What information does the doctor-log script supply?
Correct Answer: A
Question 42
Like a Site-to-Site VPN between two Security Gateways, a Remote Access VPN relies on the Internet Key Exchange (IKE) what types of keys are generated by IKE during negotiation?
Correct Answer: D
Question 43
The two procedures available for debugging in the firewall kernel are i. fw ctl zdebug ii. fw ctl debug/kdebug Choose the correct statement explaining the differences in the two
Correct Answer: D
The correct statement explaining the differences between the two procedures for debugging in the firewall kernel is D. (i) is used for general debugging, has a small buffer and is a quick way to set kernel debug flags to get an output via command line whereas (ii) is useful when there is a need for detailed debugging and requires additional steps to set the buffer and get an output via command line. The command fw ctl zdebug is a shortcut command that sets the kernel debug flags to a predefined value and prints the debug output to the standard output. It is useful for general debugging of common issues, such as traffic drops, NAT, VPN, or clustering. It has a small buffer size and does not require additional steps to start or stop the debugging. However, it has some limitations, such as it cannot be used with SecureXL, it cannot filter the output by chain modules, and it cannot save the output to a file12. The command fw ctl debug is a command that allows the administrator to set the kernel debug flags to a custom value and specify the chain modules to debug. It is useful for detailed debugging of specific issues, such as policy installation, CoreXL, or Identity Awareness. It has a larger buffer size and can save the output to a file. However, it requires additional steps to start and stop the debugging, such as setting the buffer size, clearing the buffer, dumping the buffer, and resetting the debug flags12. The command fw ctl kdebug is a command that is used in conjunction with fw ctl debug to dump the kernel debug buffer to the standard output or to a file. It is part of the procedure (ii) for detailed debugging in the firewall kernel12. The other statements are not correct or relevant for explaining the differences between the two procedures for debugging in the firewall kernel. The command fw ctl zdebug can be used to debug more than just the access control policy, and the command fw ctl debug/kdebug can be used to debug more than just the unified policy. Both commands can be used on both the Security Gateway and the Security Management Server, depending on the issue to be debugged12. References: Check Point Processes and Daemons3, (CCTE) - Check Point Software2 1: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81. 10_AdvancedTechnicalReferenceGuide/html_frameset.htm 2: https://www.checkpoint.com/downloads /training/DOC-Training-Data-Sheet-CCTE-R81.10-V1.0.pdf 3: https://supportcenter.checkpoint.com /supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97638
Question 44
What is the most efficient way to read an IKEv2 Debug?
Correct Answer: A
IKE view is the most efficient way to read an IKEv2 debug. IKE view is a graphical user interface tool that enables you to analyze the IKEv2 debugs generated by the Security Gateway1. It can parse the debug files and display the information in a structured and readable format. It can also filter the debug messages based on various criteria, such as IP address, encryption domain, or IKEv2 state1. IKE view can help you to troubleshoot the IKEv2 issues and identify the root cause of the problems1. Reference: IKEView: VPN Debugging Tool - Check Point Software
Question 45
What is the best way to resolve an issue caused by a frozen process?
Correct Answer: D
When a process is frozen (hung or unresponsive), the typical method to resolve it is to kill the process. On Check Point, you can use cpwd_admin kill -name <ProcessName> or a standard Linux kill -9 <PID> command if necessary. You then allow CPWD (the Check Point watchdog) to restart it, or manually restart it if needed. Other options: A . Power off the machine: This is too drastic and not recommended just for a single frozen process. B . Restart the process: While this sounds viable, you typically must kill the frozen process first, then let WatchDog or an admin restart it. C . Reboot the machine: Similar to powering off-too disruptive for just one stuck process. Hence, the most direct and standard approach: "Kill the process." Check Point Troubleshooting Reference sk97638 - Explanation of CPWD (Check Point WatchDog) and how to manage processes. sk43807 - How to gracefully stop or kill a Check Point process. Check Point CLI Reference Guide - Details on using cpwd_admin commands to kill or restart processes.
