.html