I85PREP
⌘ K
CCTE R81.20 study materials
CCTE R81.20 study resources

CCTE R81.20 practice questions

One question at a time. Build your CCTE R81.20 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Troubleshooting methodology and tooling

A Check Point Security Gateway stops passing traffic and SmartConsole shows the gateway as unreachable. Which tool should you use first to confirm whether the management server can reach the gateway over the network?

  1. ping and cpstat on the management server Correct answer.
  2. SmartView Tracker log export
  3. fw monitor on the gateway
  4. cpinfo -z on the gateway

Explanation

Basic reachability is confirmed before deeper inspection: ping verifies IP connectivity and cpstat reports the gateway's status as seen by the management server. These are non-intrusive and quick, so they belong at the start of the troubleshooting flow. Only after connectivity and status are established should you move to packet capture or diagnostic bundles.

Question 2Troubleshooting methodology and tooling

Which command displays real-time per-daemon status such as fwd, cpd, and vpnd on a Security Gateway?

  1. fw ctl pstat
  2. cpview
  3. fw stat
  4. cpstat -f all os Correct answer.

Explanation

cpstat queries the gateway's status providers and can report per-daemon health, including fwd, cpd, and vpnd. It is the standard way to confirm that the software blades' processes are running. Other commands report policy installation state, kernel counters, or live performance views rather than daemon status.

Question 3Troubleshooting methodology and tooling

You want to capture only packets matching a specific filter expression while troubleshooting a dropped connection on the gateway. Which fw monitor option applies a capture filter?

  1. -o
  2. -e
  3. -f Correct answer.
  4. -x

Explanation

The -f option supplies a filter expression so that only matching packets are captured, which keeps output focused. The -e option defines the inspection points, and -o writes the capture to a file. Using -f avoids drowning in unrelated traffic during analysis.

Question 4Troubleshooting methodology and tooling

A gateway shows high CPU and you need a quick interactive view of CPU, memory, and interface statistics without installing extra tooling. Which built-in utility provides this?

  1. cpinfo
  2. cpview Correct answer.
  3. SmartLog
  4. fw monitor

Explanation

cpview is the built-in real-time performance monitor on Security Gateways, showing CPU, memory, disk, and interface statistics in an interactive view. It requires no additional installation and is suited to live diagnosis. The other tools serve packet capture, diagnostic bundling, or log review.

Question 5Troubleshooting methodology and tooling

Users report that a new rule was supposed to allow HTTP but traffic is still dropped. Which action confirms whether the Security Policy was actually installed on the gateway?

  1. Run cpinfo on the gateway
  2. Run cpstat os -f all on the gateway
  3. Run fw monitor -e on the gateway
  4. Run fw stat on the management server Correct answer.

Explanation

fw stat reports the policy name and install time for each target, confirming whether the intended policy reached the gateway. If the timestamp predates your change, the install did not complete. This isolates policy-installation problems from rule-logic problems.

Question 6Troubleshooting methodology and tooling

During troubleshooting you need to see the kernel's connection table counters, including peaks and memory usage, on the gateway. Which command is appropriate?

  1. fw ctl pstat Correct answer.
  2. fw stat
  3. cpview
  4. cpstat -f all os

Explanation

fw ctl pstat reports kernel-level statistics such as active and peak connections, memory allocation, and table usage. It is the standard tool for confirming whether the gateway is hitting connection-table limits. Policy state, daemon status, and live dashboards are covered by other tools.

Question 7Troubleshooting methodology and tooling

You suspect a routing problem between an internal client and a server behind the gateway. Which combination best isolates whether packets leave the client, arrive at the gateway, and reach the server?

  1. cpinfo on the gateway and SmartLog export
  2. fw monitor on the gateway with inspection points i, I, o, O Correct answer.
  3. cpview and fw stat
  4. SmartConsole policy verification only

Explanation

fw monitor's inspection points show packets at ingress (i/I) and egress (o/O), so you can see whether traffic arrives and whether it is forwarded toward the server. Comparing ingress and egress counters localizes the drop to routing, policy, or the downstream path. This is the core packet-path technique for gateway troubleshooting.

