[2024年07月21日] 完全版には更新されたのはCCME（156-836）認定サンプル問題
最新のCheckPoint 156-836リアル試験問題集PDF
Check Point Certified Maestro Expert - R81（CCME）試験は、Maestroアーキテクチャと展開、ネットワークセグメンテーション、トラフィック管理、高可用性、セキュリティ、トラブルシューティングなど、広範なトピックをカバーしています。候補者はこれらのトピックについて深い理解を持ち、現実のシナリオでそれらを適用できることが期待されています。
質問 # 21
In a dual MHO environment, MHO1 and MHO2 are connected to the SGM line cards in which way?
- A. MHO 1 is connected to the odd-numbered ports, while MHO2 is connected to even-numbered ports.
- B. MHO 1 is connected to the even-numbered ports, while MHO2 is connected to odd-numbered ports.
- C. MHO1 and MHO2 are connected to the line cards in any order administrators see fit.
- D. MHO1 and MHO2 are connected to the SGMs using the Sync cable.
正解：B
解説：
Explanation
The correct way to connect MHO1 and MHO2 to the SGM line cards in a dual MHO environment is to use the even-numbered ports for MHO1 and the odd-numbered ports for MHO2. This is to ensure that each SGM has two downlinks to each MHO, and that the downlinks are balanced across the different NICs and links. This provides redundancy and high availability for the traffic flow between the SGMs and the MHOs.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*Maestro Expert (CCME) Course - Check Point Software, page 18
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 16
質問 # 22
To display processes that are consuming excessive system resources, users should use the_____ command.
- A. asg perf -v
- B. top
- C. asg_perf_hogs
- D. asg stat -v
正解：C
解説：
Explanation
The asg_perf_hogs command is a script that displays the processes that are consuming excessive system resources, such as CPU, memory, disk, and network, on the orchestrator and the appliances. It can help identify performance issues and bottlenecks in the Maestro environment.
References
*Software Provision and Performance hogs failed - Check Point CheckMates1
*CHECK POINT MAESTRO EXPERT, page 33
質問 # 23
What happens if the SMO Master fails?
- A. A failover will occur on the MHO and traffic will continue to pass.
- B. The Security Group will no longer pass traffic and the issue must be resolved with the SMO Master.
- C. The next SGM with the current lowest SGM ID assumes the role of the SMO Master.
- D. The Backup SMO Master will take over in the event of a failure with the SMO Master.
正解：C
解説：
Explanation
This aligns with the principle of redundancy in network systems, where the next available device with the lowest ID typically takes over management roles in case of a failure.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 91
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
質問 # 24
Which blade configuration files should be backed up on the SG if upgrading from R80.30SP or earlier?
- A. VPN configuration files
- B. Mobile Access configuration files.
- C. fwkern.conf files.
- D. IPS configuration files
正解：D
解説：
Explanation
References
*Maestro R80.30SP Jumbo Hotfix Accumulator, Section: Important Notes
*Check Point Maestro R80.30SP with Gaia 3.10, Section: Known Limitations
*Check Point SNMP MIB files, Section: Revision History
質問 # 25
What is the maximum number of Appliances within Security group in Dual-Site configuration?
- A. 0
- B. 1
- C. 2
- D. 3
正解：C
質問 # 26
How does HyperSync work in a Dual Site environment?
- A. Each active connection has a backup connection on the second site (remote site.)
- B. Each active connection has two local backups (on the local site) and a third backup connection on the second site (remote site.)
- C. Each active connection has a local backup (on the local site) and a second backup connection on each of the MHOs.
- D. Each active connection has a local backup (on the local site) and a second backup connection on the second site (remote site.)
正解：D
質問 # 27
Is it possible to define distribution mode per interface?
- A. Yes, for both uplink and downlink interfaces
- B. Yes, only for uplink interfaces
- C. Yes, only for downlink interfaces
- D. No, only for the Security Group
正解：A
解説：
Explanation
Maestro allows you to define the distribution mode per interface, which determines how traffic is distributed among the Security Group Modules (SGMs) in a Security Group. You can configure the distribution mode for each interface individually, or use the default mode for all interfaces. The distribution mode can be set for both uplink and downlink interfaces.
References =
*Check Point Maestro R81.X Administration Guide, page 62, section "Distribution Mode" 1
*Check Point Maestro R81.X Getting Started Guide, page 25, section "Distribution Mode" 2
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
質問 # 28
What does the lldpctl command do?
- A. Discover orchestrators
- B. Show all devices discovered by LLDP protocol on all ports
- C. Show all devices discovered by LLDP protocol on uplink ports
- D. Show all devices discovered by LLDP protocol on downlink ports
正解：B
解説：
Explanation
The lldpctl command is a tool to display information about the devices discovered by the Link Layer Discovery Protocol (LLDP) on all ports of the Maestro Orchestrator and the Security Group Members. LLDP is a protocol that enables devices to exchange information about their identity, capabilities, and configuration.
