Down To Date Check Point Certified Troubleshooting Expert 156-585 Exam Dumps

NEW QUESTION 1
Which command do you need to execute to insert fw monitor after TCP streaming (out) in the outbound chain using absolute position? Given the chain was 1ffffe0, choose the correct answer.

• A. fw monitor –po -0x1ffffe0
• B. fw monitor –p0 ox1ffffe0
• C. fw monitor –po 1ffffe0
• D. fw monitor –p0 –ox1ffffe0

Answer: A

Explanation:
https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_PerformanceTuning_AdminG

NEW QUESTION 2
How does the URL Filtering Categorization occur in the kernel?
* 1. RAD provides the status of the search to the client.
* 2. The a-sync request is forwarded to the RAD User space via the RAD kernel for online categorization.
* 3. The online detection service responds with categories and the kernel cache is updated.
* 4. The kernel cache notifies the RAD kernel of hits and misses.
* 5. URL lookup initiated by the client.
* 6. URL lookup occurs in the kernel cache.
* 7. The client sends an a-sync request back to RAD If the URL was not found.

• A. 5, 6, 7, 1, 3, 2, 4
• B. 5, 6, 2, 4, 1, 7, 3
• C. 5, 6, 4, 1, 7, 2, 3
• D. 5, 6, 3, 1, 2, 4, 7

Answer: C

NEW QUESTION 3
Which of the following is contained in the System Domain of the Postgres database?

• A. Saved queries for applications
• B. Configuration data of log servers
• C. Trusted GUI clients
• D. User modified configurations such as network objects

Answer: C

NEW QUESTION 4
What process monitors, terminates, and restarts critical Check Point processes as necessary?

• A. CPWD
• B. CPM
• C. FWD
• D. FWM

Answer: A

NEW QUESTION 5
Check Point provides tools & commands to help you to identify issues about products and applications. Which Check Point command can help you to display status and statistics information for various Check Point products and applications?

• A. cpstat
• B. CPstat
• C. CPview
• D. fwstat

Answer: A

NEW QUESTION 6
Which kernel process is used by Content Awareness to collect the data from contexts?

• A. dlpda
• B. PDP
• C. cpemd
• D. CMI

Answer: D

NEW QUESTION 7
How can you increase the ring buffer size to 1024 descriptors?

• A. set interface eth0 rx-ringsize 1024
• B. fw ctl int rx_ringsize 1024
• C. echo rx_ringsize=1024>>/etc/sysconfig/sysctl.conf
• D. dbedit>modify properties firewall_properties rx_ringsize 1024

Answer: A

NEW QUESTION 8
For TCP connections, when a packet arrives at the Firewall Kernel out of sequence or fragmented, which layer of IPS corrects this to allow for proper inspection?

• A. Passive Streaming Library
• B. Protections
• C. Protocol Parsers
• D. Context Management

Answer: A

NEW QUESTION 9
During firewall kernel debug with fw ctl zdebug you received less information than expected. You noticed that a lot of messages were lost since the time the debug was started. What should you do to resolve this issue?

• A. Increase debug buffer; Use fw ctl debug –buf 32768
• B. Redirect debug output to file; Use fw ctl zdebug –o ./debug.elg
• C. Increase debug buffer; Use fw ctl zdebug –buf 32768
• D. Redirect debug output to file; Use fw ctl debug –o ./debug.elg

Answer: A

NEW QUESTION 10
What is the simplest and most efficient way to check all dropped packets in real time?

• A. fw ctl zdebug * drop in expert mode
• B. Smartlog
• C. cat /dev/fwTlog in expert mode
• D. tail -f SFWDIR/log/fw log |grep drop in expert mode

Answer: D

NEW QUESTION 11
What are the maximum kernel debug buffer sizes, depending on the version

• A. 8MB or 32MB
• B. 8GB or 64GB
• C. 4MB or 8MB
• D. 32MB or 64MB

Answer: A

NEW QUESTION 12
You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week. Therefore you need to add a timestamp to the kernel debug and write the output to a file What is the correct syntax for this?

• A. fw ctl kdebug -T -f > filename.debug
• B. fw ctl kdebug -T > filename.debug
• C. fw ctl debug -T -f > filename.debug
• D. fw ctl kdebug -T -f -o filename.debug

Answer: C

NEW QUESTION 13
How can you start debug of the Unified Policy with all possible flags turned on?

• A. fw ctl debug -m UP all
• B. fw ctl debug -m UnifiedPolicy all
• C. fw ctl debug -m fw + UP
• D. fw ctl debug -m UP *

Answer: D

NEW QUESTION 14
How many captures does the command "fw monitor -p all" take?

• A. All 15 of the inbound and outbound modules
• B. All 4 points of the fw VM modules
• C. 1 from every inbound and outbound module of the chain
• D. The -p option takes the same number of captures, but gathers all of the data packet

Answer: C

NEW QUESTION 15
Select the technology that does the following actions
- provides reassembly via streaming for TCP
- handles packet reordering and congestion
- handles payload overlap
- provides consistent stream of data to protocol parsers

• A. Passive Streaming Library
• B. Context Management
• C. Pre-Protocol Parser
• D. fwtcpstream

Answer: A

NEW QUESTION 16
......