• ホーム
  • ブログ
  • 検証済みの156-836試験問題集PDF [2024年最新] 成功の秘訣はここにある [Q12-Q31]

検証済みの156-836試験問題集PDF [2024年最新] 成功の秘訣はここにある [Q12-Q31]

Share

検証済みの156-836試験問題集PDF [2024年最新] 成功の秘訣はここにある

ベストを体験せよ！156-836試験問題トレーニングを提供していますPassTest

質問 # 12
Maestro allows running commands globally in Expert mode by using global prefixes, such as:

  • A. asg all
  • B. g_all
  • C. global
  • D. all

正解：B

解説：
Explanation
The g_all prefix is used to run commands globally in Expert mode on all Security Group Members of the current Security Group. For example, g_all cpstop will stop the Check Point services on all SGMs. The other prefixes are not valid for global commands in Expert mode.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates


質問 # 13
What command should be used for collecting diagnostic information about the orchestrator?

  • A. orch_info
  • B. asg perf -v
  • C. cpinfo
  • D. cpview

正解：C

解説：
Explanation
The cpinfo command is a tool that collects diagnostic information about the orchestrator, such as hardware, software, network, configuration, and logs. The cpinfo command generates a file that can be sent to Check Point Support for analysis and troubleshooting. The cpinfo command can be run on the orchestrator's CLI or WebUI.
References =
*Check Point Maestro R81.X Administration Guide, page 68, section "cpinfo" 1
*Check Point Maestro R81.X Getting Started Guide, page 30, section "cpinfo" 2
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software 3
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3: https://www.checkpoint.com/downloads/products/maestro-hyperscale-orchestrator-datasheet.pdf


質問 # 14
What does asg monitor command do?

  • A. Monitor traffic on Appliances in Security Group
  • B. Show real-time cluster status of Appliances in Security Group
  • C. This command does not exist
  • D. Monitor health status of entire system

正解：B

解説：
Explanation
The "asg monitor" command generally would show real-time cluster status of appliances in a security group, focusing on health and operational status.


質問 # 15
What happens if you apply a hotfix using gClish?

  • A. If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.
  • B. If you apply a hotfix using gclish, the operation will fail because an outage would occur.
  • C. Logical groups "A" and "B" are created. Members of group "A" install and reboot first. Then members of group "B" does the same once reboots have finished with group "A."
  • D. If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.

正解：C

解説：
Explanation
This is the correct answer because it describes the hotfix installation process using gClish on a Maestro Security Group. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. When a hotfix is applied using gClish, the SG members are divided into two logical groups: "A" and "B". The members of group "A" install the hotfix and reboot first, while the members of group "B" wait for their turn. After all the members of group "A" are back online, the members of group
"B" install the hotfix and reboot.This way, the SG maintains high availability and does not cause an outage.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates


質問 # 16
While looking at your system's correction statistics, you notice you have a correction rate approaching 100 percent. Is this a problem?

  • A. If correction rates are higher than 80 percent, latency is expected.
  • B. A correction rate approaching 100 percent of all connections is unusual. This is a cause for concern because the SGMs may fail to process traffic.
  • C. A correction rate above 90 percent indicates a need to disable Layer 4 Distribution.
  • D. In some scenarios, a correction rate approaching 100 percent of all connections is not unusual. This is not usually a cause for concern as the correction mechanism is fast and efficient.

正解：B

解説：
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23 3
*Check Point Maestro Frequently Asked Questions (FAQ), question 9 4
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
4:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=


質問 # 17
What is the Correction Layer?

  • A. Correction Layer is a Layer of GAIA OS which corrects misspelled commands and allows them to execute
  • B. Correction Layer is a daemon which corrects errors on Backplane interfaces
  • C. Correction Layer is a mechanism which activated in case of asymmetric routing
  • D. Correction Layer is a mechanism which handles asymmetric connections in multi-appliance system. For example, in case of NAT

正解：D

解説：
Explanation
The Correction Layer is a Maestro component that ensures that packets from the same connection are handled by the same Security Group Module (SGM) in a multi-appliance system. This is especially important when NAT is involved, as packets sent from the client to the server can be distributed to a different SGM than packets from the same session sent from the server to the client. The Correction Layer must then forward the packet to the correct SGM.
References:
*NAT and the Correction Layer on a Security Gateway - Check Point Software1
*Solved: Maestro queries - Check Point CheckMates


質問 # 18
In a dual MHO environment, MHO1 and MHO2 are connected to the SGM line cards in which way?

