更新されたのは2024年10月25日認定試験156-836問題集で練習テスト問題
更新された検証済みの156-836問題集と解答で合格保証もしくは全額返金
質問 # 31
When working with Maestro, what is the difference between using Clish and gClish?
- A. Clish commands apply only to a specific SG member. gClish commands apply to all UP SG members, by default.
- B. Clish commands are run on the SG members. gClish commands are run on the MHO and applied to all connected SG members in a specified group.
- C. Clish commands are for testing purposes only and cannot be saved, gClish commands apply to all SG members, by default.
- D. Clish commands apply to all UP SG members, by default. gClish commands apply to all SG members, by default.
正解：A
解説：
Explanation
This is the correct answer because it describes the difference between using Clish and gClish when working with Maestro. Clish is the Check Point command line shell that allows users to configure and manage the SG members individually. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. UP SG members are theones that are in the UP state and have the same policy installed as the SMO Master.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
質問 # 32
What is a downlink interface used for?
- A. To connect appliances to Orchestrators
- B. To connect in between Orchestrators
- C. To connect appliances to customer's infrastructure
- D. To connect Orchestrators to customer's infrastructure
正解：C
質問 # 33
At a minimum, how many management and Uplink ports does a SG require?
- A. Only one of the two interfaces is needed for the Security Group.
- B. One each.
- C. Two of each.
- D. Neither are required.
正解：B
解説：
Explanation
A Security Group (SG) requires at least one management port and one uplink port to function properly. The management port is used to connect the SG to the Maestro Hyperscale Orchestrator (MHO) and the customer's management infrastructure, such as SmartConsole or SmartDomain Manager. The uplink port is used to connect the SG to the customer's network infrastructure, such as switches, routers, or firewalls. The uplink port is also used to send and receive traffic from the customer's network to the SG.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 41
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
質問 # 34
What command should be used for collecting diagnostic information about the orchestrator?
- A. cpinfo
- B. asg perf -v
- C. orch_info
- D. cpview
正解：A
解説：
Explanation
The cpinfo command is a tool that collects diagnostic information about the orchestrator, such as hardware, software, network, configuration, and logs. The cpinfo command generates a file that can be sent to Check Point Support for analysis and troubleshooting. The cpinfo command can be run on the orchestrator's CLI or WebUI.
References =
*Check Point Maestro R81.X Administration Guide, page 68, section "cpinfo" 1
*Check Point Maestro R81.X Getting Started Guide, page 30, section "cpinfo" 2
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software 3
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3: https://www.checkpoint.com/downloads/products/maestro-hyperscale-orchestrator-datasheet.pdf
質問 # 35
What type of license is required for an MHO?
- A. The MHO does not require a license.
- B. The MHO requires a NGTP license.
- C. A license is needed for each attached SGM.
- D. The MHO requires a VSX license.
正解：A
解説：
Explanation
The MHO (Maestro Hyperscale Orchestrator) does not require a license by itself, but each SGM (Security Group Module) that is attached to the MHO needs a license. The license type depends on the features and blades that are enabled on the SGM. For example, if the SGM is running VSX, it needs a VSX license.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 71
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
質問 # 36
What command can be run to show which SGM is selected to receive traffic?
- A. asg monitor
- B. g_tcpdump
- C. dxl calc
- D. asg calc
正解：D
解説：
Explanation
The asg calc command is a tool to show which SGM is selected to receive traffic based on the distribution mode and the packet parameters. It takes the port number, the source IP, the destination IP, and optionally the source port and the destination port as arguments and returns the SGM ID and the hash value. For example, asg calc 1 10.0.0.1 20.0.0.2 1234 80 will show which SGM will receive the traffic from 10.0.0.1:1234 to
20.0.0.2:80 on port 1.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using theCommand Line Interface and WebUI, Lesson 4.1: asg calc, page 4-5
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: asg calc, page 4-5
*asg calc - Check Point Software
質問 # 37
What cannot be learned from the output of lldpctl?
- A. Serial number of Appliance
- B. Distribution mode
- C. Orchestrator's IP
- D. Appliance model
正解：B
解説：
Explanation
The lldpctl command is a tool to display information about the devices discovered by the Link Layer Discovery Protocol (LLDP) on all ports of the Maestro Orchestrator and the Security Group Members. LLDP is a protocol that enables devices to exchange information about their identity, capabilities, and configuration.
