156-585 sample questions

Question 1

A troubleshooter needs to capture traffic on a Security Gateway to diagnose an issue with clear-text SMTP traffic being dropped. They want to see the packet as it is processed by the firewall kernel chain, both before and after the Access Control policy is applied. Which `fw monitor` chain points are the most appropriate for this task? (Select TWO).

Accepted Answer

i (inbound, pre-chain)

Accepted Answer

I (inbound, post-chain)

Answer

o (outbound, pre-chain)

Answer

O (outbound, post-chain)

Answer

p (pre-VPN encrypt/decrypt)

Question 2

An administrator is troubleshooting a policy installation failure to a remote Security Gateway. The error in SmartConsole is 'Installation failed. Reason: TCP connectivity failure (port 18191)'. The administrator has verified with `netstat` that the `fwd` process is listening on port 18191 on the Management Server. A traceroute from the remote gateway to the Management Server completes successfully. What is the most logical next step?

Accepted Answer

Run a packet capture (e.g., `tcpdump`) on the Management Server for port 18191 while attempting another policy installation.

Answer

Restart the `fwd` process on the Management Server.

Answer

Reboot the remote Security Gateway.

Answer

Re-establish SIC between the gateway and the Management Server.

Question 3

True or False: The `fw ctl zdebug` command is functionally identical to `fw ctl debug` but writes its output to a compressed file instead of a memory buffer.

Accepted Answer

False

Answer

True

Question 4

To collect comprehensive diagnostic data from a Security Gateway, including configuration, process status, log files, and OS information, for submission to Check Point Support, which command should be executed in Expert mode?

Accepted Answer

cpinfo -z -o my_cpinfo.tgz

Answer

cpview -e > diag.txt

Answer

fw ctl diag

Answer

ips stats -v

Question 5

**Case Study:**

A retail company uses an R81 cluster with the Identity Awareness blade enabled, using AD Query as the identity source. Recently, the IT department deployed a new fleet of Point-of-Sale (POS) terminals that run a custom Linux OS. The security team created an Access Role for these terminals based on their static IP addresses. However, store managers, who use Windows laptops and are part of the 'Store_Managers' AD group, report that they can no longer access the inventory server, which they could access before the POS deployment.

Troubleshooting shows that the managers' traffic is being dropped by a rule that denies access from the POS terminals' Access Role to the inventory server. Logs indicate that when a manager logs in, their IP address is incorrectly being associated with the POS Access Role instead of their AD-based user identity. The POS terminals are on the same subnet as the managers' laptops.

What is the most likely reason for this identity misidentification?

Accepted Answer

In the Identity Awareness configuration, the 'Access Roles' identity source has a higher priority than the 'AD Query' identity source.

Answer

The AD Query configuration on the Security Gateway has incorrect credentials for the Active Directory server.

Answer

The 'Networks' configuration in the Gateway object's Identity Awareness settings does not include the subnet for the managers and POS terminals.

Answer

The Windows laptops are not correctly configured to respond to WMI queries from the Security Gateway.

Question 6

You are debugging a slow database issue on a Security Management Server. You suspect the `solr` process, which handles log indexing, is consuming excessive resources. Which command would you use to safely restart ONLY the `solr` process without impacting other critical management services like `cpm`?

Accepted Answer

cpm_control.sh restart -n solr

Answer

cpstop; cpstart

Answer

evstop; evstart

Answer

kill -9 `pidof solr`

Question 7

An administrator is troubleshooting an issue where traffic that should be accelerated by SecureXL is being processed by the Firewall (FW) path instead, causing high CPU. They check `fwaccel stats -s` and see that 'Accelerated conns' is very low. They suspect a specific NAT rule is causing traffic to be de-accelerated. Which of the following NAT configurations are known to prevent SecureXL acceleration? (Select TWO).

Accepted Answer

NAT rules that use Port Address Translation (PAT) with a port range.

Accepted Answer

NAT rules configured with 'Any' in the destination port field.

Answer

Static NAT for a single host.

Answer

Hide NAT behind the gateway's external interface IP address.

Question 8

A kernel debug is being performed on a production gateway to trace a complex packet flow issue. The administrator needs to ensure the debug buffer is large enough to capture all relevant data without wrapping too quickly, but also wants to avoid consuming excessive kernel memory. What is the command to set the kernel debug buffer to 16384 KB?

Accepted Answer

fw ctl debug -buf 16384

Answer

fw ctl kdebug -s 16384

Answer

fw ctl debug --buf 16384

Answer

fw ctl debug -s 16384

Question 9

**Case Study:**

A large enterprise has a multi-site deployment with a central R81 Security Management Server and numerous remote gateways. An administrator pushes a large policy package to all gateways. Most installations succeed, but one specific remote cluster reports 'Installation failed. Reason: Verification failed.' The administrator reviews the `fwm.elg` log file on the Management Server and finds messages indicating a 'syntax error' related to a newly added network object, but the object's configuration appears correct in SmartConsole.

The administrator suspects a database inconsistency between what is shown in the GUI and what is stored in the PostgreSQL database. They decide to use the `api status` command on the management server, and the output shows that the 'API server' process is running, but the 'FWM' process is in a 'starting' state and repeatedly restarting. This confirms a problem with the management database preventing the FWM process from initializing correctly.

What is the most appropriate next step to resolve this issue?

Accepted Answer

Revert to a previous revision of the management database using the Database Revision Control feature in SmartConsole.

Answer

Run `cpstop; cpstart` on the remote cluster that is failing the policy installation.

Answer

Restore the entire Security Management Server from the last known good backup.

Answer

Manually edit the `objects_5_0.C` file in the `$FWDIR/conf` directory to remove the problematic object.

Question 10

When using `fw monitor` to inspect traffic, the output shows a packet being dropped with the reason `chain_fn_0: drop, rule 23`. What does this message indicate?

Accepted Answer

The packet was dropped by rule number 23 in the Access Control policy.

Answer

The packet was dropped by the 23rd chain module in the kernel.

Answer

The packet was dropped due to an Anti-Spoofing violation on the ingress interface.

Answer

The packet was dropped because the kernel has no route to the destination.

Free 156-585 sample questions

True or False: The `fw ctl zdebug` command is functionally identical to `fw ctl debug` but writes its output to a compressed file instead of a memory buffer.

To collect comprehensive diagnostic data from a Security Gateway, including configuration, process status, log files, and OS information, for submission to Check Point Support, which command should be executed in Expert mode?

When using `fw monitor` to inspect traffic, the output shows a packet being dropped with the reason `chain_fn_0: drop, rule 23`. What does this message indicate?

10 more free samples are waiting