CheckPoint Check Point Certified Troubleshooting Expert - R81.20 156-587 Exam Questions

Answer : A

In Check Point Gaia, you can enable core dumping through the command line interface (clish) using the following command:

set core-dump enable

This command activates the core dump mechanism, allowing the system to generate core dump files when user processes crash. Remember to save the configuration after enabling core dumps with the command:

save config

Why other options are incorrect:

B . set core-dump total: This command is used to set the total disk space limit for core dump files, not to enable core dumping itself.

C . set user-dump enable: There is no such command in Gaia clish for enabling core dumps.

D . set core-dump per_process: This command sets the maximum number of core dump files allowed per process, but it doesn't enable core dumping.

Check Point Troubleshooting Reference:

Check Point R81.20 Security Administration Guide: This guide provides comprehensive information about Gaia clish commands, including those related to system configuration and troubleshooting.

Check Point sk92764: This knowledge base article specifically addresses core dump management in Gaia, explaining how to enable and configure core dumps.

Enabling core dumps is a crucial step in troubleshooting process crashes as it provides valuable information for analysis and debugging.

Answer : A

The PDP process is the Identity server, which is a component of the Identity Awareness blade on the Security Gateway. The PDP process is responsible for collecting and managing identity information from various sources, such as Active Directory, Identity Agents, Captive Portal, Terminal Servers, and RADIUS.The PDP process also communicates with the PEP process, which is the Policy Enforcement Point, to enforce identity-based policies on the traffic passing through the Security Gateway1.The other options, such as Log Sifter, Captive Portal Service, and UserAuth Database, are either not related to Identity Awareness or not processes, but rather files or services.Reference:1: sk93046: Identity Awareness - How to Configure

Answer : B

Answer : C

Answer : B

The main components of Check Point's Security Management architecture are1:

Management server: This is the central component that manages the security policy, configuration, and licenses for the Security Gateways and other Check Point devices. It also provides the SmartConsole interface for the administrators to manage the security environment.

Management database: This is the database that stores the security policy, configuration, and objects for the Security Management Server. It also stores the logs and events from the Security Gateways and other Check Point devices.

Log server: This is the component that receives and stores the logs and events from the Security Gateways and other Check Point devices. It also provides the SmartLog and SmartEvent interfaces for the administrators to view, analyze, and manage the logs and events.

Automation server: This is the component that provides the REST API and the CLI for the administrators to automate and script the security management tasks.

1: (CCTE) - Check Point Software

Answer : A

Answer : C

= The RFL process is the Remote File Log process that is responsible for transferring logs from the Security Gateway to the Security Management Server1.If the RFL process is with status T, it means that it is terminated and not running2. This could explain why the logs are not seen in the SMS.To resolve this issue, one possible command to run issmartlog_server stopandsmartlog_server restart3. This command will stop and restart the SmartLog server, which is the process that indexes and displays the logs in the SmartConsole. By restarting the SmartLog server, it may also restart the RFL process and resume the log transfer. Alternatively, one can also try to restart the RFL process directly by runningcpwd_admin stop -name RFLandcpwd_admin start -name RFL.Reference:Check Point Processes and Daemons,sk97638 - Check Point Processes and Daemons,sk144192 - How to restart SmartLog server, [sk98348 - SmartLog / SmartView server functionality], [sk97638 - Check Point Processes and Daemons]