2026 Updated CheckPoint 156-836 Dumps PDF - Want To Pass 156-836 Fast
156-836 Practice Exam Dumps - 99% Marks In CheckPoint Exam
NEW QUESTION # 24
HealthCheck Point _____
- A. is a self-updatable suite of tools for SGMs with the capability to assess the health of the system, visualize the Firewall topology, provide a timeline of critical and informative events that might have occurred in a production system.
- B. is a self-updatable suite of tools for MHOs with the capability to assess the health of the system and provide a timeline of critical and informative events that might have occurred in a production system.
- C. can be used to let you visualize the Firewall topology for the SG and view live statistics, which includes throughput, problem notes, and CPU utilization.
- D. performs a system health check and is meant to replace both a CPInfo and the health check script.
Answer: A
Explanation:
HealthCheck Point (HCP) is a tool that can perform various tests and checks on the system components of the Security Group Modules (SGMs), such as hardware, software, network, clock, ARP, and more. It can also display the performance statistics of the SGMs, such as throughput, packet rate, CPU utilization, memory usage, and more. Additionally, HCP can provide a graphical representation of the Firewall topology for the Security Group, showing the connections and statuses of the SGMs and the Orchestrators. Furthermore, HCP can generate a report of the critical and informative events that occurred on the system, such as configuration changes, errors, warnings, and alerts. HCP can help identify and troubleshoot any issues or errors that may affect the system functionality or performance.
References =
*HealthCheck Point (HCP) Release Updates - Check Point Software 1
*Professional Services Healthcheck - Check Point Software 2
*HealthCheck Point - Check Point CheckMates 3
NEW QUESTION # 25
In a dual MHO environment, MHO1 and MHO2 are connected to the SGM line cards in which way?
- A. MHO1 and MHO2 are connected to the SGMs using the Sync cable.
- B. MHO1 and MHO2 are connected to the line cards in any order administrators see fit.
- C. MHO 1 is connected to the even-numbered ports, while MHO2 is connected to odd-numbered ports.
- D. MHO 1 is connected to the odd-numbered ports, while MHO2 is connected to even-numbered ports.
Answer: C
Explanation:
Explanation
The correct way to connect MHO1 and MHO2 to the SGM line cards in a dual MHO environment is to use the even-numbered ports for MHO1 and the odd-numbered ports for MHO2. This is to ensure that each SGM has two downlinks to each MHO, and that the downlinks are balanced across the different NICs and links. This provides redundancy and high availability for the traffic flow between the SGMs and the MHOs.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*Maestro Expert (CCME) Course - Check Point Software, page 18
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 16
NEW QUESTION # 26
Multiple SGs can exist in a Dual Site environment. Each SG can be configured in one of three ways. Which is not one of those ways?
- A. Direct connectivity between Remote Site MHOs.2
- B. Two MHOs at same site connected to remote site MHOs via two different switches.
- C. Two MHOs connected to two MHOs via load balancers.
- D. Two MHOs at same site connected to remote site MHOs via single switch.
Answer: C
Explanation:
This is not one of the ways to configure a Security Group in a Dual Site environment, because load balancers are not required or supported for the inter-site communication between the Maestro Orchestrators (MHOs).
The MHOs use the Site-Sync port and VLANs to synchronize the resources and connections across the sites.
The three valid scenarios for Dual Site configuration are:
*Direct connectivity between remote site Orchestrators: This scenario requires two orchestrators, one for each site, and a direct connection between them using the site-sync port.
*Two orchestrators on the same site are connected to the remote site orchestrators through two different switches: This scenario requires four orchestrators, two for each site, and a connection between them using the site-sync port and two external switches that support QinQ and MTU increment.
*Two orchestrators on the same site are connected to the remote site orchestrators through one switch: This scenario also requires four orchestrators, two for each site, and a connection between them using the site-sync port and one external switch that support QinQ and MTU increment.
References =
*Maestro Dual Site configuration with a direct connection through L2 switches
*[Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)]
*[Maestro Frequently Asked Questions (FAQ)]
NEW QUESTION # 27
What is a security group?
- A. A set of appliances of the same model that are collectively managed by the MHO.
- B. A solution for Security Gateway redundancy and Load Sharing.
- C. A set of objects in SmartConsole that are responsible for enforcing an access policy.
