[Jan 19, 2026] Valid 156-587 Test Answers & CheckPoint 156-587 Exam PDF
Realistic 156-587 Exam Dumps with Accurate & Updated Questions
NEW QUESTION # 32
What information does the doctor-log script supply?
- A. Repair options. Logging Rates, Logging Directories
- B. Logging rates. Logging Directories, List of troubleshooting tips
- C. Logging errors. Exceptions, Repair options
- D. Current and daily average logging rates. Indexing status, Size
Answer: D
NEW QUESTION # 33
What are the four main database domains?
- A. System. Global. Log. Event
- B. System, User, Host, Network
- C. System, User, Global. Log
- D. Local, Global, User, VPN
Answer: C
Explanation:
The four main database domains are System, User, Global, and Log. Each domain contains different types of data and serves different purposes123. The System domain contains the configuration data of the Security Management Server (SMS), such as the SMS name, IP address, licensing, and installed products. The User domain contains the configuration data of the security policy, such as the objects, rules, services, and VPN communities. The Global domain contains the configuration data of the global policy, such as the global objects, rules, and services. The Log domain contains the log data of the security events, such as the source, destination, action, and time of each event123. References:
* 1: CCTE Courseware, Module 3: Management Database and Processes, Slide 4
* 2: Check Point R81 Security Management Administration Guide, Chapter 2: Security Management Server, Page 14
* 3: Check Point R81 Security Management Administration Guide, Chapter 2: Security Management Server, Page 15
NEW QUESTION # 34
Which of the following file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?
- A. core dump
- B. tcpdump
- C. CPMIL dump
- D. fw monitor
Answer: A
NEW QUESTION # 35
You receive reports from multiple users that they cannot browse Upon further discovery you identify that Identity Awareness cannot identify the users properly and apply the configuredAccess Roles What commands you can use to troubleshoot all identity collectors and identity providers from the command line?
- A. on the gateway: pdp debug set AD all and IDC all
- B. on the management: pdp debug set all
- C. on the gateway: pdp debug set IDC all IDP all
- D. on the management: pdp debug on IDC all
Answer: C
Explanation:
To troubleshoot Identity Awareness issues related to user identification and Access Role application, you need to enable debugging for both Identity Collectors (IDC) and Identity Providers (IDP). The command pdp debug set IDC all IDP all on the gateway achieves this.
Here's why this is the correct answer and why the others are not:
A . on the gateway: pdp debug set IDC all IDP all: This correctly enables debugging for all Identity Collectors and Identity Providers, allowing you to see detailed logs and messages related to user identification and Access Role assignment. This helps pinpoint issues with user mapping, authentication, or authorization.
B . on the gateway: pdp debug set AD all and IDC all: This command only enables debugging for Active Directory (AD) as an Identity Provider and all Identity Collectors. It might miss issues related to other Identity Providers if they are in use.
C . on the management: pdp debug on IDC all: This command has two issues. First, it should be executed on the gateway, not the management server, as the gateway is responsible for user identification and policy enforcement. Second, it only enables debugging for Identity Collectors, not Identity Providers.
D . on the management: pdp debug set all: While this command might seem to enable debugging for everything, it's not specific enough for Identity Awareness troubleshooting. It might generate excessive logs unrelated to the issue and make it harder to find the relevant information.
Check Point Troubleshooting Reference:
Check Point Identity Awareness Administration Guide: This guide provides detailed information about Identity Awareness components, configuration, and troubleshooting.
Check Point sk113963: This article explains how to troubleshoot Identity Awareness issues using debug commands and logs.
Check Point R81.20 Security Administration Guide: This guide covers general troubleshooting and debugging techniques, including the use of pdp debug commands.
NEW QUESTION # 36
What command(s) will turn off all vpn debug collection?
- A. vpn debug off
- B. fw ctl debug 0
- C. vpn debug off and vpn debug ikeoff
- D. vpn debug -a off
Answer: C
NEW QUESTION # 37
Check Point provides tools & commands to help you to identify issues about products and applications. Which Check Point command can help you to display status and statistics information for various Check Point products and applications?
- A. CPview
- B. CPstat
- C. CPstat is not a valid command. The correct command is cpstat, which is case-sensitive.
