156-587 sample questions

Question 1

A hospital uses Identity Awareness with AD Query. Physicians share workstations. An administrator adds a rule for the clinical research portals with an Access Role in the Source column and 'Enable Identity Captive Portal' in the Action settings. Physicians who sit down at a shared workstation still get the access of the previous user and never see the Captive Portal. What explains this behavior?

Accepted Answer

AD Query already identified the workstation's IP address, so the gateway applies the rule action without a redirect.

Answer

The Access Role must be placed in the Destination column for the redirect to happen.

Answer

The Captive Portal redirects only HTTPS traffic, and the portals use HTTP.

Answer

The Terminal Servers Identity Agent must be installed on each workstation before the Captive Portal can work.

Question 2

A user is unable to connect to the corporate network using the Check Point Mobile Access VPN client. The connection fails during the key negotiation phase. The administrator runs `vpn debug trunc` on the Security Gateway and captures the IKE debug logs. The output contains the message: `NO_PROPOSAL_CHOSEN`. What are the two MOST likely causes of this error? (Select TWO).

Accepted Answer

The VPN encryption suite on the client does not match any allowed suite on the gateway.

Accepted Answer

The Diffie-Hellman (DH) group configured in the client's VPN site profile is not supported by the gateway's configuration.

Answer

The Office Mode IP pool on the Security Gateway is exhausted.

Answer

The user's account is not part of the correct Active Directory group for remote access.

Answer

The user entered an incorrect password for their account.

Question 3

An administrator is troubleshooting a slow policy installation process to a remote Security Gateway. Which two processes on the Security Management Server are primarily responsible for compiling the policy and transferring it to the gateway? (Select TWO).

Accepted Answer

FWM (FireWall Management)

Accepted Answer

CPD (Check Point Daemon)

Answer

FWD (FireWall Daemon)

Answer

CPWD (Check Point WatchDog)

Question 4

A kernel debug using `fw ctl zdebug` is being performed on a production gateway to diagnose a connectivity issue. The administrator is concerned about the performance impact and wants to ensure the debug buffer does not overwrite important initial data too quickly. What is the correct command to increase the kernel debug buffer size to 2048 KB?

Accepted Answer

`fw ctl debug -buf 2048`

Answer

`fw ctl zdebug --bufsize 2048`

Answer

`zdebug set buffer_size 2048`

Answer

`fwk ctl set-buffer -s 2048`

Question 5

True or False: When troubleshooting Identity Awareness, the `pdp` process runs on the Security Gateway (PEP) and is responsible for enforcing the identity-based policy.

Accepted Answer

False

Answer

True

Question 6

A retail company's Check Point R81.20 gateway uses a permanent tunnel in the active 'dpd' mode to a third-party branch firewall. While troubleshooting tunnel flaps, the administrator checks when the gateway sends DPD requests to this peer. Which statement is correct?

Accepted Answer

It sends DPD requests at regular 10-second intervals, but only while no traffic arrives from the peer.

Answer

It sends DPD requests every 10 seconds, even while IPsec traffic arrives from the peer.

Answer

It sends DPD requests only after the IPsec SA with the peer has already expired.

Answer

It sends Tunnel Test packets on UDP port 18234 to the peer instead of DPD requests.

Question 7

An administrator notices that the `/var/log/` partition on a Security Gateway is filling up rapidly with `fw.log` files. The gateway is configured to send logs to a dedicated Log Server, and connectivity between the two is stable. What is the MOST likely cause for the local logging?

Accepted Answer

The gateway object's Logs settings have 'Save logs locally, on this server' selected.

Answer

The 'Implied Rules' are configured to log traffic locally.

Answer

The 'fwlog_retries' kernel parameter is set to a non-zero value.

Answer

The gateway object's 'Logs' setting has 'Log to both Security Management and Log Server' enabled.

Question 8

A consultant is tasked with troubleshooting a complex application performance issue through a Check Point cluster. The traffic is encrypted (HTTPS) and uses multiple, short-lived TCP sessions. The consultant needs to see the full, unencrypted payload and correlate it with kernel-level decisions like NAT and routing for specific packets. Which combination of tools would be the MOST effective for this task?

Accepted Answer

HTTPS Inspection with Mirror and Decrypt to a recorder, plus `fw monitor -p all`

Answer

`cpview` history mode and enabling 'Account' tracking on the relevant rule

Answer

HTTPS Inspection, then `tcpdump` on the internal interface plus `fw ctl zdebug + drop`

Answer

`fw monitor -e 'accept;'` and SmartView Tracker logs

Question 9

**Case Study:**

A logistics company runs an R81.20 Security Gateway. A new inventory application opens thousands of new TCP connections per second from the same clients to one server on port 15500. At peak hours the CoreXL Firewall instances reach 100% CPU, and `fwaccel stats -s` shows that most packets are F2Fed.

Which command should the administrator run first to see whether SecureXL Accept Templates are enabled?

Accepted Answer

`fwaccel stat`

Answer

`fw ctl multik print_heavy_conn`

Answer

`fw ctl affinity -l`

Answer

`fwaccel dos stats`

Question 10

When using `fw monitor`, what is the significance of the lowercase 'o' and uppercase 'O' inspection points in the output?

Accepted Answer

'o' is before the outbound FireWall Virtual Machine and 'O' is after it.

Answer

'o' is the original packet and 'O' is the offloaded packet by SecureXL.

Answer

'o' is the outbound packet before QoS and 'O' is the outbound packet after QoS.

Answer

'o' is before the VPN encryption/decryption process and 'O' is after.

Free 156-587 sample questions

An administrator is troubleshooting a slow policy installation process to a remote Security Gateway. Which two processes on the Security Management Server are primarily responsible for compiling the policy and transferring it to the gateway? (Select TWO).

True or False: When troubleshooting Identity Awareness, the `pdp` process runs on the Security Gateway (PEP) and is responsible for enforcing the identity-based policy.

A retail company's Check Point R81.20 gateway uses a permanent tunnel in the active 'dpd' mode to a third-party branch firewall. While troubleshooting tunnel flaps, the administrator checks when the gateway sends DPD requests to this peer. Which statement is correct?

An administrator notices that the `/var/log/` partition on a Security Gateway is filling up rapidly with `fw.log` files. The gateway is configured to send logs to a dedicated Log Server, and connectivity between the two is stable. What is the MOST likely cause for the local logging?

When using `fw monitor`, what is the significance of the lowercase 'o' and uppercase 'O' inspection points in the output?

10 more free samples are waiting