You run a free-command on a gateway and notice that the Swap column is not zero Choose the best answer
- A . Utilization of ram is high and swap file had to be used
- B . Swap file is used regularly because RAM memory is reserved for management traffic
- C . Swap memory is used for heavy connections when RAM memory is full
- D . Its ole Swap is used to increase performance
You modified kernel parameters and after rebooting the gateway, a lot of production traffic gets dropped and the gateway acts strangely What should you do"?
- A . Run command fw ctl set int fw1_kernel_all_disable=1
- B . Restore fwkem.conf from backup and reboot the gateway
- C . run fw unloadlocal to remove parameters from kernel
- D . Remove all kernel parameters from fwkem.conf and reboot
B
Explanation:
If you have modified kernel parameters (in fwkern.conf, for example) and the gateway starts dropping traffic or behaving abnormally after a reboot, the best practice is to restore the original or a known-good configuration from backup. Then, reboot again so that the gateway loads the last known stable settings.
Option A (fw ctl set int fw1_kernel_all_disable=1) is not a standard or documented method for “undoing” all kernel tweaks.
Option B (Restore fwkem.conf from backup and reboot the gateway) is the correct and straightforward approach.
Option C (fw unloadlocal) removes the local policy but does not revert custom kernel parameters that have already been loaded at boot.
Option D (Remove all kernel parameters from fwkem.conf and reboot) might help in some cases, but you risk losing other beneficial or necessary parameters if there were legitimate custom settings. Restoring from a known-good backup is safer and more precise.
Hence, the best answer:
“Restore fwkem.conf from backup and reboot the gateway.”
Check Point Troubleshooting Reference
sk98339 C Working with fwkern.conf (kernel parameters) in Gaia OS.
sk92739 C Advanced System Tuning in Gaia OS.
Check Point Gaia Administration Guide C Section on kernel parameters and system tuning.
Check Point CLI Reference Guide C Explanation of using fw ctl, fw unloadlocal, and relevant
troubleshooting commands.
What process monitors terminates, and restarts critical Check Point processes as necessary?
- A . CPM
- B . FWD
- C . CPWD
- D . FWM
C
Explanation:
CPWD (Check Point WatchDog) is the process that monitors, terminates (if necessary), and restarts critical Check Point processes (e.g., FWD, FWM, CPM) when they stop responding or crash.
CPM (Check Point Management process) is a process on the Management Server responsible for the web-based SmartConsole connections, policy installations, etc.
FWD (Firewall Daemon) handles logging and communication functions in the Security Gateway.
FWM (FireWall Management) is an older reference to the management process on the Management Server for older versions.
Therefore, the best answer is CPWD.
Check Point Troubleshooting Reference
sk97638: Check Point WatchDog (CPWD) process explanation and commands.
R81.20 Administration Guide C Section on CoreXL, Daemons, and CPWD usage.
sk105217: Best Practices C Explains system processes, how to monitor them, and how CPWD is utilized.
When dealing with monolithic operating systems such as Gaia where are system calls initiated from to achieve a required system level function?
- A . Kernel Mode
- B . Slow Path
- C . Medium Path
- D . User Mode
Which of the following commands can be used to see the list of processes monitored by the Watch Dog process?
- A . cpstat fw -f watchdog
- B . fw ctl get str watchdog
- C . cpwd_admin list
- D . ps -ef | grep watchd
C
Explanation:
To see the list of processes monitored by the WatchDog process (CPWD), you use the cpwd_admin list command.
Option A (cpstat fw -f watchdog): Shows firewall status and statistics for the "fw" context, not necessarily the list of monitored processes.
Option B (fw ctl get str watchdog): Not a valid parameter for retrieving the list of monitored processes; “fw ctl” deals with kernel parameters.
Option C (cpwd_admin list): Correct command that lists all processes monitored by CPWD, their status, and how many times they have been restarted.
Option D (ps -ef | grep watchd): This will list any running process that matches the string “watchd” but will not specifically detail which processes are being monitored by CPWD.
Therefore, the best answer is cpwd_admin list.
Check Point Troubleshooting Reference
sk97638: Explains Check Point WatchDog (CPWD) usage and the cpwd_admin utility.
