EMT Practice Test

1. Question Content...

---

Question1: Which of the following inputs is suitable for debugging HTTPS inspection issues?

Question2: Where do you enable log indexing on the SMS?

Question3: When debugging is enabled on firewall kernel module using the fw ctl debug' command with required options, many debug messages are provided by the kernel that help the administrator to identify Issues. Which of the following is true about these debug messages generated by the kernel module?

Question4: You were asked by security team to debug Mobile Access VPN. What processes will you debug?

Question5: What Check Point process controls logging?

Question6: VPN issues may result from misconfiguration communication failure, or incompatible default configurations between peers. Which basic command syntax needs to be used for troubleshooting Site-toSite VPN Issues?

Question7: You are using the identity Collector with identity Awareness in large environment. Users report that they cannot access resources on Internet You identify that the traffic is matching the cleanup rule Instead of the proper rule with Access Roles using the IDC How can you check if IDC is working?

Question8: John has renewed his NPTX License but he gets an error (contract for Anti-Bot expired). He wants to check the subscription status on the CLI of the gateway, what command can he use for this?

Question9: Your users have some issues connecting with Mobile Access VPN to your gateway. How can you debug the tunnel establishment?

Question10: You run cpwd_admin list on a Security Gateway and notice that the CPM process is not listed. Select the best answer.

Question11: In Check Point's Packet Processing Infrastructure what is the role of Observers?

Question12: An administrator receives reports about issues with log indexing and text searching regarding an existing Management Server. In trying to find a solution she wants to check if the process responsible for this feature is running correctly. What is true about the related process?

Question13: What does CMI stand for in relation to the Access Control Policy?

Question14: What information does the doctor-log script supply?

Question15: If SmartLog is not active or failed to parse results from server, what commands can be run to re-enable the service?

Question16: You run a free-command on a gateway and notice that the Swap column is not zero Choose the best answer

Question17: When a User Mode process suddenly crashes, it may create a core dump file. Which of the following information is available in the core dump and may be used to identify the root cause of the crash?
i. Program Counter
ii. Stack Pointer
iii. Memory management information
iv. Other Processor and OS flags / information

Question18: In some scenarios it is very helpful to use advanced Linux commands for troubleshooting purposes. Which command displays information about resource utilization for running processes and shows additional information for core utilization and memory?

Question19: The two procedures available for debugging in the firewall kernel are
i. fw ctl zdebug
ii. fw ctl debug/kdebug
Choose the correct statement explaining the differences in the two

Question20: If the cpsemd process of SmartEvent has crashed or is having trouble coming up, then it usually indicates that __________.

Question21: Troubleshooting issues with Mobile Access requires the following:

Question22: You do not see logs in the SMS. When you login on the SMS shell and run cpwd_admin list you notice that the RFL process is with status T. What command can you run to try to resolve it?

Question23: What is the function of the Core Dump Manager utility?

Question24: You are seeing output from the previous kernel debug. What command should you use to avoid that?

Question25: What is the correct syntax to set all debug flags for Unified Policy related issues?

Question26: What process monitors terminates, and restarts critical Check Point processes as necessary?

Question27: For Identity Awareness, what is the PDP process?

Question28: Which of the following is a component of the Context Management Infrastructure used to collect signatures in user space from multiple sources such as Application Control and IPS. and compiles them together into unified Pattern Matchers?

Question29: What is NOT monitored as a PNOTE by ClusterXL?

Question30: What function receives the AD log event information?

Question31: When viewing data for CPMI objects in the Postgres database, what table column should be selected to query for the object instance?

Question32: You want to fully investigate the VPN establishment, what will you do?

Question33: You modified kernel parameters and after rebooting the gateway, a lot of production traffic gets dropped and the gateway acts strangely What should you do"?

Question34: Check Point Access Control Daemons contains several daemons for Software Blades and features. Which Daemon is used for Application & Control URL Filtering?

Question35: What is the kernel process for Content Awareness that collects the data from the contexts received from the CMI and decides if the file is matched by a data type?

Question36: Where will the usermode core files located?

Question37: What tool would you run to diagnose logging and indexing?

Question38: What are the three main component of Identity Awareness?

Question39: What command is used to find out which port Multi-Portal has assigned to the Mobile Access Portal?

Question40: What command is usually used for general firewall kernel debugging and what is the size of the buffer that is automatically enabled when using the command?

Question41: Which two files contain the Application Database on the Security Gateway?

Question42: How does Identity Collector connect to Windows Server?

Question43: Packet processing infrastructure consists of the following components EXCEPT:

Question44: You found out that $FWDIR/Iog/fw.log is constantly growing in size at a Security Gateway, what is the reason?

Question45: When a User process or program suddenly crashes, a core dump is often used to examine the problem Which command is used to enable the core-dumping via GAIA clish?

Question46: When a user space process or program suddenly crashes, what type of file is created for analysis

Question47: User defined URLS and HTTPS inspection User defined URLs on the Security Gateway are stored in which database file?

Question48: What is the correct syntax to turn a VPN debug on and create new empty debug files'?

Question49: You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week Therefore you need to add a timestamp to the kernel debug and write the output to a file. What is the correct syntax for this?

Question50: When URL category is not found in the kernel cache, what action will GW do?

Question51: The management configuration stored in the Postgres database is partitioned into several relational database domains. What is the purpose of the Global Domain?

Question52: What components make up the Context Management Infrastructure?

Question53: Which Daemon should be debugged for HTTPS inspection related issues?