  • A. MHO1 and MHO2 are connected to the SGMs using the Sync cable.
  • B. MHO 1 is connected to the even-numbered ports, while MHO2 is connected to odd-numbered ports.
  • C. MHO1 and MHO2 are connected to the line cards in any order administrators see fit.
  • D. MHO 1 is connected to the odd-numbered ports, while MHO2 is connected to even-numbered ports.

正解：B

解説：
Explanation
The correct way to connect MHO1 and MHO2 to the SGM line cards in a dual MHO environment is to use the even-numbered ports for MHO1 and the odd-numbered ports for MHO2. This is to ensure that each SGM has two downlinks to each MHO, and that the downlinks are balanced across the different NICs and links. This provides redundancy and high availability for the traffic flow between the SGMs and the MHOs.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*Maestro Expert (CCME) Course - Check Point Software, page 18
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 16


質問 # 19
Layer 4 distribution is enabled by default in Maestro. Which is not a scenario when you would want to leave this enabled?

  • A. When there is a heavy imbalance of traffic between the SGMs that are members of the same SG.
  • B. When dynamic routing protocols, such as BGP or OSPF are used.
  • C. When there is a large number of source ports in use by protocols such as HTTP, HTTPS, and DNS.
  • D. When the SG is NATing a very high percentage of traffic passing through it.

正解：B

解説：
Explanation
This is the correct answer because Layer 4 distribution is not recommended when dynamic routing protocols are used in Maestro. Layer 4 distribution is a feature that adds the source and/or destination ports to the distribution equation, which can improve the load balancing among the SGMs. However, it can also cause issues with the correction layer, which is a mechanism that ensures the packets are processed by the correct SGM. Dynamic routing protocols, such as BGP or OSPF, use specific ports to exchange routing information and establish neighbor relationships. If Layer 4 distribution is enabled, it can interfere with the routing protocol packets and cause routing instability or failures.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-20
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-8
*Layer 4 Distribution - Yes or No? - Check Point CheckMates
*Support, Support Requests, Training ... - Check Point Software


質問 # 20
How does HyperSync work in a Dual Site environment?

  • A. Each active connection has two local backups (on the local site) and a third backup connection on the second site (remote site.)
  • B. Each active connection has a local backup (on the local site) and a second backup connection on each of the MHOs.
  • C. Each active connection has a local backup (on the local site) and a second backup connection on the second site (remote site.)
  • D. Each active connection has a backup connection on the second site (remote site.)

正解：C

解説：
Explanation
HyperSync is a feature of Maestro that enables stateful synchronization of connections and resources across different sites in a Dual Site environment. HyperSync works by creating two backup connections for each active connection: one on the same site as the active connection, and another on the remote site. This ensures that the connection can be seamlessly resumed in case of a failover event, either within the same site or across the sites. HyperSync uses the Site-Sync port and VLANs to transmit the synchronization packets between the Security Group Members and the Maestro Orchestrators.
References =
*Maestro Dual Site configuration with a direct connection through L2 switches
*Maestro Frequently Asked Questions (FAQ)
*CHECK POINT MAESTRO EXPERT


質問 # 21
Do all MHOs need to be upgraded before starting the SGM upgrades?

  • A. All MHOs must first be upgraded before starting the SGM upgrades However, there is no requirement to upgrade all the SGMs during the same maintenance window as the MHOs.
  • B. MHOs do not need to be upgraded at all because Maestro supports the use of different versions between the MHOs and SGMs.
  • C. During the upgrade process all SGMs should be upgraded before upgrading all of the MHOs.
  • D. A minimum of one of the MHOs should be upgraded before starting the SGM upgrades. However, there is no requirement to upgrade all the SGMs during the same maintenance window as the MHO

正解：A

解説：
Explanation
This is the correct answer because it follows the upgrade order and procedure specified in the R81.10 and R81.20 Administration Guides for Maestro environments. The MHOs are responsible for managing and synchronizing the SGMs, so they must be upgraded to the target version before the SGMs. However, the SGMs can be upgraded one by one or in batches, as long as they are compatible with the MHOs. The upgrade process also supports Multi-Version Clustering, which allows different versions of SGMs to operate in the same Security Group with zero downtime.
References =
*Check Point R81.10 for Scalable Platforms - Check Point Software
*Check Point R81.20 for Scalable Platforms - Check Point Software
*CHECK POINT MAESTRO EXPERT


質問 # 22
What is one benefit of a Dual MHO environment?

