View Full Checkpoint 156-587 Exam Dumps and Practice Test Dumps.

 

Question 61

Which command is used to display the active CoreXL affinity configuration for all processes and network interfaces?

1. fw ctl affinity -l -a
2. cpconfig affinity show
3. sim affinity -show
4. show corexl affinity

Correct Answer: 1

Explanation:

The fw ctl affinity -l -a command provides a comprehensive view of how CPU cores are bound to system processes, CoreXL firewall instances, and interface SND (Secure Network Distributor) cores on a Security Gateway. Using the -l flag lists detailed parameters, while -a displays all assignments simultaneously. Security engineers use this command to inspect dynamic or static CPU core distribution, verify that interface interrupt handling does not overlap unallocated cores, and troubleshoot core starvation issues under heavy network workloads.

Question 62

Which daemon process on the Security Gateway communicates directly with the Smart Event server to forward log correlation events?

1. fwd
2. cpm
3. cpd
4. evmd

Correct Answer: 1

Explanation:

The Firewall Daemon (FWD) acts as the primary log transport agent on Security Gateways, managing outbound event streams destined for SmartEvent and central Log Servers. FWD extracts log records directly from kernel state tables, formats incoming audit events, and forwards them over encrypted TCP port 257 connections to the SmartEvent correlation engine. By continuously streaming state changes and policy logs, FWD ensures that SmartEvent receives real-time security events for pattern correlation, threat detection, and automated event reporting across enterprise environments.

Question 63

What is the function of the command fw ctl chain?

1. To display the order of kernel inspection modules in the firewall processing chain
2. To create a sequential list of active Security Gateways in a cluster
3. To monitor active IPsec VPN tunnel chains
4. To export management session chains to an external database

Correct Answer: 1

Explanation:

Executing fw ctl chain displays the precise sequence of kernel inspection modules through which network packets flow inside the Check Point kernel driver. The command outputs both inbound and outbound inspection chains, listing active kernel functions such as stateful inspection, NAT, IPsec decryption, anti-spoofing, and threat prevention modules. Security administrators consult fw ctl chain to verify module ordering, troubleshoot custom kernel extensions, and determine exactly where in the kernel stack specific security decisions or packet drops occur.

Question 64

Which diagnostic file logs detailed runtime output for the rad daemon during online category lookups?

1. $FWDIR/log/rad.elg
2. $FWDIR/log/rad.log
3. /var/log/rad.elg
4. $RADDIR/log/rad.elg

Correct Answer: 1

Explanation:

The $FWDIR/log/rad.elg log file records diagnostic logs, connectivity errors, and operational events for the Resource Availability Daemon (rad). When the Application Control or URL Filtering software blades perform cloud-based category lookups, rad queries ThreatCloud servers or internal cache structures. System administrators review rad.elg to troubleshoot web categorization failures, isolate online server connection timeouts, evaluate lookup response latencies, and confirm that online categorization queries execute properly without delaying web traffic inspection.

Question 65

What is the role of the adlogd daemon in an Identity Awareness deployment using AD Query?

1. Enforcing identity-based access rules directly inside the kernel
2. Polling Windows Domain Controllers via WMI or API to extract security event logs
3. Serving the Captive Portal login pages to unauthenticated web browsers
4. Distributing identity updates across remote Security Gateways

Correct Answer: 2

Explanation:

The adlogd daemon manages Active Directory Event Log tracking when AD Query is enabled. It establishes background connections to configured Windows Domain Controllers over WMI or Windows API protocols to read Security Event Logs continuously. adlogd filters log streams specifically for successful user logins and logouts (such as Event IDs 4624 and 4625), extracts user-to-IP address bindings, and forwards normalized identity data to pdpd. This automated background collection allows the gateway to maintain identity visibility without requiring endpoint software installation.

Question 66

Which CLI command displays real-time memory usage details specifically for Check Point kernel memory?

1. cpstat os -f memory
2. fw ctl pstat
3. top
4. free -m

Correct Answer: 2

Explanation:

While standard operating system commands display global physical RAM usage, fw ctl pstat extracts internal memory allocation metrics directly from the Check Point kernel. It provides detailed statistics on kernel heap memory, dynamic memory allocations, system cookie usage, and hash table capacities. Network engineers rely on fw ctl pstat during high-throughput monitoring to verify that kernel inspection memory limits are not exceeded, preventing packet drops or system instability caused by kernel memory pool exhaustion.

Question 67

Which configuration file is used to configure static CoreXL SND and worker core allocations manually?

