Based on Official Syllabus Topics of Actual CheckPoint 156-587 Exam
Free 156-587 Dumps are Available for Instant Access
CheckPoint 156-587 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
NEW QUESTION # 40
In Mobile Access VPN, clientless access is done using a web browser. The primary communication path for these browser based connections is a process that allows numerous processes to utilize port 443 and redirects traffic to a designated port of the respective process.
Which daemon handles this?
- A. HTTPS Inspection Daemon (HID)
- B. Mobile Access Daemon (MAD)
- C. Connectra VPN Daemon (cvpnd)
- D. Multi-portal Daemon
Answer: D
NEW QUESTION # 41
Which of the following is a component of the Context Management Infrastructure used to collect signatures in user space from multiple sources such as Application Control and IPS. and compiles them together into unified Pattern Matchers?
- A. Context Loader
- B. CMI Loader
- C. PSL - Passive Signature Loader
- D. cpas
Answer: C
NEW QUESTION # 42
Where do you enable log indexing on the SMS?
- A. SMS object under "General Properties"
- B. SMS object under "Other"
- C. SMS object under "Logs"
- D. SMS object under "Advanced"
Answer: C
Explanation:
Log indexing is a feature that enables faster and more efficient log searches in SmartLog and SmartEvent. To enable log indexing on the Security Management Server (SMS), you need to edit the SMS object in SmartConsole and go to the "Logs" tab. There you can configure the log indexing settings, such as the index location, the index size, the index frequency, and the index retention123. Reference:
1: CCTE Courseware, Module 2: Advanced Logs and Monitoring, Slide 9
2: Check Point R81 Logging and Monitoring Administration Guide, Chapter 2: Log Indexing, Page 17
3: Check Point R81 Logging and Monitoring Administration Guide, Chapter 2: Log Indexing, Page 18
NEW QUESTION # 43
In Check Point's Packet Processing Infrastructure, what is the role of Observers?
- A. Observers attach object IDs to traffic
- B. Observers monitor the state of Check Point gateways and report it to the security manager
- C. They store Rule Base matching state related information
- D. Observers decide whether or not to publish a CLOB to the Security Policy
Answer: D
Explanation:
NEW QUESTION # 44
The Check Point Watch Daemon (CPWD) monitors critical Check Point processes, terminating them or restarting them as needed to maintain consistent, stable operating conditions. When checking the status/output of CPWD you are able to see some columns like APP, PID, STAT, START, etc. What is the column "STAT" used for?
- A. Shows the Watch Dog name of the monitored process
- B. Shows how many times the Watch Dog started the monitored process
- C. Shows the status of the monitored process
- D. Shows what monitoring method Watch Dog is using to track the process
Answer: C
Explanation:
The STAT column in the output of the cpwd_admin list command shows the status of the monitored process.
The possible values are E for established, meaning that the process is running, or T for terminated, meaning that the process is not running. The STAT column is useful for quickly checking if any critical process has crashed or failed to start. If the value is T, the process should be restarted and the reason for the termination should be investigated. The STAT column does not show the Watch Dog name, the number of times the process was started, or the monitoring method of the Watch Dog.
NEW QUESTION # 45
VPN's allow traffic to pass through the Internet securely by encrypting the traffic as it enters the VPN tunnel and then decrypting the traffic as it exists. Which process is responsible for Mobile VPN connections?
- A. fwk
- B. vpnd
- C. vpnk
- D. cvpnd
Answer: D
NEW QUESTION # 46
If SmartLog is not active or failed to parse results from server, what commands can be run to re- enable the service?
- A. smartlogrestart and smartlogstart
- B. smartloginit and smartlogstop
- C. smartlogstart and smartlogsetup
- D. smartlogstart and smartlogstop
Answer: A
NEW QUESTION # 47
What function receives the AD log event information?
- A. PEP
- B. FWD
- C. ADLOG
- D. CPD
Answer: C
Explanation:
The ADLOG function receives the AD log event information from the Domain Controllers. The ADLOG function is part of the Identity Awareness feature that enables the Security Gateway to identify users and machines in the network and enforce Access Control policy rules based on their identities. The ADLOG function uses the AD Query (ADQ) method to connect to the Active Directory Domain Controllers using WMI and subscribe to receive Security Event logs that are generated when users perform login. The ADLOG function then extracts the user and machine information that maps to an IP address from the event logs and sends it to the PEP function, which enforces the policy based on the identity information.