  • A. Dual MHOs can be used to achieve increased scalability and redundancy.
    .
  • B. Dual MHOs allow additional SGMs to be added to the SG.
  • C. Dual MHOs provide redundancy to the Maestro environment by increasing throughput by at least 50 percent.
  • D. Dual MHOs allow better synchronization to occur between SGMs.

正解：A

解説：
Explanation
One of the benefits of a Dual MHO environment is that it can provide both scalability and redundancy to the Maestro system. Scalability means that the system can handle more traffic and SGMs as the demand grows, and redundancy means that the system can survive the failure of one or more components without losing functionality or performance. Dual MHOs can achieve these benefits by distributing the load and the management tasks among two orchestrators, and by providing backup and failover mechanisms for each other.
References
*Maestro Expert (CCME) Course - Check Point Software, page 251
*CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 22
*Check Point Certified Maestro Expert (CCME) R81.X, page 23


質問 # 23
There are two 10Gbps dual-port NIC installed on a 6800 appliance. Which interfaces should be connected to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators?

  • A. Port 1 in Slot 2 and Port 2 in Slot 1
  • B. Any pair of available ports
  • C. Port 1 in Slot 1 and Port 1 in Slot 2
  • D. Port 1 in Slot 1 and Port 2 in Slot 1

正解：C

解説：
Explanation
The correct interfaces to connect to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators are Port 1 in Slot 1 and Port 1 in Slot 2. This is because each slot represents a different NIC, and each port represents a different physical link. By connecting two ports from different slots, the appliance can have redundant connections to the same orchestrator, and avoid a single point of failure in case of a NIC or link failure.
References
*Check Point 156-835 Certification Flashcards | Quizlet1
*Maestro Expert (CCME) Course - Check Point Software, page 182
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide
163


質問 # 24
In a Maestro Dual Site environment, what is the definition of the term Active Site.

  • A. The Active Site is the site currently handling the enforcement on traffic passing for a specific SG.Connections are synced within the SGMs in the Active Site.
  • B. The Active Site is the site that is not handling any traffic for the specific SG, but itsconnections are synced to its SGMs from the MHOs to be ready in the event of a failover.
  • C. The Active Site is the site where the SMO Master exists.
  • D. There is no such thing as an active site. In a Dual Site environment, traffic is load balanced.

正解：A

解説：
Explanation
In a Maestro Dual Site environment, there are two sites that can host Security Group Members (SGMs) for each Security Group (SG). The Active Site is the one that is currently processing the traffic for a specific SG, while the Standby Site is the one that is ready to take over in case of a failover. The Active Site and the Standby Site can be different for different SGs, depending on the load balancing and failover policies. The Active Site and the Standby Site are synchronized by the Maestro Orchestrators (MHOs) using the Site-Sync port and VLANs.
References =
*Solved: Maestro dual site failover - Check Point CheckMates
*Maestro Dual Site configuration with a direct connection through L2 switches


質問 # 25
There are two appliances within the same Security Group. One of them is connected by One downlink only, another one by Two downlinks. Assuming there's no NAT and no VPN, what would be proportion of traffic distribution done by Orchestrator?

  • A. 100%/0%
  • B. 50%/50%
  • C. 66%/33%
  • D. 33%/66%

正解：B

解説：
Explanation
The proportion of traffic distribution done by Orchestrator depends on the traffic distribution mode that is configured for the Security Group. There are three modes: Round Robin, Load Sharing, andActive/Standby1.
*Round Robin mode distributes the traffic equally among all the appliances in the Security Group, regardless of the number of downlinks they have. This mode is suitable for scenarios where all the appliances have similar performance and capacity. In this mode, the proportion of traffic distribution would be 50%/50% for two appliances with one and two downlinks respectively.
*Load Sharing mode distributes the traffic proportionally to the number of downlinks each appliance has. This mode is suitable for scenarios where the appliances have different performance and capacity. In this mode, the proportion of traffic distribution would be 33%/66% for two appliances with one and two downlinks respectively.
*Active/Standby mode distributes the traffic to only one appliance at a time, while the other appliances are in standby mode. This mode is suitable for scenarios where high availability is required. In this mode, the proportion of traffic distribution would be 100%/0% or 0%/100% for two appliances with one and two downlinks respectively, depending on which appliance is active.
Since the question does not specify the traffic distribution mode, the default mode is Round Robin2.
Therefore, the proportion of traffic distribution would be 50%/50% for two appliances with one and two downlinks respectively.


