156-585 Sample Questions & Answers

To collect comprehensive diagnostic data from a Security Gateway, including configuration, process status, log files, and OS information, for submission to Check Point Support, which command should be executed in Expert mode?

Case Study:

A retail company uses an R81 cluster with the Identity Awareness blade enabled, using AD Query as the identity source. Recently, the IT department deployed a new fleet of Point-of-Sale (POS) terminals that run a custom Linux OS. The security team created an Access Role for these terminals based on their static IP addresses. However, store managers, who use Windows laptops and are part of the 'Store_Managers' AD group, report that they can no longer access the inventory server, which they could access before the POS deployment.

Troubleshooting shows that the managers' traffic is being dropped by a rule that denies access from the POS terminals' Access Role to the inventory server. Logs indicate that when a manager logs in, their IP address is incorrectly being associated with the POS Access Role instead of their AD-based user identity. The POS terminals are on the same subnet as the managers' laptops.

What is the most likely reason for this identity misidentification?

You are debugging a slow database issue on a Security Management Server. You suspect the solr process, which handles log indexing, is consuming excessive resources. Which command would you use to safely restart ONLY the solr process without impacting other critical management services like cpm?

An administrator is troubleshooting an issue where traffic that should be accelerated by SecureXL is being processed by the Firewall (FW) path instead, causing high CPU. They check fwaccel stats -s and see that 'Accelerated conns' is very low. They suspect a specific NAT rule is causing traffic to be de-accelerated. Which of the following NAT configurations are known to prevent SecureXL acceleration? (Select TWO).

A kernel debug is being performed on a production gateway to trace a complex packet flow issue. The administrator needs to ensure the debug buffer is large enough to capture all relevant data without wrapping too quickly, but also wants to avoid consuming excessive kernel memory. What is the command to set the kernel debug buffer to 16384 KB?

Case Study:

A large enterprise has a multi-site deployment with a central R81 Security Management Server and numerous remote gateways. An administrator pushes a large policy package to all gateways. Most installations succeed, but one specific remote cluster reports 'Installation failed. Reason: Verification failed.' The administrator reviews the fwm.elg log file on the Management Server and finds messages indicating a 'syntax error' related to a newly added network object, but the object's configuration appears correct in SmartConsole.

The administrator suspects a database inconsistency between what is shown in the GUI and what is stored in the PostgreSQL database. They decide to use the api status command on the management server, and the output shows that the 'API server' process is running, but the 'FWM' process is in a 'starting' state and repeatedly restarting. This confirms a problem with the management database preventing the FWM process from initializing correctly.

What is the most appropriate next step to resolve this issue?

When using fw monitor to inspect traffic, the output shows a packet being dropped with the reason chain_fn_0: drop, rule 23. What does this message indicate?

True or False: The cphaprob stat command provides detailed statistics about the state of all configured cluster members, including their roles (e.g., Active, Standby), synchronization status, and the state of monitored pnotes (problem notifications).

You need to debug an issue related to the Check Point daemon (cpd) on a Security Gateway, but you only want to see debug messages specifically related to SIC (Secure Internal Communication). Which command would accomplish this?

A hospital's R81 gateway is dropping HTTPS traffic to a critical patient records system. A kernel debug using fw ctl debug -m fw + conn drop was performed. The administrator needs to analyze the output file, kdebug.out, to find entries related to a specific source IP address, 10.100.50.15. Which grep command is the most efficient for finding all debug entries containing this IP address?