LLDP can help to discover the topology and connectivity of the Maestro environment. The output of lldpctl can show the serial number, appliance model, and orchestrator's IP of the connected devices, but it cannot show the distribution mode of the Security Group. The distribution mode is the algorithm that determines how the Maestro Orchestrator distributes the traffic among the Security Group Members. To view the distribution mode, other commands such as asg monitor or asg stat can be used.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.2: LLDP, page 4-9
*Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
LLDP, page 3-9
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Maestro basic setup documentation - Page 2 - Check Point CheckMates
*Log and Configuration Files - Check Point Software
質問 # 38
There are two 10Gbps dual-port NICs and one 40Gbps NIC installed on a 23800 Appliance in slots 1, 2 and 3 accordingly. Which interfaces should be connected to Orchestrator 1 for downlinks' intra- orchestrator redundancy when using two Orchestrators?
- A. Any pair of available ports
- B. Port 1 in Slot 2 and Port 2 in Slot 1
- C. Port 1 in Slot 1 and Port 2 in Slot 1
- D. This configuration is not supported
正解：C
解説：
Explanation
This configuration likely provides balanced and redundant connectivity for orchestrator redundancy.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 3: Dual Orchestrator Environment, Lesson 3.1: Introduction to Dual Orchestrator Environment, page 3-7
*Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
Downlinks, page 3-8
*Check Point 23800 Appliance Datasheet - Check Point Software, page 2
質問 # 39
Which feature is used to force trusted non-F2F traffic into the fully accelerated path for handling by SecureXL.
- A. SecureXL
- B. hypersync
- C. rate limiting
- D. Fast Accelerator
正解：A
解説：
Explanation
SecureXL is typically used to accelerate trusted traffic, including non-F2F (face-to-face) traffic, through a secure, fast path.
References =
*SecureXL Fast Accelerator (fw fast_accel) for R80.20 and above 1
*SecureXL Fast Accelerator - Need to clarify packet flow 2
1:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
2:
https://community.checkpoint.com/t5/Security-Gateways/SecureXL-Fast-Accelerator-Need-to-clarify-packet-flo
質問 # 40
What is the difference between Dual-Site and Dual-Room?
- A. Dual-Room is a Single-Site deployment where all Appliances are connected to both orchestrators
- B. Dual-Room is a kind of Dual-Site deployment within the same building
- C. They are the same
- D. Dual-Room is Active / Standby and Dual-Site is Active / Active
正解：B
解説：
Explanation
References =
*[Maestro Frequently Asked Questions (FAQ)]
*Maestro Dual Site configuration with a direct connection through L2 switches
*Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)
*CHECK POINT MAESTRO EXPERT
質問 # 41
What is the throughput penalty of Security Group?
- A. Depends on the type of Appliance
- B. 1% per member
- C. 5% per member
- D. 10% per Security Group with no relation to the number of members
正解：B
解説：
Explanation
Check Point reduced throughput degradation to 1% per added SGMs. For example, the overall throughput degradation is 10% for 10 SGMs in a Security Group. Check Point aims to reduce this even further in the future.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
質問 # 42
There is a Security group of 10 Appliances and all of them are up and running. How many Appliances within a Security Group keep the same connection in its connection table in case of NAT?
- A. 0
- B. Between 2 and 4
- C. All 10
- D. 1
正解：B
解説：
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23
*Check Point Maestro Frequently Asked Questions (FAQ), question 9
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
質問 # 43
What kinds of transceivers are supported on Orchestrator MHO-170?
- A. SFP, SFP+, SFP28
- B. QSFP, QSFP28
- C. SFP, QSFP, QSFP28
- D. SFP+, SFP28, QSFP
正解：B
解説：
Explanation
The Orchestrator MHO-170 supports QSFP and QSFP28 transceivers on its 32x 100 GbE ports. QSFP stands for Quad Small Form-factor Pluggable and QSFP28 is an enhanced version of QSFP that supports up to 28 Gbps per lane. These transceivers can provide high-speed and high-density connectivity for the Maestro environment.
References
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software1, page 2
*Maestro Transceiver & DAC Inventory - Check Point CheckMates
質問 # 44
There are two appliances within the same Security Group. One of them is connected by One downlink only, another one by Two downlinks. Assuming there's no NAT and no VPN, what would be proportion of traffic distribution done by Orchestrator?
- A. 50%/50%
- B. 33%/66%
- C. 100%/0%
- D. 66%/33%
正解：A
解説：
Explanation
The proportion of traffic distribution done by Orchestrator depends on the traffic distribution mode that is configured for the Security Group. There are three modes: Round Robin, Load Sharing, andActive/Standby1.
*Round Robin mode distributes the traffic equally among all the appliances in the Security Group, regardless of the number of downlinks they have. This mode is suitable for scenarios where all the appliances have similar performance and capacity. In this mode, the proportion of traffic distribution would be 50%/50% for two appliances with one and two downlinks respectively.
*Load Sharing mode distributes the traffic proportionally to the number of downlinks each appliance has. This mode is suitable for scenarios where the appliances have different performance and capacity. In this mode, the proportion of traffic distribution would be 33%/66% for two appliances with one and two downlinks respectively.