Question 8Troubleshooting methodology and tooling

A Security Gateway frequently restarts unexpectedly. Which log or file should you review first to find the cause of the crash?

  1. The $FWDIR/conf/objects_5_0.C file
  2. The fwd.elg and cpd.elg debug files under $FWDIR/log Correct answer.
  3. The gateway's routing table
  4. The SmartConsole audit log

Explanation

Daemon debug files such as fwd.elg and cpd.elg record process activity and are the first place to look for crash causes. They capture errors and termination reasons that the audit log does not. Configuration objects and routing tables do not record process failures.

Question 9Troubleshooting methodology and tooling

What is the primary purpose of collecting cpinfo from a Security Gateway during a support case?

  1. To install the latest hotfix automatically
  2. To convert firewall rules into a readable report
  3. To gather a diagnostic snapshot of configuration, logs, and system state into an archive Correct answer.
  4. To reset the gateway's policy to defaults

Explanation

cpinfo bundles system information, configuration, and relevant logs into a single archive for analysis by support. It is a diagnostic collection tool, not a remediation or reporting tool. It should be run when escalation requires a comprehensive snapshot.

Question 10Troubleshooting methodology and tooling

You need to test whether a specific TCP port is reachable from the management server to a gateway without relying on ICMP. Which approach is most appropriate?

  1. Use traceroute only
  2. Use ping only
  3. Use nslookup only
  4. Use telnet or a TCP-based probe to the target port Correct answer.

Explanation

ICMP may be filtered even when the service port is open, so a TCP probe to the actual port verifies reachability and listening state. telnet or a similar TCP client tests the transport path used by the service. Ping alone can produce false negatives when ICMP is blocked.

Question 11Troubleshooting methodology and tooling

When reviewing SmartLog for a dropped connection, which field most directly identifies the rule or reason the traffic was blocked?

  1. The rule number and the action/reason fields in the log record Correct answer.
  2. The source MAC address
  3. The log server's IP address
  4. The interface MTU

Explanation

Log records include the matched rule number and the action and reason fields, which state why traffic was dropped. These fields point directly to the rule or implicit drop that caused the block. MAC addresses, MTU, and log server addresses do not explain the verdict.

Question 12Troubleshooting methodology and tooling

A rule appears to allow traffic, but the log shows the connection matching a different rule. Which troubleshooting step best explains this behavior?

  1. Restart the management server
  2. Increase the gateway's memory
  3. Reinstall the SmartConsole client
  4. Check rule order and examine the log's matched rule number Correct answer.

Explanation

The firewall evaluates rules in order, so an earlier matching rule takes precedence and the log records the rule that actually matched. Comparing the logged rule number with the intended rule reveals ordering or overlap problems. Memory, management restarts, and client reinstallation do not change rule evaluation.

Question 13Troubleshooting methodology and tooling

Which tool lets you follow a single connection through the gateway and see the verdict applied to it in real time?

  1. cpview
  2. fw stat
  3. fw monitor combined with SmartLog filtering on that connection Correct answer.
  4. cpinfo

Explanation

fw monitor shows the packet path while SmartLog filtering on the same connection shows the verdict and matched rule, together giving end-to-end visibility. This pairing correlates packet flow with the policy decision. The other tools provide diagnostics, performance, or policy state but not per-connection verdicts.

Question 14Troubleshooting methodology and tooling

You want to confirm that the management server and gateway clocks are aligned so log timestamps correlate across systems. Which check is most relevant?

  1. Compare the system time and NTP synchronization status on both systems Correct answer.
  2. Review the SmartConsole audit log only
  3. Check the firewall rule base for time objects
  4. Inspect the routing table

Explanation

Correlating logs across systems requires synchronized clocks, so verifying system time and NTP status on both the management server and gateway is essential. Time objects in rules affect policy but not clock alignment. Audit logs and routing tables do not verify time synchronization.

