156-587 Check Point Certified Troubleshooting Expert - R81.20 (CCTE) Questions and Answers

 Identity Awareness is a feature that enables the Security Gateway to identify users and groups behind IP addresses, and apply security policies based on their identity12. Identity Awareness uses different methods to acquire identities, such as AD Query, Identity Collector, and Browser-Based Authentication12. To debug Identity Awareness issues, you need to use the command pdp debug on the gateway, where pdp stands for Policy Decision Point, the component that handles the identity acquisition and enforcement13. The command pdp debug has different flags for different identity sources, such as adlog for AD Query, ic for Identity Collector, and nac for Browser-Based Authentication13. The flag extended enables more detailed debug output13. Therefore, the correct command to debug the problem of users not being able to browse internet sites with Identity Awareness using AD Query, Identity Collector, and Browser-Based Authentication is pdp debug nac extended on the gateway13. The other options are incorrect because they either use the wrong command (ad debug instead of pdp debug), the wrong flag (ad query instead of nac), or the wrong location (on the management instead of on the gateway). References:

1: CCTE Courseware, Module 9: Advanced Identity Awareness Troubleshooting, Slide 4

2: Check Point R81 Identity Awareness Administration Guide, Chapter 1: Introduction to Identity Awareness, Page 7

3: Check Point R81 Identity Awareness Administration Guide, Chapter 5: Troubleshooting Identity Awareness, Page 49

The fw monitor command is a powerful troubleshooting tool in Check Point Gateways that captures packets at various points in the processing chain. The question asks how to capture trafficpre-inbound(before inbound processing, i.e., at the “i” inspection point) andbefore the VPN module(before VPN decryption or processing).

The fw monitor syntax allows specifying inspection points using options like -pi (pre-inbound) and module names (e.g., -vpn for the VPN module). The correct syntax to capture traffic before a specific module is -pi -, where the module name is prefixed with a minus sign to indicate “before” the module.

Option A: Incorrect. fw monitor -p all captures packets at all inspection points in the chain, which includes pre-inbound, post-inbound, pre-outbound, and post-outbound points, as well as points around all modules. This is too broad and does not specifically target pre-inbound and before the VPN module.

Option B: Correct. fw monitor -pi -vpn captures packets at the pre-inbound inspection point (“i”) and before the VPN module (-vpn). The -pi specifies the pre-inbound point, and -vpn ensures the capture occurs before VPN processing (e.g., decryption).

Option C: Incorrect. fw monitor -pi +vpn would capture packets at the pre-inbound point butafterthe VPN module (+vpn indicates after the module), which contradicts the requirement to capturebeforethe VPN module.

Option D: Incorrect. This option is a duplicate of Option C in the provided question, likely a typographical error. Even if corrected, +vpn is incorrect for the same reason as Option C.

The Core Dump Manager (CDM) is a utility that helps manage core dump files on Check Point systems. Its main functions include:  

Limiting file size and number:CDM can be configured to limit the size of individual core dump files and the total amount of disk space used for core dumps. This prevents core dumps from filling up valuable disk space.  

Compression:CDM can compress core dump files to reduce their storage size. This is particularly helpful when dealing with large core dumps.  

Process filtering:CDM allows you to specify which processes should be allowed to generate core dumps. This can help prevent unnecessary core dumps from being created.  

Remote collection:CDM can be configured to send core dump files to a remote server for analysis. This is useful in environments where direct access to the system generating the core dump is limited.

By using CDM, you can effectively manage core dump files and ensure that they are not overwhelming your system's resources.

 The CPD process controls logging on the Security Management Server or the Log Server. It is responsible for receiving logs from the Security Gateways, storing them in the log files, and forwarding them to the SmartLog and SmartEvent servers. It also handles the communication with the SmartConsole clients and the CPM process. The CPD process runs on the Security Management Server or the Log Server as part of the Management High Availability module.

The PDP process is the Identity server, which is a component of the Identity Awareness blade on the Security Gateway. The PDP process is responsible for collecting and managing identity information from various sources, such as Active Directory, Identity Agents, Captive Portal, Terminal Servers, and RADIUS. The PDP process also communicates with the PEP process, which is the Policy Enforcement Point, to enforce identity-based policies on the traffic passing throughthe Security Gateway1. The other options, such as Log Sifter, Captive Portal Service, andUserAuth Database, are either not related to Identity Awareness or not processes, but rather files or services. References: 1: sk93046: Identity Awareness - How to Configure

In Check Point’s Security Management Architecture, SmartConsole is the graphical user interface used to manage the Security Management Server. The communication between SmartConsole and the Security Management Server relies on specific processes and ports, which are critical for troubleshooting connectivity issues.

