• ホーム
  • ブログ
  • 156-836 PDFで合格させるスゴ問題集で156-836最新のリアル試験問題 [Q24-Q46]

156-836 PDFで合格させるスゴ問題集で156-836最新のリアル試験問題 [Q24-Q46]

Share

156-836 PDFで合格させるスゴ問題集で156-836最新のリアル試験問題

有効な156-836テスト解答156-836試験PDF問題を試そう

質問 # 24
When a VPN tunnel is formed with a Maestro SGM,

  • A. The MHO handles the IKE before distributing the traffic to a SGM to handle all encrypted traffic. This helps to prevent any issues with the correction layer.
  • B. SGM 1 analyzes the policy and topology. If encryption is required, it calculates the tunnel owner's IP address. SGM 1 sends a clear packet to the tunnel owner. SGM 2 is now the connectionand tunnel owner.
  • C. The MHO distributes copies of the packets to two different SGMs because SGM 1 will handle the clear traffic IKE exchange packets, while SGM2 handles encrypted packets.
  • D. The receiving SGM makes an encryption decision. The SGM then syncs the traffic to two backup SGMs: one for clear traffic and one for encrypted traffic.

正解：A

解説：
Explanation
In scalable security environments, initial IKE (Internet Key Exchange) handling by a central orchestrator before distributing traffic for encryption is a common approach to maintain efficiency and security.


質問 # 25
What kinds of transceivers are supported on Orchestrator MHO-140?

  • A. SFP, SFP+, SFP28
  • B. SFP+, SFP28, QSFP
  • C. SFP, SFP+, QSFP, QSFP28
  • D. SFP, QSFP, QSFP28

正解：A

解説：
Explanation
According to the Maestro Hyperscale Orchestrator Datasheet1, the Orchestrator MHO-140 supports the following transceiver types: SFP, SFP+, SFP28. These transceivers can be used for the management, uplink, and downlink ports of the Orchestrator. The SFP transceivers support 1 GbE, the SFP+ transceivers support 10 GbE, and the SFP28 transceivers support 25 GbE.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 42
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline3
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software, page 2


質問 # 26
What is the max amount of Orchestrators in Dual-site setup?

  • A. 4 per Security Group
  • B. 2 per Security Group
  • C. 0
  • D. 1

正解：A

解説：
Explanation
A Dual Site setup can have either two or four orchestrators, depending on the scenario. However, the maximum number of orchestrators per Security Group is four, regardless of the number of sites. This is because each Security Group can have up to two orchestrators on each site, and each site can have up to two orchestrators. Therefore, the maximum number of orchestrators in a Dual Site setup is four per Security Group.
References =
*Maestro Frequently Asked Questions (FAQ)
*Maestro Dual Site configuration with a direct connection through L2 switches
*Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)


質問 # 27
What cannot be a reason for "Failed to get remote orchestrator interfaces" error message, when clicking on
"Orchestrator" in WebUI

  • A. No Sync between orchestrators
  • B. Remote orchestrator has no empty interfaces
  • C. One orchestrator only, but Orchestrator amount is 2 or no Sync in between orchestrators
  • D. Single orchestrator environment, but configured Orchestrator amount is 2

正解：B

解説：
Explanation
One of the possible reasons for the "Failed to get remote orchestrator interfaces" error message, when clicking on "Orchestrator" in WebUI, is that the remote orchestrator has no empty interfaces that can be assigned to a security group. This can happen if all the interfaces on the remote orchestrator are already part of configured security groups, or if the remote orchestrator has no physical interfaces at all. In this case, the WebUI cannot display the unassigned interfaces of the remote orchestrator, and shows the error message.
References
*Not able to see unassigned interfaces on checkpoint Orchestrator
*Maestro 140 not detecting Interfaces
*Maestro Expert (CCME) Course - Check Point Software, page


質問 # 28
How does HyperSync work in a Dual Site environment?

  • A. Each active connection has two local backups (on the local site) and a third backup connection on the second site (remote site.)
  • B. Each active connection has a local backup (on the local site) and a second backup connection on each of the MHOs.
  • C. Each active connection has a local backup (on the local site) and a second backup connection on the second site (remote site.)
  • D. Each active connection has a backup connection on the second site (remote site.)

正解：C

解説：
Explanation
HyperSync is a feature of Maestro that enables stateful synchronization of connections and resources across different sites in a Dual Site environment. HyperSync works by creating two backup connections for each active connection: one on the same site as the active connection, and another on the remote site. This ensures that the connection can be seamlessly resumed in case of a failover event, either within the same site or across the sites. HyperSync uses the Site-Sync port and VLANs to transmit the synchronization packets between the Security Group Members and the Maestro Orchestrators.
References =
*Maestro Dual Site configuration with a direct connection through L2 switches
*Maestro Frequently Asked Questions (FAQ)
*CHECK POINT MAESTRO EXPERT


質問 # 29
Which licenses should be issued for the Orchestrator?