*Active/Standby mode distributes the traffic to only one appliance at a time, while the other appliances are in standby mode. This mode is suitable for scenarios where high availability is required. In this mode, the proportion of traffic distribution would be 100%/0% or 0%/100% for two appliances with one and two downlinks respectively, depending on which appliance is active.
Since the question does not specify the traffic distribution mode, the default mode is Round Robin2.
Therefore, the proportion of traffic distribution would be 50%/50% for two appliances with one and two downlinks respectively.
質問 # 45
Which command should be used to restart Orchestrator service only?
- A. orchd restart
- B. reboot
- C. service orchestrator restart
- D. cpstop; cpstart
正解：A
解説：
Explanation
Page 313 from the training manual:
- Restart the service:
orchd restart
- Restart the service without confirmation
service orchd restart
質問 # 46
In a dual MHO environment, MHO1 and MHO2 are connected to the SGM line cards in which way?
- A. MHO1 and MHO2 are connected to the SGMs using the Sync cable.
- B. MHO 1 is connected to the even-numbered ports, while MHO2 is connected to odd-numbered ports.
- C. MHO1 and MHO2 are connected to the line cards in any order administrators see fit.
- D. MHO 1 is connected to the odd-numbered ports, while MHO2 is connected to even-numbered ports.
正解：B
解説：
Explanation
The correct way to connect MHO1 and MHO2 to the SGM line cards in a dual MHO environment is to use the even-numbered ports for MHO1 and the odd-numbered ports for MHO2. This is to ensure that each SGM has two downlinks to each MHO, and that the downlinks are balanced across the different NICs and links. This provides redundancy and high availability for the traffic flow between the SGMs and the MHOs.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*Maestro Expert (CCME) Course - Check Point Software, page 18
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 16
質問 # 47
Complete the sentence: Dual Orchestrators work as.______
- A. Active-Active cluster
- B. Hot-Swap RAID
- C. Load Sharing cluster
- D. Active - Standby cluster
正解：A
解説：
Explanation
Dual Orchestrators work as an Active-Active cluster, which means that both Orchestrators are active and share the load of the traffic that is sent to and from the Security Group Members (SGMs). Active-Active cluster provides better performance and scalability than Active-Standby cluster, which only uses one Orchestrator at a time and keeps the other as a backup. Active-Active cluster also allows for faster failover and recovery in case of an Orchestrator failure, as the surviving Orchestrator can take over the traffic without interruption.
References
*Maestro Expert (CCME) Course - Check Point Software, page 25
*CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 2
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, page 2
質問 # 48
To display processes that are consuming excessive system resources, users should use the_____ command.
- A. asg perf -v
- B. top
- C. asg_perf_hogs
- D. asg stat -v
正解：C
解説：
Explanation
The asg_perf_hogs command is a script that displays the processes that are consuming excessive system resources, such as CPU, memory, disk, and network, on the orchestrator and the appliances. It can help identify performance issues and bottlenecks in the Maestro environment.
References
*Software Provision and Performance hogs failed - Check Point CheckMates1
*CHECK POINT MAESTRO EXPERT, page 33
質問 # 49
What is the default Distribution mode?
- A. Network
- B. Manual-General
- C. User
- D. Auto-topology
正解：D
解説：
Explanation
Auto-topology is the default distribution mode for Maestro Security Groups. In this mode, the Orchestrator assigns packets to a Security Group Member based on the topology of the port defined in the gateway object.
Each port is either in user mode or network mode depending on the topology. User mode means that the port is connected to the internal network and network mode means that the port is connected to the external network.
The Orchestrator uses a hash function to map each source IP or destination IP to a specific SGM, depending on the mode of the port. This mode ensures that all packets with the same source IP or destination IP are processed by the same SGM, regardless of the port or protocol.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-18
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Lari Luoma | Lead Consultant | Maestro SME | Check Point Evangelist1, slide 16
質問 # 50
What happens if you apply a hotfix using gClish?
- A. If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.
- B. If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.
- C. Logical groups "A" and "B" are created. Members of group "A" install and reboot first. Then members of group "B" does the same once reboots have finished with group "A."
- D. If you apply a hotfix using gclish, the operation will fail because an outage would occur.
正解：C
解説：
Explanation
This is the correct answer because it describes the hotfix installation process using gClish on a Maestro Security Group. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. When a hotfix is applied using gClish, the SG members are divided into two logical groups: "A" and "B". The members of group "A" install the hotfix and reboot first, while the members of group "B" wait for their turn. After all the members of group "A" are back online, the members of group
"B" install the hotfix and reboot.This way, the SG maintains high availability and does not cause an outage.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
質問 # 51
Possibilities for a failure in a single SGM of a Security Group include.
- A. There are too many active SGMs in the SG.
