[2026] Pass your 156-836 exam with this 100% Free 156-836 Braindump
View All 156-836 Actual Exam Questions, Answers and Explanations for Free
NEW QUESTION # 24
What is the maximum number of Appliances within Security group in Dual-Site configuration?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
NEW QUESTION # 25
There are two 10Gbps dual-port NIC installed on a 6800 appliance. Which interfaces should be connected to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators?
- A. Port 1 in Slot 2 and Port 2 in Slot 1
- B. Port 1 in Slot 1 and Port 2 in Slot 1
- C. Any pair of available ports
- D. Port 1 in Slot 1 and Port 1 in Slot 2
Answer: D
Explanation:
Explanation
The correct interfaces to connect to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators are Port 1 in Slot 1 and Port 1 in Slot 2. This is because each slot represents a different NIC, and each port represents a different physical link. By connecting two ports from different slots, the appliance can have redundant connections to the same orchestrator, and avoid a single point of failure in case of a NIC or link failure.
References
*Check Point 156-835 Certification Flashcards | Quizlet1
*Maestro Expert (CCME) Course - Check Point Software, page 182
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide
163
NEW QUESTION # 26
What is the purpose of Management ports located on the Rear Panel of the Orchestrator MHO-140?
- A. Reserved for internal purposes. Not in use.
- B. 1Gbps connectivity for Security Groups
- C. Out-of-band interfaces for access to Orchestrator itself
- D. Additional ports used as uplinks
Answer: C
Explanation:
The Management ports located on the Rear Panel of the Orchestrator MHO-140 are out-of-band interfaces that provide access to the Orchestrator itself for configuration and management purposes. They are not used for traffic distribution or connectivity to the Security Groups or the external networks. They are 1Gbps RJ-45 ports that can be connected to a switch or a router.
References
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software1, page 2
*Quantum Maestro Getting Started Guide - Check Point CheckMates2, page 4
NEW QUESTION # 27
There are two appliances within the same Security Group. One of them is connected by One downlink only, another one by Two downlinks. Assuming there's no NAT and no VPN, what would be proportion of traffic distribution done by Orchestrator?
- A. 50%/50%
- B. 33%/66%
- C. 100%/0%
- D. 66%/33%
Answer: B
NEW QUESTION # 28
Which command should be used to restart Orchestrator service only?
- A. orchd restart
- B. service orchestrator restart
- C. cpstop; cpstart
- D. reboot
Answer: A
Explanation:
Explanation
Page 313 from the training manual:
- Restart the service:
orchd restart
- Restart the service without confirmation
service orchd restart
NEW QUESTION # 29
What command can be run to show which SGM is selected to receive traffic?
- A. dxl calc
- B. asg calc
- C. g_tcpdump
- D. asg monitor
Answer: B
Explanation:
Explanation
The asg calc command is a tool to show which SGM is selected to receive traffic based on the distribution mode and the packet parameters. It takes the port number, the source IP, the destination IP, and optionally the source port and the destination port as arguments and returns the SGM ID and the hash value. For example, asg calc 1 10.0.0.1 20.0.0.2 1234 80 will show which SGM will receive the traffic from 10.0.0.1:1234 to
20.0.0.2:80 on port 1.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using theCommand Line Interface and WebUI, Lesson 4.1: asg calc, page 4-5
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: asg calc, page 4-5
*asg calc - Check Point Software
NEW QUESTION # 30
What happens if you apply a hotfix using gClish?
- A. If you apply a hotfix using gclish, the operation will fail because an outage would occur.
- B. If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.
- C. Logical groups "A" and "B" are created. Members of group "A" install and reboot first. Then members of group "B" does the same once reboots have finished with group "A."
- D. If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.
Answer: C
Explanation:
Explanation
This is the correct answer because it describes the hotfix installation process using gClish on a Maestro Security Group. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. When a hotfix is applied using gClish, the SG members are divided into two logical groups: "A" and "B". The members of group "A" install the hotfix and reboot first, while the members of group "B" wait for their turn. After all the members of group "A" are back online, the members of group
"B" install the hotfix and reboot.This way, the SG maintains high availability and does not cause an outage.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
NEW QUESTION # 31
What Maestro component is automatically designated the SMO Master?
