CheckPoint 156-836 Certification Exam Dumps with 90 Practice Test Questions
New 156-836 Exam Dumps with High Passing Rate
The Check Point Certified Maestro Expert - R81 certification validates the candidates' ability to configure and implement high-performance, scalable, dynamic security management solutions in complex network environments. 156-836 exam validates the candidate's mastery of topics such as Maestro architecture, high availability, clustering, multi-domain management, and scalability. Check Point Certified Maestro Expert - R81 (CCME) certification also focuses on advanced troubleshooting techniques, performance optimization, and management of complex policies.
CheckPoint 156-836 (Check Point Certified Maestro Expert - R81 (CCME)) Certification Exam is a specialized certification designed for IT professionals who are looking to enhance their skills and knowledge in managing complex network infrastructures. 156-836 exam is designed to validate the skills and expertise of candidates in using Check Point Maestro, which is a network orchestration solution used to manage multiple firewalls and security gateways.
NEW QUESTION # 23
What kinds of transceivers are supported on Orchestrator MHO-170?
- A. SFP, SFP+, SFP28
- B. QSFP, QSFP28
- C. SFP+, SFP28, QSFP
- D. SFP, QSFP, QSFP28
Answer: B
Explanation:
Explanation
The Orchestrator MHO-170 supports QSFP and QSFP28 transceivers on its 32x 100 GbE ports. QSFP stands for Quad Small Form-factor Pluggable and QSFP28 is an enhanced version of QSFP that supports up to 28 Gbps per lane. These transceivers can provide high-speed and high-density connectivity for the Maestro environment.
References
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software1, page 2
*Maestro Transceiver & DAC Inventory - Check Point CheckMates
NEW QUESTION # 24
Which command should be used to restart Orchestrator service only?
- A. service orchestrator restart
- B. cpstop; cpstart
- C. orchd restart
- D. reboot
Answer: C
Explanation:
Explanation
Page 313 from the training manual:
- Restart the service:
orchd restart
- Restart the service without confirmation
service orchd restart
NEW QUESTION # 25
What can be learned from the output of sx_api_ports_dump.py command?
- A. Orchestrator port status
- B. Information about Security Groups
- C. Information about downlink ports only
- D. Information about backplane bonds
Answer: D
Explanation:
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*[Maestro Expert (CCME) Course - Check Point Software], page 31
*[Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge], page 3
NEW QUESTION # 26
Maestro allows running commands globally in Expert mode by using global prefixes, such as:
- A. g_all
- B. all
- C. global
- D. asg all
Answer: A
Explanation:
Explanation
The g_all prefix is used to run commands globally in Expert mode on all Security Group Members of the current Security Group. For example, g_all cpstop will stop the Check Point services on all SGMs. The other prefixes are not valid for global commands in Expert mode.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
NEW QUESTION # 27
There are two 10Gbps dual-port NIC installed on a 6800 appliance. Which interfaces should be connected to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators?
- A. Port 1 in Slot 1 and Port 2 in Slot 1
- B. Any pair of available ports
- C. Port 1 in Slot 1 and Port 1 in Slot 2
- D. Port 1 in Slot 2 and Port 2 in Slot 1
Answer: C
Explanation:
Explanation
The correct interfaces to connect to Orchestrator 1 for downlinks' intra-orchestrator redundancy when using two Orchestrators are Port 1 in Slot 1 and Port 1 in Slot 2. This is because each slot represents a different NIC, and each port represents a different physical link. By connecting two ports from different slots, the appliance can have redundant connections to the same orchestrator, and avoid a single point of failure in case of a NIC or link failure.
References
*Check Point 156-835 Certification Flashcards | Quizlet1
*Maestro Expert (CCME) Course - Check Point Software, page 182
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide
163
NEW QUESTION # 28
In a Maestro Dual Site environment, what is the definition of the term Active Site.
- A. The Active Site is the site where the SMO Master exists.
- B. There is no such thing as an active site. In a Dual Site environment, traffic is load balanced.
- C. The Active Site is the site that is not handling any traffic for the specific SG, but its connections are synced to its SGMs from the MHOs to be ready in the event of a failover.
- D. The Active Site is the site currently handling the enforcement on traffic passing for a specific SG.Connections are synced within the SGMs in the Active Site.