- B. An administrator imported a hotfix into the CPUSE repository of a single SGM.
- C. A change was made with clish instead of gClish, causing the SGM to handle traffic differently than the other SGMs.
- D. SecureXL is not enabled on the SGM.
正解：B
解説：
Explanation
One of the possible causes of a failure in a single SGM of a Security Group is that an administrator imported a hotfix into the CPUSE repository of a single SGM, instead of using the orchestrator to distribute the hotfix to all the SGMs in the Security Group. This can create a mismatch in the software versions and configurations of the SGMs, and lead to unexpected behavior and errors.
References
*Maestro Expert (CCME) Course - Check Point Software, page 251
*sk172923: The /var/log/messages file does not save Maestro Gaia Clish commands2
*sk180418: Security Gateway Member (SGM) is stuck after it is added to a Security Group with image auto cloning enabled on the Single Management Object (SMO)
質問 # 52
HealthCheck Point _____
- A. can be used to let you visualize the Firewall topology for the SG and view live statistics, which includes throughput, problem notes, and CPU utilization.
- B. performs a system health check and is meant to replace both a CPInfo and the health check script.
- C. is a self-updatable suite of tools for MHOs with the capability to assess the health of the system and provide a timeline of critical and informative events that might have occurred in a production system.
- D. is a self-updatable suite of tools for SGMs with the capability to assess the health of the system, visualize the Firewall topology, provide a timeline of critical and informative events that might have occurred in a production system.
正解：D
解説：
Explanation
HealthCheck Point (HCP) is a tool that can perform various tests and checks on the system components of the Security Group Modules (SGMs), such as hardware, software, network, clock,ARP, and more. It can also display the performance statistics of the SGMs, such as throughput, packet rate, CPU utilization, memory usage, and more. Additionally, HCP can provide a graphical representation of the Firewall topology for the Security Group, showing the connections and statuses of the SGMs and the Orchestrators. Furthermore, HCP can generate a report of the critical and informative events that occurred on the system, such as configuration changes, errors, warnings, and alerts. HCP can help identify and troubleshoot any issues or errors that may affect the system functionality or performance.
References =
*HealthCheck Point (HCP) Release Updates - Check Point Software 1
*Professional Services Healthcheck - Check Point Software 2
*HealthCheck Point - Check Point CheckMates 3
質問 # 53
What is the maximum number of Appliances within the same Security Group?
- A. 0
- B. 1
- C. 2
- D. 3
正解：B
解説：
Explanation
The maximum number of appliances within the same security group is 31. This is because a security group can have up to 31 Security Group Modules (SGMs) of the same or different models, and each SGM is an appliance that runs the Check Point software. A security group can span across multiple chassis, and each chassis can have up to 16 SGMs. However, the total number of SGMs in a security group cannot exceed 31.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 51
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
質問 # 54
Which command is used to set the number of sites in a Maestro environment?
- A. set maestro configuration orchestrator-site-number
- B. set maestro configuration orchestrator-site-amount
- C. set maestro orchestrator-site-amount
- D. set maestro configuration orchestrator-site-id
正解：B
解説：
Explanation
This command is used to set the number of sites in a Maestro environment, which can be either one or two.
The number of sites determines the site-sync configuration and the failover policies for the Security Groups and the Security Group Members. The default value is one, and it can be changed only before the first Security Group is created.
References =
*Maestro basic setup documentation - Page 2 - Check Point CheckMates
*Check Point R81.10 for Scalable Platforms - Check Point Software
*CHECK POINT MAESTRO EXPERT
質問 # 55
What is one benefit of a Dual MHO environment?
- A. Dual MHOs allow additional SGMs to be added to the SG.
- B. Dual MHOs allow better synchronization to occur between SGMs.
- C. Dual MHOs can be used to achieve increased scalability and redundancy.
. - D. Dual MHOs provide redundancy to the Maestro environment by increasing throughput by at least 50 percent.
正解：C
解説：
Explanation
One of the benefits of a Dual MHO environment is that it can provide both scalability and redundancy to the Maestro system. Scalability means that the system can handle more traffic and SGMs as the demand grows, and redundancy means that the system can survive the failure of one or more components without losing functionality or performance. Dual MHOs can achieve these benefits by distributing the load and the management tasks among two orchestrators, and by providing backup and failover mechanisms for each other.
References
*Maestro Expert (CCME) Course - Check Point Software, page 251
*CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 22
*Check Point Certified Maestro Expert (CCME) R81.X, page 23
質問 # 56
......
試験エンジンは156-836試験無料お試しサンプル365日更新されます：https://jp.fast2test.com/156-836-premium-file.html
156-836のPDF問題とテストエンジンには77問があります：https://drive.google.com/open?id=13zCu-VGBrxGIdq6o2gsNUbfOtVRk8vsq