  • A. No licenses are required for Orchestrator
  • B. The Orchestrator is considered a Management server, hence it's licensed the same way
  • C. Depends on Software Blades enabled on connected appliances
  • D. The Orchestrator requires NGTX license

正解：A

解説：
Explanation
Orchestrators in many network environments do not require separate licenses, as they primarily function to manage and distribute network traffic.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 1: Introduction to Check Point Maestro, Lesson 1.2: Maestro Licensing, page 1-8
*Check Point R81 Maestro Administration Guide, Chapter 1: Introduction to Check Point Maestro, Section:
Maestro Licensing, page 1-6
*Activation of a Quantum Maestro Orchestrator - Check Point Software


質問 # 30
What happens if you apply a hotfix using gClish?

  • A. Logical groups "A" and "B" are created. Members of group "A" install and reboot first. Then members of group "B" does the same once reboots have finished with group "A."
  • B. If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.
  • C. If you apply a hotfix using gclish, the operation will fail because an outage would occur.
  • D. If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.

正解：A

解説：
Explanation
This is the correct answer because it describes the hotfix installation process using gClish on a Maestro Security Group. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. When a hotfix is applied using gClish, the SG members are divided into two logical groups: "A" and "B". The members of group "A" install the hotfix and reboot first, while the members of group "B" wait for their turn. After all the members of group "A" are back online, the members of group
"B" install the hotfix and reboot.This way, the SG maintains high availability and does not cause an outage.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates


質問 # 31
What is a security group?

  • A. A set of network interfaces and individual SGMs assigned to a logical group.
  • B. A solution for Security Gateway redundancy and Load Sharing.
  • C. A set of appliances of the same model that are collectively managed by the MHO.
  • D. A set of objects in SmartConsole that are responsible for enforcing an access policy.

正解：B

解説：
Explanation
Security groups are used to simplify management and policy enforcement across multiple devices or network segments, often offering redundancy and load balancing features


質問 # 32
After you import the R81.10 software package, what do you use to verify that it is possible to upgrade an MHO or SG?

  • A. Nothing. CPUSE will run a verification during the upgrade process to ensure the package is compatible.
  • B. The package is verified during the import process and a warning or error will be displayed at that time.
  • C. Run HCP. One of the tests will list upgrade eligibility status for the MHO or SG.
  • D. Run the Pre-Upgrade Verifier to make sure it is possible to upgrade

正解：D

解説：
Explanation
The Pre-Upgrade Verifier is a tool that checks the compatibility and readiness of the Maestro environment for the upgrade process. It verifies the current version, the target version, the hardware requirements, the configuration settings, and the license validity of the Maestro Orchestrators and the Security Groups. It also identifies any potential issues or risks that might affect the upgrade and provides recommendations on how to resolve them. The Pre-Upgrade Verifier should be run before importing the R81.10 software package and before performing the actual upgrade.
References =
*Check Point R81.10 for Scalable Platforms - Check Point Software
*CHECK POINT MAESTRO EXPERT


質問 # 33
The core four manual diagnostic tools include:
asg diag verify, asg perf -v, orch_stat -all, and

  • A. cpinfo
  • B. hcp -r all
  • C. asg stat -v
  • D. asg diag verify

正解：C

解説：
Explanation
"Asg stat -v" could be a part of the core diagnostic tools, providing valuable statistics and information for manual diagnostics.
References =
*Maestro Expert (CCME) Course - Check Point Software 3
*Check Point Maestro R81.X Administration Guide 1
*Check Point Maestro R81.X Getting Started Guide 2
3: https://www.checkpoint.com/downloads/training/ccme-maestro-expert-r81.10-course.pdf 1:
https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame


質問 # 34
While looking at your system's correction statistics, you notice you have a correction rate approaching 100 percent. Is this a problem?

  • A. In some scenarios, a correction rate approaching 100 percent of all connections is not unusual. This is not usually a cause for concern as the correction mechanism is fast and efficient.
  • B. If correction rates are higher than 80 percent, latency is expected.
  • C. A correction rate above 90 percent indicates a need to disable Layer 4 Distribution.
  • D. A correction rate approaching 100 percent of all connections is unusual. This is a cause for concern because the SGMs may fail to process traffic.

正解：D

解説：
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23 3
*Check Point Maestro Frequently Asked Questions (FAQ), question 9 4
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
4:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=


質問 # 35
What is the maximum number of Appliances within Security group in Dual-Site configuration?

  • A. 0
  • B. 1
  • C. 2
  • D. 3

正解：A


質問 # 36
What does the lldpctl command do?

