CheckPoint Check Point Certified Troubleshooting Expert - R81.20 156-587 Exam Questions

Answer : A

When a user space process crashes unexpectedly, the operating system often creates a core dump file. This file is a snapshot of the process's memory at the time of the crash, including information such as:

Program counter: This indicates where the program was executing when it crashed.

Stack pointer: This shows the function call stack, which can help trace the sequence of events leading to the crash.

Memory contents: This includes the values of variables and data structures used by the process.

Register values: This shows the state of the processor registers at the time of the crash.

Core dump files can be analyzed using debuggers like GDB to understand the cause of the crash.

Why other options are incorrect:

B . kernel_memory_dump dbg: This refers to a kernel memory dump, which is generated when the operating system kernel itself crashes.

C . core analyzer: This is a tool used to analyze core dump files, not the file itself.

D . coredebug: This is not a standard term for any type of crash dump file.

Check Point Troubleshooting Reference:

Check Point's documentation mentions core dumps in the context of troubleshooting various processes, such as fwd (firewall) and cpd (Check Point daemon). You can find information on enabling core dumps and analyzing them in the Check Point administration guides and knowledge base articles.

Answer : D

The correct command to check the subscription status on the CLI of the gateway isshow license status. This command displays the current license information, such as the license type, expiration date, and subscription status for various blades, such as Anti-Bot, Anti-Virus, IPS, etc. The command also shows the contract status for each blade, such as valid, expired, or invalid. If John has renewed his NPTX license, but he gets an error that the contract for Anti-Bot expired, he can use this command to verify the contract status and the subscription status for the Anti-Bot blade.

The other commands are incorrect because:

A . fwm lie print is not a valid command. The correct command isfwm lic print, which displays the license information on the Security Management Server, not on the gateway. This command does not show the subscription status or the contract status for the blades.

B . fw monitor license status is not a valid command. The correct command isfw monitor, which is a tool for capturing network traffic on the gateway, not for checking the license status.

C . cpstat antimalware-f subscription status is not a valid command. The correct command iscpstat antimalware -f subscription_status, which displays the subscription status for the Anti-Virus blade, not for the Anti-Bot blade. This command does not show the contract status for the blade.

How to check the contract status and expiration date of the Check Point products

How to check the subscription status of the blades on the Security Gateway

sk163417 - Check Point Software

Answer : A

The cpwd_admin list command is used to display the status of processes monitored by the Check Point WatchDog Daemon (CPWD). The CPM (Check Point Management) process is a core process on the Security Management Server, responsible for management operations. However, on a Security Gateway, the CPM process is not typically present, as it is specific to management functions.

Option A: Correct. The output of cpwd_admin list differs between a Security Gateway and a Security Management Server. On a Security Gateway, processes like FWD, VPND, and PEP are monitored, but CPM is not present because it runs on the Management Server. Thus, CPM will not appear in the cpwd_admin list output on a Gateway.

Option B: Incorrect. While it's true that CPM is not running on the Security Gateway, the reason it's not listed is not because it ''can't be monitored'' by CPWD. On a Management Server, CPM is indeed monitored by CPWD, but this question pertains to a Gateway.

Option C: Incorrect. CPM is automatically monitored by CPWD on systems where it runs (e.g., Management Server). There is no need to manually add it to WatchDog's monitoring list.

Option D: Incorrect. CPM does not have its own separate monitoring system. On a Management Server, CPM is monitored by CPWD like other critical processes. The statement about ''only lower processes'' being monitored is inaccurate.

