Free Practice Questions for Checkpoint 156-587 Exam

CPWD (Check Point WatchDog)is the process that monitors, terminates (if necessary), and restarts critical Check Point processes (e.g., FWD, FWM, CPM) when they stop responding or crash.

CPM(Check Point Management process) is a process on the Management Server responsible for the web-based SmartConsole connections, policy installations, etc.

FWD(Firewall Daemon) handles logging and communication functions in the Security Gateway.

FWM(FireWall Management) is an older reference to the management process on the Management Server for older versions.

Therefore, the best answer isCPWD.

Check Point Troubleshooting References

sk97638: Check Point WatchDog (CPWD) process explanation and commands.

R81.20 Administration Guide– Section on CoreXL, Daemons, and CPWD usage.

sk105217: Best Practices – Explains system processes, how to monitor them, and how CPWD is utilized.

IKE view is the most efficient way to read an IKEv2 debug. IKE view is a graphical user interface tool that enables you to analyze the IKEv2 debugs generated by the Security Gateway1. It can parse the debug files and display the information in a structured and readable format. It can also filter the debug messages based on various criteria, such as IP address, encryption domain, or IKEv2 state1. IKE view can help you to troubleshoot the IKEv2 issues and identify the root cause of the problems1. References: IKEView: VPN Debugging Tool - Check Point Software

The Resource Advisor (RAD) service on the Security Gateways is responsible for online categorization of URLs and resources for Application Control and Threat Prevention blades. RAD has two components: a kernel module and a user space module. The kernel module looks up the kernel cache for URLs and resources, notifies the client about hits and misses, and forwards asynchronous requests to the user space module. The user space module handles the communication with the Check Point online web service and updates the kernel cache with the results. RAD can operate in three modes: hold, background, and custom, depending on the configuration of the blades and the policy. References:

Check Point Processes and Daemons - Section: Security Gateway Software Blades and Features - Subsection: URL Filtering Blade

Solved: Re: RAD’s high utilization - Post by @PhoneBoy

Check Point Certified Troubleshooting Expert (CCTE) - Exam Topics - Module 5: Advanced Access Control

The ADLOG function receives the AD log event information from the Domain Controllers. The ADLOG function is part of the Identity Awareness feature that enablesthe Security Gateway to identify users and machines in the network and enforce Access Control policy rules based on their identities. The ADLOG function uses the AD Query (ADQ) method to connect to the Active Directory Domain Controllers using WMI and subscribe to receive Security Event logs that are generated when users perform login. The ADLOG function then extracts the user and machine information that maps to an IP address from the event logs and sends it to the PEP function, which enforces the policy based on the identity information.

The kernel component associated with Content Awareness and data collection from contexts (often provided by the Context Management Infrastructure - CMI) is dlpda.  

According to the Check Point R81.20 Quantum Security Gateway Administration Guide, within the listing of kernel modules, dlpda is described as follows:

Exact Extract:

Module "dlpda" (Data Loss Prevention - Download Agent for Content Awareness)

The dlpda module functions as a "Download Agent for Content Awareness." This role involves collecting data necessary for the Content Awareness blade to inspect and understand the content of traffic. The Content Awareness blade works in conjunction with the Context Management Infrastructure (CMI), which provides the initial context about the traffic. The dlpda component then uses these contexts to gather the relevant data for deeper inspection and to determine if the content matches any defined data types or policies. While the guide lists it as a "Module," exam questions in the CCTE context often refer to such components involved in kernel operations as "kernel processes." The function described clearly aligns with collecting data for Content Awareness.  

Options analysis:

A. PDP (Policy Decision Point): This process is primarily associated with Identity Awareness for making access decisions based on user identity, not directly for Content Awareness data collection from CMI contexts.

B. cpemd (Check Point Endpoint Management Daemon): This daemon is related to endpoint security management and does not fit the role of a kernel process for gateway-level Content Awareness data collection.

D. CMI (Context Management Infrastructure): CMI is an infrastructure that provides contexts to various blades, including Content Awareness. It is the source of the contexts, not the kernel process that collects data based on those contexts.

Therefore, dlpda is the kernel component specifically tasked with collecting data for Content Awareness.