質問 # 26
What is the max amount of Orchestrators in Dual-site setup?

  • A. 0
  • B. 1
  • C. 4 per Security Group
  • D. 2 per Security Group

正解：C

解説：
Explanation
A Dual Site setup can have either two or four orchestrators, depending on the scenario. However, the maximum number of orchestrators per Security Group is four, regardless of the number of sites. This is because each Security Group can have up to two orchestrators on each site, and each site can have up to two orchestrators. Therefore, the maximum number of orchestrators in a Dual Site setup is four per Security Group.
References =
*Maestro Frequently Asked Questions (FAQ)
*Maestro Dual Site configuration with a direct connection through L2 switches
*Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)


質問 # 27
At a minimum, how many management and Uplink ports does a SG require?

  • A. One each.
  • B. Only one of the two interfaces is needed for the Security Group.
  • C. Neither are required.
  • D. Two of each.

正解：A

解説：
Explanation
A Security Group (SG) requires at least one management port and one uplink port to function properly. The management port is used to connect the SG to the Maestro Hyperscale Orchestrator (MHO) and the customer's management infrastructure, such as SmartConsole or SmartDomain Manager. The uplink port is used to connect the SG to the customer's network infrastructure, such as switches, routers, or firewalls. The uplink port is also used to send and receive traffic from the customer's network to the SG.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 41
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline


質問 # 28
Which distribution mode assigns packets to an SGM based solely on the packet destination IP?

  • A. Manual mode
  • B. Auto-topology mode
  • C. User mode
  • D. Network mode

正解：D

解説：
Explanation
Network mode is the distribution mode that assigns packets to an SGM based solely on the packet destination IP. In this mode, the Orchestrator uses a hash function to map each destination IP to a specific SGM. This mode ensures that all packets with the same destination IP are processed by the same SGM, regardless of the source IP or port. This mode is suitable for scenarios where the destination IP is the main factor for load balancing, such as NAT or VPN.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-19
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Maestro basic setup documentation - Page 2 - Check Point CheckMates


質問 # 29
When a VPN tunnel is formed with a Maestro SGM,

  • A. The receiving SGM makes an encryption decision. The SGM then syncs the traffic to two backup SGMs: one for clear traffic and one for encrypted traffic.
  • B. The MHO handles the IKE before distributing the traffic to a SGM to handle all encrypted traffic. This helps to prevent any issues with the correction layer.
  • C. SGM 1 analyzes the policy and topology. If encryption is required, it calculates the tunnel owner's IP address. SGM 1 sends a clear packet to the tunnel owner. SGM 2 is now the connectionand tunnel owner.
  • D. The MHO distributes copies of the packets to two different SGMs because SGM 1 will handle the clear traffic IKE exchange packets, while SGM2 handles encrypted packets.

正解：B

解説：
Explanation
In scalable security environments, initial IKE (Internet Key Exchange) handling by a central orchestrator before distributing traffic for encryption is a common approach to maintain efficiency and security.


質問 # 30
What is a security group?

  • A. A set of network interfaces and individual SGMs assigned to a logical group.
  • B. A solution for Security Gateway redundancy and Load Sharing.
  • C. A set of objects in SmartConsole that are responsible for enforcing an access policy.
  • D. A set of appliances of the same model that are collectively managed by the MHO.

正解：B

解説：
Explanation
Security groups are used to simplify management and policy enforcement across multiple devices or network segments, often offering redundancy and load balancing features


質問 # 31
......

最新の100%合格保証付きの素晴らしい156-836試験問題PDF：https://www.passtest.jp/CheckPoint/156-836-shiken.html

練習サンプルと問題集と秘訣には2024年最新の156-836有効なテスト問題集：https://drive.google.com/open?id=1wgaZrszu-XhVkd71KY98QCMsFh3uEKmM

関するブログ

もっと
156-836 無料問題集