References:
* 1: Identity Awareness AD Query - Check Point Software
* 2: Identity Logging - Frequently Asked Questions - Check Point Software
3: Support, Support Requests, Training ... - Check Point Software
NEW QUESTION # 48
What is correct about the Resource Advisor (RAD) service on the Security Gateways?
- A. RAD is completely loaded as a kernel module that looks up URL in cache and if not found connects online for categorization. There is no user space involvement in this process
- B. RAD has a kernel module that looks up the kernel cache, notifies client about hits and misses and forwards a-sync requests to RAD user space module which is responsible for online categorization
- C. RAD functions completely in user space. The Pattern Matter (PM) module of the CMI looks up for URLs in the cache and if not found, contact the RAD process in user space to do online categorization
- D. RAD is not a separate module, it is an integrated function of the kernel module and does all operations in the kernel space
Answer: B
NEW QUESTION # 49
Which of the following file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?
- A. fw monitor
- B. tcpdump
- C. CPMIL dump
- D. core dump
Answer: D
NEW QUESTION # 50
VPNs allow traffic to pass through the Internet securely by encrypting the traffic as it enters the VPN tunnel and decrypting the traffic as it exits. Which process is responsible for Mobile VPN connections?
- A. fwk
- B. vpnd
- C. vpnk
- D. cvpnd
- E. vpnk: This refers to VPN kernel-level operations and modules (e.g., handling the actual encryption/decryption of traffic processed by IPsec SAs). It is not the user-space daemon that manages Mobile VPN sessions and policies.
Answer: D
Explanation:
Therefore, cvpnd is the specific process dedicated to managing Mobile VPN connections within the Check Point architecture.
Reference (based on official Check Point documentation naming and functionality):
Check Point R81.20 CLI Reference Guide (details for cvpnd_admin).
Check Point R81.20 Administration Guides (sections discussing Mobile Access architecture and daemons).
Commonly known Check Point process lists available in CCTE study materials.
Explanation:
The Check Point process responsible for Mobile VPN connections, particularly those associated with the Mobile Access Software Blade (which includes SSL VPN and clientless access), is cvpnd (Connectra VPN Daemon).
Exact Extracts and Supporting Information:
Check Point CLI Reference Guide (for cvpnd_admin):
"cvpnd_admin. Description. Changes the behavior of the Mobile Access cvpnd process." This command utility directly interacts with cvpnd for Mobile Access functionalities.
Check Point Daemon Lists (e.g., from "tech :: stuff - Checkpoint Daemons and Processes Explained" or similar CCTE R81.20 documentation):
Under the "Mobile Access Blade" section, CVPND is typically listed as:"CVPND - Connectra VPN Daemon. Main daemon for the Mobile Access Software Blade." It's also often noted that the cpwd_admin list command (Check Point WatchDog) shows this process as "CVPND".
Commands like cvpnstart and cvpnstop are used to manage this daemon.
Exam Preparation Materials (e.g., ExamTopics for 156-586):
A question directly asking "Which process is responsible for Mobile VPN connections?" with options including cvpnd, vpnk, fwk, and vpnd, typically indicates cvpnd as the correct answer.
Explanation of other options:
B : fwk: This is a general suffix often related to firewall worker processes or kernel modules, not a specific high-level daemon for Mobile VPN.
C : vpnd: This is the main VPN daemon, primarily responsible for site-to-site IPsec VPNs and some traditional IPsec remote access clients. While it handles VPN functions, cvpnd is specialized for Mobile Access.
NEW QUESTION # 51
What information does the doctor-log script supply?
- A. Logging rates. Logging Directories, List of troubleshooting tips
- B. Current and daily average logging rates. Indexing status, Size
- C. Logging errors. Exceptions, Repair options
- D. Repair options. Logging Rates, Logging Directories
Answer: B
NEW QUESTION # 52
What is NOT a benefit of the 'fw ctl zdebug' command?