- A. The SGM with the highest member ID (the last one added to the security group.)
- B. The MDS that pushes policy to the SMO is considered the SMO Master.
- C. The first MHO configured is considered the SMO Master.
- D. The SGM with the lowest member ID (the first one added to the security group.)
Answer: D
Explanation:
The SMO Master is the SGM that is responsible for synchronizing the configuration and policy with the other SGMs in the security group. The SMO Master is automatically designated as the SGM with the lowest member ID, which is usually the first one added to the security group. The SMO Master can be changed manually if needed.
References:
*Maestro Frequently Asked Questions (FAQ), under "What is a Single Management Object (SMO)?"
*Check Point Jump Start Course: Maestro, under "Maestro Security Groups"
NEW QUESTION # 32
What happens if you apply a hotfix using gClish?
- A. If you apply a hotfix using gclish, the operation will fail because an outage would occur.
- B. If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.
- C. If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.
- D. Logical groups "A" and "B" are created. Members of group "A" install and reboot first. Then members of group "B" does the same once reboots have finished with group "A."
Answer: B
Explanation:
According to the Installing and Uninstalling a Hotfix on Quantum Maestro Orchestrators, page 1, when you apply a hotfix using gclish, the MHO distributes the hotfix to all SGMs in the SecurityGroup. The SGMs install the hotfix and reboot one by one, in ascending order of their SGM IDs. The SGMs wait for the previous SGM to finish rebooting before starting their own reboot. This ensures that there is no outage for the entire Security Group.
References = Installing and Uninstalling a Hotfix on Quantum Maestro Orchestrators, page 1; Maestro R81.10 Jumbo Hotfix install - Check Point CheckMates, page 1.
NEW QUESTION # 33
Maestro allows running commands globally in Expert mode by using global prefixes, such as:
- A. asg all
- B. g_all
- C. global
- D. all
Answer: B
Explanation:
Explanation
The g_all prefix is used to run commands globally in Expert mode on all Security Group Members of the current Security Group. For example, g_all cpstop will stop the Check Point services on all SGMs. The other prefixes are not valid for global commands in Expert mode.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
NEW QUESTION # 34
What will happen in case of NAT of the traffic passing through Management network?
- A. This traffic will not pass correction, since it will be dropped
- B. Since Management traffic is always going to SMO, it will take a care for Correction Layer and will re- distribute traffic to other Appliances
- C. Orchestrator will disable NAT and traffic will pass with no issue
- D. This traffic will pass with no inspection
Answer: C
Explanation:
According to the Check Point MAESTRO R80.20SP Administration Manual1, NAT is not supported on the management network. If you configure NAT on the management network, the Orchestrator will disable NAT and allow the traffic to pass without translation. This is to ensure that the management traffic can reach the Security Group members and the SmartConsole without any issues.
References
*Check Point MAESTRO R80.20SP Administration Manual, page 291
NEW QUESTION # 35
What is the maximum number of Appliances within the same Security Group?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
Explanation
The maximum number of appliances within the same security group is 31. This is because a security group can have up to 31 Security Group Modules (SGMs) of the same or different models, and each SGM is an appliance that runs the Check Point software. A security group can span across multiple chassis, and each chassis can have up to 16 SGMs. However, the total number of SGMs in a security group cannot exceed 31.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 51
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
NEW QUESTION # 36
What is the purpose of g_tcpdump command?
- A. Collects traffic dump from Sync network
- B. Collects traffic dump from all Active Appliances within Security Group
- C. The same as tcpdump, just on Scalable Platform
- D. Collects traffic dump from CIN network
Answer: B
Explanation:
Explanation
_tcpdump" probably collects traffic dumps from all active appliances within a security group, aligning with the naming convention and function of similar commands in scalable platforms.
References
*Maestro Expert (CCME) Course - Check Point Software, page 331
*What is 'IN' and 'OUT' of g_tcpdump? - Check Point CheckMates2
*CHECK POINT MAESTRO EXPERT, page 23
NEW QUESTION # 37
What is the throughput penalty of Security Group?