Question 15Troubleshooting methodology and tooling

A gateway is dropping packets but no log entries appear in SmartLog. Which explanation is most likely?

  1. The management server is out of disk space
  2. The gateway has too many interfaces
  3. The SmartConsole version is outdated
  4. The connection is being dropped before logging, such as by an implicit drop with logging disabled or by a SecureXL path Correct answer.

Explanation

Some drops occur before the logging stage, for example implicit cleanup rules with logging disabled or accelerated paths that bypass inspection. Enabling implicit rule logging or disabling acceleration for a test can confirm this. Disk space, console version, and interface count do not explain missing drop logs.

Question 16Troubleshooting methodology and tooling

Which command disables SecureXL acceleration temporarily to test whether acceleration is causing unexpected behavior?

  1. fw monitor -o
  2. cpstat -f all os
  3. fwaccel off Correct answer.
  4. fw ctl pstat

Explanation

fwaccel off disables SecureXL acceleration, allowing you to test whether the accelerated path is responsible for the observed behavior. This is a common isolation step when traffic behaves differently than the policy suggests. The other commands report statistics, status, or capture packets without changing acceleration.

Question 17Troubleshooting methodology and tooling

You need to verify whether a specific blade, such as IPS, is enforcing on a gateway. Which approach is most direct?

  1. Review the switch's spanning-tree topology
  2. Check the client's ARP cache
  3. Check the installed policy and blade status with cpstat and the gateway's blade configuration Correct answer.
  4. Run nslookup against the gateway

Explanation

Blade enforcement depends on the installed policy and the gateway's blade configuration, which cpstat and configuration review reveal. Confirming both shows whether the blade is active. DNS, ARP, and switching topology do not determine blade enforcement.

Question 18Troubleshooting methodology and tooling

A user cannot reach an external site, but other users can. Which troubleshooting approach best isolates whether the problem is client-specific or gateway-wide?

  1. Compare logs and captures for the failing client against a working client Correct answer.
  2. Replace the gateway's network cables
  3. Reboot the gateway immediately
  4. Reinstall the Security Policy

Explanation

Comparing a failing client with a working one isolates whether the cause is client-specific configuration or a broader gateway issue. This scoping step prevents unnecessary disruptive actions. Rebooting, reinstalling policy, or replacing hardware are premature without that comparison.

Question 19Troubleshooting methodology and tooling

Which file or command shows the current connections tracked by the gateway, useful for confirming whether a session was established?

  1. cpinfo
  2. SmartConsole audit log
  3. fw ctl conntab Correct answer.
  4. fw stat

Explanation

fw ctl conntab displays the kernel connection table, showing whether a session was established and its state. This confirms whether traffic reached the point of connection tracking. Policy state, diagnostic bundles, and audit logs do not list live connections.

Question 20Troubleshooting methodology and tooling

When capturing traffic with fw monitor, what do the inspection points i, I, o, and O represent?

  1. Ingress before and after inspection, and egress before and after inspection Correct answer.
  2. IPv4, IPv6, overlay, and offload paths
  3. Inbound, Internal, outbound, and Other zones
  4. Interface, IP, output, and option flags

Explanation

The inspection points mark where in the data path the packet is sampled: ingress before and after inspection, and egress before and after inspection. Comparing them shows whether and where the gateway modified or dropped traffic. The other interpretations are not what these letters denote.

Question 21Troubleshooting methodology and tooling

A policy install fails with an error. Which source should you check first for the specific failure reason?

  1. The policy installation output and the fwd.elg log on the management server Correct answer.
  2. The DNS forwarder configuration
  3. The switch's MAC address table
  4. The client's browser cache

Explanation

Policy installation errors are recorded in the installation output and in the management server's fwd.elg log, which name the failing component. Reviewing these first gives the specific cause rather than symptoms. Browser caches, switch tables, and DNS settings do not record install failures.