- D. fwstat
- E. cpstat
Answer: E
Explanation:
The correct Check Point command to display status and statistics information for various Check Point products and applications is cpstat. This command provides a dynamic real-time view of the system, showing the information such as the number of connections, packets, drops, CPU usage, memory usage, disk space, license status, and blade status. The cpstat command can be customized by using various options and flags to specify the product, the interval, the fields, and the format of the output. For example, to display the status and statistics of the firewall module every 5 seconds, the command would be:
cpstat fw -f all -i 5
The other commands are incorrect because:
A: CPview is a Check Point tool that displays information about the system performance, such as the CPU, memory, disk, network, and firewall. It does not show information about other products and applications, such as VPN, Identity Awareness, Anti-Virus, etc.
C: fwstat is not a valid command. The correct command is fw ctl pstat, which displays information about the firewall kernel, such as the number of connections, packets, drops, memory, and synchronization. It does not show information about other products and applications, such as VPN, Identity Awareness, Anti-Virus, etc.
Reference:
cpstat - Check Point Software
CPView Utility
fw ctl pstat - Check Point Software
(CCTE) - Check Point Software
NEW QUESTION # 38
What is the Security Gateway directory where an administrator can find vpn debug log files generated during Site-to-Site VPN troubleshooting?
- A. SCPDIR/conf/
- B. SFWDIR/log/
- C. opt/CPsuiteR80/vpn/log/
- D. SFWDIR/conf/
Answer: B
Explanation:
The correct directory where an administrator can find vpn debug log files generated during Site-to-Site VPN troubleshooting is $FWDIR/log/. This directory contains the following files related to vpn debug:
* vpnd.elg: This file contains the high-level VPN debug information, such as the VPN tunnel establishment, deletion, and negotiation messages. It can be enabled by using the vpn debug on command on the Security Gateway CLI.
* legacy_ike.elg: This file contains the low-level IKE debug information for IKEv1, such as the IKE packets, encryption, decryption, and authentication. It can be enabled by using the vpn debug ikeon command on the Security Gateway CLI.
* legacy_ikev2.xml: This file contains the low-level IKE debug information for IKEv2, such as the IKE packets, encryption, decryption, and authentication. It can be enabled by using the vpn debug ikev2on command on the Security Gateway CLI.
These files can be viewed by using the vpn debug view command on the Security Gateway CLI, or by using the IKEView tool on the Security Management Server GUI.
References:
* vpn debug - Check Point Software
* IKE Debug on R81 and above - Check Point CheckMates
* (CCTE) - Check Point Software
NEW QUESTION # 39
What is the benefit of fw ctl debug over fw ctl zdebug?
- A. There is no difference Both are used for debugging kernel
- B. You don't need timestamps
- C. It allows you to debug multiple modules at the same time
- D. You only need 1MB buffer
Answer: C
NEW QUESTION # 40
Troubleshooting issues with Mobile Access requires the following:
- A. 'ma_vpnd' process on Security Gateway
- B. Debug logs of FWD captured with the command - 'fw debug fwd on TDERROR_MOBILE_ACCESS=5'
- C. Standard VPN debugs and packet captures on Security Gateway, debugs of 'cvpnd' process on Security Management
- D. Standard VPN debugs, packet captures and debugs of cvpnd1 process on Security Gateway
Answer: D
NEW QUESTION # 41
SmartEvent utilizes the Log Server, Correlation Unit and SmartEvent Server to aggregate logs and identify security events. The three main processes that govern these SmartEvent components are:
- A. eventiasv, eventiarp,eventiacu
- B. fwd, secu, sesrv
- C. cpsemd, cpsead, and DBSync
- D. cpcu, cplog, cpse
Answer: A
Explanation:
SmartEvent is a unified security event management and analysis solution that collects and analyzes data from multiple sources to identify and respond to security threats. SmartEvent consists of three main components:
Log Server, Correlation Unit, and SmartEvent Server1. The three main processes that govern these SmartEvent components are:
* eventiasv: This process is responsible for indexing the logs received from the Log Server and storing them in the SmartEvent database. It also performs log consolidation and compression to optimize the disk space usage2.
* eventiarp: This process is responsible for running the predefined and custom correlation rules on the indexed logs and generating security events based on the rule criteria. It also sends notifications and triggers automatic responses for the security events3.
