CheckPoint 156-585 Free Practice Questions

NEW QUESTION 1
URL Filtering is an essential part of Web Security in the Gateway. For the Security Gateway to perform a URL lookup when a client makes a URL request, where is the sync-request forwarded from if a sync-request is required''

• A. RAD Kernel Space
• B. URLF Kernel Client
• C. URLF Online Service
• D. RAD User Space

Answer: B

NEW QUESTION 2
Some users from your organization have been reporting some connection problems with CIFS since this morning You suspect an IPS issue after an automatic IPS update last night. So you want to perform a packet capture on uppercase I only directly after the IPS chain module (position 4 in the chain) to check If the packets pass the IPS. What command do you need to run?

• A. fw monitor -ml -pi 5 -e
• B. fw monitor -pi 5 -e
• C. tcpdump -eni any
• D. fw monitor -pi asm

Answer: C

NEW QUESTION 3
Check Point Threat Prevention policies can contain multiple policy layers and each layer consists of its own Rule Base Which Threat Prevention daemon is used for Anti-virus?

• A. in.emaild.mta
• B. in.msd
• C. ctasd
• D. in emaild

Answer: D

NEW QUESTION 4
You are upgrading your NOC Firewall (on a Check Point Appliance) from R77 to R80 30 but you did not touch the security policy After the upgrade you can't connect to the new R80 30 SmartConsole of the upgraded Firewall anymore What is a possible reason for this?

• A. new new console port is 19009 and a access rule ts missing
• B. the license became invalig and the firewall does not start anymore
• C. the upgrade process changed the interfaces and IP adresses and you have to switch cables
• D. the IPS System on the new R80.30 Version prohibits direct Smartconsole access to a standalone firewall

Answer: D

NEW QUESTION 5
What is the most efficient way to view large fw monitor captures and run filters on the file?

• A. wireshark
• B. CLISH
• C. CLI
• D. snoop

Answer: A

NEW QUESTION 6
Which file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?

• A. core dump
• B. CPMIL dump
• C. fw monitor
• D. tcpdump

Answer: A

NEW QUESTION 7
Which of the following is NOT a valid "fwaccel" parameter?

• A. stat
• B. stats
• C. templates
• D. packets

Answer: D

NEW QUESTION 8
When a User process or program suddenly crashes, a core dump is often used to examine the problem. Which command is used to enable the core-dumping via GAIA dish?

• A. set core-dump enable
• B. set core-dump per_process
• C. set user-dump enable
• D. set core-dump total

Answer: A

NEW QUESTION 9
Which process is responsible for the generation of certificates?

• A. cpm
• B. cpca
• C. dbsync
• D. fwm

Answer: B

NEW QUESTION 10
What are some measures you can take to prevent IPS false positives?

• A. Exclude problematic services from being protected by IPS (sip, H 323, etc )
• B. Use IPS only in Detect mode
• C. Use Recommended IPS profile
• D. Capture packet
• E. Update the IPS database, and Back up custom IPS files

Answer: A

NEW QUESTION 11
Which kernel process is used by Content Awareness to collect the data from contexts?

• A. dlpda
• B. PDP
• C. cpemd
• D. CMI

Answer: D

NEW QUESTION 12
What is NOT a benefit of the fw ctl zdebug command?

• A. Cannot be used to debug additional modules
• B. Collect debug messages from the kernel
• C. Clean the buffer
• D. Automatically allocate a 1MB buffer

Answer: A

NEW QUESTION 13
Which command(s) will turn off all vpn debug collection?

• A. vpn debug off
• B. vpn debug -a off
• C. vpn debug off and vpn debug ikeoff
• D. fw ctl debug 0

Answer: C

NEW QUESTION 14
What does CMI stand for in relation to the Access Control Policy?

• A. Content Matching Infrastructure
• B. Content Management Interface
• C. Context Management Infrastructure
• D. Context Manipulation Interface

Answer: C

NEW QUESTION 15
Which of the following daemons is used for Threat Extraction?

• A. scrubd
• B. extractd
• C. tex
• D. tedex

Answer: A

NEW QUESTION 16
For TCP connections, when a packet arrives at the Firewall Kernel out of sequence or fragmented, which layer of IPS corrects this to allow for proper inspection?

• A. Passive Streaming Library
• B. Protections
• C. Protocol Parsers
• D. Context Management

Answer: A

NEW QUESTION 17
Which Daemon should be debugged for HTTPS Inspection related issues?

• A. FWD
• B. HTTPD
• C. WSTLSO
• D. VPND

Answer: C

NEW QUESTION 18
Which of the following inputs is suitable for debugging HTTPS inspection issues?

• A. vpn debug cptls on
• B. fw ctl debug –m fw + conn drop cptls
• C. fw diag debug tls enable
• D. fw debug tls on TDERROR_ALL_ALL=5

Answer: B

NEW QUESTION 19
......