LLDP can help to discover the topology and connectivity of the Maestro environment.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.2: LLDP, page 4-9
*Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
LLDP, page 3-9
質問 # 29
What is the throughput penalty of Security Group?
- A. Depends on the type of Appliance
- B. 10% per Security Group with no relation to the number of members
- C. 1% per member
- D. 5% per member
正解：C
解説：
Explanation
Check Point reduced throughput degradation to 1% per added SGMs. For example, the overall throughput degradation is 10% for 10 SGMs in a Security Group. Check Point aims to reduce this even further in the future.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
質問 # 30
What Maestro component is automatically designated the SMO Master?
- A. The MDS that pushes policy to the SMO is considered the SMO Master.
- B. The SGM with the lowest member ID (the first one added to the security group.)
- C. The SGM with the highest member ID (the last one added to the security group.)
- D. The first MHO configured is considered the SMO Master.
正解：B
解説：
Explanation
The SMO Master is the SGM that is responsible for synchronizing the configuration and policy with the other SGMs in the security group. The SMO Master is automatically designated as the SGM with the lowest member ID, which is usually the first one added to the security group. The SMO Master can be changed manually if needed.
References:
*Maestro Frequently Asked Questions (FAQ), under "What is a Single Management Object (SMO)?"
*Check Point Jump Start Course: Maestro, under "Maestro Security Groups"
質問 # 31
What is one benefit of a Dual MHO environment?
- A. Dual MHOs allow better synchronization to occur between SGMs.
- B. Dual MHOs allow additional SGMs to be added to the SG.
- C. Dual MHOs provide redundancy to the Maestro environment by increasing throughput by at least 50 percent.
- D. Dual MHOs can be used to achieve increased scalability and redundancy.
.
正解：D
解説：
Explanation
One of the benefits of a Dual MHO environment is that it can provide both scalability and redundancy to the Maestro system. Scalability means that the system can handle more traffic and SGMs as the demand grows, and redundancy means that the system can survive the failure of one or more components without losing functionality or performance. Dual MHOs can achieve these benefits by distributing the load and the management tasks among two orchestrators, and by providing backup and failover mechanisms for each other.
References
*Maestro Expert (CCME) Course - Check Point Software, page 251
*CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 22
*Check Point Certified Maestro Expert (CCME) R81.X, page 23
質問 # 32
Splitter cannot be used _______
- A. To connect single port on orchestrator to multiple Appliances
- B. To connect single port on orchestrator to the same Appliance
- C. To connect single port on orchestrator to multiple port on external switch
- D. To connect single port on Appliance to multiple ports on the orchestrator
正解：B
質問 # 33
In a Maestro Dual Site environment, what is the definition of the term Active Site.
- A. There is no such thing as an active site. In a Dual Site environment, traffic is load balanced.
- B. The Active Site is the site where the SMO Master exists.
- C. The Active Site is the site that is not handling any traffic for the specific SG, but itsconnections are synced to its SGMs from the MHOs to be ready in the event of a failover.
- D. The Active Site is the site currently handling the enforcement on traffic passing for a specific SG.Connections are synced within the SGMs in the Active Site.
正解：D
解説：
Explanation
In a Maestro Dual Site environment, there are two sites that can host Security Group Members (SGMs) for each Security Group (SG). The Active Site is the one that is currently processing the traffic for a specific SG, while the Standby Site is the one that is ready to take over in case of a failover. The Active Site and the Standby Site can be different for different SGs, depending on the load balancing and failover policies. The Active Site and the Standby Site are synchronized by the Maestro Orchestrators (MHOs) using the Site-Sync port and VLANs.
References =
*Solved: Maestro dual site failover - Check Point CheckMates
*Maestro Dual Site configuration with a direct connection through L2 switches
質問 # 34
What is the purpose of RJ-45 connectors located at the front panel of the Orchestrator MHO-170?
- A. 1Gbps connectivity for Security Groups
- B. Two Out-of-band interfaces for access to Orchestrator itself
- C. Out-of-band interface for access to Orchestrator itself and Serial Console connector
- D. Reserved for internal purposes. Not in use
正解：C
解説：
Explanation
The RJ-45 connectors located at the front panel of the Orchestrator MHO-170 are used for out-of-band management and serial console access. One of them is a 1Gbps RJ-45 port that provides an out-of-band interface for accessing the Orchestrator itself for configuration and management purposes. The other one is a RJ-45 serial console port that provides a command-line interface for initial setup and troubleshooting.
References
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software1, page 2
*Quantum Maestro Getting Started Guide - Check Point CheckMates, page 4
質問 # 35
What is the Correction Layer?
- A. Correction Layer is a daemon which corrects errors on Backplane interfaces
- B. Correction Layer is a Layer of GAIA OS which corrects misspelled commands and allows them to execute
- C. Correction Layer is a mechanism which handles asymmetric connections in multi-appliance system. For example, in case of NAT
- D. Correction Layer is a mechanism which activated in case of asymmetric routing
正解：C
解説：
Explanation
The Correction Layer is a Maestro component that ensures that packets from the same connection are handled by the same Security Group Module (SGM) in a multi-appliance system. This is especially important when NAT is involved, as packets sent from the client to the server can be distributed to a different SGM than packets from the same session sent from the server to the client. The Correction Layer must then forward the packet to the correct SGM.