Answer: D
Explanation:
In a Maestro Dual Site environment, there are two sites that can host Security Group Members (SGMs) for each Security Group (SG). The Active Site is the one that is currently processing the traffic for a specific SG, while the Standby Site is the one that is ready to take over in case of a failover. The Active Site and the Standby Site can be different for different SGs, depending on the load balancing and failover policies. The Active Site and the Standby Site are synchronized by the Maestro Orchestrators (MHOs) using the Site-Sync port and VLANs.
References =
*Solved: Maestro dual site failover - Check Point CheckMates
*Maestro Dual Site configuration with a direct connection through L2 switches
NEW QUESTION # 29
What is the Orchestrator?
- A. Manager of compute and network resources, load balancer and network switch
- B. Network Switch
- C. Load balancer
- D. None of above
Answer: A
Explanation:
Explanation
The Orchestrator is a Maestro component that manages the compute and network resources of the Security Group Modules (SGMs) in a Security Group. It also acts as a load balancer and a network switch, distributing traffic among the SGMs and connecting them to the customer's network infrastructure.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 41
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
NEW QUESTION # 30
What is the difference between Dual-Site and Dual-Room?
- A. Dual-Room is a kind of Dual-Site deployment within the same building
- B. They are the same
- C. Dual-Room is a Single-Site deployment where all Appliances are connected to both orchestrators
- D. Dual-Room is Active / Standby and Dual-Site is Active / Active
Answer: A
Explanation:
Explanation
References =
*[Maestro Frequently Asked Questions (FAQ)]
*Maestro Dual Site configuration with a direct connection through L2 switches
*Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)
*CHECK POINT MAESTRO EXPERT
NEW QUESTION # 31
What happens when you make changes from Clish on the SMO Master?
- A. Changes are only applied on the SMO Master.
- B. Changes are applied to all members in the SG.
- C. The changes are synchronized to the MHO as a backup.
- D. The changes are synchronized to the SMS/MDS as a backup.
Answer: A
Explanation:
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.2: Security Group Configuration, page 2-10
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Security Group Configuration, page 2-9
*Security Group Configuration - Check Point Software
NEW QUESTION # 32
How many orchestrators may Dual-Site include?
- A. 2 or 4
- B. Only 4
- C. 0
- D. 1
Answer: A
Explanation:
Explanation
A Dual Site environment can include either two or four orchestrators, depending on the scenario. There are three primary scenarios for Dual Site configuration:
*Direct connectivity between remote site orchestrators: This scenario requires two orchestrators, one for each site, and a direct connection between them using the site-sync port.
*Two orchestrators on the same site are connected to the remote site orchestrators through two different switches: This scenario requires four orchestrators, two for each site, and a connection between them using the site-sync port and two external switches that support QinQ and MTU increment.
*Two orchestrators on the same site are connected to the remote site orchestrators through one switch: This scenario also requires four orchestrators, two for each site, and a connection between them using the site-sync port and one external switch that supports QinQ and MTU increment.
References =
*Maestro Dual Site configuration with a direct connection through L2 switches
*Dual Site Single Maestro Hyperscale Orchestrator Cluster (Dual Site Single MHO Redundancy)
*Maestro Frequently Asked Questions (FAQ)
NEW QUESTION # 33
What cannot be a reason for "Failed to get remote orchestrator interfaces" error message, when clicking on
"Orchestrator" in WebUI
- A. One orchestrator only, but Orchestrator amount is 2 or no Sync in between orchestrators
- B. No Sync between orchestrators
- C. Remote orchestrator has no empty interfaces
- D. Single orchestrator environment, but configured Orchestrator amount is 2
Answer: C
Explanation:
One of the possible reasons for the "Failed to get remote orchestrator interfaces" error message, when clicking on "Orchestrator" in WebUI, is that the remote orchestrator has no empty interfaces that can be assigned to a security group. This can happen if all the interfaces on the remote orchestrator are already part of configured security groups, or if the remote orchestrator has no physical interfaces at all. In this case, the WebUI cannot display the unassigned interfaces of the remote orchestrator, and shows the error message.
References
*Not able to see unassigned interfaces on checkpoint Orchestrator
*Maestro 140 not detecting Interfaces
*Maestro Expert (CCME) Course - Check Point Software, page
NEW QUESTION # 34
What command should be used for collecting diagnostic information about the orchestrator?