R81.20 CLI Reference Guide: Describes common troubleshooting commands including cpwd_admin list.
Check Point Gaia Administration Guide: Provides instructions for monitoring system processes and verifying CPWD.
What tool would you run to diagnose logging and indexing?
- A . run cpm_doctor.sh
- B . cpstat mg -f log_server
- C . run diagnostic view
- D . run doctor-log.sh
You found out that $FWDIR/Iog/fw.log is constantly growing in size at a Security Gateway, what is the reason?
- A . TCP state logging is enabled
- B . Its not a problem the gateways is logging connections and also sessions
- C . fw.log can grow when GW does not have space in logging directory
- D . The GW is logging locally
What is the best way to resolve an issue caused by a frozen process?
- A . Power off the machine
- B . Restart the process
- C . Reboot the machine
- D . Kill the process
D
Explanation:
When a process is frozen (hung or unresponsive), the typical method to resolve it is to kill the process. On Check Point, you can use cpwd_admin kill -name <ProcessName> or a standard Linux kill -9 <PID> command if necessary. You then allow CPWD (the Check Point watchdog) to restart it, or manually restart it if needed.
Other options:
Which of the following file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?
- A . tcpdump
- B . core dump
- C . fw monitor
- D . CPMIL dump
B
Explanation:
When troubleshooting crashes on a Security Gateway (or any Linux-based system), the file type that is typically generated and used for in-depth analysis is a core dump.
A core dump captures the memory state of a process at the time it crashed and is critical for root-cause analysis.
Other options:
When a User Mode process suddenly crashes, it may create a core dump file.
Which of the following information is available in the core dump and may be used to identify the root cause of the crash?
i. Program Counter
ii. Stack Pointer
iii. Memory management information
iv. Other Processor and OS flags / information
- A . iii and iv only
- B . i and ii only
- C . i, ii, iii and iv
- D . Only lii
C
Explanation:
A core dump file is essentially a snapshot of the process’s memory at the time of the crash. This snapshot includes crucial information that can help diagnose the cause of the crash.
Here’s why all the options are relevant:
i. Program Counter: This register stores the address of the next instruction the CPU was supposed to execute. It pinpoints exactly where in the code the crash occurred.
ii. Stack Pointer: This register points to the top of the call stack, which shows the sequence of function calls that led to the crash. This helps trace the program’s execution flow before the crash.
iii. Memory management information: This includes details about the process’s memory allocations, which can reveal issues like memory leaks or invalid memory access attempts.
iv. Other Processor and OS flags/information: This encompasses various registers and system information that provide context about the state of the processor and operating system at the time of the crash.
By analyzing this information within the core dump, you can often identify the root cause of the crash, such as a segmentation fault, null pointer dereference, or stack overflow.
Check Point Troubleshooting
Reference: While core dumps are a general concept in operating systems, Check Point’s documentation touches upon them in the context of troubleshooting specific processes like fwd (firewall) or cpd (Check Point daemon). The fw ctl zdebug command, for example, can be used to trigger a core dump of the fwd process for debugging purposes.
Where will the usermode core files located?
- A . $FWDIRVar/log/dump/usermode
- B . /var/suroot
- C . /var/log/dump/usermode
- D . $CPDIR/var/log/dump/usermode
D
Explanation:
Usermode core files are generated when a user mode process crashes. They are located in the $CPDIR/var/log/dump/usermode directory on the Security Gateway or Security Management server.
The core files can be used to analyze the cause of the crash and troubleshoot the issue. The core files are named according to the process name, date, and time of the crash.
For example, cpd_2023_02_03_16_40_55.core is a core file for the cpd process that crashed on February 3, 2023 at 16:40:55
What is the function of the Core Dump Manager utility?
- A . To determine which process is slowing down the system
- B . To send crash information to an external analyzer
- C . To limit the number of core dump files per process as well as the total amount of disk space used by core files
- D . To generate a new core dump for analysis
C
Explanation:
The Core Dump Manager (CDM) is a utility that helps manage core dump files on Check Point systems. Its main functions include:
Limiting file size and number: CDM can be configured to limit the size of individual core dump files and the total amount of disk space used for core dumps. This prevents core dumps from filling up valuable disk space.