- D. A set of network interfaces and individual SGMs assigned to a logical group.
Answer: B
Explanation:
Security groups are used to simplify management and policy enforcement across multiple devices or network segments, often offering redundancy and load balancing features
NEW QUESTION # 28
Is it possible to define distribution mode per interface?
- A. Yes, only for uplink interfaces
- B. No, only for the Security Group
- C. Yes, only for downlink interfaces
- D. Yes, for both uplink and downlink interfaces
Answer: D
Explanation:
Maestro allows you to define the distribution mode per interface, which determines how traffic is distributed among the Security Group Modules (SGMs) in a Security Group. You can configure the distribution mode for each interface individually, or use the default mode for all interfaces. The distribution mode can be set for both uplink and downlink interfaces.
References =
*Check Point Maestro R81.X Administration Guide, page 62, section "Distribution Mode" 1
*Check Point Maestro R81.X Getting Started Guide, page 25, section "Distribution Mode" 2
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2: https://sc1.
checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frameset.htm
NEW QUESTION # 29
At a minimum, how many management and Uplink ports does a SG require?
- A. Only one of the two interfaces is needed for the Security Group.
- B. Neither are required.
- C. One each.
- D. Two of each.
Answer: C
Explanation:
A Security Group (SG) requires at least one management port and one uplink port to function properly. The management port is used to connect the SG to the Maestro Hyperscale Orchestrator (MHO) and the customer' s management infrastructure, such as SmartConsole or SmartDomain Manager. The uplink port is used to connect the SG to the customer's network infrastructure, such as switches, routers, or firewalls. The uplink port is also used to send and receive traffic from the customer's network to the SG.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 41
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
NEW QUESTION # 30
What is a security group?
- A. A set of appliances of the same model that are collectively managed by the MHO.
- B. A solution for Security Gateway redundancy and Load Sharing.
- C. A set of objects in SmartConsole that are responsible for enforcing an access policy.
- D. A set of network interfaces and individual SGMs assigned to a logical group.
Answer: B
Explanation:
Explanation
Security groups are used to simplify management and policy enforcement across multiple devices or network segments, often offering redundancy and load balancing features
NEW QUESTION # 31
What is the difference between Dual-Site and Dual-Room?
- A. Dual-Room is Active / Standby and Dual-Site is Active / Active
- B. Dual-Room is a Single-Site deployment where all Appliances are connected to both orchestrators
- C. Dual-Room is a kind of Dual-Site deployment within the same building
- D. They are the same
Answer: C
Explanation:
References =
*[Maestro Frequently Asked Questions (FAQ)]
*Maestro Dual Site configuration with a direct connection through L2 switches
*Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)
*CHECK POINT MAESTRO EXPERT
NEW QUESTION # 32
Which command do you use to find bottlenecks in the system that are affecting performance, even functionality in some cases?
- A. asg monitor
- B. asg perf -v
- C. asg diag verify
- D. asg stat -v
Answer: B
Explanation:
The asg perf -v command is used to find bottlenecks in the system that are affecting performance, even functionality in some cases. The asg perf -v command displays the performance statistics of the Security Group Modules (SGMs) in the Security Group, such as throughput, packet rate, CPU utilization, memory usage, and more. The asg perf -v command also shows the distribution mode and the correction rate of each SGM, which can indicate potential issues with asymmetric routing or load balancing. The asg perf -v command can help identify which SGMs are overloaded, underutilized, or misconfigured, and provide insights for troubleshooting and optimization.
References =
*Check Point Maestro R81.X Administration Guide, page 67, section "asg perf" 1
*Check Point Maestro R81.X Getting Started Guide, page 29, section "asg perf" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 26
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2: https://sc1.
checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frameset.htm
2: https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%
20Maestro%20under%20the%20hood%202022.pptx
NEW QUESTION # 33
Which command can be used during an upgrade to verify that the upgraded SGMs have returned to UP status before upgrading other SGMs?
- A. asg monitor
- B. asg stat -v
- C. cpview
- D. asg perf -v
Answer: B
Explanation:
The asg stat -v command is used to verify the status of Security Group Members (SGMs) during an upgrade in a Maestro environment. This command provides detailed status information, including whether SGMs are in the UP state, which is critical before proceeding with upgrades to other SGMs to ensure system stability and continuity.