- A. Automatically allocate a 1MB buffer
- B. Clean the buffer
- C. Collect debug messages from the kernel
- D. Cannot be used to debug additional modules
Answer: D
Explanation:
The fw ctl zdebug command is a powerful tool that can be used to collect debug messages from the kernel, clean the buffer, and automatically allocate a 1MB buffer. However, it cannot be used to debug additional modules, such as SecureXL, CoreXL, or VPN. For those modules, other commands or tools are needed, such as fwaccel dbg, fw ctl affinity, or vpn debug.
References:
* 2: "fw ctl zdebug" - Helpful Command Combinations
* 3: How to use " fw ctl zdebug" command
Troubleshooting Expert R81.1 (CCTE) Course Outline) - Module 4: Debugging Tools and Methods
NEW QUESTION # 53
The FileApp parser in the Content Awareness engine does not extract text from which of the following file types?
- A. PDFs
- B. Microsoft Office.docx files
- C. Microsoft Office PowerPoint files
- D. Microsoft Office Excel files
Answer: A
NEW QUESTION # 54
You run cpwd_admin list on a Security Gateway and notice that the CPM process is not listed. Select the best answer.
- A. CPM is not running and can't be monitored by WatchDog.
- B. If you want to monitor CPM, you have to manually add it to WatchDog.
- C. CPM is not there because it has its own monitoring system. Only lower processes are monitored by WatchDog.
- D. The output is different between Gateway and Management Server.
Answer: D
Explanation:
The cpwd_admin list command is used to display the status of processes monitored by the Check Point WatchDog Daemon (CPWD). The CPM (Check Point Management) process is a core process on the Security Management Server, responsible for management operations. However, on a Security Gateway, the CPM process is not typically present, as it is specific to management functions.
Option A: Correct. The output of cpwd_admin list differs between a Security Gateway and a Security Management Server. On a Security Gateway, processes like FWD, VPND, and PEP are monitored, but CPM is not present because it runs on the Management Server. Thus, CPM will not appear in the cpwd_admin list output on a Gateway.
Option B: Incorrect. While it's true that CPM is not running on the Security Gateway, the reason it's not listed is not because it "can't be monitored" by CPWD. On a Management Server, CPM is indeed monitored by CPWD, but this question pertains to a Gateway.
Option C: Incorrect. CPM is automatically monitored by CPWD on systems where it runs (e.g., Management Server). There is no need to manually add it to WatchDog's monitoring list.
Option D: Incorrect. CPM does not have its own separate monitoring system. On a Management Server, CPM is monitored by CPWD like other critical processes. The statement about "only lower processes" being monitored is inaccurate.
Reference:
The Check Point R81.20 Gaia Administration Guide explains the role of CPWD and the processes it monitors on different Check Point systems (Gateway vs. Management Server). The CCTE R81.20 course (as per and) emphasizes understanding the differences in process monitoring between Gateways and Management Servers, including the use of cpwd_admin commands for troubleshooting.https://edu.arrow.com/uk/training/course-detail/90175/Check-Point-Certified-Troubleshooting-Expert-%28CCTE%29-R81.20-%28includes-180-days%27-lab-access%29/False Reference:
The Check Point R81.20 Gaia Administration Guide explains the role of CPWD and the processes it monitors on different Check Point systems (Gateway vs. Management Server). The CCTE R81.20 course (as per and) emphasizes understanding the differences in process monitoring between Gateways and Management Servers, including the use of cpwd_admin commands for troubleshooting.https://edu.arrow.com/uk/training/course-detail/90175/Check-Point-Certified-Troubleshooting-Expert-%28CCTE%29-R81.20-%28includes-180-days%27-lab-access%29/False
https://www.koenig-solutions.com/ccte-r81-20-language-course
For precise details, refer to:
Check Point R81.20 Gaia Administration Guide, section on "CPWD and Process Monitoring" (available via Check Point Support Center).
CCTE R81.20 Courseware, which covers advanced troubleshooting of Security Gateway and Management Server processes (available through authorized training partners).
NEW QUESTION # 55
What process monitors, terminates, and restarts critical Check Point processes as necessary?
