When troubleshooting a performance problem on multicore firewall that is using CoreXL, what command checks the number of connections each core is processing?

Options are :

• fw ctl multik stat (Correct)
• sim affinity -l
• cat fwkern.conf
• fw CTL pstat

Answer : fw ctl multik stat

What is the difference between “connection establishment acceleration” (templating) and “traffic acceleration”?

Options are :

• “Connection establishment acceleration” only accelerates a single connection, while “traffic acceleration” accelerates similar traffic.
• “Traffic acceleration” only accelerates a single connection, while “connection establishment acceleration” accelerates similar traffic. (Correct)
• These are the same technologies with different names.
• “Traffic acceleration” is accelerated through hardware, and “connection establishment acceleration” is accelerated in software.

Answer : “Traffic acceleration” only accelerates a single connection, while “connection establishment acceleration” accelerates similar traffic.

Why would you not see a CoreXL configuration option in cpconfig?

Options are :

• CoreXL is not licensed.
• CoreXL is not enabled in the gateway object.
• The gateway only has one processor core. (Correct)
• CoreXL is disabled via policy.

Answer : The gateway only has one processor core.

Which command will allow you to change firewall affinity and survive a reboot with no further modification?

Options are :

• fw affinity –l
• sim affinity –s (Correct)
• sim affinity –l
• fw ctl affinity –s

Answer : sim affinity –s

How does the Check Point Security Administrator enable NAT Templates?

Options are :

• Set Firewall object > NAT > Advanced
• Run commands with syntax fw ctl set int cphwd_nat_templates_support 1 and fw ctl set int cphwd_nat_templates_enabled 1
• Set Global properties > NAT-Network address translation
• Edit file $FWDIR/boot/modules/fwkern.conf with the lines “cphwd_nat_templates_support=1” and “cphwd_nat_templates_enabled=1”. (Correct)

Answer : Edit file $FWDIR/boot/modules/fwkern.conf with the lines “cphwd_nat_templates_support=1” and “cphwd_nat_templates_enabled=1”.

To check what is currently set in the Firewall kernel debug input the command:

Options are :

• fw ctl debug –x
• fw ctl debug (Correct)
• fw ctl pstat
• fw ctl multistate

Answer : fw ctl debug

You want to verify that the majority of your connections are being optimized by SecureXL. What command would you run to establish this information?

Options are :

• sim_dbg -s
• fwaccel conns -s (Correct)
• fw tab -t connections -s
• fw ctl pstat

Answer : fwaccel conns -s

Which command displays FireWall internal statistics about memory and traffic?

Options are :

• cpstat os –f memory
• fw getifs
• cpstat os –f cpu
• fw ctl pstat (Correct)

Answer : fw ctl pstat

ACME Corp has a cluster consisting of two 13500 appliances. As the Firewall Administrator, you notice that on an output of top, you are seeing high CPU usage of the cores assigned as SNDs, but low CPU usage on cores assigned to individual fw_worker_X processes. What command should you run next to performance tune your cluster?

Options are :

• fw ctl debug –m cluster + all – this will show you all the connections being processed by ClusterXL and explain the high CPU usage on your appliance.
• fw tab –t connections –s – this will show you a summary of your connections table, and allow you to determine whether there is too much traffic traversing your firewall.
• fwaccel stats –s – this will show you the acceleration profile of your connections and potentially why your SNDs are running high while other cores are running low. (Correct)
• fwaccel off – this will turn off SecureXL, which is causing your SNDs to be running high in the first place

Answer : fwaccel stats –s – this will show you the acceleration profile of your connections and potentially why your SNDs are running high while other cores are running low.

From a Best Practices perspective, what percentage of your packets should be accelerated?

Options are :

• 75%
• 65%
• 90% (Correct)
• 100%

Answer : 90%

How would you determine the value of 'Maximum concurrent connections' of the NAT Table?

Options are :

• fwx_max_conns
• fwx_auth
• fwx_alloc (Correct)
• objects_5_0.C

Answer : fwx_alloc

What is one way to check cluster status on two gateways running in HA mode?

Options are :

• cphaprob stat (Correct)
• show cluster
• show cluster ha status
• cp ha prob stat

Answer : cphaprob stat

In a ClusterXL cluster with delayed synchronization, which of the following is not true?

Options are :

• The length of time for the delay can be edited. (Correct)
• Delayed Synchronization is performed only for connections matching a SecureXL Connection
• Delayed Synchronization is disabled if the Track option in the rule is set to Log or Account.
• It applies only to TCP services whose Protocol Type is set to HTTP or None.

Answer : The length of time for the delay can be edited.

What command displays the Connections Table for a specified CoreXL firewall instance?

Options are :

• fw tab –t connection | grep fw
• fw tab –t connections –s
• fw tab –t connections
• fw -i FW_INSTANCE_ID tab -t connections [flags] (Correct)

Answer : fw -i FW_INSTANCE_ID tab -t connections [flags]

What will be the outcome if you set the kernel parameters cphwd_nat_templates_enabled and cphwd_nat_templates_support?