Compression: CDM can compress core dump files to reduce their storage size. This is particularly helpful when dealing with large core dumps.
Process filtering: CDM allows you to specify which processes should be allowed to generate core dumps. This can help prevent unnecessary core dumps from being created.
Remote collection: CDM can be configured to send core dump files to a remote server for analysis.
This is useful in environments where direct access to the system generating the core dump is limited.
By using CDM, you can effectively manage core dump files and ensure that they are not overwhelming your system’s resources.
What is the proper command for allowing the system to create core files?
- A . service core-dump start
- B . SFWDIR/scripts/core-dump-enable.sh
- C . set core-dump enable
>save config - D . # set core-dump enable
# save config
When a user space process or program suddenly crashes, what type of file is created for analysis
- A . core dump
- B . kernel_memory_dump dbg
- C . core analyzer
- D . coredebug
A
Explanation:
When a user space process crashes unexpectedly, the operating system often creates a core dump file. This file is a snapshot of the process’s memory at the time of the crash, including information such as:
Program counter: This indicates where the program was executing when it crashed.
Stack pointer: This shows the function call stack, which can help trace the sequence of events leading to the crash.
Memory contents: This includes the values of variables and data structures used by the process.
Register values: This shows the state of the processor registers at the time of the crash.
Core dump files can be analyzed using debuggers like GDB to understand the cause of the crash.
Why other options are incorrect:
B. kernel_memory_dump dbg: This refers to a kernel memory dump, which is generated when the operating system kernel itself crashes.
C. core analyzer: This is a tool used to analyze core dump files, not the file itself.
D. coredebug: This is not a standard term for any type of crash dump file.
Check Point Troubleshooting
Reference: Check Point’s documentation mentions core dumps in the context of troubleshooting various processes, such as fwd (firewall) and cpd (Check Point daemon). You can find information on enabling core dumps and analyzing them in the Check Point administration guides and knowledge base articles.
You receive reports from multiple users that they cannot browse Upon further discovery you identify that Identity Awareness cannot identify the users properly and apply the configuredAccess Roles
What commands you can use to troubleshoot all identity collectors and identity providers from the command line?
- A . on the gateway: pdp debug set IDC all IDP all
- B . on the gateway: pdp debug set AD all and IDC all
- C . on the management: pdp debug on IDC all
- D . on the management: pdp debug set all
A
Explanation:
To troubleshoot Identity Awareness issues related to user identification and Access Role application, you need to enable debugging for both Identity Collectors (IDC) and Identity Providers (IDP). The command pdp debug set IDC all IDP all on the gateway achieves this.
Here’s why this is the correct answer and why the others are not:
When a User process or program suddenly crashes, a core dump is often used to examine the problem.
Which command is used to enable the core-dumping via GAIA clish?
- A . set core-dump enable
- B . set core-dump total
- C . set user-dump enable
- D . set core-dump per_process
A
Explanation:
In Check Point Gaia, you can enable core dumping through the command line interface (clish) using the following command:
set core-dump enable
This command activates the core dump mechanism, allowing the system to generate core dump files when user processes crash. Remember to save the configuration after enabling core dumps with the command:
save config
Why other options are incorrect:
B. set core-dump total: This command is used to set the total disk space limit for core dump files, not to enable core dumping itself.
C. set user-dump enable: There is no such command in Gaia clish for enabling core dumps.
D. set core-dump per_process: This command sets the maximum number of core dump files allowed per process, but it doesn’t enable core dumping.
Check Point Troubleshooting
Reference: Check Point R81.20 Security Administration Guide: This guide provides comprehensive information about Gaia clish commands, including those related to system configuration and troubleshooting.
Check Point sk92764: This knowledge base article specifically addresses core dump management in Gaia, explaining how to enable and configure core dumps.
Enabling core dumps is a crucial step in troubleshooting process crashes as it provides valuable information for analysis and debugging.
What is NOT a benefit of the ‘fw ctl zdebug’ command?
- A . Automatically allocate a 1MB buffer
- B . Collect debug messages from the kernel
- C . Cannot be used to debug additional modules
- D . Clean the buffer
When debugging is enabled on firewall kernel module using the fw ctl debug’ command with required options, many debug messages are provided by the kernel that help the administrator to identify Issues.
