CheckPoint 156-836 CCME Exam Questions Instant Access

Question 1

Layer 4 distribution is enabled by default in Maestro. Which is not a scenario when you would want to leave this enabled?

AWhen there is a large number of source ports in use by protocols such as HTTP, HTTPS, and DNS.

BWhen dynamic routing protocols, such as BGP or OSPF are used.

CWhen there is a heavy imbalance of traffic between the SGMs that are members of the same SG.

DWhen the SG is NATing a very high percentage of traffic passing through it.

Answer : B

Question 2

Is it possible to define distribution mode per interface?

AYes, only for downlink interfaces

BNo, only for the Security Group

CYes, only for uplink interfaces

DYes, for both uplink and downlink interfaces

Answer : D

Question 3

What is the maximum number of Appliances within Security group in Dual-Site configuration?

A28

B31

C15

D16

Answer : A

Question 4

What is the default Distribution mode?

AAuto-topology

BUser

CManual-General

DNetwork

Answer : A

Question 5

When a VPN tunnel is formed with a Maestro SGM,

AThe receiving SGM makes an encryption decision. The SGM then syncs the traffic to two backup SGMs: one for clear traffic and one for encrypted traffic.

BSGM 1 analyzes the policy and topology. If encryption is required, it calculates the tunnel owner's IP address. SGM 1 sends a clear packet to the tunnel owner. SGM 2 is now the connection and tunnel owner.

CThe MHO handles the IKE before distributing the traffic to a SGM to handle all encrypted traffic. This helps to prevent any issues with the correction layer.

DThe MHO distributes copies of the packets to two different SGMs because SGM 1 will handle the clear traffic IKE exchange packets, while SGM2 handles encrypted packets.

Answer : B

Question 6

Splitter cannot be used _______

ATo connect single port on orchestrator to the same Appliance

BTo connect single port on orchestrator to multiple port on external switch

CTo connect single port on Appliance to multiple ports on the orchestrator

DTo connect single port on orchestrator to multiple Appliances

Answer : A

Question 7

Possibilities for a failure in a single SGM of a Security Group include.

AA change was made with clish instead of gClish, causing the SGM to handle traffic differently than the other SGMs.

BSecureXL is not enabled on the SGM.

CAn administrator imported a hotfix into the CPUSE repository of a single SGM.

DThere are too many active SGMs in the SG.

Answer : C

CheckPoint Check Point Certified Maestro Expert - R81.X 156-836 CCME Exam Questions