- A. 1% per member
- B. 5% per member
- C. Depends on the type of Appliance
- D. 10% per Security Group with no relation to the number of members
Answer: A
Explanation:
Check Point reduced throughput degradation to 1% per added SGMs. For example, the overall throughput degradation is 10% for 10 SGMs in a Security Group. Check Point aims to reduce this even further in the future. https://supportcenter.checkpoint.com/supportcenter/portal?
eventSubmit_doGoviewsolutiondetails=&solutionid=sk147853
NEW QUESTION # 38
There is a Security group of 10 Appliances and all of them are up and running. How many Appliances within a Security Group keep the same connection in its connection table in case of NAT?
- A. Between 2 and 4
- B. 0
- C. All 10
- D. 1
Answer: A
Explanation:
Explanation
References =
*Check Point Maestro R81.X Administration Guide, page 64, section "Correction Layer" 1
*Check Point Maestro R81.X Getting Started Guide, page 26, section "Correction Layer" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23
*Check Point Maestro Frequently Asked Questions (FAQ), question 9
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
:
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20M
:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
NEW QUESTION # 39
Which command should be used to restart Orchestrator service only?
- A. orchd restart
- B. service orchestrator restart
- C. cpstop; cpstart
- D. reboot
Answer: A
Explanation:
Page 313 from the training manual:
- Restart the service:
orchd restart
- Restart the service without confirmation
service orchd restart
NEW QUESTION # 40
To display processes that are consuming excessive system resources, users should use the_____ command.
- A. asg_perf_hogs
- B. asg stat -v
- C. asg perf -v
- D. top
Answer: A
Explanation:
The asg_perf_hogs command is a script that displays the processes that are consuming excessive system resources, such as CPU, memory, disk, and network, on the orchestrator and the appliances. It can help identify performance issues and bottlenecks in the Maestro environment.
References
*Software Provision and Performance hogs failed - Check Point CheckMates1
*CHECK POINT MAESTRO EXPERT, page 33
NEW QUESTION # 41
Each morning at 1:00 am, a series of automatic diagnostics on all the SGMs runs by automatic execution of which command?
- A. asg diag verify
- B. asg diag list
- C. hcp -r all
- D. asg perf -v
Answer: A
NEW QUESTION # 42
When a VPN tunnel is formed with a Maestro SGM,
- A. The MHO handles the IKE before distributing the traffic to a SGM to handle all encrypted traffic. This helps to prevent any issues with the correction layer.
- B. SGM 1 analyzes the policy and topology. If encryption is required, it calculates the tunnel owner's IP address. SGM 1 sends a clear packet to the tunnel owner. SGM 2 is now the connectionand tunnel owner.
- C. The receiving SGM makes an encryption decision. The SGM then syncs the traffic to two backup SGMs: one for clear traffic and one for encrypted traffic.
- D. The MHO distributes copies of the packets to two different SGMs because SGM 1 will handle the clear traffic IKE exchange packets, while SGM2 handles encrypted packets.
Answer: A
Explanation:
Explanation
In scalable security environments, initial IKE (Internet Key Exchange) handling by a central orchestrator before distributing traffic for encryption is a common approach to maintain efficiency and security.
NEW QUESTION # 43
In case of Correction, where is information about Owner stored?
- A. In Correction table of Target Appliance
- B. In Correction tables of all Appliances participating in Correction Layer flow
- C. In Connection tables of all Appliances participating in Correction Layer flow
- D. In Connection table of Target Appliances
Answer: B
Explanation:
Explanation
The Correction Layer is a mechanism that handles asymmetric connections in systems with several cluster members. It allows traffic flow to be handled by a single cluster member, even if the flow is asymmetric1 The Correction Layer works as follows:
*When a packet arrives at a cluster member, it checks if it is the owner of the connection. If yes, it processes the packet normally. If not, it checks the Correction table to find the owner of the connection.
*If the owner is found in the Correction table, the packet is forwarded to the owner with a Correction Layer header. The owner then processes the packet and removes the Correction Layer header before sending it to the destination.
