CheckPoint 156-585 Exam Practice Test Instant Access

Question 1

Which command(s) will turn off all vpn debug collection?

Avpn debug off

Bvpn debug -a off

Cvpn debug off and vpn debug ikeoff

Dfw ctl debug 0

Answer : C

Question 2

When debugging is enabled on firewall kernel module using the 'fw ctl debug' command with required options, many debug messages are provided by the kernel that help the administrator to identify issues. Which of the following is true about these debug messages generated by the kernel module?

AMessages are written to a buffer and collected using 'fw ctl kdebug'

BMessages are written to console and also /var/log/messages file

CMessages are written to /etc/dmesg file

DMessages are written to $FWDIR/log/fw.elg

Answer : B

Question 3

You are running R80.XX on an open server and you see a high CPU utilization on your 12 CPU cores You now want to enable Hyperthreading to get more cores to gain some performance. What is the correct way to achieve this?

AHyperthreading is not supported on open servers, on on Check Point Appliances

Bjust turn on HAT in the bios of the server and boot it

Cjust turn on HAT in the bios of the server and after it has booted enable it in cpconfig

Din dish run set HAT on

Answer : A

Question 4

What is the name of the VPN kernel process?

AVPNK

BVPND

CCVPND

DFWK

Answer : A

Question 5

The two procedures available for debugging in the firewall kernel are

i fw ctl zdebug

ii fw ctl debug/kdebug

Choose the correct statement explaining the differences in the two

A(i) Is used for general debugging, has a small buffer and is a quick way to set kernel debug flags to get an output via command line
whereas (11) is useful when there is a need for detailed debugging and requires additional steps to set the buffer and get an output via command line

B(i) is used to debug the access control policy only, however (n) can be used to debug a unified policy

C(i) is used to debug only issues related to dropping of traffic, however (n) can be used for any firewall issue including NATing, clustering etc.

D(i) is used on a Security Gateway, whereas (11) is used on a Security Management Server

Answer : C

Question 6

Which file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?

Acore dump

BCPMIL dump

Cfw monitor

Dtcpdump

Answer : A

Question 7

Some users from your organization have been reporting some connection problems with CIFS since this morning You suspect an IPS issue after an automatic IPS update last night. So you want to perform a packet capture on uppercase I only directly after the IPS chain module (position 4 in the chain) to check If the packets pass the IPS. What command do you need to run?

Afw monitor -ml -pi 5 -e <filterexperession>

Bfw monitor -pi 5 -e <filterexptession>

Ctcpdump -eni any <filterexpression>

Dfw monitor -pi asm <filtefexpfession>

Answer : C

CheckPoint 156-585 Check Point Certified Troubleshooting Expert Exam Practice Test