Ccse

Front 1

All the functionality of the management server is implemented in what processes?

Back 1

User-mode processes

Front 2

The most significant processes are what?

Back 2

FWM (management)

FWD (daemons)

CPD

CPWD (checkpoint watch dog)

Front 3

To mitigate rish, some of the firewall functionality is implemented in what?

Back 3

The OS Kernel. This allows the traffic to be inspected before even getting to the OS IP stack.

Front 4

The firewall kernel is responsible for the majority of what?

Back 4

security enforcement, encryption/decryption NAT, etc...

Front 5

What two mechanisms allow the user and kernel proceses to communicate?

Back 5

IOctl(input/output controls)

traps ( changes a value in registry key)

Front 6

IOctl

Back 6

When a usermode entity needs to write information to a kernel process, it uses IOctl, which is an infrastructure allowing the entity to call a function in the kernel and supply the requierd parameters.

Front 7

CPD allows for what?

Back 7

SIC functionality (ports 18xxx)

Status -pull amon status from the GW/management using smartevent

Transferring messages from FW-1 processes

Policy installation - Recieves the policy and pushes it forward to relevant processes and the Kernel

Front 8

what does fwm do?

Back 8

GUI client communications

DB manipulation - all actions performed on the MGMT, such as object creation, rules, and users

Policy compilation

Management HA sync

Front 9

fwd

Back 9

Allows other processes including the kernel to forward logs to evernal log server as well as the MGMT. Used to communicate with the kernel using command line tools such as the fw commansd; for example, when setting kernel variables or using kernel control commands

Front 10

fwssd

Back 10

child process of fwd responsible for maintaining the MGMT serveres.

Front 11

cpwd

Back 11

WatchDog. Process that invokes and monitors critical processes such as CP daemons on the local machine, and attempts to restart them if they fail. Some processes monitored are fwd, fwm.

Front 12

cpwd_admin

Back 12

shows the status of the processes, and to configure cpwd

Front 13

For wire-mode configuration, chaim modules are marked with what?

Back 13

1

Front 14

For stateful mode, the chain modules are marked with what?

Back 14

2

Front 15

Chain moduels marked with what to apply to all traffic?

Back 15

3

Front 16

Stateful inspection acts between what two layers?

Back 16

Data and Network, but is capable of processing data from layers 4 - 7

Front 17

How to view all the existing Kernel tables?

Back 17

fw tab - t <tablename>

Front 18

To view only table names and get a perspective on the number of Kernel tables available, type what?

Back 18

fw tab | grep -e "---" | more or

fw tab -s

Front 19

Most traffic related information is saved in the what?

Back 19

Kernel Tables

Front 20

Connections table

Back 20

Essentially an approved-connections list

Front 21

Connections Table Stateful features are?

Back 21

Streaming base applications

Sequence verification and translation

Hide NAT

logging, accounting, monitor, etc.

Client and server identification

Data Connections

Front 22

Once a packet is matched against the rule base, a log is generated and sent where?

Back 22

From the kernel to the user-mode process, FWD, located in the security gateway

Front 23

What does the FWD process on the gateway do with logs it recieves from the kernel?

Back 23

Sends the logs to the FWD on the MGMT server, where it is forwarded to FWM via CPD

Front 24

Where must a packet go through the Firewall kernel?

Back 24

On the both the inbound and outbound interfaces

Front 25

Policy Installation Flow

Back 25

1. Policy is defined in the SmartDashboard GUI

2. When the policy is saved, the new file in created called $WFDIR/conf/*.W.

3. fwm_gen complines the *.W into a machine language create a new files called $FWDIR/conf/*.pf

Front 26

$FWDIR/conf/*.pf is actually what?

Back 26

the input from the $FWDIR/conf/objects.C file

Front 27

$FWDIR/conf/*.W is actually the exact same information defined in the GUI, just what?

Back 27

In a text format

Front 28

object.C file contains what?

Back 28

information relevant to the policy installation only

Front 29

objects_5_0.c file contains what?

Back 29

all the objects defines int he GUI

Front 30

$FWDIR/conf/objects_5_0.C is stored where?

Back 30

On the management server, and is important only to the MGMT server.

Front 31

$FWDIR/database/objects.C is relvant to what?

Back 31

the Gatway only.

Front 32

CPMI

Back 32

Check Point management Interface

Front 33

What is bi-directional NAT

Back 33

The ability to match two NAT rules on the same connection. Only applies to automatic rules

Front 34

Where is source NAT translated?

Back 34

Server side

Front 35

CPsuite-R76

Back 35

Manages firewall modules. CPsuite in the generic installation

Front 36

CPshrd-R76

Back 36

Stores what used to be called SVN foundation including CPD database, licenses, registry and generic low level Check Point infrastruction

Front 37

FWvsxngxcmp

Back 37

For managing VSX

Front 38

CPedgecmp

Back 38

For managing Edge devices

Front 39

$FWDIR/lib/*.def

Back 39

include rulebase and protocol definitions

Front 40

$FWDIR/conf/fwauth.NDB

Back 40

Users definitions are stored here

Front 41

$FWDIR/conf/fwauthd.conf

Back 41

Security server configuration settings

Front 42

$FWDIR/conf/classes.C

Back 42

defines fields for each object used in the objects_5_0.C such as color, num/string, and default value.

Front 43

$FWDIR/database/

Back 43

Specific object entries are stored for that particular gateway

Front 44

cpconfig

Back 44

Used to run a command line version of the CP configuration tool, and to configure or reconfigure a gateway/MGMT installation

Front 45

cplic print

Back 45

Located in $FWDIR/bin...prints the details of CP licenses on teh local machine.

Front 46

cplic print -x

Back 46

prints the licenses with signatures

Front 47

cplic del

Back 47

deletes the licenses

Front 48

cpstart

Back 48

used to start all CP processes and applications running on a machine

Front 49

cpstop

Back 49

used to stop all CP proccesses and applications

Front 50

cpstart and cp stop are actually calling what scripts?

Back 50

fwstop and fwtart in $FWDIR/bin

Front 51

What layers does fw monitor work at?

Back 51

layers 3 and above

Front 52

VRRP

Back 52

A cluster solution where two ormore Gaia based gateways work together as one gateway. You can configure your VRRP cluster for high availability or load sharing

Front 53

Monitored-Circuit VRRP

Back 53

prevents black holes cause by asymmetric routes create when only one interface on master route fails. Gaia releases priority over all interfaces on a virtual router to let failover occur

Front 54

Advantages of using ClusterXL

Back 54

Provides HA and load sharing

Transparent failover

Higher performance

Easy deployment

Cost-effectiveA

Front 55

dvantages of using VRRP

Back 55

Minimezes failover time (black Holes) and bandwidth overhead when a primary router becomes unavailable

Supports up to 255 virtual routers

Minimizes service disruptions during failover

Provides for election of multiple virtual routers

Addresses failover problems at the router level instead of on the network edge

Avoids the need to make configuration changes in the end nodes

Eliminates the need for router discover protocols

Front 56

You can configure VRRP using one of two procedures...

Back 56

Simple Monitored Curiuity VRRP

Advanced VRRP

Front 57

How does Gaia eliminate Black Holes?

Back 57

By reducing the priority over all of theinterfaces in the virtual router to allow the backup to take over entirely

Front 58

How would you enable traces for VRRP?

Back 58

1. WebUI -> Routing-> Routing Options

2. In teh trace options sections, select VRRP

3. Select an option and click activate

Front 59

All routers of a VRRP group must ahve teh same what?

Back 59

Hello Interval

Front 60

What is the multicast domain for VRRP?

Back 60

224.0.0.18