- A. asg perf -v
- B. cpinfo
- C. orch_info
- D. cpview
Answer: B
Explanation:
Explanation
The cpinfo command is a tool that collects diagnostic information about the orchestrator, such as hardware, software, network, configuration, and logs. The cpinfo command generates a file that can be sent to Check Point Support for analysis and troubleshooting. The cpinfo command can be run on the orchestrator's CLI or WebUI.
References =
*Check Point Maestro R81.X Administration Guide, page 68, section "cpinfo" 1
*Check Point Maestro R81.X Getting Started Guide, page 30, section "cpinfo" 2
*Maestro Hyperscale Orchestrator Datasheet - Check Point Software 3
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frame
3: https://www.checkpoint.com/downloads/products/maestro-hyperscale-orchestrator-datasheet.pdf
NEW QUESTION # 35
Which distribution mode assigns packets to an SGM based solely on the packet destination IP?
- A. Network mode
- B. User mode
- C. Manual mode
- D. Auto-topology mode
Answer: A
Explanation:
Network mode is the distribution mode that assigns packets to an SGM based solely on the packet destination IP. In this mode, the Orchestrator uses a hash function to map each destination IP to a specific SGM. This mode ensures that all packets with the same destination IP are processed by the same SGM, regardless of the source IP or port. This mode is suitable for scenarios where the destination IP is the main factor for load balancing, such as NAT or VPN.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-19
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Maestro basic setup documentation - Page 2 - Check Point CheckMates
NEW QUESTION # 36
What Maestro component acts as a load balancer and network switch?
- A. Security Gateway Module (SGM)
- B. Security Group (SG)
- C. Security Switching Module (SSM)
- D. Maestro Hyperscale Orchestrator (MHO)
Answer: D
Explanation:
*The Quantum Maestro Orchestrator uses the Distribution Mode to assign incoming traffic to Security Group Members.
*Reference: Working with the Distribution Mode
NEW QUESTION # 37
Which blade configuration files should be backed up on the SG if upgrading from R80.30SP or earlier?
- A. fwkern.conf files.
- B. VPN configuration files
- C. IPS configuration files
- D. Mobile Access configuration files.
Answer: C
Explanation:
Explanation
References
*Maestro R80.30SP Jumbo Hotfix Accumulator, Section: Important Notes
*Check Point Maestro R80.30SP with Gaia 3.10, Section: Known Limitations
*Check Point SNMP MIB files, Section: Revision History
NEW QUESTION # 38
Logs without a dedicated log file can be found in
- A. /var/log/messages
- B. $FWDIR/log/fw.log
- C. /var/log/junk.log.dbg
- D. $RTDIR/log/junk.log
Answer: A
Explanation:
Explanation
The /var/log/messages file is a general system log file that contains information about various system events, such as booting, shutdown, cron jobs, kernel messages, and other system services. Logs without a dedicated log file can be found in this file, as well as some Maestro Gaia Clishcommands that are not saved in the
/var/log/command_logger.log file.
References
*Maestro Audit Logs - Where are they? - Check Point CheckMates1
*sk172923: The /var/log/messages file does not save Maestro Gaia Clish commands2
*Maestro Expert (CCME) Course - Check Point Software, page 33
NEW QUESTION # 39
What happens when you make changes from Clish on the SMO Master?
- A. Changes are only applied on the SMO Master.
- B. Changes are applied to all members in the SG.
- C. The changes are synchronized to the MHO as a backup.
- D. The changes are synchronized to the SMS/MDS as a backup.
Answer: A
Explanation:
Explanation
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.2: Security Group Configuration, page 2-10
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Security Group Configuration, page 2-9
*Security Group Configuration - Check Point Software
NEW QUESTION # 40
What is the Correction Layer?
- A. Correction Layer is a Layer of GAIA OS which corrects misspelled commands and allows them to execute
- B. Correction Layer is a daemon which corrects errors on Backplane interfaces
- C. Correction Layer is a mechanism which handles asymmetric connections in multi-appliance system. For example, in case of NAT
- D. Correction Layer is a mechanism which activated in case of asymmetric routing
Answer: C
Explanation:
The Correction Layer is a Maestro component that ensures that packets from the same connection are handled by the same Security Group Module (SGM) in a multi-appliance system. This is especially important when NAT is involved, as packets sent from the client to the server can be distributed to a different SGM than packets from the same session sent from the server to the client. The Correction Layer must then forward the packet to the correct SGM.