* eventiacu: This process is responsible for providing the web-based user interface for SmartEvent, which allows the administrators to view, analyze, and manage the security events. It also provides the SmartEvent API for external integration4. References: Check Point Processes and Daemons5, SmartEvent Administration Guide1
1: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.
10_SmartEvent_AdminGuide/html_frameset.htm 2: https://sc1.checkpoint.com/documents/R81.10
/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent- Components.htm#_Toc64167467 3: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN
/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.
htm#_Toc64167468 4: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.
10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.htm#_Toc64167469 5:
https://supportcenter.checkpoint.com/supportcenter/portal?
eventSubmit_doGoviewsolutiondetails=&solutionid=sk97638
NEW QUESTION # 42
Check Point provides tools & commands to help you to identify issues about products and applications.
Which Check Point command can help you to display status and statistics information for various Check Point products and applications?
- A. CPview
- B. CPstat
- C. fwstat
- D. cpstat
Answer: D
Explanation:
The correct Check Point command to display status and statistics information for various Check Point products and applications is cpstat. This command provides a dynamic real-time view of the system, showing the information such as the number of connections, packets, drops, CPU usage, memory usage, disk space, license status, and blade status. The cpstat command can be customized by using various options and flags to specify the product, the interval, the fields, and the format of the output. For example, to display the status and statistics of the firewall module every 5 seconds, the command would be:
cpstat fw -f all -i 5
The other commands are incorrect because:
* A. CPview is a Check Point tool that displays information about the system performance, such as the CPU, memory, disk, network, and firewall. It does not show information about other products and applications, such as VPN, Identity Awareness, Anti-Virus, etc.
* C. fwstat is not a valid command. The correct command is fw ctl pstat, which displays information about the firewall kernel, such as the number of connections, packets, drops, memory, and synchronization. It does not show information about other products and applications, such as VPN, Identity Awareness, Anti-Virus, etc.
* D. CPstat is not a valid command. The correct command is cpstat, which is case-sensitive.
References:
* cpstat - Check Point Software
* CPView Utility
* fw ctl pstat - Check Point Software
* (CCTE) - Check Point Software
NEW QUESTION # 43
You need to monitor traffic pre-inbound and before the VPN module in a Security Gateway. How would you achieve this using fw monitor?
- A. fw monitor -pi +vpn
- B. fw monitor -pi +vpn
- C. fw monitor -p all
- D. fw monitor -pi -vpn
Answer: D
Explanation:
The fw monitor command is a powerful troubleshooting tool in Check Point Gateways that captures packets at various points in the processing chain. The question asks how to capture traffic pre-inbound (before inbound processing, i.e., at the "i" inspection point) and before the VPN module (before VPN decryption or processing).
The fw monitor syntax allows specifying inspection points using options like -pi (pre-inbound) and module names (e.g., -vpn for the VPN module). The correct syntax to capture traffic before a specific module is -pi -<module>, where the module name is prefixed with a minus sign to indicate "before" the module.
Option A: Incorrect. fw monitor -p all captures packets at all inspection points in the chain, which includes pre-inbound, post-inbound, pre-outbound, and post-outbound points, as well as points around all modules. This is too broad and does not specifically target pre-inbound and before the VPN module.
Option B: Correct. fw monitor -pi -vpn captures packets at the pre-inbound inspection point ("i") and before the VPN module (-vpn). The -pi specifies the pre-inbound point, and -vpn ensures the capture occurs before VPN processing (e.g., decryption).
Option C: Incorrect. fw monitor -pi +vpn would capture packets at the pre-inbound point but after the VPN module (+vpn indicates after the module), which contradicts the requirement to capture before the VPN module.
Option D: Incorrect. This option is a duplicate of Option C in the provided question, likely a typographical error. Even if corrected, +vpn is incorrect for the same reason as Option C.
Reference:
The Check Point R81.20 Gaia Administration Guide explains the fw monitor command and its options, including how to specify inspection points and module positions. The CCTE R81.20 course includes hands-on labs for using fw monitor to troubleshoot packet flow, emphasizing precise inspection point selection.
For precise details, refer to:
Check Point R81.20 Gaia Administration Guide, section on "fw monitor" (available via Check Point Support Center).
CCTE R81.20 Courseware, which covers advanced packet capture techniques with fw monitor (available through authorized training partners).
NEW QUESTION # 44
If SmartLog is not active or failed to parse results from server, what commands can be run to re- enable the service?