Reference: The Check Point R81.20 Gaia Administration Guide explains the role of CPWD and the processes it monitors on different Check Point systems (Gateway vs. Management Server). The CCTE R81.20 course (as per and) emphasizes understanding the differences in process monitoring between Gateways and Management Servers, including the use of cpwd_admin commands for troubleshooting.https://edu.arrow.com/uk/training/course-detail/90175/Check-Point-Certified-Troubleshooting-Expert-%28CCTE%29-R81.20-%28includes-180-days%27-lab-access%29/False

Reference: The Check Point R81.20 Gaia Administration Guide explains the role of CPWD and the processes it monitors on different Check Point systems (Gateway vs. Management Server). The CCTE R81.20 course (as per and) emphasizes understanding the differences in process monitoring between Gateways and Management Servers, including the use of cpwd_admin commands for troubleshooting.https://edu.arrow.com/uk/training/course-detail/90175/Check-Point-Certified-Troubleshooting-Expert-%28CCTE%29-R81.20-%28includes-180-days%27-lab-access%29/False

https://www.koenig-solutions.com/ccte-r81-20-language-course

For precise details, refer to:

Check Point R81.20 Gaia Administration Guide, section on ''CPWD and Process Monitoring'' (available via Check Point Support Center).

CCTE R81.20 Courseware, which covers advanced troubleshooting of Security Gateway and Management Server processes (available through authorized training partners).

Answer : C

The Application Database on a Check Point Security Gateway stores information about applications and categories used by the Application Control and URL Filtering blades. This database is maintained in specific files on the Gateway.

Option A: Incorrect. api_db.C and api_custom_db.C are not standard files related to the Application Database. These names may be confused with API-related configurations.

Option B: Incorrect. apcl_db.C and apd_custom_db.C are not recognized as Application Database files. These names do not align with Check Point's file naming conventions.

Option C: Correct. The Application Database is stored in application_db.C (the main database) and application_custom_db.C (custom application definitions). These files are located in the $FWDIR/conf directory on the Security Gateway.

Option D: Incorrect. appi_db.C and appi_custom_db.C are close but incorrect. The correct prefix is application_, not appi_.

The Check Point R81.20 Security Gateway Administration Guide describes the Application Control and URL Filtering blades, including the storage of application data in application_db.C and application_custom_db.C. The CCTE R81.20 course covers file structures and database management for troubleshooting Application Control issues.

For precise details, refer to:

Check Point R81.20 Security Gateway Administration Guide, section on ''Application Control and URL Filtering'' (available via Check Point Support Center).

CCTE R81.20 Courseware, which includes labs on Application Database management (available through authorized training partners).

Answer : B

The WSTLSD daemon is responsible for handling HTTPS Inspection related issues on the Security Gateway.It performs SSL/TLS termination and re-encryption, certificate validation and generation, and URL categorization for HTTPS traffic1.The WSTLSD daemon can be debugged using the commandwstlsd debug on TDERROR_ALL_ALL=52.The debug file is located in $FWDIR/log/wstlsd.elg2.The other daemons, such as FWD, HTTPD, and VPND, are not directly related to HTTPS Inspection, but rather to policy installation, web server, and VPN, respectively.Reference:1: sk65144: HTTPS Inspection Architecture2: sk83520: How to debug the WSTLSD daemon

Answer : D

Answer : C

A core dump file is essentially a snapshot of the process's memory at the time of the crash. This snapshot includes crucial information that can help diagnose the cause of the crash. Here's why all the options are relevant:

i. Program Counter: This register stores the address of the next instruction the CPU was supposed to execute. It pinpoints exactly where in the code the crash occurred.

ii. Stack Pointer: This register points to the top of the call stack, which shows the sequence of function calls that led to the crash. This helps trace the program's execution flow before the crash.

iii. Memory management information: This includes details about the process's memory allocations, which can reveal issues like memory leaks or invalid memory access attempts.

iv. Other Processor and OS flags/information: This encompasses various registers and system information that provide context about the state of the processor and operating system at the time of the crash.

By analyzing this information within the core dump, you can often identify the root cause of the crash, such as a segmentation fault, null pointer dereference, or stack overflow.

Check Point Troubleshooting Reference:

While core dumps are a general concept in operating systems, Check Point's documentation touches upon them in the context of troubleshooting specific processes like fwd (firewall) or cpd (Check Point daemon). The fw ctl zdebug command, for example, can be used to trigger a core dump of the fwd process for debugging purposes.