Question 22Troubleshooting methodology and tooling

Which practice best preserves evidence when troubleshooting an intermittent issue on a production gateway?

  1. Delete old logs to free space
  2. Capture targeted data and save logs before making configuration changes Correct answer.
  3. Immediately reboot the gateway to clear state
  4. Disable all logging to reduce load

Explanation

Intermittent issues require evidence that may vanish after a change, so capturing targeted data and preserving logs first is essential. Changes made before capture can destroy the state that explains the fault. Rebooting, deleting logs, or disabling logging can erase the very evidence needed.

Question 23Troubleshooting methodology and tooling

You need to determine whether a performance problem originates in the gateway kernel or in a specific daemon. Which comparison is most useful?

  1. Compare the routing table with the ARP cache
  2. Compare fw ctl pstat kernel statistics with cpstat daemon status during the slowdown Correct answer.
  3. Compare switch port speeds
  4. Compare SmartConsole versions across administrators

Explanation

Kernel statistics from fw ctl pstat and daemon status from cpstat together show whether the bottleneck is in the data path or in a user-space process. Correlating them during the slowdown localizes the cause. Routing, console versions, and switch port speeds do not separate kernel from daemon behavior.

Question 24Troubleshooting methodology and tooling

A rule uses a service object that does not match the actual port in use. What is the most reliable way to confirm the mismatch?

  1. Check the gateway's uptime
  2. Review the audit log for administrator logins
  3. Capture the traffic and compare the observed port with the service object definition Correct answer.
  4. Inspect the DNS zone file

Explanation

Capturing the traffic reveals the actual port, which can then be compared with the service object's definition to confirm the mismatch. This grounds the conclusion in observed data. Uptime, login audits, and DNS records do not show port usage.

Question 25Troubleshooting methodology and tooling

Which statement best describes the role of the fwd daemon during troubleshooting?

  1. It handles management communication and logging between the gateway and management server Correct answer.
  2. It performs packet forwarding in the kernel data path
  3. It resolves DNS names for clients
  4. It manages interface link state

Explanation

The fwd daemon manages communication and logging between the gateway and the management server, so its health affects policy installs and log delivery. Data-path forwarding occurs in the kernel, and link state and DNS are handled elsewhere. Understanding this role guides which logs and status checks to use.

Question 26Troubleshooting methodology and tooling

Which daemon on a Security Gateway is responsible for enforcing the security policy and logging accepted and dropped connections?

  1. cpm
  2. fwd Correct answer.
  3. DAService
  4. cpd

Explanation

The fwd (firewall daemon) runs the inspection kernel logic and produces the security logs for connections passing through the gateway. cpm and cpd handle management and communication tasks, not packet verdicts. DAService is unrelated to enforcement.

Question 27Troubleshooting methodology and tooling

You need to confirm which policy package is currently installed on a specific Security Gateway. Which approach is most direct?

  1. Check the $FWDIR/conf/masters file
  2. Open the gateway object and read the installed policy field
  3. Query the SmartConsole audit log for the last install
  4. Run cpstat fw -f policy on the gateway Correct answer.

Explanation

cpstat fw -f policy reports the policy name and install time currently enforced by the local gateway. The gateway object in SmartConsole may show the last install but can be stale. The audit log records install events but does not reflect the currently enforced package.

Question 28Troubleshooting methodology and tooling

Which log field in SmartLog most directly tells you the name of the policy rule that produced a given verdict?

  1. Action
  2. Interface
  3. Rule Correct answer.
  4. Service

Explanation

The Rule column identifies the specific policy rule (by number and section) that matched the connection. Action shows the resulting verdict, Service shows the matched port, and Interface shows the ingress or egress interface.

Question 29Troubleshooting methodology and tooling

A gateway is unexpectedly restarting. Which source should you review first to find the cause of the reboot?

  1. The $FWDIR/conf/objects.C file
  2. The cpinfo summary
  3. The messages and syslog files on the gateway Correct answer.
  4. The SmartConsole audit log

Explanation

Kernel and daemon messages, including panic or watchdog events, are written to the system messages file and syslog. These typically record the reason for a reboot. The audit log, cpinfo, and objects.C do not contain crash details.

