156-836 sample questions

Question 1

A Maestro environment has two Orchestrators on one site. During a planned upgrade, the upgrade of the second Orchestrator fails. The first Orchestrator and all SGMs still run the old version. What is the documented way to recover the failed Orchestrator?

Accepted Answer

Run `orchd stop`, then revert the upgrade's automatic Gaia snapshot with `set snapshot revert`.

Answer

Copy the configuration from the other Orchestrator to the failed one with `scp`.

Answer

Run `reboot` on the failed Orchestrator at once to force a re-sync.

Answer

Proceed with upgrading the other Orchestrator to see if it resolves the sync issue.

Question 2

True or False: In a Maestro environment, the Single Management Object (SMO) IP address is a virtual IP that always resides on the designated SMO Master SGM.

Accepted Answer

False

Answer

True

Question 3

Which TWO statements about Layer 4 distribution in a Maestro R81.10 Security Group are correct? (Select TWO)

Accepted Answer

Layer 4 distribution is enabled by default in a new Security Group.

Accepted Answer

With Layer 4 distribution enabled, User (Internal) mode assigns packets based on the Source Port and the Destination IP address.

Answer

Layer 4 distribution is configured with the `asg_user_distribution` command.

Answer

Layer 4 distribution is configured with `g_asg_distribution_gslb_by_ip`.

Answer

Layer 4 distribution hashes on a user-defined offset within the packet payload.

Question 4

A new Security Group has been created in a Maestro R81.10 environment. An administrator needs to push a custom script to all SGMs in this new group to gather specific performance metrics. The script should not be sent to any other Security Groups. Which action is the most appropriate for this task?

Accepted Answer

Connect to the new Security Group (its SMO) and run `asg_cp2blades /path/to/script` in Gaia gClish or Expert mode

Answer

Log in to Gaia Clish on the Orchestrator and run `asg_cp2blades /path/to/script`

Answer

Run `update_conf_file /path/to/script` on the Orchestrator

Answer

Run `asg_config save /path/to/script` on any Security Group

Question 5

A systems engineer is provisioning a new Maestro MHO-170 Orchestrator running R81.10. After connecting the management interface and assigning an IP address to Mgmt1 in Gaia Clish, the engineer is unable to access the WebUI (Gaia Portal). What is the most likely reason?

Accepted Answer

The interface was not set to state on, or no default route was added.

Answer

The MHO-170 model requires a dedicated management SGM to be connected.

Answer

The WebUI service is disabled by default.

Answer

A license must be installed via the CLI before the WebUI is activated.

Question 6

Which of the following are key benefits of connecting two Orchestrators on the same site in a Check Point Maestro R81.10 environment? (Select THREE)

Accepted Answer

High availability for the orchestration and distribution plane.

Accepted Answer

Ability to upgrade or patch one Orchestrator at a time while the other Orchestrator keeps distributing traffic.

Accepted Answer

Redundancy for the physical downlink connections to the SGMs.

Answer

It removes the need for Security Gateway licenses on the SGMs.

Answer

Automatic load balancing of management tasks between orchestrators.

Question 7

An administrator sees in the `asg stat -v` output that SGM 1_3 of a Quantum Maestro R81.10 Security Group is DOWN while all other SGMs are ACTIVE. Before opening a support case, the administrator wants to run the built-in Maestro diagnostic test suite (System Health, Resources, SSD Health, Policy, Licenses, networking tests and more) and see a Passed/Failed summary with the failure reasons. Which Gaia gClish command should be used?

Accepted Answer

`show smo verifiers report`

Answer

`asg diag --blades all`

Answer

`asg test --member 1_3`

Answer

`g_asg_diag 1_3`

Question 8

An administrator runs `asg monitor -v` on a Maestro Security Group. What does the output show?

Accepted Answer

Only the System component status, refreshed continuously (the same information as asg stat)

Answer

A per-packet trace of each connection, including the SGM that processed it

Answer

Packets captured on the Orchestrator Uplink ports, with their source MAC addresses

Answer

The matching security rule number and name for each packet

Question 9

A retail company has deployed a Maestro R81.10 Security Group to handle its e-commerce traffic. To comply with PCI DSS, they must record every successful Gaia configuration change that administrators make on the Security Group and send these records to their Check Point Management Server. Which feature provides this information?

Accepted Answer

Gaia audit logging (`set syslog auditlog permanent` and `set syslog mgmtauditlogs on`)

Answer

The Threat Prevention logs of the Security Group, viewed in SmartConsole.

Answer

The Expert mode `history` command, run on each SGM separately.

Answer

The `cpstat` command, run on the Security Group.

Question 10

What is the primary purpose of defining multiple Security Groups in a single Maestro deployment?

Accepted Answer

To split one Maestro system into separate gateways, each with its own policy.

Answer

To increase the total number of physical ports available.

Answer

To provide physical redundancy for the SGMs.

Answer

To enable active-active clustering between two different Maestro chassis.

Free 156-836 sample questions