Prepare Top CheckPoint 156-836 Exam Study Guide Practice Questions Edition
Go to 156-836 Questions - Try 156-836 dumps pdf
Preparing for the CCME certification exam requires a combination of hands-on experience and study materials. Check Point offers various training courses and study materials, including online courses, instructor-led courses, and study guides, to help candidates prepare for the exam.
The CCME certification program is designed for security professionals who are responsible for managing and securing large enterprise networks. It is ideal for network security architects, network security engineers, senior security analysts, and other security professionals who have a deep understanding of network security and experience in deploying and managing large-scale security architectures.
NEW QUESTION # 39
While looking at your system's correction statistics, you notice you have a correction rate approaching 100 percent. Is this a problem?
- A. In some scenarios, a correction rate approaching 100 percent of all connections is not unusual. This is not usually a cause for concern as the correction mechanism is fast and efficient.
- B. A correction rate approaching 100 percent of all connections is unusual. This is a cause for concern because the SGMs may fail to process traffic.
- C. A correction rate above 90 percent indicates a need to disable Layer 4 Distribution.
- D. If correction rates are higher than 80 percent, latency is expected.
Answer: B
Explanation:
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23 3
*Check Point Maestro Frequently Asked Questions (FAQ), question 9 4
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
4:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
NEW QUESTION # 40
Maestro allows running commands globally in Expert mode by using global prefixes, such as:
- A. g_all
- B. global
- C. all
- D. asg all
Answer: A
Explanation:
Explanation
The g_all prefix is used to run commands globally in Expert mode on all Security Group Members of the current Security Group. For example, g_all cpstop will stop the Check Point services on all SGMs. The other prefixes are not valid for global commands in Expert mode.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
NEW QUESTION # 41
For the MHO-175, which ports are Management ports?
- A. Ports 27 - 47 are Management ports.
- B. Ports 1 - 4 are Management ports.
- C. Ports 49 - 55 are Management ports.
- D. Ports 5 - 26 are Management ports.
Answer: B
Explanation:
Explanation
According to the Port Mapping for the Check Point Maestro HyperScale Orchestrator MHO-175 document1, ports 1 - 4 are Management ports that are used to connect the MHO to the customer's management infrastructure, such as SmartConsole or SmartDomain Manager. Ports 5 - 26 are Uplink ports that are used to connect the MHO to the customer's network infrastructure, such as switches, routers, or firewalls. Ports 27 -
47 are Downlink ports that are used to connect the MHO to the Security Group Modules (SGMs) in the Security Group. Ports 49 - 55 are Backplane ports that are used to connect the MHO to another MHO in a Dual Orchestrator environment.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 42
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline3
*Port Mapping for the Check Point Maestro HyperScale Orchestrator MHO-1751
NEW QUESTION # 42
During an upgrade, Is Multi-Version Clustering (MVC) supported?
- A. No. Maestro does not support MVC because ClusterXL is disabled during an upgrade.
- B. Maestro supports MVC or full connectivity upgrade as of R80.40.
- C. Yes, MVC is supported as of R81 for Maestro.
- D. No, Maestro does not support MVC.
Answer: C
Explanation:
Explanation
Multi-Version Clustering (MVC) is a feature that allows different versions of Security Gateways to operate in the same cluster and provide seamless failover and load balancing. MVC is supported for Maestro environments as of R81, which means that it is possible to upgrade the Security Groups in a Maestro environment as a Multi-Version Cluster with zero downtime. This requires that the Maestro Orchestrators are upgraded to R81.20 first, and then the Security Groups can be upgraded one by one to R81.20 while maintaining full connectivity and synchronization.
References =
*Check Point R81.20 for Scalable Platforms - Check Point Software
*Maestro Dual Site configuration with a direct connection through L2 switches
*CHECK POINT MAESTRO EXPERT
NEW QUESTION # 43
What is the purpose of g_tcpdump command?
- A. Collects traffic dump from all Active Appliances within Security Group
- B. The same as tcpdump, just on Scalable Platform
- C. Collects traffic dump from Sync network
- D. Collects traffic dump from CIN network
Answer: A
Explanation:
Explanation
_tcpdump" probably collects traffic dumps from all active appliances within a security group, aligning with the naming convention and function of similar commands in scalable platforms.
References
*Maestro Expert (CCME) Course - Check Point Software, page 331
*What is 'IN' and 'OUT' of g_tcpdump? - Check Point CheckMates2
*CHECK POINT MAESTRO EXPERT, page 23
NEW QUESTION # 44
There are two 10Gbps dual-port NICs and one 40Gbps NIC installed on a 23800 Appliance in slots 1, 2 and 3 accordingly. Which interfaces should be connected to Orchestrator 1 for downlinks' intra- orchestrator redundancy when using two Orchestrators?