Question 30Troubleshooting methodology and tooling

Which command temporarily disables SecureXL acceleration on a gateway to test whether acceleration is causing unexpected behavior?

  1. cpstop
  2. fw ctl fastaccel off
  3. sim enable
  4. fwaccel off Correct answer.

Explanation

fwaccel off disables SecureXL acceleration so traffic is processed by the firewall path only, which is useful for isolating acceleration-related issues. sim enable is a different simulator command, cpstop halts gateway processes, and fw ctl fastaccel off is not a valid command.

Question 31Troubleshooting methodology and tooling

When running fw monitor, what do the inspection points i, I, o, and O represent?

  1. Ingress, egress, inbound, outbound
  2. Pre-inbound, post-inbound, pre-outbound, post-outbound Correct answer.
  3. Interface, internal, outbound, overall
  4. Input, inspect, output, observe

Explanation

fw monitor captures packets at four inspection points: i (pre-inbound), I (post-inbound), o (pre-outbound), and O (post-outbound). Comparing these points shows whether the firewall modified or dropped the packet.

Question 32Troubleshooting methodology and tooling

Which file or command shows the current connections tracked by the gateway, useful for confirming whether a session is still active?

  1. cpstat os -f cpu
  2. cat $FWDIR/conf/fwauthd.conf
  3. fw tab -t connections -s Correct answer.
  4. netstat -rn

Explanation

fw tab -t connections -s reports the connection table counters, including active connections, which confirms whether a session is still tracked. The other options show auth daemon configuration, CPU statistics, or routing, none of which list active sessions.

Question 33Troubleshooting methodology and tooling

A rule appears to allow traffic, but the log shows the connection matching a different rule. Which troubleshooting step best explains the mismatch?

  1. Restart the gateway to reload the policy
  2. Reinstall the policy package
  3. Increase the log verbosity for the matched rule
  4. Check the rule order and the matched rule number in the log Correct answer.

Explanation

Rule order determines which rule matches first, and the Rule field in the log shows the actual match. Comparing the intended rule with the logged rule number identifies the ordering or overlap problem. Verbosity, restart, and reinstall do not change match order.

Question 34Troubleshooting methodology and tooling

A user cannot reach an external site, but other users can. Which troubleshooting approach best isolates whether the problem is user-specific?

  1. Compare the user's traffic in SmartLog with a working user's traffic Correct answer.
  2. Reboot the gateway to rule out transient issues
  3. Run cpinfo on the management server
  4. Check the DNS server logs

Explanation

Comparing logs for the failing user and a working user shows whether the difference is in identity, source IP, or rule match, which isolates user-specific causes. A reboot, cpinfo, and DNS logs do not distinguish user-specific behavior.

Question 35Troubleshooting methodology and tooling

You suspect a routing problem between an internal client and a server behind the gateway. Which combination best isolates the cause?

  1. Run fw monitor and cpinfo
  2. Restart the gateway and reinstall the policy
  3. Check the routing table with netstat -rn and trace the path with traceroute Correct answer.
  4. Check the audit log and the gateway object

Explanation

The routing table confirms whether the correct next hop exists, and traceroute shows the actual path and where it fails. The other options do not directly test routing.

Question 36Troubleshooting methodology and tooling

A gateway is dropping packets but no entries appear in SmartLog. Which explanation is most likely?

  1. The policy was installed on the wrong gateway
  2. The drop occurs before logging, such as in the kernel or in SecureXL Correct answer.
  3. The log server is out of disk space
  4. The SmartConsole session has expired

Explanation

Drops in the kernel or in SecureXL may occur before a log record is generated, so no SmartLog entry appears. Disk space, wrong gateway, and expired sessions would produce other symptoms, such as missing logs for all traffic or install failures.

Question 37Troubleshooting methodology and tooling

Which command shows the current connections tracked by the gateway, useful for confirming whether a session was established?

