ベストな準備プラン156-836試験2024年最新のCCME無制限77問題
注目すべき時短になる156-836オールインワン試験ガイド
質問 # 29
What happens if the SMO Master fails?
- A. The next SGM with the current lowest SGM ID assumes the role of the SMO Master.
- B. The Backup SMO Master will take over in the event of a failure with the SMO Master.
- C. The Security Group will no longer pass traffic and the issue must be resolved with the SMO Master.
- D. A failover will occur on the MHO and traffic will continue to pass.
正解：A
解説：
Explanation
This aligns with the principle of redundancy in network systems, where the next available device with the lowest ID typically takes over management roles in case of a failure.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 91
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
質問 # 30
Possibilities for a failure in a single SGM of a Security Group include.
- A. SecureXL is not enabled on the SGM.
- B. A change was made with clish instead of gClish, causing the SGM to handle traffic differently than the other SGMs.
- C. An administrator imported a hotfix into the CPUSE repository of a single SGM.
- D. There are too many active SGMs in the SG.
正解：C
解説：
Explanation
One of the possible causes of a failure in a single SGM of a Security Group is that an administrator imported a hotfix into the CPUSE repository of a single SGM, instead of using the orchestrator to distribute the hotfix to all the SGMs in the Security Group. This can create a mismatch in the software versions and configurations of the SGMs, and lead to unexpected behavior and errors.
References
*Maestro Expert (CCME) Course - Check Point Software, page 251
*sk172923: The /var/log/messages file does not save Maestro Gaia Clish commands2
*sk180418: Security Gateway Member (SGM) is stuck after it is added to a Security Group with image auto cloning enabled on the Single Management Object (SMO)
質問 # 31
Logs without a dedicated log file can be found in
- A. $FWDIR/log/fw.log
- B. /var/log/messages
- C. $RTDIR/log/junk.log
- D. /var/log/junk.log.dbg
正解：B
解説：
Explanation
The /var/log/messages file is a general system log file that contains information about various system events, such as booting, shutdown, cron jobs, kernel messages, and other system services. Logs without a dedicated log file can be found in this file, as well as some Maestro Gaia Clishcommands that are not saved in the
/var/log/command_logger.log file.
References
*Maestro Audit Logs - Where are they? - Check Point CheckMates1
*sk172923: The /var/log/messages file does not save Maestro Gaia Clish commands2
*Maestro Expert (CCME) Course - Check Point Software, page 33
質問 # 32
What cannot be learned from the output of lldpctl?
- A. Orchestrator's IP
- B. Serial number of Appliance
- C. Distribution mode
- D. Appliance model
正解：C
解説：
Explanation
The lldpctl command is a tool to display information about the devices discovered by the Link Layer Discovery Protocol (LLDP) on all ports of the Maestro Orchestrator and the Security Group Members. LLDP is a protocol that enables devices to exchange information about their identity, capabilities, and configuration.
LLDP can help to discover the topology and connectivity of the Maestro environment. The output of lldpctl can show the serial number, appliance model, and orchestrator's IP of the connected devices, but it cannot show the distribution mode of the Security Group. The distribution mode is the algorithm that determines how the Maestro Orchestrator distributes the traffic among the Security Group Members. To view the distribution mode, other commands such as asg monitor or asg stat can be used.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.2: LLDP, page 4-9
*Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
LLDP, page 3-9
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Maestro basic setup documentation - Page 2 - Check Point CheckMates
*Log and Configuration Files - Check Point Software
質問 # 33
Splitter cannot be used _______
- A. To connect single port on orchestrator to multiple port on external switch
- B. To connect single port on orchestrator to the same Appliance
- C. To connect single port on orchestrator to multiple Appliances
- D. To connect single port on Appliance to multiple ports on the orchestrator
正解：B
質問 # 34
How does HyperSync work in a Dual Site environment?
- A. Each active connection has a backup connection on the second site (remote site.)
- B. Each active connection has two local backups (on the local site) and a third backup connection on the second site (remote site.)
- C. Each active connection has a local backup (on the local site) and a second backup connection on the second site (remote site.)
- D. Each active connection has a local backup (on the local site) and a second backup connection on each of the MHOs.
正解：C
解説：
Explanation
HyperSync is a feature of Maestro that enables stateful synchronization of connections and resources across different sites in a Dual Site environment. HyperSync works by creating two backup connections for each active connection: one on the same site as the active connection, and another on the remote site. This ensures that the connection can be seamlessly resumed in case of a failover event, either within the same site or across the sites. HyperSync uses the Site-Sync port and VLANs to transmit the synchronization packets between the Security Group Members and the Maestro Orchestrators.
References =
*Maestro Dual Site configuration with a direct connection through L2 switches
*Maestro Frequently Asked Questions (FAQ)
*CHECK POINT MAESTRO EXPERT
質問 # 35
Which licenses should be issued for the Orchestrator?
