CheckPoint 156-586 practice test

Check Point Certified Troubleshooting Expert

Last exam update: Dec 15 ,2025
Page 1 out of 5. Viewing questions 1-15 out of 75

Question 1

Which of these packet processing components stores Rule Base matching state-related information?

  • A. Observers
  • B. Classifiers
  • C. Manager
  • D. Handlers
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 2

That is the proper command for allowing the system to create core files?

  • A. $FWDIR/scripts/core-dump-enable.sh
  • B. # set core-dump enable # save config
  • C. > set core-dump enable > save config
  • D. service core-dump start
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

What is correct about the Resource Advisor (RAD) service on the Security Gateways?

  • A. RAD functions completely in user space. The Pattern Matter (PM) module of the CMI looks up for URLs in the cache and if not found, contact the RAD process in user space to do online categorization
  • B. RAD is completely loaded as a kernel module that looks up URL in cache and if not found connects online for categorization. There is no user space involvement in this process
  • C. RAD is not a separate module, it is an integrated function of the W kernel module and does all operations in the kernel space
  • D. RAD has a kernel module that looks up the kernel cache, notifies client about hits and misses and forwards a-sync requests to RAD user space module which is responsible for online categorization
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

Which of the following is contained in the System Domain of the Postgres database?

  • A. Trusted GUI clients
  • B. Configuration data of log servers
  • C. Saved queries for applications
  • D. User modified configurations such as network objects
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

Where will the usermode core files located?

  • A. /var/log/dump/usermode
  • B. $CPDIR/var/log/dump/usermode
  • C. $FWDIR/var/log/dump/usermode
  • D. /var/suroot
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 6

The Check Point Watch Daemon (CPWD) monitors critical Check Point processes, terminating them
or restarting them as needed to maintain consistent, stable operating conditions. When checking the
status/output of CPWD you are able to see some columns like APP, PID, STAT, START, etc. What is the
column "STAT" used for?

  • A. Shows the Watch Dog name of the monitored process
  • B. Shows the status of the monitored process
  • C. Shows how many times the Watch Dog started the monitored process
  • D. Shows what monitoring method Watch Dog is using to track the process
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 7

What does CMI stand for in relation to the Access Control Policy?

  • A. Content Management Interface
  • B. Content Matching Infrastructure
  • C. Context Manipulation Interface
  • D. Context Management Infrastructure
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

When viewing data for CPMI objects in the Postgres database, what table column should be selected
to query for the object instance?

  • A. CpmiHostCkp
  • B. fwset
  • C. CPM Global M
  • D. GuiDBedit
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

An administrator receives reports about issues with log indexing and text searching regarding an
existing Management Server. In trying to find a solution she wants to check if the process responsible
for this feature is running correctly. What is true about the related process?

  • A. cpd needs to be restarted manual to show in the list
  • B. fwm manaqes this database after initialization of the 1CA
  • C. solr is a child process of cpm
  • D. fwssd crashes can affect therefore not show in the list
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

What is the best way to resolve an issue caused by a frozen process?

  • A. Kill the process
  • B. Restart the process
  • C. Reboot the machine
  • D. Power off the machine
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 11

What is the Security Gateway directory where an administrator can find vpn debug log files
generated during Site-to-Site VPN troubleshooting?

  • A. /opt/CPsuiteR80/vpn/log/
  • B. $FWDIR/conf/
  • C. $FWDIR/log/
  • D. $CPDIR/conf/
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 12

In Mobile Access VPN, clientless access is done using a web browser. The primary communication
path for these browser based connections is a process that allows numerous processes to utilize port
443 and redirects traffic to a designated port of the respective process. Which daemon handles this?

  • A. Mobile Access Daemon (MAD)
  • B. Connectra VPN Daemon (cvpnd)
  • C. HTTPS Inspection Daemon (HID)
  • D. Multi-portal Daemon
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

SmartEvent utilizes the Log Server, Correlation Unit and SmartEvent Server to aggregate logs and
identify security events. The three main processes that govern these SmartEvent components are:

  • A. cpcu, cplog, cpse
  • B. eventiasv, eventiarp,eventiacu
  • C. cpsemd, cpsead, and DBSync
  • D. fwd, secu, sesrv
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

During firewall kernel debug with fw ctl zdebug you received less information that expected. You
noticed that a lot of messages were lost since the time the debug was started. What should you do to
resolve this issue?

  • A. Increase debug buffer; Use fw ctl debug -buf 32768
  • B. Redirect debug output to file; Use fw ctl debug -o ./debug.elg
  • C. Redirect debug output to file; Use fw ctl zdebug -o ./debug.elg
  • D. Increase debug buffer; Use fw ctl zdebug -buf 32768
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

Check Point Access Control Daemons contains several daemons for Software Blades and features.
Which Daemon is used for Application & Control URL Filtering?

  • A. cprac
  • B. rad
  • C. pepd
  • D. pdpd
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2