156-115.80 Check Point Certified Security Master - R80 Practice Questions
Prepare for 156-115.80 with more than an answer.
- 1
Which command would you use to check CoreXL instances for IPv6 traffic?
Show answer details
Correct answer: C
The fw ctl multik stat command is used to check CoreXL instances for both IPv4 and IPv6 traffic processing. CoreXL distributes traffic processing across multiple CPU cores, and this command shows statistics for each worker instance including IPv6 packet processing. Commands like fwaccel6 do not exist in Check Point, and fw6ctl is not a valid command syntax. The multik stat command provides comprehensive statistics for all CoreXL worker instances regardless of IP version.
- 2
What must be done for the “fw monitor” command to capture packets through the firewall kernel?
Show answer details
Correct answer: C
The firewall policy must be re-installed for the fw monitor command to capture packets through the firewall kernel effectively. Policy installation ensures that the kernel inspection points are properly configured to allow fw monitor to intercept and capture traffic at the correct stages of packet processing. SecureXL and ClusterXL do not need to be disabled, and transferring output files to Wireshark is a post-capture activity, not a prerequisite. Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk30583
- 3
Consider a Check Point Security Gateway under high load. What mechanism can be used to confirm that important traffic such as control connections are not dropped?
Show answer details
Correct answer: B
The fw ctl multik prioq command is used to check the priority queue mechanism that ensures important traffic such as control connections are not dropped during high load conditions. This command shows statistics for the priority queuing system within CoreXL that gives precedence to critical traffic like management connections, cluster communications, and routing protocols. Debug flags like fgd50 and OPSEC_DEBUG are for different troubleshooting purposes, while fgate commands are for other gateway functions.
- 4
Tom has been tasked to install Check Point R80 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?
Show answer details
Correct answer: C
A distributed Check Point R80 deployment requires two machines: one for the Security Management Server and one for the Security Gateway. The Security Management Server handles policy management, logging, and monitoring through SmartConsole, while the Security Gateway enforces the security policies and processes network traffic. One machine would be a standalone deployment, three machines would be overkill for basic distributed architecture, and SecurePlatform compatibility is not the determining factor for machine count.
- 5
In order to test ClusterXL failovers which command would you use on one of the ClusterXL nodes to initiate a failover?
Show answer details
Correct answer: A
The clusterXL_admin down -p command is used to simulate a problem state and trigger a failover in ClusterXL environments for testing purposes. This command forces the current cluster member to report a problem state, causing other cluster members to take over its responsibilities. The up command would bring a member back online, while cphaprob commands are used for monitoring cluster status rather than initiating failovers. Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_ClusterXL_AdminGuide/7298.htm#o97358
- 6
Which of the following is NOT a valid “fwaccel” parameter?
Show answer details
Correct answer: D
The packets parameter is not a valid fwaccel command option in Check Point SecureXL acceleration framework. Valid fwaccel parameters include stat (shows acceleration statistics), stats (detailed statistics), and templates (shows acceleration templates). The fwaccel command is used to monitor and configure SecureXL hardware acceleration features on Check Point gateways. Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk41397