  1. cpstat fw -f policy
  2. netstat -i
  3. cat $FWDIR/conf/fwauthd.conf
  4. fw tab -t connections -s Correct answer.

Explanation

fw tab -t connections -s reports connection table counters, confirming whether a session is currently tracked. The other commands report policy status, auth daemon configuration, or interface statistics.

Question 38Troubleshooting methodology and tooling

You need to test whether a specific TCP port is reachable from the management server to a gateway without relying on ICMP. Which tool is appropriate?

  1. traceroute to the gateway
  2. telnet or nc to the target port Correct answer.
  3. arp -a
  4. ping the gateway

Explanation

telnet or nc tests TCP reachability to a specific port, which is independent of ICMP. Ping and traceroute rely on ICMP and do not confirm TCP port reachability, and arp shows local neighbor entries.

Question 39Troubleshooting methodology and tooling

You want to confirm that the management server and gateway clocks are aligned so log timestamps correlate across systems. Which check is most direct?

  1. Check the audit log for install events
  2. Compare the date and time on both systems and check the NTP configuration Correct answer.
  3. Run cpinfo on the management server
  4. Run fw monitor on the gateway

Explanation

Comparing date and time on both systems and checking NTP configuration confirms clock alignment. The other options do not verify time synchronization.

Question 40Troubleshooting methodology and tooling

You need to see the kernel's connection table counters, including peaks and memory usage, on the gateway. Which command best provides this?

  1. netstat -rn
  2. cat $FWDIR/conf/fwauthd.conf
  3. fw tab -t connections -s Correct answer.
  4. cpstat os -f cpu

Explanation

fw tab -t connections -s reports connection table counters, including peak values, which help size and diagnose the table. The other commands show CPU, routing, or auth daemon configuration.

Question 41Troubleshooting methodology and tooling

During troubleshooting you need to confirm whether the firewall or the network is dropping packets. Which approach best isolates the firewall as the cause?

  1. Compare fw monitor captures at i and o to see whether the packet enters and leaves the gateway Correct answer.
  2. Compare the routing table with the ARP cache
  3. Check the audit log for install events
  4. Run cpinfo on the management server

Explanation

fw monitor captures at i (pre-inbound) and o (pre-outbound) show whether the packet enters and leaves the gateway, isolating the firewall as the drop point. The other options do not show packet flow.

Question 42Troubleshooting methodology and tooling

A gateway is dropping packets silently and nothing appears in SmartLog. Which first step best distinguishes an implicit drop from a problem that bypasses logging entirely?

  1. Run cpinfo on the gateway and send the output to support for analysis
  2. Check whether the relevant connection is matched by a Cleanup rule or an implicit drop rather than by a logging rule in the installed policy Correct answer.
  3. Reinstall the security policy on the gateway to regenerate the inspection code
  4. Restart the fwd daemon to force pending log entries to flush to the management server

Explanation

An implicit drop occurs when no rule explicitly matches and no logging rule captures the traffic, so the connection is discarded without a log entry. Reviewing the rule order and whether a Cleanup or explicit drop rule with logging sits in the path confirms whether the drop is silent by policy design or whether logging itself is broken.

Question 43Troubleshooting methodology and tooling

You want to observe the packets of a single active connection as they traverse the gateway without capturing unrelated traffic. Which fw monitor invocation is best suited?

  1. fw monitor -a
  2. fw monitor -e "accept (src=10.1.1.5 and dst=10.2.2.9);" Correct answer.
  3. fw monitor -F /var/log/fwmonitor.log
  4. fw monitor -s

Explanation

fw monitor supports a filter expression that limits capture to packets matching the specified addresses or ports. Filtering on the source and destination of the connection of interest keeps the capture small and readable while still showing all inspection points.

Question 44Troubleshooting methodology and tooling

A gateway shows high CPU but SmartLog contains no dropped traffic. Which diagnostic approach best determines whether the load comes from the kernel or from a user-space process?