References:
*NAT and the Correction Layer on a Security Gateway - Check Point Software1
*Solved: Maestro queries - Check Point CheckMates
NEW QUESTION # 41
In a dual MHO environment, MHO1 and MHO2 are connected to the SGM line cards in which way?
- A. MHO1 and MHO2 are connected to the SGMs using the Sync cable.
- B. MHO 1 is connected to the odd-numbered ports, while MHO2 is connected to even-numbered ports.
- C. MHO 1 is connected to the even-numbered ports, while MHO2 is connected to odd-numbered ports.
- D. MHO1 and MHO2 are connected to the line cards in any order administrators see fit.
Answer: C
Explanation:
Explanation
The correct way to connect MHO1 and MHO2 to the SGM line cards in a dual MHO environment is to use the even-numbered ports for MHO1 and the odd-numbered ports for MHO2. This is to ensure that each SGM has two downlinks to each MHO, and that the downlinks are balanced across the different NICs and links. This provides redundancy and high availability for the traffic flow between the SGMs and the MHOs.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates, page 2
*Maestro Expert (CCME) Course - Check Point Software, page 18
*Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 16
NEW QUESTION # 42
What type of license is required for an MHO?
- A. The MHO requires a VSX license.
- B. A license is needed for each attached SGM.
- C. The MHO requires a NGTP license.
- D. The MHO does not require a license.
Answer: D
Explanation:
Explanation
The MHO (Maestro Hyperscale Orchestrator) does not require a license by itself, but each SGM (Security Group Module) that is attached to the MHO needs a license. The license type depends on the features and blades that are enabled on the SGM. For example, if the SGM is running VSX, it needs a VSX license.
References:
*Maestro Expert (CCME) Course - Check Point Software, page 71
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline
NEW QUESTION # 43
How does HyperSync work in a Dual Site environment?
- A. Each active connection has a backup connection on the second site (remote site.)
- B. Each active connection has a local backup (on the local site) and a second backup connection on each of the MHOs.
- C. Each active connection has a local backup (on the local site) and a second backup connection on the second site (remote site.)
- D. Each active connection has two local backups (on the local site) and a third backup connection on the second site (remote site.)
Answer: C
Explanation:
HyperSync is a feature of Maestro that enables stateful synchronization of connections and resources across different sites in a Dual Site environment. HyperSync works by creating two backup connections for each active connection: one on the same site as the active connection, and another on the remote site. This ensures that the connection can be seamlessly resumed in case of afailover event, either within the same site or across the sites. HyperSync uses the Site-Sync port and VLANs to transmit the synchronization packets between the Security Group Members and the Maestro Orchestrators.
References =
*Maestro Dual Site configuration with a direct connection through L2 switches
*Maestro Frequently Asked Questions (FAQ)
*CHECK POINT MAESTRO EXPERT
NEW QUESTION # 44
What is the Correction Layer mechanism?
- A. Ensures asymmetric traffic is handled properly, especially in the case of NAT or VPNs.
- B. Enforces the access policy on the SGMs and synchronizes the enforcement verdict to other SGMs in the SG.
- C. The MHO's distribution algorithm which determines the handling SGM for a given connection.
- D. The load-balancing mechanism used by the MHO.
Answer: A
Explanation:
The Correction Layer mechanism is a Maestro component that ensures that packets from the same connection are handled by the same Security Group Module (SGM) in a multi-appliance system.This is especially important when NAT or VPNs are involved, as packets sent from the client to the server can be distributed to a different SGM than packets from the same session sent from the server to the client. The Correction Layer must then forward the packet to the correct SGM.
References:
*NAT and the Correction Layer on a VSX Gateway - Check Point Software1
*Solved: Maestro queries - Check Point CheckMates
NEW QUESTION # 45
......
To prepare for the Check Point Certified Maestro Expert - R81 exam, candidates can take advantage of the various training resources available, including self-study materials, instructor-led courses, and online tutorials. They can also participate in online communities, attend webinars, and network with industry professionals to gain insights into the latest trends and best practices in the field.
Get 156-836 Braindumps & 156-836 Real Exam Questions: https://itcert-online.newpassleader.com/CheckPoint/156-836-exam-preparation-materials.html