1. $FWDIR/conf/affinity.conf
2. $FWDIR/conf/local.app
3. /etc/sysctl.conf
4. $FWDIR/boot/modules/fwkern.conf

Correct Answer: 1

Explanation:

Manual CPU core assignments for CoreXL worker instances (fw_worker), Secure Network Distributor (SND) cores, and specific background daemons are configured in $FWDIR/conf/affinity.conf. System administrators edit this file to override automatic affinity rules, dedicating specific CPU cores to high-volume network interface interrupts or isolating heavy firewall instances. Manual core tuning helps prevent cross-core synchronization overhead, balances uneven processing loads across multi-core server platforms, and optimizes total system packet processing throughput.

Question 68

What command is used to display the active state of ClusterXL interfaces and delta sync status?

1. cphaprob -a if
2. cphaprob syncstat
3. fw ctl clusterstat
4. show cluster status

Correct Answer: 2

Explanation:

The cphaprob syncstat command displays precise state statistics regarding ClusterXL state synchronization between cluster members. It outputs metrics on sync connection states, state table transmission rates, lost sync updates, and delta sync transport efficiency over dedicated sync interfaces. System administrators use cphaprob syncstat during cluster health assessments to verify that active connection tables are replicating cleanly across cluster nodes, ensuring seamless, stateful connection failover without dropping active user sessions.

Question 69

Which daemon process listens on TCP port 18190 on the Security Management Server?

1. fwm
2. cpm
3. cpd
4. fwd

Correct Answer: 1

Explanation:

The Firewall Management daemon (fwm) listens on TCP port 18190 to service CPMI (Check Point Management Interface) connections on the Security Management Server. Legacy SmartConsole utilities, background management components, and external API services connect over port 18190 to query management database objects, execute administrative scripts, and initiate policy compilation routines. Securing this communication channel via Secure Internal Communication (SIC) ensures all management operations remain authenticated and protected against unauthorized tampering across administration networks.

Question 70

What does the SecureXL Fast Path (Accelerated Path) accomplish?

1. It sends packets directly to user space for deep application-layer inspection.
2. It processes packets entirely within the SecureXL module without involving CoreXL instances.
3. It routes packets to the management server for automated threat correlation.
4. It bypasses interface driver checks to reduce physical line latency.

Correct Answer: 2

Explanation:

The SecureXL Fast Path (Accelerated Path) handles connection traffic entirely within the SecureXL kernel module, completely bypassing CoreXL firewall instances and user-space daemons. Once an initial connection is validated and an acceleration template is established, Fast Path performs network-layer operations—such as state matching, NAT transformations, and interface forwarding—directly at the driver layer. This offloading mechanism significantly reduces CPU overhead, lowers latency, and maximizes firewall throughput for trusted stateful traffic flows.

Question 71

Which command enables debug logging for the Identity Awareness PDP daemon?

1. pdp debug on
2. fw ctl debug -m pdp all
3. pdp d on
4. set pdp debug enable

Correct Answer: 3

Explanation:

Executing pdp d on enables comprehensive user-space debug tracing for the Policy Decision Point daemon (pdpd). This command forces pdpd to write detailed operational traces—such as identity collection events, session table modifications, Active Directory synchronization details, and identity propagation updates—directly to $FWDIR/log/pdpd.elg. Security administrators use this command to isolate identity resolution failures, diagnose unauthenticated access issues, and verify real-time session updates across distributed Identity Awareness deployments.

Question 72

Where is the core execution binary for the CPM daemon located on Gaia OS?

1. $FWDIR/bin/cpm
2. $CPMDIR/bin/cpm
3. /usr/bin/cpm
4. /var/ctlogs/cpm

Correct Answer: 1

Explanation:

The primary execution binary for the Check Point Management (CPM) daemon is located in $FWDIR/bin/cpm on Security Management Servers. CPM operates as a Java-based application server orchestrating core management functionality, database transactions, SmartConsole sessions, and Solr indexing tasks. System administrators and automated service scripts reference this binary location to verify process integrity, check service file signatures, or execute low-level process management routines directly from the Gaia CLI environment.

Question 73

Which command displays the current IPS protection engine version and update status?

1. show ips update
2. cpstat ips -f status
3. fw ctl ips stat
4. ips stat

Correct Answer: 2

Explanation:

Executing cpstat ips -f status queries the IPS software blade daemon to retrieve current engine versions, loaded protection database signatures, and online update statuses. The output displays the installed package update timestamp, protection count, operational enforcement mode, and engine build version. Security administrators run this command to verify that Security Gateways are running the latest threat signatures, ensuring protection against emerging zero-day vulnerabilities and confirming policy updates deployed from SmartConsole.