  • A. Show all devices discovered by LLDP protocol on downlink ports
  • B. Show all devices discovered by LLDP protocol on uplink ports
  • C. Discover orchestrators
  • D. Show all devices discovered by LLDP protocol on all ports

正解：D

解説：
Explanation
The lldpctl command is a tool to display information about the devices discovered by the Link Layer Discovery Protocol (LLDP) on all ports of the Maestro Orchestrator and the Security Group Members. LLDP is a protocol that enables devices to exchange information about their identity, capabilities, and configuration.
LLDP can help to discover the topology and connectivity of the Maestro environment.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.2: LLDP, page 4-9
*Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
LLDP, page 3-9


質問 # 37
The drop_monitor command is useful for

  • A. Monitoring Check Point code drops
  • B. Viewing all interface drops such as RX-ERR, RX-DRP, and RX-OVR
  • C. Viewing all drops by Check Point code or the Gaia OS, such as RX-DRP, RX-ERR, and Gaia OS drops.
  • D. Showing the system temperature in real-time for multiple components, such as CPU, fan, and SSDs.

正解：C

解説：
Explanation
The drop_monitor command is a tool that monitors and displays the packets that are dropped by the Check Point code or the Gaia OS on the orchestrator and the appliances. It can help troubleshoot network issues and optimize performance. The command shows the drop reason, source, destination, protocol, and port of the dropped packets, as well as the interface and the module that dropped them.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates1
*Support, Support Requests, Training ... - Check Point Software2
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge


質問 # 38
In a dual MHO environment, MHO1 and MHO2 are connected to the SGM line cards in which way?

  • A. MHO1 and MHO2 are connected to the SGMs using the Sync cable.
  • B. MHO1 and MHO2 are connected to the line cards in any order administrators see fit.
  • C. MHO 1 is connected to the odd-numbered ports, while MHO2 is connected to even-numbered ports.
  • D. MHO 1 is connected to the even-numbered ports, while MHO2 is connected to odd-numbered ports.

正解：D

解説：
Explanation
The correct way to connect MHO1 and MHO2 to the SGM line cards in a dual MHO environment is to use the even-numbered ports for MHO1 and the odd-numbered ports for MHO2. This is to ensure that each SGM has two downlinks to each MHO, and that the downlinks are balanced across the different NICs and links. This provides redundancy and high availability for the traffic flow between the SGMs and the MHOs.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*Maestro Expert (CCME) Course - Check Point Software, page 18
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 16


質問 # 39
HealthCheck Point _____

  • A. is a self-updatable suite of tools for MHOs with the capability to assess the health of the system and provide a timeline of critical and informative events that might have occurred in a production system.
  • B. is a self-updatable suite of tools for SGMs with the capability to assess the health of the system, visualize the Firewall topology, provide a timeline of critical and informative events that might have occurred in a production system.
  • C. performs a system health check and is meant to replace both a CPInfo and the health check script.
  • D. can be used to let you visualize the Firewall topology for the SG and view live statistics, which includes throughput, problem notes, and CPU utilization.

正解：B

解説：
Explanation
HealthCheck Point (HCP) is a tool that can perform various tests and checks on the system components of the Security Group Modules (SGMs), such as hardware, software, network, clock,ARP, and more. It can also display the performance statistics of the SGMs, such as throughput, packet rate, CPU utilization, memory usage, and more. Additionally, HCP can provide a graphical representation of the Firewall topology for the Security Group, showing the connections and statuses of the SGMs and the Orchestrators. Furthermore, HCP can generate a report of the critical and informative events that occurred on the system, such as configuration changes, errors, warnings, and alerts. HCP can help identify and troubleshoot any issues or errors that may affect the system functionality or performance.
References =
*HealthCheck Point (HCP) Release Updates - Check Point Software 1
*Professional Services Healthcheck - Check Point Software 2
*HealthCheck Point - Check Point CheckMates 3


質問 # 40
Which blade configuration files should be backed up on the SG if upgrading from R80.30SP or earlier?

  • A. IPS configuration files
  • B. fwkern.conf files.
  • C. VPN configuration files
  • D. Mobile Access configuration files.

正解：A

解説：
Explanation
References
*Maestro R80.30SP Jumbo Hotfix Accumulator, Section: Important Notes
*Check Point Maestro R80.30SP with Gaia 3.10, Section: Known Limitations
*Check Point SNMP MIB files, Section: Revision History


質問 # 41
Layer 4 distribution is enabled by default in Maestro. Which is not a scenario when you would want to leave this enabled?

  • A. When the SG is NATing a very high percentage of traffic passing through it.
  • B. When there is a large number of source ports in use by protocols such as HTTP, HTTPS, and DNS.
  • C. When dynamic routing protocols, such as BGP or OSPF are used.
  • D. When there is a heavy imbalance of traffic between the SGMs that are members of the same SG.