- A. No licenses are required for Orchestrator
- B. The Orchestrator is considered a Management server, hence it's licensed the same way
- C. Depends on Software Blades enabled on connected appliances
- D. The Orchestrator requires NGTX license
正解：A
解説：
Explanation
Orchestrators in many network environments do not require separate licenses, as they primarily function to manage and distribute network traffic.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 1: Introduction to Check Point Maestro, Lesson 1.2: Maestro Licensing, page 1-8
*Check Point R81 Maestro Administration Guide, Chapter 1: Introduction to Check Point Maestro, Section:
Maestro Licensing, page 1-6
*Activation of a Quantum Maestro Orchestrator - Check Point Software
質問 # 36
While looking at your system's correction statistics, you notice you have a correction rate approaching 100 percent. Is this a problem?
- A. A correction rate approaching 100 percent of all connections is unusual. This is a cause for concern because the SGMs may fail to process traffic.
- B. A correction rate above 90 percent indicates a need to disable Layer 4 Distribution.
- C. In some scenarios, a correction rate approaching 100 percent of all connections is not unusual. This is not usually a cause for concern as the correction mechanism is fast and efficient.
- D. If correction rates are higher than 80 percent, latency is expected.
正解：A
解説：
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23 3
*Check Point Maestro Frequently Asked Questions (FAQ), question 9 4
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
4:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
質問 # 37
What is an uplink interface used for?
- A. To connect in between Orchestrators
- B. To connect Orchestrators to customer's infrastructure
- C. To connect appliances to customer's infrastructure
- D. To connect in between appliances
正解：B
解説：
Explanation
Uplink interfaces are used to connect Maestro Hyperscale Orchestrators (MHOs) to the customer's network infrastructure, such as switches, routers, or firewalls. They are also used to send and receive management and control traffic from the customer's network to the MHOs.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 41
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
質問 # 38
What type of license is required for an MHO?
- A. A license is needed for each attached SGM.
- B. The MHO requires a NGTP license.
- C. The MHO requires a VSX license.
- D. The MHO does not require a license.
正解：D
解説：
Explanation
The MHO (Maestro Hyperscale Orchestrator) does not require a license by itself, but each SGM (Security Group Module) that is attached to the MHO needs a license. The license type depends on the features and blades that are enabled on the SGM. For example, if the SGM is running VSX, it needs a VSX license.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 71
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
質問 # 39
What is the purpose of g_tcpdump command?
- A. The same as tcpdump, just on Scalable Platform
- B. Collects traffic dump from all Active Appliances within Security Group
- C. Collects traffic dump from CIN network
- D. Collects traffic dump from Sync network
正解：B
解説：
Explanation
_tcpdump" probably collects traffic dumps from all active appliances within a security group, aligning with the naming convention and function of similar commands in scalable platforms.
References
*Maestro Expert (CCME) Course - Check Point Software, page 331
*What is 'IN' and 'OUT' of g_tcpdump? - Check Point CheckMates2
*CHECK POINT MAESTRO EXPERT, page 23
質問 # 40
What will happen in case of NAT of the traffic passing through Management network?
- A. This traffic will pass with no inspection
- B. Orchestrator will disable NAT and traffic will pass with no issue
- C. Since Management traffic is always going to SMO, it will take a care for Correction Layer and will re-distribute traffic to other Appliances
- D. This traffic will not pass correction, since it will be dropped
正解：B
解説：
Explanation
According to the Check Point MAESTRO R80.20SP Administration Manual1, NAT is not supported on the management network. If you configure NAT on the management network, the Orchestrator will disable NAT and allow the traffic to pass without translation. This is to ensure that the management traffic can reach the Security Group members and the SmartConsole without any issues.
References
*Check Point MAESTRO R80.20SP Administration Manual, page 291
質問 # 41
What happens when you make changes from Clish on the SMO Master?
- A. The changes are synchronized to the MHO as a backup.
- B. Changes are only applied on the SMO Master.
- C. The changes are synchronized to the SMS/MDS as a backup.
- D. Changes are applied to all members in the SG.
正解：B
解説：
Explanation
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.2: Security Group Configuration, page 2-10
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Security Group Configuration, page 2-9
*Security Group Configuration - Check Point Software
質問 # 42
What can be learned from the output of sx_api_ports_dump.py command?
- A. Information about Security Groups
- B. Orchestrator port status
- C. Information about downlink ports only
- D. Information about backplane bonds
正解：D
解説：
Explanation
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*[Maestro Expert (CCME) Course - Check Point Software], page 31
*[Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge], page 3
質問 # 43
There is a Security group of 10 Appliances and all of them are up and running. How many Appliances within a Security Group keep the same connection in its connection table in case of NAT?
- A. 0
- B. All 10
- C. Between 2 and 4
- D. 1
正解：C
解説：
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23
*Check Point Maestro Frequently Asked Questions (FAQ), question 9
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
質問 # 44
For the MHO-175, which ports are Management ports?
