CheckPoint Check Point Certified Troubleshooting Expert - R81.20 156-587 Exam Questions

Answer : A

The Unified Policy is a feature that allows you to create a single policy layer that combines the functionality of Access Control, Threat Prevention, and HTTPS Inspection12.To debug the Unified Policy, you need to use the commandfw ctl debugwith the module nameUPand the flagallor specific flags for different aspects of the Unified Policy inspection34. The possible flags for the Unified Policy module are:

up_match: Shows the matching process of the Unified Policy rules.

up_inspect: Shows the inspection process of the Unified Policy rules.

up_action: Shows the action process of the Unified Policy rules.

up_log: Shows the logging process of the Unified Policy rules.

up_tls: Shows the TLS inspection process of the Unified Policy rules.

up_clob: Shows the CLOB (Content Limitation and Optimization Blade) inspection process of the Unified Policy rules.

up_rulebase: Shows the rulebase loading process of the Unified Policy rules.

up_connection: Shows the connection tracking process of the Unified Policy rules.

The flagtlsis not a valid flag for the Unified Policy module, as it is used for the TLS Inspection module5. Therefore, the correct answer is A. tls.The other options are valid flags for the Unified Policy module, as explained above34.Reference:

1: CCTE Courseware, Module 8: Advanced Access Control, Slide 7

2: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 5: Unified Policy, Page 29

3: CCTE Courseware, Module 8: Advanced Access Control, Slide 17

4: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 5: Unified Policy, Page 32

5: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 6: TLS Inspection, Page 36

Answer : C

Answer : C

The Application Database on a Check Point Security Gateway stores information about applications and categories used by the Application Control and URL Filtering blades. This database is maintained in specific files on the Gateway.

Option A: Incorrect. api_db.C and api_custom_db.C are not standard files related to the Application Database. These names may be confused with API-related configurations.

Option B: Incorrect. apcl_db.C and apd_custom_db.C are not recognized as Application Database files. These names do not align with Check Point's file naming conventions.

Option C: Correct. The Application Database is stored in application_db.C (the main database) and application_custom_db.C (custom application definitions). These files are located in the $FWDIR/conf directory on the Security Gateway.

Option D: Incorrect. appi_db.C and appi_custom_db.C are close but incorrect. The correct prefix is application_, not appi_.

The Check Point R81.20 Security Gateway Administration Guide describes the Application Control and URL Filtering blades, including the storage of application data in application_db.C and application_custom_db.C. The CCTE R81.20 course covers file structures and database management for troubleshooting Application Control issues.

For precise details, refer to:

Check Point R81.20 Security Gateway Administration Guide, section on ''Application Control and URL Filtering'' (available via Check Point Support Center).

CCTE R81.20 Courseware, which includes labs on Application Database management (available through authorized training partners).

Answer : C

The correct command to enter the PostgreSQL interactive shell ispsql_client cpm postgres. This command allows the administrator to view and manipulate the database of the Check Point Management (CPM) module, which stores the configuration and policy data. Thepsql_clientcommand is a Check Point wrapper for thepsqlcommand, which is the native PostgreSQL interactive shell. Thepsql_clientcommand takes two arguments: the first one is the name of the database module, and the second one is the name of the database user. In this case, the database module iscpmand the database user ispostgres.

The other commands are incorrect because:

A . mysql_client cpm postgres is not a valid command. Themysql_clientcommand is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL.

B . mysql -u root is not a valid command. Themysqlcommand is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL. Moreover, the-uoption specifies the MySQL user name, which is not relevant for Check Point.

D . psql_client postgres cpm is not a valid command. Thepsql_clientcommand takes the database module name as the first argument, and the database user name as the second argument. In this case, the database module name iscpmand the database user name ispostgres. The order of the arguments is reversed in this command.

How to use PostgreSQL interactive shell (psql) with Check Point database

Check Point Database Tool (GuiDBedit) - Check Point Software

(CCTE) - Check Point Software

Answer : A

The top command is a Linux command that displays information about resource utilization for running processes and shows additional information for core utilization and memory. The top command provides a dynamic real-time view of the system, showing the processes that are consuming the most CPU, memory, and other resources. The top command also shows the total number of processes, the system load average, the uptime, and the CPU usage by user, system, and idle. The top command can be customized by using various options and interactive commands to change the display, sort the processes, filter the output, and kill processes.

The other commands are incorrect because:

B . vmstat is a Linux command that displays information about the virtual memory, CPU, disk, and system activity. It does not show information about individual processes or core utilization.

C . cptop is a Check Point command that displays information about the firewall kernel activity, such as the number of connections, packets, drops, and rejects. It does not show information about other processes or memory usage.

D . mpstat is a Linux command that displays information about the CPU utilization by each processor or core. It does not show information about processes or memory usage.

top(1) - Linux manual page

vmstat(8) - Linux manual page

cptop - Check Point Software

mpstat(1) - Linux manual page

Answer : A

The correct answer is A. smartlogrestart and smartlogstart. These commands are used to restart the SmartLog service and start the SmartLog indexing process. They can be run on the Security Management Server or the Log Server to resolve issues with SmartLog not being active or failing to parse results from the server.The other commands are not valid or relevant for this purpose.Reference: Check Point Troubleshooting Expert (CCTE) R81.10 Course Data Sheet1, Check Point Troubleshooting Expert (CCTE) R81.10 Course Outline2, Check Point Troubleshooting Expert (CCTE) R81.10 Lab Manual3, sk175223 - SmartLog is not active or failed to parse results from server

Answer : D