CheckPoint Check Point Certified Troubleshooting Expert - R81.20 156-587 Exam Practice Test

Page: 1 / 14
Total 109 questions
Question 1
Question 2

You found out that $FWDIR/Iog/fw.log is constantly growing in size at a Security Gateway, what is the reason?



Answer : B


Question 3

What tool would you run to diagnose logging and indexing?



Answer : D


Question 4

You receive reports that Users cannot browse internet sites. You are using identity awareness with AD Query and Identity Collector in addition you have the Browser Based Authentication Enabled. What command can be used to debug the problem?



Answer : D

Identity Awareness is a feature that enables the Security Gateway to identify users and groups behind IP addresses, and apply security policies based on their identity12.Identity Awareness uses different methods to acquire identities, such as AD Query, Identity Collector, and Browser-Based Authentication12.To debug Identity Awareness issues, you need to use the commandpdp debugon the gateway, wherepdpstands for Policy Decision Point, the component that handles the identity acquisition and enforcement13.The commandpdp debughas different flags for different identity sources, such asadlogfor AD Query,icfor Identity Collector, andnacfor Browser-Based Authentication13.The flagextendedenables more detailed debug output13.Therefore, the correct command to debug the problem of users not being able to browse internet sites with Identity Awareness using AD Query, Identity Collector, and Browser-Based Authentication ispdp debug nac extendedon the gateway13. The other options are incorrect because they either use the wrong command (ad debuginstead ofpdp debug), the wrong flag (ad queryinstead ofnac), or the wrong location (on the managementinstead ofon the gateway).Reference:

1: CCTE Courseware, Module 9: Advanced Identity Awareness Troubleshooting, Slide 4

2: Check Point R81 Identity Awareness Administration Guide, Chapter 1: Introduction to Identity Awareness, Page 7

3: Check Point R81 Identity Awareness Administration Guide, Chapter 5: Troubleshooting Identity Awareness, Page 49


Question 5

Your users have some issues connecting with Mobile Access VPN to your gateway. How can you debug the tunnel establishment?



Answer : C


Question 6

You run a free-command on a gateway and notice that the Swap column is not zero Choose the best answer



Answer : A

When the free command on a Linux-based system (like a Check Point Gaia gateway) shows a non-zero value in the 'Swap' column, it indicates that the system has utilized its swap space. Swap space is a portion of the hard disk designated to act as virtual RAM when the physical RAM is fully utilized.

The most direct and accurate explanation for swap usage is that the system's demand for Random Access Memory (RAM) exceeded the available physical RAM, forcing the operating system to move some less frequently used memory pages from RAM to the swap space on the disk. This frees up physical RAM for more active processes.

Let's analyze the options:

A . Utilization of ram is high and swap file had to be used: This is the correct and fundamental reason. Swap is used precisely because RAM utilization reached a point where the system needed more memory than was physically available.

B . Swap file is used regularly because RAM memory is reserved for management traffic: While Check Point gateways handle management traffic, operating systems do not typically use swap 'regularly' due to a fixed reservation of RAM for such traffic in a way that would routinely force swapping under normal conditions. If management traffic is excessively high and consumes too much RAM, it would fall under the general case of high RAM utilization.

C . Swap memory is used for heavy connections when RAM memory is full: This describes a common cause for high RAM utilization on a firewall. Heavy connections can consume significant memory resources. When this consumption leads to RAM exhaustion, swap will indeed be used. However, option A is a more general and direct explanation of why swap is used, regardless of the specific cause of high RAM utilization. Option C is a specific scenario leading to the condition described in A.

D . Its ole Swap is used to increase performance: This statement is incorrect. Swapping to disk is significantly slower than accessing RAM. Therefore, swap usage generally indicates a performance bottleneck (or potential for one) rather than a performance enhancement. While virtual memory (which includes swap) allows a system to run more or larger applications than its physical RAM would normally allow, the act of swapping itself is detrimental to performance.

Conclusion: The best answer is A because it directly and accurately describes the immediate reason for swap usage: high RAM utilization necessitating the use of the swap file. Option C, while plausible as a cause of high RAM utilization, is a specific instance, whereas A is the overarching reason swap comes into play.

Reference (General Linux/System Administration Principles and supported by CCTE exam preparation materials): This understanding is based on fundamental principles of how operating systems manage memory and swap space. Check Point CCTE R81.20 exam preparation materials also affirm this understanding for similar questions. For instance, a question identical to this one appearing in CCTE exam preparation resources typically points to option A as the correct answer.


Question 7

You receive complains that Guest Users cannot login and use the Guest Network which is configured with Access Role of Guest Users. You need to verity the Captive Portal configuration. Where can

you find the config file?



Answer : A


Page:    1 / 14   
Total 109 questions