- A. smartloginit and smartlogstop
- B. smartlogstart and smartlogsetup
- C. smartlogstart and smartlogstop
- D. smartlogrestart and smartlogstart
Answer: D
NEW QUESTION # 45
Check Point provides tools & commands to help you to identify issues about products and applications. Which Check Point command can help you to display status and statistics information for various Check Point products and applications?
- A. CPview
- B. CPstat
- C. fwstat
- D. cpstat
Answer: D
NEW QUESTION # 46
What cli command is run on the GW to verify communication to the Identity Collector?
- A. fwd connected
- B. pep connections idc
- C. pdp connections idc
- D. show idc connections
Answer: C
NEW QUESTION # 47
What tool would you run to diagnose logging and indexing?
- A. run doctor-log.sh
- B. run diagnostic view
- C. run cpm_doctor.sh
- D. cpstat mg -f log_server
Answer: A
NEW QUESTION # 48
Which of the following commands can be used to see the list of processes monitored by the Watch Dog process?
- A. fw ctl get str watchdog
- B. cpstat fw -f watchdog
- C. cpwd_admin list
- D. ps -ef | grep watchd
Answer: C
Explanation:
To see the list of processes monitored by the WatchDog process (CPWD), you use the cpwd_admin list command.
* Option A (cpstat fw -f watchdog): Shows firewall status and statistics for the "fw" context, not necessarily the list of monitored processes.
* Option B (fw ctl get str watchdog): Not a valid parameter for retrieving the list of monitored processes; "fw ctl" deals with kernel parameters.
* Option C (cpwd_admin list): Correct command that lists all processes monitored by CPWD, their status, and how many times they have been restarted.
* Option D (ps -ef | grep watchd): This will list any running process that matches the string "watchd" but will not specifically detail which processes are being monitored by CPWD.
Therefore, the best answer is cpwd_admin list.
Check Point Troubleshooting References
* sk97638: Explains Check Point WatchDog (CPWD) usage and the cpwd_admin utility.
* R81.20 CLI Reference Guide: Describes common troubleshooting commands including cpwd_admin list.
* Check Point Gaia Administration Guide: Provides instructions for monitoring system processes and verifying CPWD.
NEW QUESTION # 49
PostgreSQL is a powerful, open source relational database management system. Check Point offers a command for viewing the database to interact with Postgres interactive shell. Which command do you need to enter the PostgreSQL interactive shell?
- A. mysql -u root
- B. psql_client cpm postgres
- C. psql_client postgres cpm
- D. mysql_client cpm postgres
Answer: B
Explanation:
The correct command to enter the PostgreSQL interactive shell is psql_client cpm postgres. This command allows the administrator to view and manipulate the database of the Check Point Management (CPM) module, which stores the configuration and policy data. The psql_client command is a Check Point wrapper for the psql command, which is the native PostgreSQL interactive shell. The psql_client command takes two arguments: the first one is the name of the database module, and the second one is the name of the database user. In this case, the database module is cpm and the database user is postgres.
The other commands are incorrect because:
A . mysql_client cpm postgres is not a valid command. The mysql_client command is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL.
B . mysql -u root is not a valid command. The mysql command is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL. Moreover, the -u option specifies the MySQL user name, which is not relevant for Check Point.
D . psql_client postgres cpm is not a valid command. The psql_client command takes the database module name as the first argument, and the database user name as the second argument. In this case, the database module name is cpm and the database user name is postgres. The order of the arguments is reversed in this command.
Reference:
How to use PostgreSQL interactive shell (psql) with Check Point database Check Point Database Tool (GuiDBedit) - Check Point Software (CCTE) - Check Point Software
NEW QUESTION # 50
You are seeing output from the previous kernel debug. What command should you use to avoid that?
- A. fw ctl zdebug disable
- B. fw ctl debug 0
- C. fw ctl debug = 0
- D. fw ctl clean buffer = 0
Answer: B
Explanation:
To reset all debug flags and enable only the default debug flags in all kernel modules:
fw ctl debug 0
https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_QoS_AdminGu ide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_QoS_Admin Guide/202665
NEW QUESTION # 51
The packet processing infrastructure consists of 4 components. Which component contains the CLOB, the object that contains information about the packet that is needed to make security decisions?
