156-115.80 Sample Questions & Answers

Audit Domain is not one of the three relational database domains that store Check Point management configuration data. The three actual domains are: User Domain (stores user-defined objects like network objects, services, and policies), System Domain (stores system-level configuration and built-in objects), and Global Domain (stores global settings that apply across the management environment). An Audit Domain does not exist in Check Point database architecture.

The .cap file extension should be used with fw monitor to create output files that can be imported and analyzed in Wireshark. Check Point fw monitor tool captures network traffic at the firewall level, and the .cap format is compatible with Wireshark packet analysis software. Extensions like .exe are executable files, .tgz are compressed archives, and .pcap is also a packet capture format but .cap is the standard extension used by fw monitor for Wireshark compatibility.

Usermode core files in Check Point systems are located in /var/log/dump/usermode directory. These core dump files are generated when usermode processes crash and are essential for troubleshooting application-level issues on Check Point gateways and management servers. The /var/suroot directory is for different system files, while and prefixed paths are not the correct locations for usermode core dumps.

A Check Point gateway with Performance Pack (SecureXL) automatically reviews and redistributes interface affinity between cores every 60 seconds by default. This automatic load balancing helps optimize network traffic processing across multiple CPU cores for maximum performance. Interface affinity is not static and can be dynamically adjusted based on traffic patterns and core utilization, rather than being fixed at gateway build time. Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_PerformanceTuning_WebAdmin/6731.htm

ClusterXL High Availability is supported in Check Point IPv6 implementation, allowing IPv6-enabled gateways to operate in cluster configurations for redundancy and load sharing. Check Point IPv6 support includes basic firewall functionality, routing, and high availability clustering. However, features like Security Servers (application layer proxies), QoS (Quality of Service), and SAM (Suspicious Activity Monitoring) have limited or no IPv6 support in Check Point R80. Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk39374

The fw ctl affinity -a -l -v command is used to set static affinity and balance interfaces between SND (SecureXL Network Distributer) cores when Performance Pack is disabled. The -a flag applies the affinity settings, -l shows the current configuration, and -v provides verbose output. This manual affinity distribution ensures optimal load balancing across CPU cores for network interface processing. Other commands like cpmq set and sim affinity are not valid for interface affinity configuration.