  1. Compare per-core CPU usage with top and check kernel-level statistics such as the SecureXL and connection table counters Correct answer.
  2. Increase the gateway memory allocation in the virtual machine settings
  3. Delete the connection table entries with fw tab -x to free resources
  4. Disable SecureXL permanently and observe whether CPU usage falls over the next hour

Explanation

Separating kernel time from user-space time is the fastest way to localize CPU consumption, and kernel statistics such as SecureXL and connection table counters indicate whether packet processing is the source. This lets you decide whether to look at a specific daemon or at the inspection path.

Question 45Troubleshooting methodology and tooling

You need to verify whether a specific TCP port is reachable from the management server to a gateway without relying on ICMP. Which tool is most appropriate?

  1. ping the gateway address
  2. traceroute to the gateway address
  3. arping to the gateway address
  4. telnet to the port from the management server Correct answer.

Explanation

A TCP connection attempt to the specific port tests reachability of that service directly and does not depend on ICMP being permitted. Ping and traceroute rely on ICMP or UDP responses that firewalls frequently block, so a failure there does not prove the port is unreachable.

Question 46Troubleshooting methodology and tooling

Logs from a gateway appear to be out of order relative to the management server. Which check best confirms whether clock skew is the cause?

  1. Increase the log retention period in the management server settings
  2. Restart the fwd daemon on the gateway to refresh log delivery
  3. Compare the date and time output on the gateway and the management server and verify time synchronization status Correct answer.
  4. Reinstall the security policy so that log fields are regenerated

Explanation

Log timestamps are generated locally and correlated centrally, so a difference in system clocks between the gateway and the management server will produce apparent ordering problems. Comparing the time on both systems and checking the synchronization service confirms or rules out skew.

Question 47Troubleshooting methodology and tooling

A customer reports that a connection is established but data does not flow. Which combination of checks best isolates whether the gateway or the endpoint is responsible?

  1. Check the management server disk usage for log storage
  2. Review the connection table entry and run a filtered fw monitor capture on the same flow Correct answer.
  3. Restart the gateway and ask the user to retry the connection
  4. Review the policy installation history for recent changes

Explanation

The connection table shows whether the gateway has state for the flow and what state it is in, while a filtered capture shows whether packets are arriving and being forwarded. Together they indicate whether the gateway is dropping or modifying traffic versus the endpoints failing to exchange data.

Question 48Troubleshooting methodology and tooling

You need to see the kernel connection table counters, including current usage, peak values, and memory consumption, on the gateway. Which command provides this?

  1. cat /proc/connections
  2. netstat -an
  3. fw tab -s -t connections
  4. fw ctl pstat Correct answer.

Explanation

fw ctl pstat reports kernel-level statistics including connection table usage, peak values, and memory consumption. It is the standard command for assessing connection table pressure on a gateway.

Question 49Troubleshooting methodology and tooling

During troubleshooting you must determine whether the firewall or the upstream network is dropping packets. Which approach best isolates the responsible layer?

  1. Ping the upstream router repeatedly and note the response time
  2. Review the SmartLog entries for the previous day
  3. Check the gateway's disk space for log storage
  4. Capture packets on the gateway's external interface and compare ingress and egress at each inspection point Correct answer.

Explanation

Comparing packets at the ingress and egress inspection points shows whether the gateway received a packet and whether it forwarded it. A packet seen on ingress but not on egress points to the gateway, while absence on ingress points to the upstream network.

Question 50Troubleshooting methodology and tooling

A rule uses a service object that does not match the port actually in use. Which step most reliably confirms the mismatch?

  1. Reinstall the policy and observe whether the rule now matches
  2. Disable SecureXL and retest the connection
  3. Inspect the service object definition and compare it with the destination port recorded in the connection log Correct answer.
  4. Restart the management server to reload the object database

Explanation

The service object definition lists the port or protocol it represents, and the connection log records the destination port that was actually used. Comparing the two directly confirms whether the object and the traffic disagree.