Exact Extract:
"The command 'asg stat -v' can be used during an upgrade to verify that the upgraded Security Group Members (SGMs) have returned to UP status before upgrading other SGMs. This command provides a detailed view of the status of all SGMs in the Security Group, ensuring that the upgraded members are operational."
-Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.4: System Diagnostics, page 4-16
-Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: System Diagnostics, page 4-13 Explanation of Options:
* A. asg monitor: Incorrect, as asg monitor is used for real-time monitoring but does not provide detailed status verification for SGMs during upgrades.
* B. cpview: Incorrect, as cpview provides performance and system statistics but is not specific to verifying SGM status post-upgrade.
* C. asg perf -v: Incorrect, as asg perf -v focuses on performance metrics, not SGM status verification.
* D. asg stat -v: Correct, as this command is explicitly used to check the UP status of SGMs during upgrades, as per the documentation.
References:
Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.4: System Diagnostics, page 4-16 Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: System Diagnostics, page 4-13
NEW QUESTION # 34
While looking at your system's correction statistics, you notice you have a correction rate approaching 100 percent. Is this a problem?
- A. A correction rate above 90 percent indicates a need to disable Layer 4 Distribution.
- B. If correction rates are higher than 80 percent, latency is expected.
- C. In some scenarios, a correction rate approaching 100 percent of all connections is not unusual. This is not usually a cause for concern as the correction mechanism is fast and efficient.
- D. A correction rate approaching 100 percent of all connections is unusual. This is a cause for concern because the SGMs may fail to process traffic.
Answer: D
Explanation:
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23 3
*Check Point Maestro Frequently Asked Questions (FAQ), question 9 4
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
4:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
NEW QUESTION # 35
Multiple SGs can exist in a Dual Site environment. Each SG can be configured in one of three ways. Which is not one of those ways?
- A. Two MHOs at same site connected to remote site MHOs via two different switches.
- B. Direct connectivity between Remote Site MHOs.
- C. Two MHOs connected to two MHOs via load balancers.
- D. Two MHOs at same site connected to remote site MHOs via single switch.
Answer: C
Explanation:
Explanation
This is not one of the ways to configure a Security Group in a Dual Site environment, because load balancers are not required or supported for the inter-site communication between the Maestro Orchestrators (MHOs).
The MHOs use the Site-Sync port and VLANs to synchronize the resources and connections across the sites.
The three valid scenarios for Dual Site configuration are:
*Direct connectivity between remote site Orchestrators: This scenario requires two orchestrators, one for each site, and a direct connection between them using the site-sync port.
*Two orchestrators on the same site are connected to the remote site orchestrators through two different switches: This scenario requires four orchestrators, two for each site, and a connection between them using the site-sync port and two external switches that support QinQ and MTU increment.
*Two orchestrators on the same site are connected to the remote site orchestrators through one switch: This scenario also requires four orchestrators, two for each site, and a connection between them using the site-sync port and one external switch that support QinQ and MTU increment.
References =
*Maestro Dual Site configuration with a direct connection through L2 switches
*[Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)]
*[Maestro Frequently Asked Questions (FAQ)]
NEW QUESTION # 36
What is the purpose of g_tcpdump command?
- A. Collects traffic dump from Sync network
- B. Collects traffic dump from CIN network
- C. The same as tcpdump, just on Scalable Platform
- D. Collects traffic dump from all Active Appliances within Security Group
Answer: D
Explanation:
Explanation
_tcpdump" probably collects traffic dumps from all active appliances within a security group, aligning with the naming convention and function of similar commands in scalable platforms.
References
*Maestro Expert (CCME) Course - Check Point Software, page 331
*What is 'IN' and 'OUT' of g_tcpdump? - Check Point CheckMates2
*CHECK POINT MAESTRO EXPERT, page 23
NEW QUESTION # 37
What is the throughput penalty of Security Group?
- A. 10% per Security Group with no relation to the number of members
- B. 1% per member
- C. 5% per member
- D. Depends on the type of Appliance
Answer: B
Explanation:
Check Point reduced throughput degradation to 1% per added SGMs. For example, the overall throughput degradation is 10% for 10 SGMs in a Security Group. Check Point aims to reduce this even further in the future. https://supportcenter.checkpoint.com/supportcenter/portal?
eventSubmit_doGoviewsolutiondetails=&solutionid=sk147853
NEW QUESTION # 38
What Maestro component is automatically designated the SMO Master?