- A. Port 1 in Slot 1 and Port 2 in Slot 1
- B. This configuration is not supported
- C. Port 1 in Slot 2 and Port 2 in Slot 1
- D. Any pair of available ports
Answer: A
Explanation:
Explanation
This configuration likely provides balanced and redundant connectivity for orchestrator redundancy.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 3: Dual Orchestrator Environment, Lesson 3.1: Introduction to Dual Orchestrator Environment, page 3-7
*Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
Downlinks, page 3-8
*Check Point 23800 Appliance Datasheet - Check Point Software, page 2
NEW QUESTION # 45
Which feature is used to force trusted non-F2F traffic into the fully accelerated path for handling by SecureXL.
- A. Fast Accelerator
- B. rate limiting
- C. SecureXL
- D. hypersync
Answer: C
Explanation:
Explanation
SecureXL is typically used to accelerate trusted traffic, including non-F2F (face-to-face) traffic, through a secure, fast path.
References =
*SecureXL Fast Accelerator (fw fast_accel) for R80.20 and above 1
*SecureXL Fast Accelerator - Need to clarify packet flow 2
1:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
2:
https://community.checkpoint.com/t5/Security-Gateways/SecureXL-Fast-Accelerator-Need-to-clarify-packet-flo
NEW QUESTION # 46
The core four manual diagnostic tools include:
asg diag verify, asg perf -v, orch_stat -all, and
- A. asg diag verify
- B. cpinfo
- C. asg stat -v
- D. hcp -r all
Answer: C
Explanation:
Explanation
"Asg stat -v" could be a part of the core diagnostic tools, providing valuable statistics and information for manual diagnostics.
References =
*Maestro Expert (CCME) Course - Check Point Software 3
*Check Point Maestro R81.X Administration Guide 1
*Check Point Maestro R81.X Getting Started Guide 2
3: https://www.checkpoint.com/downloads/training/ccme-maestro-expert-r81.10-course.pdf 1:
https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
NEW QUESTION # 47
There are two 10Gbps dual-port NIC installed on a 6800 appliance. Which interfaces should be connected to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators?
- A. Port 1 in Slot 1 and Port 2 in Slot 1
- B. Port 1 in Slot 2 and Port 2 in Slot 1
- C. Port 1 in Slot 1 and Port 1 in Slot 2
- D. Any pair of available ports
Answer: C
Explanation:
Explanation
The correct interfaces to connect to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators are Port 1 in Slot 1 and Port 1 in Slot 2. This is because each slot represents a different NIC, and each port represents a different physical link. By connecting two ports from different slots, the appliance can have redundant connections to the same orchestrator, and avoid a single point of failure in case of a NIC or link failure.
References
*Check Point 156-835 Certification Flashcards | Quizlet1
*Maestro Expert (CCME) Course - Check Point Software, page 182
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide
163
NEW QUESTION # 48
When security policy is installed
- A. All SGMs receive the security policy and one by one performs an independent policy verification. Then, all SGMs simultaneously install the policy.
- B. All SGMs receive the security policy and simultaneous policy installation occurs.
- C. The SMO Master receives the policy and performs a policy verification the policy is installed on the SMO Master, the SMO Master broadcasts the available package, other membersretrieve the new policy from the SMO Master, then the non-SMO Master SGMs install the policy.
- D. The policy is installed on the SMO, the SMO Master broadcasts the available package, other members retrieve the new policy from the SMO Master and perform an independent policy verification, then the non-SMO Master SGMs install the policy.
Answer: C
Explanation:
Explanation
This is the correct answer because it describes the security policy installation flow for a Maestro Security Group. The SMO Master is the Security Group Member that acts as the leader and the single point of contact for the Management Server. The SMO Master verifies the policy and installs it first, then notifies the other SGMs that a new policy is available. The other SGMs fetch the policy from the SMO Master and install it in parallel.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.3: Security Policy Installation, page 2-15
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Security Policy Installation, page 2-13
*Policy installation flow - Check Point Software
NEW QUESTION # 49
HealthCheck Point _____
- A. is a self-updatable suite of tools for SGMs with the capability to assess the health of the system, visualize the Firewall topology, provide a timeline of critical and informative events that might have occurred in a production system.
- B. can be used to let you visualize the Firewall topology for the SG and view live statistics, which includes throughput, problem notes, and CPU utilization.