- A. Ports 1 - 4 are Management ports.
- B. Ports 49 - 55 are Management ports.
- C. Ports 5 - 26 are Management ports.
- D. Ports 27 - 47 are Management ports.
正解：A
解説：
Explanation
According to the Port Mapping for the Check Point Maestro HyperScale Orchestrator MHO-175 document1, ports 1 - 4 are Management ports that are used to connect the MHO to the customer's management infrastructure, such as SmartConsole or SmartDomain Manager. Ports 5 - 26 are Uplink ports that are used to connect the MHO to the customer's network infrastructure, such as switches, routers, or firewalls. Ports 27 -
47 are Downlink ports that are used to connect the MHO to the Security Group Modules (SGMs) in the Security Group. Ports 49 - 55 are Backplane ports that are used to connect the MHO to another MHO in a Dual Orchestrator environment.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 42
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline3
*Port Mapping for the Check Point Maestro HyperScale Orchestrator MHO-1751
質問 # 45
Do all MHOs need to be upgraded before starting the SGM upgrades?
- A. During the upgrade process all SGMs should be upgraded before upgrading all of the MHOs.
- B. A minimum of one of the MHOs should be upgraded before starting the SGM upgrades. However, there is no requirement to upgrade all the SGMs during the same maintenance window as the MHO
- C. All MHOs must first be upgraded before starting the SGM upgrades However, there is no requirement to upgrade all the SGMs during the same maintenance window as the MHOs.
- D. MHOs do not need to be upgraded at all because Maestro supports the use of different versions between the MHOs and SGMs.
正解：C
解説：
Explanation
This is the correct answer because it follows the upgrade order and procedure specified in the R81.10 and R81.20 Administration Guides for Maestro environments. The MHOs are responsible for managing and synchronizing the SGMs, so they must be upgraded to the target version before the SGMs. However, the SGMs can be upgraded one by one or in batches, as long as they are compatible with the MHOs. The upgrade process also supports Multi-Version Clustering, which allows different versions of SGMs to operate in the same Security Group with zero downtime.
References =
*Check Point R81.10 for Scalable Platforms - Check Point Software
*Check Point R81.20 for Scalable Platforms - Check Point Software
*CHECK POINT MAESTRO EXPERT
質問 # 46
What happens if you apply a hotfix using gClish?
- A. If you apply a hotfix using gclish, the operation will fail because an outage would occur.
- B. Logical groups "A" and "B" are created. Members of group "A" install and reboot first. Then members of group "B" does the same once reboots have finished with group "A."
- C. If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.
- D. If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.
正解：B
解説：
Explanation
This is the correct answer because it describes the hotfix installation process using gClish on a Maestro Security Group. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. When a hotfix is applied using gClish, the SG members are divided into two logical groups: "A" and "B". The members of group "A" install the hotfix and reboot first, while the members of group "B" wait for their turn. After all the members of group "A" are back online, the members of group
"B" install the hotfix and reboot.This way, the SG maintains high availability and does not cause an outage.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
質問 # 47
The drop_monitor command is useful for
- A. Showing the system temperature in real-time for multiple components, such as CPU, fan, and SSDs.
- B. Viewing all drops by Check Point code or the Gaia OS, such as RX-DRP, RX-ERR, and Gaia OS drops.
- C. Monitoring Check Point code drops
- D. Viewing all interface drops such as RX-ERR, RX-DRP, and RX-OVR
正解：B
解説：
Explanation
The drop_monitor command is a tool that monitors and displays the packets that are dropped by the Check Point code or the Gaia OS on the orchestrator and the appliances. It can help troubleshoot network issues and optimize performance. The command shows the drop reason, source, destination, protocol, and port of the dropped packets, as well as the interface and the module that dropped them.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates1
*Support, Support Requests, Training ... - Check Point Software2
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge
質問 # 48
What is the default Distribution mode?
- A. Network
- B. Manual-General
- C. Auto-topology
- D. User
正解：C
解説：
Explanation
Auto-topology is the default distribution mode for Maestro Security Groups. In this mode, the Orchestrator assigns packets to a Security Group Member based on the topology of the port defined in the gateway object.
Each port is either in user mode or network mode depending on the topology. User mode means that the port is connected to the internal network and network mode means that the port is connected to the external network.
The Orchestrator uses a hash function to map each source IP or destination IP to a specific SGM, depending on the mode of the port. This mode ensures that all packets with the same source IP or destination IP are processed by the same SGM, regardless of the port or protocol.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-18
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Lari Luoma | Lead Consultant | Maestro SME | Check Point Evangelist1, slide 16
質問 # 49
......
合格保証付き156-836問題集：https://jp.fast2test.com/156-836-premium-file.html
あなたを合格さすCheckPoint 156-836試験専門はここにある：https://drive.google.com/open?id=1l0JAPxcONjIZeSHNWc8f91lzIde61-cs