CCTE R81.20 study plan

Build a personal troubleshooting checklist that orders the steps of defining the problem, collecting evidence, forming a hypothesis, testing it, and confirming resolution, and map each step to the Check Point tool that supports it

Enumerate the log and debug sources available on a Security Management Server and a Security Gateway (SmartConsole logs, fw log export, fw monitor, fw ctl debug, cpinfo) and note for each what question it answers and what it cannot show

Practise reading fw monitor output: capture a simple TCP handshake and explain each of the four inspection points (i, I, o, O) and what a missing packet at each point implies

Set up a lab journal template that records symptom, hypothesis, commands run, output, and conclusion for every exercise in this plan

Use fw ctl zdebug and fw ctl debug with a module mask to isolate a single failing connection, then clear the debug cleanly and verify no residual debug load remains

Interpret tcpdump on the gateway interface and compare it against fw monitor to explain where in the stack each capture point sits

Collect and read a cpinfo output to identify installed hotfixes, kernel version, and core dump settings

Diagnose a simulated asymmetric routing or dropped-packet scenario using only CLI evidence and write the causal chain

Trace the Management Server startup and service dependencies (cpstart, CPM, FWM, DLE, and the database) and identify which log or status command confirms each is healthy

Diagnose SmartConsole login failures by separating authentication, connectivity, certificate, and GUI-client causes and testing each in order

Read and interpret the Management Server log files (fwm.elg, cpm.elg, and related .elg files) to locate the first error in a failure sequence

Explain how SIC trust works between gateway and management, and list the concrete steps to diagnose and re-establish a broken SIC

Use the policy installation flow to identify where an install fails: verify which stage (compile, transfer, install, verify) reports the error and which log records it

Diagnose a policy install failure caused by an unreachable gateway, a version mismatch, or a locked database, and state the fix for each

Compare API-based changes with SmartConsole changes and explain how to confirm which one is authoritative when they appear to conflict

Practise restoring a Management Server database backup into a lab and verify policy and objects survived intact

Trace how a packet moves through the gateway (ingress, SecureXL, firewall kernel, inspection, egress) and name the tool that shows each stage

Diagnose SecureXL acceleration problems by comparing accelerated and slow-path behaviour and using the SecureXL status and template commands

Interpret fw ctl chain and fw ctl pstat output to explain which kernel modules are active and whether offload or accounting is healthy

Diagnose a NAT or routing failure by distinguishing a routing decision problem from a NAT rule problem using logs and packet captures

Read a SmartLog or SmartEvent record field by field and explain how rule number, action, and blade determine the verdict

Diagnose why a connection is dropped when no log appears, distinguishing implicit drop, stealth rule, and logging suppression causes

Configure and verify log export to an external destination, then troubleshoot a failed export using the relevant logs

Correlate a user-reported failure with log entries and packet captures to prove whether the gateway or the destination is responsible

Debug an identity-awareness or application-control decision end to end using the relevant debug flags and confirm the decision path in logs

Diagnose a site-to-site VPN tunnel failure by separating phase 1, phase 2, and routing causes and naming the command that proves each

Use kernel debug filters narrowly enough that gateway performance is not materially affected, and demonstrate clearing them

Re-run the week 1 methodology checklist against two new scenarios and note where the checklist was insufficient

Complete a timed mixed-domain practice set and classify every miss by domain and by failure type (knowledge gap, misread, tool unfamiliarity)

Re-derive the four domain checklists from memory and compare against your notes to find remaining weak spots

Revisit the three weakest areas from the practice set with targeted lab exercises

Write a one-page pre-exam reference of the commands you most often needed but forgot