- C. is a self-updatable suite of tools for MHOs with the capability to assess the health of the system and provide a timeline of critical and informative events that might have occurred in a production system.
- D. performs a system health check and is meant to replace both a CPInfo and the health check script.
Answer: A
Explanation:
Explanation
HealthCheck Point (HCP) is a tool that can perform various tests and checks on the system components of the Security Group Modules (SGMs), such as hardware, software, network, clock,ARP, and more. It can also display the performance statistics of the SGMs, such as throughput, packet rate, CPU utilization, memory usage, and more. Additionally, HCP can provide a graphical representation of the Firewall topology for the Security Group, showing the connections and statuses of the SGMs and the Orchestrators. Furthermore, HCP can generate a report of the critical and informative events that occurred on the system, such as configuration changes, errors, warnings, and alerts. HCP can help identify and troubleshoot any issues or errors that may affect the system functionality or performance.
References =
*HealthCheck Point (HCP) Release Updates - Check Point Software 1
*Professional Services Healthcheck - Check Point Software 2
*HealthCheck Point - Check Point CheckMates 3
NEW QUESTION # 50
What happens if the SMO Master fails?
- A. The Backup SMO Master will take over in the event of a failure with the SMO Master.
- B. A failover will occur on the MHO and traffic will continue to pass.
- C. The next SGM with the current lowest SGM ID assumes the role of the SMO Master.
- D. The Security Group will no longer pass traffic and the issue must be resolved with the SMO Master.
Answer: C
Explanation:
Explanation
This aligns with the principle of redundancy in network systems, where the next available device with the lowest ID typically takes over management roles in case of a failure.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 91
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
NEW QUESTION # 51
What is one benefit of a Dual MHO environment?
- A. Dual MHOs allow additional SGMs to be added to the SG.
- B. Dual MHOs provide redundancy to the Maestro environment by increasing throughput by at least 50 percent.
- C. Dual MHOs allow better synchronization to occur between SGMs.
- D. Dual MHOs can be used to achieve increased scalability and redundancy.
.
Answer: D
Explanation:
Explanation
One of the benefits of a Dual MHO environment is that it can provide both scalability and redundancy to the Maestro system. Scalability means that the system can handle more traffic and SGMs as the demand grows, and redundancy means that the system can survive the failure of one or more components without losing functionality or performance. Dual MHOs can achieve these benefits by distributing the load and the management tasks among two orchestrators, and by providing backup and failover mechanisms for each other.
References
*Maestro Expert (CCME) Course - Check Point Software, page 251
*CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 22
*Check Point Certified Maestro Expert (CCME) R81.X, page 23
NEW QUESTION # 52
What happens if you apply a hotfix using gClish?
- A. If you apply a hotfix using gclish, the operation will fail because an outage would occur.
- B. If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.
- C. Logical groups "A" and "B" are created. Members of group "A" install and reboot first. Then members of group "B" does the same once reboots have finished with group "A."
- D. If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.
Answer: C
Explanation:
Explanation
This is the correct answer because it describes the hotfix installation process using gClish on a Maestro Security Group. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. When a hotfix is applied using gClish, the SG members are divided into two logical groups: "A" and "B". The members of group "A" install the hotfix and reboot first, while the members of group "B" wait for their turn. After all the members of group "A" are back online, the members of group
"B" install the hotfix and reboot.This way, the SG maintains high availability and does not cause an outage.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
NEW QUESTION # 53
When working with Maestro, what is the difference between using Clish and gClish?
- A. Clish commands apply to all UP SG members, by default. gClish commands apply to all SG members, by default.
- B. Clish commands are run on the SG members. gClish commands are run on the MHO and applied to all connected SG members in a specified group.
- C. Clish commands apply only to a specific SG member. gClish commands apply to all UP SG members, by default.
- D. Clish commands are for testing purposes only and cannot be saved, gClish commands apply to all SG members, by default.
Answer: C
Explanation:
Explanation
This is the correct answer because it describes the difference between using Clish and gClish when working with Maestro. Clish is the Check Point command line shell that allows users to configure and manage the SG members individually. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. UP SG members are theones that are in the UP state and have the same policy installed as the SMO Master.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
NEW QUESTION # 54
What will happen in case of NAT of the traffic passing through Management network?