*If the owner is not found in the Correction table, the packet is forwarded to the Maestro Orchestrator (MHO) with a Correction Layer header. The MHO then checks its own Correction table to find the owner of the connection. If the owner is found, the MHO forwards the packet to the owner with a Correction Layer header.
If the owner is not found, the MHO drops the packet and sends an ICMP error message to the source.
*The Correction tables are updated by the MHO whenever a new connection is established or an existing connection is terminated. The MHO sends Correction Layer messages to all clustermembers to inform them about the owner of each connection2
NEW QUESTION # 44
What is the throughput penalty of Security Group?
- A. 1% per member
- B. 5% per member
- C. Depends on the type of Appliance
- D. 10% per Security Group with no relation to the number of members
Answer: A
Explanation:
Explanation
Check Point reduced throughput degradation to 1% per added SGMs. For example, the overall throughput degradation is 10% for 10 SGMs in a Security Group. Check Point aims to reduce this even further in the future.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=
NEW QUESTION # 45
Which distribution mode assigns packets to an SGM based solely on the packet destination IP?
- A. Manual mode
- B. Network mode
- C. Auto-topology mode
- D. User mode
Answer: B
Explanation:
Network mode is the distribution mode that assigns packets to an SGM based solely on the packet destination IP. In this mode, the Orchestrator uses a hash function to map each destination IP to a specific SGM. This mode ensures that all packets with the same destination IP are processed by the same SGM, regardless of the source IP or port. This mode is suitable for scenarios where the destination IP is the main factor for load balancing, such as NAT or VPN.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-19
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Maestro basic setup documentation - Page 2 - Check Point CheckMates
NEW QUESTION # 46
HealthCheck Point _____
- A. performs a system health check and is meant to replace both a CPInfo and the health check script.
- B. is a self-updatable suite of tools for SGMs with the capability to assess the health of the system, visualize the Firewall topology, provide a timeline of critical and informative events that might have occurred in a production system.
- C. is a self-updatable suite of tools for MHOs with the capability to assess the health of the system and provide a timeline of critical and informative events that might have occurred in a production system.
- D. can be used to let you visualize the Firewall topology for the SG and view live statistics, which includes throughput, problem notes, and CPU utilization.
Answer: B
Explanation:
HealthCheck Point (HCP) is a tool that can perform various tests and checks on the system components of the Security Group Modules (SGMs), such as hardware, software, network, clock, ARP, and more. It can also display the performance statistics of the SGMs, such as throughput, packet rate, CPU utilization, memory usage, and more. Additionally, HCP can provide a graphical representation of the Firewall topology for the Security Group, showing the connections and statuses of the SGMs and the Orchestrators. Furthermore, HCP can generate a report of the critical and informative events that occurred on the system, such as configuration changes, errors, warnings, and alerts. HCP can help identify and troubleshoot any issues or errors that may affect the system functionality or performance.
References =
*HealthCheck Point (HCP) Release Updates - Check Point Software 1
*Professional Services Healthcheck - Check Point Software 2
*HealthCheck Point - Check Point CheckMates 3
NEW QUESTION # 47
What command can be run to show which SGM is selected to receive traffic?
- A. dxl calc
- B. asg calc
- C. g_tcpdump
- D. asg monitor
Answer: B
Explanation:
The asg calc command is a tool to show which SGM is selected to receive traffic based on the distribution mode and the packet parameters. It takes the port number, the source IP, the destination IP, and optionally the source port and the destination port as arguments and returns the SGM ID and the hash value. For example, asg calc 1 10.0.0.1 20.0.0.2 1234 80 will show which SGM will receive the traffic from 10.0.0.1:1234 to
20.0.0.2:80 on port 1.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.1: asg calc, page 4-5
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: asg calc, page 4-5
*asg calc - Check Point Software
NEW QUESTION # 48
......
156-836 dumps Free Test Engine Verified By It Certified Experts: https://www.crampdf.com/156-836-exam-prep-dumps.html
156-836 Exam Free Practice Test with100% Accurate Answers: https://drive.google.com/open?id=1ytVAkwJaVG_m24YZxAEcKXFN069O0gJs