- A. The SGM with the highest member ID (the last one added to the security group.)
- B. The SGM with the lowest member ID (the first one added to the security group.)
- C. The first MHO configured is considered the SMO Master.
- D. The MDS that pushes policy to the SMO is considered the SMO Master.
Answer: B
Explanation:
Explanation
The SMO Master is the SGM that is responsible for synchronizing the configuration and policy with the other SGMs in the security group. The SMO Master is automatically designated as the SGM with the lowest member ID, which is usually the first one added to the security group. The SMO Master can be changed manually if needed.
References:
*Maestro Frequently Asked Questions (FAQ), under "What is a Single Management Object (SMO)?"
*Check Point Jump Start Course: Maestro, under "Maestro Security Groups"
NEW QUESTION # 39
What is the throughput penalty of Security Group?
- A. 10% per Security Group with no relation to the number of members
- B. 1% per member
- C. 5% per member
- D. Depends on the type of Appliance
Answer: B
Explanation:
Explanation
Check Point reduced throughput degradation to 1% per added SGMs. For example, the overall throughput degradation is 10% for 10 SGMs in a Security Group. Check Point aims to reduce this even further in the future.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
NEW QUESTION # 40
There are two 10Gbps dual-port NICs and one 40Gbps NIC installed on a 23800 Appliance in slots 1, 2 and 3 accordingly. Which interfaces should be connected to Orchestrator 1 for downlinks' intra- orchestrator redundancy when using two Orchestrators?
- A. Any pair of available ports
- B. Port 1 in Slot 2 and Port 2 in Slot 1
- C. Port 1 in Slot 1 and Port 2 in Slot 1
- D. This configuration is not supported
Answer: C
Explanation:
Explanation
This configuration likely provides balanced and redundant connectivity for orchestrator redundancy.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 3: Dual Orchestrator Environment, Lesson 3.1: Introduction to Dual Orchestrator Environment, page 3-7
*Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
Downlinks, page 3-8
*Check Point 23800 Appliance Datasheet - Check Point Software, page 2
NEW QUESTION # 41
What command should be used for collecting diagnostic information about the orchestrator?
- A. cpview
- B. orch_info
- C. asg perf -v
- D. cpinfo
Answer: D
Explanation:
Explanation
The cpinfo command is a tool that collects diagnostic information about the orchestrator, such as hardware, software, network, configuration, and logs. The cpinfo command generates a file that can be sent to Check Point Support for analysis and troubleshooting. The cpinfo command can be run on the orchestrator's CLI or WebUI.
References =
*Check Point Maestro R81.X Administration Guide, page 68, section "cpinfo" 1
*Check Point Maestro R81.X Getting Started Guide, page 30, section "cpinfo" 2
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software 3
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3: https://www.checkpoint.com/downloads/products/maestro-hyperscale-orchestrator-datasheet.pdf
NEW QUESTION # 42
What type of cluster can a Security Group can be compared to?
- A. Active / Backup
- B. Load Sharing Active / Active
- C. Active / Standby
- D. VSLS
Answer: B
Explanation:
Explanation
A Security Group can be compared to a Load Sharing Active / Active cluster because it consists of multiple Security Group Members that share the traffic load and provide high availability and scalability. Each Security Group Member is an active firewall that processes traffic according to the Security Group policy and synchronizes its state with other members. The Maestro Orchestrator acts as a load balancer that distributes the traffic among the Security Group Members based on their capacity and availability.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.1: Introduction to Security Groups, page 2-4
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Security Group Overview, page 2-3
NEW QUESTION # 43
Which command should be used to restart Orchestrator service only?
- A. orchd restart
- B. service orchestrator restart
- C. cpstop; cpstart
- D. reboot
Answer: A
Explanation:
Page 313 from the training manual:
- Restart the service:
orchd restart
- Restart the service without confirmation
service orchd restart
NEW QUESTION # 44
......
Updated Verified 156-836 Q&As - Pass Guarantee: https://dumpscertify.torrentexam.com/156-836-exam-latest-torrent.html