TheCPM (Check Point Management)process is the primary process on the Security Management Server responsible for handling management operations, including interactionswith SmartConsole. The default port for this communication is18190(TCP), used for the SIC (Secure Internal Communication) and management GUI connections.

Option A: Correct. SmartConsole communicates with the Security Management Server using the CPM process over port 18190. This port is used for GUI client connections to the management server.

Option B: Incorrect. The FWM (Firewall Management) process is an older process used in earlier Check Point versions (pre-R80) for management tasks. In R81.20, CPM has largely replaced FWM for SmartConsole communications. Additionally, port 19009 is used for other purposes, such as the Check Point REST API, not SmartConsole.

Option C: Incorrect. While CPM is the correct process, port 19009 is not used for SmartConsole communication. Port 19009 is associated with the Check Point Management API (e.g., for mgmt_cli or REST API calls).

Option D: Incorrect. While CPM is involved, SmartConsole does not use both ports 19009 and 18191. Port 18191 is typically used for log server communications (e.g., SmartConsole to Log Server), not direct management server communication.

 The four main database domains are System, User, Global, and Log. Each domain contains different types of data and serves different purposes123. The System domain contains the configuration data of the Security Management Server (SMS), such as the SMS name, IP address, licensing, and installed products. The User domain contains the configuration data of the security policy, such as the objects, rules, services, and VPN communities. The Global domain contains the configuration data of the global policy, such as the global objects, rules, and services. The Log domain contains the log data of the security events, such as the source, destination, action, and time of each event123. References:

1: CCTE Courseware, Module 3: Management Database and Processes, Slide 4

2: Check Point R81 Security Management Administration Guide, Chapter 2: Security Management Server, Page 14

3: Check Point R81 Security Management Administration Guide, Chapter 2: Security Management Server, Page 15

The correct command to enter the PostgreSQL interactive shell is psql_client cpm postgres. This command allows the administrator to view and manipulate the database of the Check Point Management (CPM) module, which stores the configuration and policy data. The psql_client command is a Check Point wrapper for the psql command, which is the native PostgreSQL interactive shell. The psql_client command takes two arguments: the first one is the name of the database module, and the second one is the name of the database user. In this case, the database module is cpm and the database user is postgres.

The other commands are incorrect because:

A. mysql_client cpm postgres is not a valid command. The mysql_client command is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL.

B. mysql -u root is not a valid command. The mysql command is used to access the MySQL database, which is not used by Check Point. The Check Point database is based on PostgreSQL, not MySQL. Moreover, the -u option specifies the MySQL user name, which is not relevant for Check Point.

D. psql_client postgres cpm is not a valid command. The psql_client command takes the database module name as the first argument, and the database user name as the second argument. In this case, the database module name is cpm and the database user name is postgres. The order of the arguments is reversed in this command.

The kernel component associated with Content Awareness and data collection from contexts (often provided by the Context Management Infrastructure - CMI) is dlpda.  

According to the Check Point R81.20 Quantum Security Gateway Administration Guide, within the listing of kernel modules, dlpda is described as follows:

Exact Extract:

Module "dlpda" (Data Loss Prevention - Download Agent for Content Awareness)

The dlpda module functions as a "Download Agent for Content Awareness." This role involves collecting data necessary for the Content Awareness blade to inspect and understand the content of traffic. The Content Awareness blade works in conjunction with the Context Management Infrastructure (CMI), which provides the initial context about the traffic. The dlpda component then uses these contexts to gather the relevant data for deeper inspection and to determine if the content matches any defined data types or policies. While the guide lists it as a "Module," exam questions in the CCTE context often refer to such components involved in kernel operations as "kernel processes." The function described clearly aligns with collecting data for Content Awareness.  

Options analysis:

A. PDP (Policy Decision Point): This process is primarily associated with Identity Awareness for making access decisions based on user identity, not directly for Content Awareness data collection from CMI contexts.

B. cpemd (Check Point Endpoint Management Daemon): This daemon is related to endpoint security management and does not fit the role of a kernel process for gateway-level Content Awareness data collection.

