Free Oct-2023 156-581 Certification Sample Questions certification Exam
Certification Topics of 156-581 Exam PDF Recently Updated Questions
NEW QUESTION # 11
How many captures does the command "fw monitor -p all" take?
- A. All 4 points of the fw VM modules
- B. The -p option takes the same number of captures, but gathers all of the data packet
- C. 1 from every inbound and outbound module of the chain
- D. All 15 of the inbound and outbound modules
Answer: B
NEW QUESTION # 12
What is the most efficient way to view large fw monitor captures and run filters on the file?
- A. CLISH
- B. snoop
- C. CLI
- D. wireshark
Answer: D
NEW QUESTION # 13
How would you check the connection status of a gateway to the Log server?
- A. run netstat -anp I grep :257 in CLISH on Log server
- B. run netstat -anp I grep :18187 in CLISH on Log server
- C. run netstat -anp I grep :18187 in expert mode on Log server
- D. run netstat -anp I grep :257 in expert mode on Log server
Answer: D
NEW QUESTION # 14
Which of the following is the most significant impact of not having a valid Policy Management license installed on a management server?
- A. Inability to make rule changes
- B. Inability to install policies
- C. Inability to log in to SmartConsole
- D. Inability to review logs
Answer: C
NEW QUESTION # 15
What is true concerning fw monitor?
- A. fwmonitor is available on all platforms and even the syntax is the same on all gateways
- B. tcpdump syntax can be used in fw monitor for deeper analysis
- C. fwmonitor has been obsoleted by tcpdump with R80.10
- D. fw monrtor is available on all management server platforms and the syntax is the same everywhere
Answer: D
NEW QUESTION # 16
What process(es) should be checked if there is high I/O and you suspect it may be related to the Antivirus Software Blade?
- A. dlpu and rad processes
- B. cpta
- C. cpm and fwm
- D. avsp
Answer: A
NEW QUESTION # 17
If you run the command "fw monitor -e "accept src.10.1.1.101 or src=172.21.201.10 or src=192.0.2.11 from the Cli.sh.
What will be captured?
- A. Packets from 10 1.1.201 going to 192.0.2.10
- B. Packets destined to 172.21.101.10 from 10.1.1.101
- C. fw monitor only works in expert mode so no packets will be captured
- D. Only packet going to 192.0.2.10
Answer: C
NEW QUESTION # 18
Is it possible to analyze ICMP packets with tcpdump?
- A. No, use fw monitor instead
- B. No, tcpdump works from layer 4. ICMP is located in the network layer (layer 3), therefore is not applicable to this scenario
- C. Yes, tcpdump is not limited to tcp specific issues
- D. No, since ICMP does not have any source or destination ports, but specification of port numbers is mandatory
Answer: D
NEW QUESTION # 19
During the policy installation process, compiled policies are located in three different directories, which directory contains the last policy which was compiled successfully on the management side?
- A. $FWDIR/state/<gateway_name>/FW1
- B. $FWDIR/log/fwd.elg
- C. $FWDIR/state/local/FW1
- D. $FWDIR/state_tmp/FW1
Answer: A
NEW QUESTION # 20
Which of these would be the best way to alter the chain insertion point of fw monitor"?
- A. Changing its settings in dbedit or Guldbedit
- B. Setting the "monitor" parameter with "fw ctl chain"
- C. Altering the "monitor" value in kernel parameters
- D. Using the "-p" parameter in the command line
Answer: D
NEW QUESTION # 21
Which of the following is NOT a way to insert fw monitor into the chain when troubleshooting packets throughout the chain?
- A. Relative position using location
- B. Relative position using id
- C. Absolution position
- D. Relative position using alias
Answer: A
NEW QUESTION # 22
Jerry is firewall administrator in BRAVO Company. He gets a call from the R&D department Manager who says that some employees from R&D could not access new development server (192.168.60.100), which is in server network behind the Data Center Firewall. Jerry looks at FW logs and found no log records for that server. What should he do next?
- A. He must check if the packets are being dropped at the firewall by using command fw ctl zdebug + drop grep 192.168.60.100
- B. He must check if the packets are being dropped at the firewall by using command tcpdump -i interface host 192.168.60.100
- C. He must check if the packets are being dropped at the firewall by using command cppcap -f "arp and host 192.168.80.10" -DNT -o /var/log/capture.pcap
- D. He must check if the packets are being dropped at the firewall by using command fw ctl zdebug + drop dst=192.168 60.100
Answer: A
NEW QUESTION # 23
The default time out for policy installation is
- A. 150 seconds
- B. 90 seconds
- C. 300 seconds
- D. 600 seconds
Answer: C
NEW QUESTION # 24
Where do Protocol parsers register themselves for IPS?
- A. Protections database
- B. Other handlers register to Protocol parser
- C. Context Management Infrastructure
- D. Passive Streaming Library
Answer: B
NEW QUESTION # 25
Which Threat Prevention daemon is the core Threat Emulation engine and responsible for emulation files and communications with Threat Cloud?
- A. ted
- B. scrub
- C. ctasd
- D. in.msd
Answer: A
NEW QUESTION # 26
The Identity Awareness process that receives identity data from the identity sources and organizes it in tables before forwarding the data to the enforcement module is called
- A. iaforward
- B. pep
- C. pdp
- D. iasend
Answer: C
NEW QUESTION # 27
After manipulating the rulebase and objects with SmartConsole the application crashes and closes immediately. To troubleshoot you will need to review the crash report. In which directory on the host PC will you find this report?
- A. <SmartFirewall Directory>\data\crash_report\
- B. <FW1 Directory>\data\crash_report
- C. <SmartConsole Directory>\Crash_report\data\
- D. <SmartConsole Directory>\data\Crash_report\
Answer: D
NEW QUESTION # 28
......
2023 New Preparation Guide of CheckPoint 156-581 Exam: https://braindumps.exam4docs.com/156-581-study-questions.html
