Important CheckPoint 156-587 Exam Questions

Answer: A

Explanation:

The cpwd_admin list command is used to display the status of processes monitored by the Check Point WatchDog Daemon (CPWD). The CPM (Check Point Management) process is a core process on the Security Management Server, responsible for management operations. However, on a Security Gateway, the CPM process is not typically present, as it is specific to management functions.

Option A: Correct. The output of cpwd_admin list differs between a Security Gateway and a Security Management Server. On a Security Gateway, processes like FWD, VPND, and PEP are monitored, but CPM is not present because it runs on the Management Server. Thus, CPM will not appear in the cpwd_admin list output on a Gateway.

Option B: Incorrect. While it's true that CPM is not running on the Security Gateway, the reason it's not listed is not because it ''can't be monitored'' by CPWD. On a Management Server, CPM is indeed monitored by CPWD, but this question pertains to a Gateway.

Option C: Incorrect. CPM is automatically monitored by CPWD on systems where it runs (e.g., Management Server). There is no need to manually add it to WatchDog's monitoring list.

Option D: Incorrect. CPM does not have its own separate monitoring system. On a Management Server, CPM is monitored by CPWD like other critical processes. The statement about ''only lower processes'' being monitored is inaccurate.

Reference: The Check Point R81.20 Gaia Administration Guide explains the role of CPWD and the processes it monitors on different Check Point systems (Gateway vs. Management Server). The CCTE R81.20 course (as per and) emphasizes understanding the differences in process monitoring between Gateways and Management Servers, including the use of cpwd_admin commands for troubleshooting.https://edu.arrow.com/uk/training/course-detail/90175/Check-Point-Certified-Troubleshooting-Expert-%28CCTE%29-R81.20-%28includes-180-days%27-lab-access%29/False

Reference: The Check Point R81.20 Gaia Administration Guide explains the role of CPWD and the processes it monitors on different Check Point systems (Gateway vs. Management Server). The CCTE R81.20 course (as per and) emphasizes understanding the differences in process monitoring between Gateways and Management Servers, including the use of cpwd_admin commands for troubleshooting.https://edu.arrow.com/uk/training/course-detail/90175/Check-Point-Certified-Troubleshooting-Expert-%28CCTE%29-R81.20-%28includes-180-days%27-lab-access%29/False

https://www.koenig-solutions.com/ccte-r81-20-language-course

For precise details, refer to:

Check Point R81.20 Gaia Administration Guide, section on ''CPWD and Process Monitoring'' (available via Check Point Support Center).

CCTE R81.20 Courseware, which covers advanced troubleshooting of Security Gateway and Management Server processes (available through authorized training partners).

Answer: B

Explanation:

If you have modified kernel parameters (in fwkern.conf, for example) and the gateway starts dropping traffic or behaving abnormally after a reboot, the best practice is to restore the original or a known-good configuration from backup. Then, reboot again so that the gateway loads the last known stable settings.

Option A (fw ctl set int fw1_kernel_all_disable=1) is not a standard or documented method for ''undoing'' all kernel tweaks.

Option B (Restore fwkem.conf from backup and reboot the gateway) is the correct and straightforward approach.

Option C (fw unloadlocal) removes the local policy but does not revert custom kernel parameters that have already been loaded at boot.

Option D (Remove all kernel parameters from fwkem.conf and reboot) might help in some cases, but you risk losing other beneficial or necessary parameters if there were legitimate custom settings. Restoring from a known-good backup is safer and more precise.

Hence, the best answer: ''Restore fwkem.conf from backup and reboot the gateway.''

Check Point Troubleshooting Reference

sk98339 -- Working with fwkern.conf (kernel parameters) in Gaia OS.

sk92739 -- Advanced System Tuning in Gaia OS.

Check Point Gaia Administration Guide -- Section on kernel parameters and system tuning.

Check Point CLI Reference Guide -- Explanation of using fw ctl, fw unloadlocal, and relevant troubleshooting commands.

Answer: C

Explanation:

The error message ''SmartLog is not active or Failed to parse results from server'' indicates that there is a problem with the SmartLog server process, which is responsible for indexing and querying the logs. One possible cause of this problem is a corrupted log file or a mismatched IP address in the logging configuration files. Another possible cause is a communication failure between the SmartLog server and the CPM process or the SmartConsole client. To resolve this issue, the first thing to try is to restart the SmartLog server process by running the commandsmartlog_server restarton the Security Management Server or the Log Server. This command will stop the SmartLog server, clean the buffer, and start it again. This may fix the corrupted log file or the communication issue. If the problem persists, other steps may be needed, such as checking the network connectivity, the firewall rules, the logging configuration files, the CPM process, or the SmartConsole client.

1: ''SmartLog is not active or unreachable'' warning when trying to connect with SmartLog GUI to SmartLog Server

2: ''SmartLog is not active'' errors

3: Solved: Activate SmartLog in R80.10

4: Troubleshooting Check Point logging issues when Security Management Server / Log Server is not receiving logs from Security Gateway

Troubleshooting Expert R81.1 (CCTE) Course Outline) - Module 9: Logging and Status Troubleshooting.

Answer: B

Answer: D

Explanation:

The Global Domain is one of the relational database domains in the Postgres database that stores the management configuration. The purpose of the Global Domain is to serve as the global database for Multi-Domain Security Management (MDSM) and contain the global objects and policies that are shared across all domains. The Global Domain also stores the global settings, such as the administrator roles, the LDAP servers, the IPS profiles, and the SmartEvent views. The Global Domain can be managed by the Global Domain Administrator or the Super User Administrator using the SmartConsole. The Global Domain can be backed up and restored using the mds_backup and mds_restore commands.

1: Architecture and Processes - Check Point Software

2: Multi-Domain Security Management R81.10 Administration Guide

3: How to backup and restore Multi-Domain Security Management Server