Free 156-585 Exam Dumps

No Installation Required, Instantly Prepare for the 156-585 exam and please click the below link to start the 156-585 Exam Simulator with a real 156-585 practice exam questions.
Use directly our on-line 156-585 exam dumps materials and try our Testing Engine to pass the 156-585 which is always updated.

Exam Code: 156-585
Exam Title: Check Point Certified Troubleshooting Expert
Vendor: CheckPoint
Exam Questions: 114
Last Updated: December 18th,2024

Question 1

What is connect about the Resource Advisor (RAD) service on the Security Gateways?

A. RAD has a kernel module that looks up the kernel cache, notifies client about hits and misses and forwards a-sync requests to RAD user space module which is responsible for online categorization
B. RAD is completely loaded as a kernel module that looks up URL in cache and if not found connects online for categorization There is no user space involvement in this process
C. RAD functions completely in user space The Pattern Matter (PM) module of the CMI looks up for URLs in the cache and if not found, contact the RAD process in user space to do online categorization
D. RAD is not a separate module, it is an integrated function of the 'fw1 kernel module and does all operations in the kernel space

Correct Answer:C

Question 2

Which is the correct “fw monitor” syntax for creating a capture file for loading it into WireShark?

A. fw monitor -e “accept<FILTER EXPRESSION>;” >> Output.cap
B. This cannot be accomplished as it is not supported with R80.10
C. fw monitor -e “accept;” -file Output.cap
D. fw monitor -e “accept;” -o Output.cap

Correct Answer:D

Question 3

Some users from your organization have been reporting some connection problems with CIFS since this morning You suspect an IPS issue after an automatic IPS update last night. So you want to perform a packet capture on uppercase I only directly after the IPS chain module (position 4 in the chain) to check If the packets pass the IPS. What command do you need to run?

A. fw monitor -ml -pi 5 -e <filterexperession>
B. fw monitor -pi 5 -e
C. tcpdump -eni any
D. fw monitor -pi asm

Correct Answer:C

Question 4

What does SIM handle?

A. Accelerating packets
B. FW kernel to SXL kernel hand off
C. OPSEC connects to SecureXL
D. Hardware communication to the accelerator

Correct Answer:D

Question 5

Vanessa is reviewing ike.elg file to troubleshoot failed site-to-site VPN connection After sending Mam Mode Packet 5 the response from the peer is PAYLOAD-MALFORMED"
What is the reason for failed VPN connection?

A. The authentication on Phase 1 is causing the problem.Pre-shared key on local gateway encrypted by the hash algorithm created in Packet 3 and Packet 4 doesn't match with the hash on the peer gateway generated by encrypting its pre-shared key
B. The authentication on Phase 2 is causing the problemPre-shared key on local gateway encrypted by the hash algorithm created in Packets 1 and 2 doesn't match with the hash on the peer gateway generated by encrypting its pre-shared key
C. The authentication on Quick Mode is causing the problemPre-shared key on local gateway encrypted by the hash algorithm created in Packets 3 and 4 doesn't match with the hash on the peer gateway generated by encrypting its pre-shared key
D. The authentication on Phase 1 is causing the problemPre-shared key on local gateway encrypted by the hash algorithm doesn't match with the hash on the peer gateway generated by encrypting its pre-shared key created in Packet 1 and Packet 2

Correct Answer:B