- A. Handlers
- B. Manager
- C. Classifiers
- D. Observers
Answer: C
NEW QUESTION # 52
You found out that $FWDIR/Iog/fw.log is constantly growing in size at a Security Gateway, what is the reason?
- A. fw.log can grow when GW does not have space in logging directory
- B. Its not a problem the gateways is logging connections and also sessions
- C. TCP state logging is enabled
- D. The GW is logging locally
Answer: B
NEW QUESTION # 53
What information does the doctor-log script supply?
- A. Logging rates, Logging Directories, List of troubleshooting tips
- B. Repair options. Logging Rates, Logging Directories
- C. Logging errors. Exceptions, Repair options
- D. Current and daily average logging rates. Indexing status, Size
Answer: D
Explanation:
The doctor-log script is a tool that provides information about the logging system and helps to identify and troubleshoot common issues. The script runs automatically every night and generates a report that contains the following information:
* Current and daily average logging rates: This shows how many logs are being generated and received by the log server per second. It can help to monitor the logging performance and identify any spikes or drops in the logging rate.
* Indexing status: This shows the status of the log indexing process, which enables faster and more efficient log searches. It can help to identify any issues with the indexing system, such as delays, failures, or errors.
* Size: This shows the size of the log files and the disk space used by the logging system. It can help to manage the disk space and plan for log rotation and backup.
The doctor-log script also provides some troubleshooting tips and repair options for common logging issues, such as corrupted log files, missing log indexes, or low disk space. The script can be run manually or scheduled to run at a specific time. The script output can be viewed in the SmartConsole or in the log server file system.
References: Check Point Troubleshooting Expert (CCTE) course, Module 2: Logs and Monitoring, Lesson
2.1: Logs and SmartEvent, Slide 19-21.
NEW QUESTION # 54
Which of the following commands can be used to see the list of processes monitored by the Watch Dog process?
- A. fw ctl get str watchdog
- B. cpstat fw -f watchdog
- C. cpwd_admin list
- D. ps -ef | grep watchd
Answer: C
Explanation:
To see the list of processes monitored by the WatchDog process (CPWD), you use the cpwd_admin list command.
Option A (cpstat fw -f watchdog): Shows firewall status and statistics for the "fw" context, not necessarily the list of monitored processes.
Option B (fw ctl get str watchdog): Not a valid parameter for retrieving the list of monitored processes; "fw ctl" deals with kernel parameters.
Option C (cpwd_admin list): Correct command that lists all processes monitored by CPWD, their status, and how many times they have been restarted.
Option D (ps -ef | grep watchd): This will list any running process that matches the string "watchd" but will not specifically detail which processes are being monitored by CPWD.
Therefore, the best answer is cpwd_admin list.
Check Point Troubleshooting Reference
sk97638: Explains Check Point WatchDog (CPWD) usage and the cpwd_admin utility.
R81.20 CLI Reference Guide: Describes common troubleshooting commands including cpwd_admin list.
Check Point Gaia Administration Guide: Provides instructions for monitoring system processes and verifying CPWD.
NEW QUESTION # 55
What is the best way to resolve an issue caused by a frozen process?
- A. Kill the process
- B. Reboot the machine
- C. Power off the machine
- D. Restart the process
Answer: A
Explanation:
* When a process is frozen (hung or unresponsive), the typical method to resolve it is to kill the process.
On Check Point, you can use cpwd_admin kill -name <ProcessName> or a standard Linux kill -9
<PID> command if necessary. You then allow CPWD (the Check Point watchdog) to restart it, or manually restart it if needed.
Other options:
* A. Power off the machine: This is too drastic and not recommended just for a single frozen process.
* B. Restart the process: While this sounds viable, you typically must kill the frozen process first, then let WatchDog or an admin restart it.
* C. Reboot the machine: Similar to powering off-too disruptive for just one stuck process.
Hence, the most direct and standard approach:"Kill the process."
Check Point Troubleshooting References
* sk97638 - Explanation of CPWD (Check Point WatchDog) and how to manage processes.
* sk43807 - How to gracefully stop or kill a Check Point process.
* Check Point CLI Reference Guide - Details on using cpwd_admin commands to kill or restart processes.
NEW QUESTION # 56
......
CheckPoint 156-587 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
156-587 Exam Dumps - PDF Questions and Testing Engine: https://www.actualtestsit.com/CheckPoint/156-587-exam-prep-dumps.html