- A. Since Management traffic is always going to SMO, it will take a care for Correction Layer and will re-distribute traffic to other Appliances
- B. This traffic will pass with no inspection
- C. Orchestrator will disable NAT and traffic will pass with no issue
- D. This traffic will not pass correction, since it will be dropped
Answer: C
Explanation:
Explanation
According to the Check Point MAESTRO R80.20SP Administration Manual1, NAT is not supported on the management network. If you configure NAT on the management network, the Orchestrator will disable NAT and allow the traffic to pass without translation. This is to ensure that the management traffic can reach the Security Group members and the SmartConsole without any issues.
References
*Check Point MAESTRO R80.20SP Administration Manual, page 291
NEW QUESTION # 55
To display processes that are consuming excessive system resources, users should use the_____ command.
- A. asg stat -v
- B. top
- C. asg perf -v
- D. asg_perf_hogs
Answer: D
Explanation:
Explanation
The asg_perf_hogs command is a script that displays the processes that are consuming excessive system resources, such as CPU, memory, disk, and network, on the orchestrator and the appliances. It can help identify performance issues and bottlenecks in the Maestro environment.
References
*Software Provision and Performance hogs failed - Check Point CheckMates1
*CHECK POINT MAESTRO EXPERT, page 33
NEW QUESTION # 56
The drop_monitor command is useful for
- A. Viewing all interface drops such as RX-ERR, RX-DRP, and RX-OVR
- B. Monitoring Check Point code drops
- C. Showing the system temperature in real-time for multiple components, such as CPU, fan, and SSDs.
- D. Viewing all drops by Check Point code or the Gaia OS, such as RX-DRP, RX-ERR, and Gaia OS drops.
Answer: D
Explanation:
Explanation
The drop_monitor command is a tool that monitors and displays the packets that are dropped by the Check Point code or the Gaia OS on the orchestrator and the appliances. It can help troubleshoot network issues and optimize performance. The command shows the drop reason, source, destination, protocol, and port of the dropped packets, as well as the interface and the module that dropped them.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates1
*Support, Support Requests, Training ... - Check Point Software2
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge
NEW QUESTION # 57
Layer 4 distribution is enabled by default in Maestro. Which is not a scenario when you would want to leave this enabled?
- A. When dynamic routing protocols, such as BGP or OSPF are used.
- B. When there is a heavy imbalance of traffic between the SGMs that are members of the same SG.
- C. When the SG is NATing a very high percentage of traffic passing through it.
- D. When there is a large number of source ports in use by protocols such as HTTP, HTTPS, and DNS.
Answer: A
Explanation:
Explanation
This is the correct answer because Layer 4 distribution is not recommended when dynamic routing protocols are used in Maestro. Layer 4 distribution is a feature that adds the source and/or destination ports to the distribution equation, which can improve the load balancing among the SGMs. However, it can also cause issues with the correction layer, which is a mechanism that ensures the packets are processed by the correct SGM. Dynamic routing protocols, such as BGP or OSPF, use specific ports to exchange routing information and establish neighbor relationships. If Layer 4 distribution is enabled, it can interfere with the routing protocol packets and cause routing instability or failures.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-20
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-8
*Layer 4 Distribution - Yes or No? - Check Point CheckMates
*Support, Support Requests, Training ... - Check Point Software
NEW QUESTION # 58
Which command should be used to restart Orchestrator service only?
- A. cpstop; cpstart
- B. orchd restart
- C. reboot
- D. service orchestrator restart
Answer: B
Explanation:
Explanation
Page 313 from the training manual:
- Restart the service:
orchd restart
- Restart the service without confirmation
service orchd restart
NEW QUESTION # 59
There is a Security group of 10 Appliances and all of them are up and running. How many Appliances within a Security Group keep the same connection in its connection table in case of NAT?
- A. 0
- B. All 10
- C. 1
- D. Between 2 and 4
Answer: D
Explanation:
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23
*Check Point Maestro Frequently Asked Questions (FAQ), question 9
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
NEW QUESTION # 60
What can be learned from the output of sx_api_ports_dump.py command?
- A. Orchestrator port status
- B. Information about backplane bonds
- C. Information about Security Groups
- D. Information about downlink ports only
Answer: B
Explanation:
Explanation
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*[Maestro Expert (CCME) Course - Check Point Software], page 31
*[Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge], page 3
NEW QUESTION # 61
......
Check Point Certified Maestro Expert - R81 (CCME) is the latest certification in this program. Check Point Certified Maestro Expert - R81 (CCME) certification exam is designed for network professionals who have already obtained the Check Point Certified Maestro Associate certification and want to further enhance their knowledge and skills in Maestro solution deployment and management.
Free CCME 156-836 Exam Question: https://examsdocs.dumpsquestion.com/156-836-exam-dumps-collection.html