References:
*NAT and the Correction Layer on a Security Gateway - Check Point Software1
*Solved: Maestro queries - Check Point CheckMates
質問 # 36
Which feature is used to force trusted non-F2F traffic into the fully accelerated path for handling by SecureXL.
- A. SecureXL
- B. Fast Accelerator
- C. hypersync
- D. rate limiting
正解：A
解説：
Explanation
SecureXL is typically used to accelerate trusted traffic, including non-F2F (face-to-face) traffic, through a secure, fast path.
References =
*SecureXL Fast Accelerator (fw fast_accel) for R80.20 and above 1
*SecureXL Fast Accelerator - Need to clarify packet flow 2
1:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
2:
https://community.checkpoint.com/t5/Security-Gateways/SecureXL-Fast-Accelerator-Need-to-clarify-packet-flo
質問 # 37
Complete the sentence: Dual Orchestrators work as.______
- A. Active-Active cluster
- B. Load Sharing cluster
- C. Active - Standby cluster
- D. Hot-Swap RAID
正解：A
解説：
Explanation
Dual Orchestrators work as an Active-Active cluster, which means that both Orchestrators are active and share the load of the traffic that is sent to and from the Security Group Members (SGMs). Active-Active cluster provides better performance and scalability than Active-Standby cluster, which only uses one Orchestrator at a time and keeps the other as a backup. Active-Active cluster also allows for faster failover and recovery in case of an Orchestrator failure, as the surviving Orchestrator can take over the traffic without interruption.
References
*Maestro Expert (CCME) Course - Check Point Software, page 25
*CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 2
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, page 2
質問 # 38
What is the Correction Layer mechanism?
- A. Enforces the access policy on the SGMs and synchronizes the enforcement verdict to other SGMs in the SG.
- B. Ensures asymmetric traffic is handled properly, especially in the case of NAT or VPNs.
- C. The MHO's distribution algorithm which determines the handling SGM for a given connection.
- D. The load-balancing mechanism used by the MHO.
正解：B
解説：
Explanation
The Correction Layer mechanism is a Maestro component that ensures that packets from the same connection are handled by the same Security Group Module (SGM) in a multi-appliance system. This is especially important when NAT or VPNs are involved, as packets sent from the client to the server can be distributed to a different SGM than packets from the same session sent from the server to the client. The Correction Layer must then forward the packet to the correct SGM.
References:
*NAT and the Correction Layer on a VSX Gateway - Check Point Software1
*Solved: Maestro queries - Check Point CheckMates
質問 # 39
Which distribution mode assigns packets to an SGM based solely on the packet destination IP?
- A. User mode
- B. Manual mode
- C. Auto-topology mode
- D. Network mode
正解：D
解説：
Explanation
Network mode is the distribution mode that assigns packets to an SGM based solely on the packet destination IP. In this mode, the Orchestrator uses a hash function to map each destination IP to a specific SGM. This mode ensures that all packets with the same destination IP are processed by the same SGM, regardless of the source IP or port. This mode is suitable for scenarios where the destination IP is the main factor for load balancing, such as NAT or VPN.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-19
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Maestro basic setup documentation - Page 2 - Check Point CheckMates
質問 # 40
What is the purpose of g_tcpdump command?
- A. Collects traffic dump from Sync network
- B. Collects traffic dump from CIN network
- C. Collects traffic dump from all Active Appliances within Security Group
- D. The same as tcpdump, just on Scalable Platform
正解：C
解説：
Explanation
_tcpdump" probably collects traffic dumps from all active appliances within a security group, aligning with the naming convention and function of similar commands in scalable platforms.
References
*Maestro Expert (CCME) Course - Check Point Software, page 331
*What is 'IN' and 'OUT' of g_tcpdump? - Check Point CheckMates2
*CHECK POINT MAESTRO EXPERT, page 23
質問 # 41
What type of license is required for an MHO?
- A. A license is needed for each attached SGM.
- B. The MHO requires a VSX license.
- C. The MHO does not require a license.
- D. The MHO requires a NGTP license.
正解：C
解説：
Explanation
The MHO (Maestro Hyperscale Orchestrator) does not require a license by itself, but each SGM (Security Group Module) that is attached to the MHO needs a license. The license type depends on the features and blades that are enabled on the SGM. For example, if the SGM is running VSX, it needs a VSX license.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 71
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
質問 # 42
......
CheckPoint 156-836問題集で一発合格を目指すならこれ！：https://jp.fast2test.com/156-836-premium-file.html
156-836練習テスト問題更新されたのは77問があります：https://drive.google.com/open?id=1l0JAPxcONjIZeSHNWc8f91lzIde61-cs