D. CMI (Context Management Infrastructure): CMI is an infrastructure that provides contexts to various blades, including Content Awareness. It is the source of the contexts, not the kernel process that collects data based on those contexts.

Therefore, dlpda is the kernel component specifically tasked with collecting data for Content Awareness.

The correct Check Point command to display status and statistics information for various Check Point products and applications is cpstat. This command provides a dynamic real-time view of the system, showing the information such as the number of connections, packets, drops, CPU usage, memory usage, disk space, license status, and blade status. The cpstat command can be customized by using various options and flags to specify the product, the interval, the fields, and the format of the output. For example, to display the status and statistics of the firewall module every 5 seconds, the command would be:

cpstat fw -f all -i 5

The other commands are incorrect because:

A. CPview is a Check Point tool that displays information about the system performance, such as the CPU, memory, disk, network, and firewall. It does not show information about other products and applications, such as VPN, Identity Awareness, Anti-Virus, etc.

C. fwstat is not a valid command. The correct command is fw ctl pstat, which displays information about the firewall kernel, such as the number of connections, packets, drops, memory, and synchronization. It does not show information about other products and applications, such as VPN, Identity Awareness, Anti-Virus, etc.

D. CPstat is not a valid command. The correct command is cpstat, which is case-sensitive.

While specific Check Point CCTE R81.20 official documentation that explicitly singles out "Handlers" from the given options as the sole component for storing Rule Base matching state-related information is not readily available in the provided search snippets, CCTE exam preparation materials consistently point to "Handlers" as the correct answer for this question.

In the broader context of Check Point's packet processing and Unified Policy architecture, several components are involved in rule base matching:

According to Check Point's sk120964 - ATRG: Unified Policy (relevant for R81.20):

Connection/Transaction: This logical entity "Saves rulebase matching state and classification objects (CLOBs)."

Manager: This component acts as a "Mediator between other components. Responsible for the whole rule base execution process. Creates connection/transactions, as required. Sends logs."  

Classifiers: These are "CMI_LOADER applications" (e.g., Network, Identity, Application Control) that provide classification data (CLOBs) used in the matching process.

Observers: An "Observer is a unit collecting CLOBs for classification refinement."

"Handlers" in a general firewall architecture are typically components (which can be kernel modules or processes) responsible for managing active connections and their progression through policy enforcement. As such, they would inherently be involved in maintaining and accessing state information related to rule base matching for those connections. The "Connection/Transaction" objects, which store the rule base matching state, are created by the Manager and would be managed by such Handlers during the lifecycle of a connection.

Therefore, in the context of the CCTE R81.20 exam, "Handlers" are understood to be the packet processing components that store this Rule Base matching state-related information. The state itself is conceptually saved within Connection/Transaction objects, which are orchestrated by the Manager and utilized by various processing components often referred to as Handlers.

Reference (based on Unified Policy component roles from official Check Point documentation):

Check Point Support Center sk120964: ATRG: Unified Policy. (Last Modified: 2024-12-29, relevant for R81.20)."Connection/Transaction. Saves rulebase matching state and classification objects (CLOBs)."

"Manager. Mediator between other components. Responsible for the whole rule base execution process. Creates connection/transactions, as required.

 The CpmiHostCkp table in the Postgres database contains the data for CPMI objects, such as gateways, clusters, and servers. The table column that should be selected to query for the object instance is the objid column, which is the primary key of the table and uniquely identifies each object. The objid column can be used to join with other tables that reference CPMI objects, such as CpmiClusterMember, CpmiCluster, and CpmiServer. The objid column can also be used to retrieve the object name, IP address, type, and other attributes from the CpmiHostCkp table itself. References:

Check Point Database Tool (GuiDBedit Tool) - Section: How to use the Check Point Database Tool (GuiDBedit Tool) - Subsection: How to view the data in the database

Check Point Certified Troubleshooting Expert (CCTE) - Exam Topics - Module 6: Advanced Management Server Troubleshooting

[Check Point R81 Database Schema] - Section: CPMI Tables - Subsection: CpmiHostCkp Table

SmartEvent is a unified security event management and analysis solution that collects and analyzes data from multiple sources to identify and respond to security threats. SmartEvent consists of three main components: Log Server, Correlation Unit, and SmartEvent Server1. The three main processes that govern these SmartEvent components are:

eventiasv: This process is responsible for indexing the logs received from the Log Server and storing them in the SmartEvent database. It also performs log consolidation and compression to optimize the diskspace usage2.