- A. CPVVD
- B. FWD
- C. CPM
- D. FWM
Answer: A
NEW QUESTION # 56
PostgreSQL is a powerful, open source relational database management system. Check Point offers a command for viewing the database to interact with Postgres interactive shell. Which command do you need to enter the PostgreSQL interactive shell?
- A. mysql_client cpm postgres
- B. psql_client cpm postgres
- C. mysql -u root
- D. psql_client postgres cpm
Answer: B
Explanation:
The correct command to enter the PostgreSQL interactive shell is psql_client cpm postgres. This command allows the administrator to view and manipulate the database of the Check Point Management (CPM) module, which stores the configuration and policy data. The psql_client command is a Check Point wrapper for the psql command, which is the native PostgreSQL interactive shell. The psql_client command takes two arguments: the first one is the name of the database module, and the second one is the name of the database user. In this case, the database module is cpm and the database user is postgres.
The other commands are incorrect because:
A . mysql_client cpm postgres is not a valid command. The mysql_client command is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL.
B . mysql -u root is not a valid command. The mysql command is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL. Moreover, the -u option specifies the MySQL user name, which is not relevant for Check Point.
D . psql_client postgres cpm is not a valid command. The psql_client command takes the database module name as the first argument, and the database user name as the second argument. In this case, the database module name is cpm and the database user name is postgres. The order of the arguments is reversed in this command.
Reference:
How to use PostgreSQL interactive shell (psql) with Check Point database Check Point Database Tool (GuiDBedit) - Check Point Software (CCTE) - Check Point Software
NEW QUESTION # 57
Which two files contain the Application Database on the Security Gateway?
- A. application_db.C and application_custom_db.C
- B. api_db.C and api_custom_db.C
- C. appi_db.C and appi_custom_db.C
- D. apcl_db.C and apd_custom_db.C
Answer: A
Explanation:
The Application Database on a Check Point Security Gateway stores information about applications and categories used by the Application Control and URL Filtering blades. This database is maintained in specific files on the Gateway.
Option A: Incorrect. api_db.C and api_custom_db.C are not standard files related to the Application Database. These names may be confused with API-related configurations.
Option B: Incorrect. apcl_db.C and apd_custom_db.C are not recognized as Application Database files. These names do not align with Check Point's file naming conventions.
Option C: Correct. The Application Database is stored in application_db.C (the main database) and application_custom_db.C (custom application definitions). These files are located in the $FWDIR/conf directory on the Security Gateway.
Option D: Incorrect. appi_db.C and appi_custom_db.C are close but incorrect. The correct prefix is application_, not appi_.
Reference:
The Check Point R81.20 Security Gateway Administration Guide describes the Application Control and URL Filtering blades, including the storage of application data in application_db.C and application_custom_db.C. The CCTE R81.20 course covers file structures and database management for troubleshooting Application Control issues.
For precise details, refer to:
Check Point R81.20 Security Gateway Administration Guide, section on "Application Control and URL Filtering" (available via Check Point Support Center).
CCTE R81.20 Courseware, which includes labs on Application Database management (available through authorized training partners).
NEW QUESTION # 58
VPN issues may result from misconfiguration, communication failure, or incompatible default configurations between peers. Which basic command syntax needs to be used for troubleshooting Site-to-Site VPN issues?
- A. fw debug truncon
- B. vpn truncon debuq
- C. vpn debug truncon
- D. cp debug truncon
Answer: C
NEW QUESTION # 59
When URL category is not found in the kernel cache, what action will GW do?
- A. GW will update kernel cache during next policy install
- B. RAD in kernel space will forward request to the cloud
- C. RAD forwards this request to CMI which is the brain of inspection
- D. RAD In user space will forward request to the cloud
Answer: D
NEW QUESTION # 60
How can you start debug of the Unified Policy with all possible flags turned on?
- A. fw ctl debug -m UP all
- B. fw ctl debug -m UnifiedPolicy all
- C. fw ctl debug -m UP *
- D. fw ctl debug -m fw + UP
Answer: A
NEW QUESTION # 61
......
The Most In-Demand 156-587 Pass Guaranteed Quiz : https://preptorrent.actual4exams.com/156-587-real-braindumps.html