正解：C

解説：
Explanation
This is the correct answer because Layer 4 distribution is not recommended when dynamic routing protocols are used in Maestro. Layer 4 distribution is a feature that adds the source and/or destination ports to the distribution equation, which can improve the load balancing among the SGMs. However, it can also cause issues with the correction layer, which is a mechanism that ensures the packets are processed by the correct SGM. Dynamic routing protocols, such as BGP or OSPF, use specific ports to exchange routing information and establish neighbor relationships. If Layer 4 distribution is enabled, it can interfere with the routing protocol packets and cause routing instability or failures.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-20
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-8
*Layer 4 Distribution - Yes or No? - Check Point CheckMates
*Support, Support Requests, Training ... - Check Point Software


質問 # 42
Which distribution mode assigns packets to an SGM based solely on the packet destination IP?

  • A. User mode
  • B. Network mode
  • C. Auto-topology mode
  • D. Manual mode

正解：B

解説：
Explanation
Network mode is the distribution mode that assigns packets to an SGM based solely on the packet destination IP. In this mode, the Orchestrator uses a hash function to map each destination IP to a specific SGM. This mode ensures that all packets with the same destination IP are processed by the same SGM, regardless of the source IP or port. This mode is suitable for scenarios where the destination IP is the main factor for load balancing, such as NAT or VPN.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-19
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Maestro basic setup documentation - Page 2 - Check Point CheckMates


質問 # 43
Is it possible to define distribution mode per interface?

  • A. No, only for the Security Group
  • B. Yes, only for uplink interfaces
  • C. Yes, for both uplink and downlink interfaces
  • D. Yes, only for downlink interfaces

正解：C

解説：
Explanation
Maestro allows you to define the distribution mode per interface, which determines how traffic is distributed among the Security Group Modules (SGMs) in a Security Group. You can configure the distribution mode for each interface individually, or use the default mode for all interfaces. The distribution mode can be set for both uplink and downlink interfaces.
References =
*Check Point Maestro R81.X Administration Guide, page 62, section "Distribution Mode" 1
*Check Point Maestro R81.X Getting Started Guide, page 25, section "Distribution Mode" 2
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame


質問 # 44
What is the default Distribution mode?

  • A. User
  • B. Network
  • C. Auto-topology
  • D. Manual-General

正解：C

解説：
Explanation
Auto-topology is the default distribution mode for Maestro Security Groups. In this mode, the Orchestrator assigns packets to a Security Group Member based on the topology of the port defined in the gateway object.
Each port is either in user mode or network mode depending on the topology. User mode means that the port is connected to the internal network and network mode means that the port is connected to the external network.
The Orchestrator uses a hash function to map each source IP or destination IP to a specific SGM, depending on the mode of the port. This mode ensures that all packets with the same source IP or destination IP are processed by the same SGM, regardless of the port or protocol.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-18
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Lari Luoma | Lead Consultant | Maestro SME | Check Point Evangelist1, slide 16


質問 # 45
When security policy is installed

  • A. All SGMs receive the security policy and one by one performs an independent policy verification. Then, all SGMs simultaneously install the policy.
  • B. The policy is installed on the SMO, the SMO Master broadcasts the available package, other members retrieve the new policy from the SMO Master and perform an independent policy verification, then the non-SMO Master SGMs install the policy.
  • C. The SMO Master receives the policy and performs a policy verification the policy is installed on the SMO Master, the SMO Master broadcasts the available package, other membersretrieve the new policy from the SMO Master, then the non-SMO Master SGMs install the policy.
  • D. All SGMs receive the security policy and simultaneous policy installation occurs.

正解：C

解説：
Explanation
This is the correct answer because it describes the security policy installation flow for a Maestro Security Group. The SMO Master is the Security Group Member that acts as the leader and the single point of contact for the Management Server. The SMO Master verifies the policy and installs it first, then notifies the other SGMs that a new policy is available. The other SGMs fetch the policy from the SMO Master and install it in parallel.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.3: Security Policy Installation, page 2-15
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Security Policy Installation, page 2-13
*Policy installation flow - Check Point Software


質問 # 46
......


CheckPoint Certified Maestro Expert（CCME）認定は、サイバーセキュリティソリューションの大手プロバイダーであるCheckPointが提供する高度なレベル認証プログラムです。この認定プログラムは、CheckPointのMaestroテクノロジーを使用して複雑なセキュリティアーキテクチャの展開と管理に関する豊富な知識と経験を持つ専門家向けに設計されています。

 

156-836問題集はあなたの合格を必ず保証します：https://www.passtest.jp/CheckPoint/156-836-shiken.html

156-836テスト問題集とオンライン試験エンジン：https://drive.google.com/open?id=1VVJNV1EdhXTY88hVx0e0RRk6lb2F2y24

関するブログ

もっと
156-836 無料問題集