Options are :

• This would enable SecureXL NAT templates. (Correct)
• These parameters are mutually exclusive and cannot be used at the same time.
• These are not valid parameters.
• This would enable Hide NAT support.

Answer : This would enable SecureXL NAT templates.

A firewall has 8 CPU cores and the correct license. CoreXL is enabled. How could you set kernel instance #3 to run on processing core #5?

Options are :

• fw ctl affinity -s -k 3 5 (Correct)
• Edit the file fwaffinity.conf and add the line “k3 cpuid 5”
• Run fwaffinity_apply –t 3 -k 5 and then check that the settings have taken affect with the command fw ctl multik stat.
• This is not possible CoreXL is best left to manage the Kernel to CPU core mappings. It is only when a daemon is bound to a dedicated core that CoreXL will ignore that CPU core when mapping Kernel instances to CPU cores.

Answer : fw ctl affinity -s -k 3 5

CoreXL on IPSO R77.20 does NOT support which of the following features?

Options are :

• Overlapping NAT
• Check Point QoS (Correct)
• IPv6
• Route-based VPN

Answer : Check Point QoS

What command verifies which core each gateway interface and firewall instance is currently running on?

Options are :

• show corexl stat
• fw ctl pstat
• fw ctl affinity -l (Correct)
• fw accel stat

Answer : fw ctl affinity -l

Misha is working on a stand-by firewall and deletes the connections table in error. He finds that now the table is out of sync with the Active member. to get them completely synced again, Mish should run the command pair ____________ and __________ .

Options are :

• fw ctl setsync stop, fw ctl setsync on
• fw ctl sync stop, fw ctl sync start
• fw ctl setsync off, fw ctl setsync on
• fw ctl setsync off, fw ctl setsync start (Correct)

Answer : fw ctl setsync off, fw ctl setsync start

What type of connections cannot be templated?

Options are :

• Complex connections such as FTP, H323, SQL, ETC (Correct)
• UDP because it is not connection oriented
• Any connections that contain Hide NAT
• TCP

Answer : Complex connections such as FTP, H323, SQL, ETC

Jane wants to create a VPN using OSPF. Which VPN configuration would you recommend she use?

Options are :

• Site-to-site VPN
• Domain-based VPN
• Route-based VPN (Correct)
• Remote-access VPN

Answer : Route-based VPN

Where would you go to adjust the number of Kernels in CoreXL?

Options are :

• Cpconfig (Correct)
• fw ctl multik stat
• fw ctl affinity
• fw ctl conf

Answer : Cpconfig

Which routing protocols are not supported with GAIA OS running VTIs?

Options are :

• Static routes
• BGP
• OSPF
• RIPv1; RIPv2 (Correct)

Answer : RIPv1; RIPv2

You are finding that some users are complaining about slow connection speed. You would like to review a summary of your connections, including which connections are accelerated and those that are not. What command could you use?

Options are :

• fw ctl pstat
• fw tab -t connections -s
• fwaccel stats -s (Correct)
• fwaccel perf

Answer : fwaccel stats -s

What is the best way to see how a firewall is performing while processing packets in the firewall path, including resource usage?

Options are :

• fw getperf
• fwaccel stats
• fw ctl pstat (Correct)
• SecureXL stat

Answer : fw ctl pstat

When a cluster member is completely powered down, how will the other member identify if there is network connectivity?

Options are :

• The working member will look for replies to traffic sent from internal hosts.
• The working member will Ping IPs in the subnet until it gets a response. (Correct)
• The working member will ARP for the default gateway.
• The working member will automatically assume connectivity.

Answer : The working member will Ping IPs in the subnet until it gets a response.

Which command will NOT display information related to memory usage?

Options are :

• free
• memoryinfo.conf (Correct)
• fw ctl pstat
• cat /proc/meminfo

Answer : memoryinfo.conf

You have a requirement to implement a strict security policy. With this in mind, you must create a stealth rule. How will this impact your packet acceleration?

Options are :

• NAT templates will not work.
• There will be no impact, since stealth rules do not affect SecureXL. (Correct)
• Using a stealth rule disables SecureXL.
• There will be no impact as long as the rule is not logged.

Answer : There will be no impact, since stealth rules do not affect SecureXL.

What is the command to check how many connections the firewall has detected for the SecureXL device?

Options are :

• fw tab –t connections –s
• fw tab -t cphwd_db –s (Correct)
• fw tab –t connection –s | grep template
• fwaccel conns

Answer : fw tab -t cphwd_db –s

What do the „F? flags mean in the output of fwaccel conns?

Options are :

• Fast path packets
• Flag set for debug
• Forward to firewall (Correct)
• Flow established

Answer : Forward to firewall