Which of the following is true about these debug messages generated by the kernel module?
- A . Messages are written to /etc/dmesg file
- B . Messages are written to a buffer and collected using ‘fw ctl kdebug
- C . Messages are written to SFWDIR
- D . Messages are written to console and also /var/log/messages file
During firewall kernel debug with fw ctl zdebug you received less information that expected. You noticed that a lot of messages were lost since the time the debug was started.
What should you do to resolve this issue?
- A . Increase debug buffer Use fw ctl debug -buf 32768
- B . Redirect debug output to file; Use fw ctl debug -o /debug.elg
- C . Redirect debug output to file; Use fw ctl zdebug -o /debug.elg
- D . Increase debug buffer; Use fw ctl zdebug -buf 32768
You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week. Therefore you need to add a timestamp to the kernel debug and write the output to a file but you cant afford to fill up all the remaining disk space and you only have 10 GB free for saving the debugs.
What is the correct syntax for this?
- A . A fw ctl kdebug -T -f -m 10 -s 1000000 -o debugfilename
- B . fw ctl debug -T -f-m 10 -s 1000000 -o debugfilename
- C . fw ctl kdebug -T -f -m 10 -s 1000000 > debugfilename
- D . fw ctl kdebug -T -m 10 -s 1000000 -o debugfilename
What command is usually used for general firewall kernel debugging and what is the size of the buffer that is automatically enabled when using the command?
- A . fw ctl debug, buffer size is 1024 KB
- B . fw ctl zdebug, buffer size is 1 MB
- C . fw ctl kdebug, buffer size is 32000 KB
- D . fw ctl zdebug, buffer size is 32768 KB
The Check Point Firewall Kernel is the core component of the Gaia operating system and an integral part of the traffic inspection process. There are two procedures available for debugging the firewall kernel.
Which procedure/command is used for troubleshooting packet drops and other kernel activities while using minimal resources (1 MB buffer)?
- A . fw ctl zdebug
- B . fwk ell debug
- C . fw debug ctl
- D . fw ctl debug/kdebug
You need to run a kernel debug over a longer period of time as the problem occurs only once or twice a week Therefore you need to add a timestamp to the kernel debug and write the output to a file.
What is the correct syntax for this?
- A . fw ctl debug -T -f > filename debug
- B . fw ctl kdebug -T -f -o filename debug
- C . fw ell kdebug -T > filename debug
- D . fw ctl kdebug -T -f > filename.debug
You are seeing output from the previous kernel debug.
What command should you use to avoid that?
- A . fw ctl clean buffer = 0
- B . fw ctl debug 0
- C . fw ctl zdebug disable
- D . fw ctl debug = 0
The Check Point Firewall Kernel is the core component of the Gaia operating system and an integral part of traffic inspection process. There are two procedures available for debugging the firewall kernel.
Which procedure/command is used for detailed troubleshooting and needs more resources?
- A . fw ctl zdebug
- B . fw debug/kdebug
- C . fw ctl debug/kdebug
- D . fw debug/kdebug ctl
What is the benefit of fw ctl debug over fw ctl zdebug?
- A . There is no difference Both are used for debugging kernel
- B . You don’t need timestamps
- C . It allows you to debug multiple modules at the same time
- D . You only need 1MB buffer
What is the buffer size set by the fw ctl zdebug command?
- A . 8GB
- B . 1 MB
- C . 1 GB
- D . 8 MB
Which command is used to write a kernel debug to a file?
- A . fw ctl kdebug -T -I > debug.txt
- B . fw ctl debug -S -t > debug.txt
- C . fw ctl kdebug -T -f > debug.txt
- D . fw ctl debut -T -f > debug.txt
What is the shorthand reference for a classification object?
- A . classobj
- B . CLOB
- C . COBJ
- D . class.obj
Which of the following is a component of the Context Management Infrastructure used to collect signatures in user space from multiple sources such as Application Control and IPS. and compiles them together into unified Pattern Matchers?
- A . Context Loader
- B . PSL – Passive Signature Loader
- C . cpas
- D . CMI Loader