eventiarp: This process is responsible for running the predefined and custom correlation rules on the indexed logs and generating security events based on the rule criteria. It also sends notifications and triggers automatic responses for the security events3.

eventiacu: This process is responsible for providing the web-based user interface for SmartEvent, which allows the administrators to view, analyze, and manage the security events. It also provides the SmartEvent API for external integration4. References: Check Point Processes and Daemons5, SmartEvent Administration Guide1

1: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/html_frameset.htm  2: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.htm#_Toc64167467  3: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SmartEvent_Adm inGuide/Content/Topics-SmartEvent/SmartEvent-Components.htm#_Toc64167468 4: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SmartEvent_AdminGuide/Content/Topics-SmartEvent/SmartEvent-Components.htm#_Toc64167469  5: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails= &solutionid=sk97638

When a Security Gateway performs a URL lookup and the URL is not found in the local caches, a request for online categorization is necessary. This process involves the Resource Advisor Daemon (RAD), which has components in both kernel space and user space.

Based on descriptions of the URL Filtering categorization process (often cited in CCTE R81.20 materials):

A client (internal component, potentially the URLF Kernel Client or a similar kernel module handling the traffic) initiates a URL lookup.

The URL is first checked against kernel caches.

If the URL is not found in the kernel cache (a cache miss), the RAD kernel component is notified.

The client component then typically sends an asynchronous request to the RAD kernel component.

The RAD Kernel Space component is then responsible for forwarding this request to the RAD User Space module.

The RAD User Space module handles the actual online categorization, often by querying the URLF Online Service (Check Point's cloud-based categorization service).

The result is then returned, and the kernel cache is updated.

The question asks where the sync-request (or a request requiring immediate online lookup) is forwarded from. In this flow, the RAD Kernel Space acts as the intermediary that forwards the request from the initial kernel-level lookup mechanism to the user-space RAD process for further handling.

Supporting Information (derived from CCTE R81.20 related materials/discussions):

The typical flow for URL categorization when an online lookup is needed involves these steps:

"The kernel cache notifies the RAD kernel of hits and misses."

"The client sends an a-sync request back to RAD if the URL was not found." (This request goes to the RAD Kernel Space).

"The a-sync request is forwarded to the RAD User space via the RAD kernel for online categorization."

This indicates that the RAD Kernel (RAD Kernel Space) is the component that forwards the request to the RAD User Space.

Therefore, if a sync-request (a request needing immediate online lookup) is required, it is forwarded from the RAD Kernel Space to the RAD User Space.

Reference Context (based on CCTE R81.20 materials and general Check Point URL Filtering architecture):

Discussions and explanations related to Check Point Certified Troubleshooting Expert (CCTE) R81.20 curriculum often detail this RAD architecture. For example, study materials might state: "RAD has a kernel module that looks up the kernel cache, notifies client about hits and misses and forwards a-sync requests to RAD user space module which is responsible for online categorization." The 1 "RAD kernel module" corresponds to the RAD Kernel Space, and it is this component that performs the forwarding action to the RAD User Space.(Exact page numbers like "CCTE R81.20, p338/339" have been referenced in public CCTE exam discussions pointing to this flow)

The ADLOG function receives the AD log event information from the Domain Controllers. The ADLOG function is part of the Identity Awareness feature that enablesthe Security Gateway to identify users and machines in the network and enforce Access Control policy rules based on their identities. The ADLOG function uses the AD Query (ADQ) method to connect to the Active Directory Domain Controllers using WMI and subscribe to receive Security Event logs that are generated when users perform login. The ADLOG function then extracts the user and machine information that maps to an IP address from the event logs and sends it to the PEP function, which enforces the policy based on the identity information.

When troubleshootingcrasheson a Security Gateway (or any Linux-based system), the file type that is typically generated and used for in-depth analysis is acore dump.

A core dump captures the memory state of a process at the time it crashed and is critical for root-cause analysis.

Other options:

A. tcpdump: A packet capture file, not a crash-related file.

C. fw monitor: A Check Point packet capture tool, but not for crash debugging.

D. CPMIL dump: Not a common or standard crash dump reference in Check Point.