Question 74

Which utility generates a system diagnostic report containing OS, hardware, and Check Point deployment data?

1. cpinfo
2. cpcollector
3. sysinfo
4. diagget

Correct Answer: 1

Explanation:

The cpinfo CLI utility generates an extensive system configuration and diagnostic report on Check Point Management Servers and Security Gateways. Executing cpinfo collects OS kernel parameters, installed hotfixes, network configurations, routing tables, process execution logs, and configuration files into a single output file. Check Point Technical Support and security engineers rely on cpinfo output to analyze system health, diagnose complex software bugs, and verify environment setups during escalation procedures.

Question 75

What is the function of the pepd daemon in Identity Awareness?

1. Fetching security logs from domain controllers via WMI
2. Enforcing identity session rules on gateway inspection traffic
3. Translating user identities into external LDAP objects
4. Indexing log data for SmartLog fast-search operations

Correct Answer: 2

Explanation:

The Policy Enforcement Point daemon (pepd) coordinates user-space identity management with kernel-level packet inspection modules on the Security Gateway. pepd receives normalized user-to-IP session mappings from the Policy Decision Point (pdpd) and programs these identity bindings into kernel lookup tables. This allows the inspection engine to match live connection flows against Access Roles in real time, enforcing granular, identity-based security policies directly within the gateway packet pipeline.

Question 76

Which log file tracks output from the fwm process on the Management Server?

1. $FWDIR/log/fwm.elg
2. $FWDIR/log/fwm.log
3. $CPMDIR/log/fwm.elg
4. /var/log/fwm.elg

Correct Answer: 1

Explanation:

The $FWDIR/log/fwm.elg log file records runtime diagnostic logs, process trace messages, and error events generated by the Firewall Management daemon (fwm). Because fwm handles rulebase compilation, GUI client sessions, database schema validations, and certificate authority management, system administrators inspect fwm.elg to troubleshoot policy compilation failures, database object corruption, and administrator authentication errors on the Management Server.

Question 77

Which command is used to clear all active IPsec VPN tunnels on a Security Gateway?

1. vpn tu tlist
2. vpn debug trunc
3. vpn tu
4. fw ctl vpn clear

Correct Answer: 3

Explanation:

The vpn tu (Tunnel Utility) CLI command opens an interactive menu that allows administrators to manage active IPsec VPN associations. Selecting option (2) or choosing the deletion sub-menus within vpn tu enables engineers to clear active IKE Phase 1 (ISAKMP) and Phase 2 (IPsec) Security Associations (SAs) selectively or globally. Clearing stale tunnel state tables forces the gateway to re-negotiate keys with remote VPN peers, helping resolve phase negotiation deadlocks or routing state mismatches.

Question 78

Which daemon process coordinates automatic core dumping and crash reporting on Gaia OS?

1. cpwatchdog
2. crashd
3. cpwd
4. automated_report

Correct Answer: 3

Explanation:

The Check Point WatchDog daemon (cpwd) manages core process monitoring and automated crash reporting on Gaia OS. When a registered system daemon (such as fwd, cpm, or pdpd) crashes or experiences a fatal execution exception, cpwd intercepts the process signal, generates a core dump file for post-mortem analysis, and logs the fault event. It then automatically attempts to restart the failed process, restoring service operation while preserving diagnostic core files for engineering analysis.

Question 79

What is the function of the command fw ctl get int ?

1. Sets a temporary kernel parameter value in memory
2. Queries the current integer value of a specific kernel parameter
3. Resets a kernel parameter back to factory default settings
4. Exports all active kernel parameters into a text configuration file

Correct Answer: 2

Explanation:

Executing fw ctl get int <parameter> queries the Check Point kernel driver to display the current integer value of a specified runtime kernel parameter. Network engineers use this command to check operational limits, such as maximum connection table capacities, NAT hash sizes, or debug levels, without interrupting active packet processing. Unlike parameter modification tools, fw ctl get int performs a safe, non-disruptive read operation directly against live kernel state structures.

Question 80

Which daemon process parses and indexes log files to power SmartLog search queries?

1. fwd
2. cpm
3. solr
4. smartlogd

Correct Answer: 3

Explanation:

The solr daemon provides full-text indexing and rapid search capabilities on Check Point Management and Log Servers using Apache Solr. As raw log files arrive via FWD, solr parses log fields—such as source IPs, rule IDs, actions, and user names—and writes them into structured, high-speed search indexes. This background indexing engine enables security analysts using SmartConsole and SmartLog to execute complex query filters across millions of historical log records in seconds.