Best Quality 156-836 Exam Questions CheckPoint Test To Gain Brilliante Result!
Preparations of 156-836 Exam 2025 CCME Unlimited 90 Questions
The Check Point Certified Maestro Expert - R81 (CCME) certification exam, also known as CheckPoint 156-836, validates the knowledge and skills of IT professionals in deploying, managing, and troubleshooting Check Point Maestro, a network orchestration solution. 156-836 exam is designed for experts who have already obtained the Check Point Certified Maestro Administrator (CCMA) certification and want to advance their career by becoming a Maestro Expert. The CCME exam covers advanced topics such as designing and implementing high-availability solutions, configuring and managing distributed environments, and troubleshooting complex issues.
NEW QUESTION # 32
Which command is used to set the number of sites in a Maestro environment?
- A. set maestro configuration orchestrator-site-id
- B. set maestro configuration orchestrator-site-number
- C. set maestro orchestrator-site-amount
- D. set maestro configuration orchestrator-site-amount
Answer: D
Explanation:
This command is used to set the number of sites in a Maestro environment, which can be either one or two.
The number of sites determines the site-sync configuration and the failover policies for the Security Groups and the Security Group Members. The default value is one, and it can be changed only before the first Security Group is created.
References =
*Maestro basic setup documentation - Page 2 - Check Point CheckMates
*Check Point R81.10 for Scalable Platforms - Check Point Software
*CHECK POINT MAESTRO EXPERT
NEW QUESTION # 33
When security policy is installed
- A. The policy is installed on the SMO, the SMO Master broadcasts the available package, other members retrieve the new policy from the SMO Master and perform an independent policy verification, then the non-SMO Master SGMs install the policy.
- B. The SMO Master receives the policy and performs a policy verification the policy is installed on the SMO Master, the SMO Master broadcasts the available package, other members retrieve the new policy from the SMO Master, then the non-SMO Master SGMs install the policy.
- C. All SGMs receive the security policy and one by one performs an independent policy verification.
Then, all SGMs simultaneously install the policy. - D. All SGMs receive the security policy and simultaneous policy installation occurs.
Answer: B
Explanation:
This is the correct answer because it describes the security policy installation flow for a Maestro Security Group. The SMO Master is the Security Group Member that acts as the leader and the single point of contact for the Management Server. The SMO Master verifies the policy and installs it first, then notifies the other SGMs that a new policy is available. The other SGMs fetch the policy from the SMO Master and install it in parallel.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.3: Security Policy Installation, page 2-15
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Security Policy Installation, page 2-13
*Policy installation flow - Check Point Software
NEW QUESTION # 34
What is the maximum number of Appliances within Security group in Dual-Site configuration?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
NEW QUESTION # 35
After you import the R81.10 software package, what do you use to verify that it is possible to upgrade an MHO or SG?
- A. The package is verified during the import process and a warning or error will be displayed at that time.
- B. Run HCP. One of the tests will list upgrade eligibility status for the MHO or SG.
- C. Run the Pre-Upgrade Verifier to make sure it is possible to upgrade
- D. Nothing. CPUSE will run a verification during the upgrade process to ensure the package is compatible.
Answer: C
Explanation:
The Pre-Upgrade Verifier is a tool that checks the compatibility and readiness of the Maestro environment for the upgrade process. It verifies the current version, the target version, the hardware requirements, the configuration settings, and the license validity of the Maestro Orchestrators and the Security Groups. It also identifies any potential issues or risks that might affect the upgrade and provides recommendations on how to resolve them. The Pre-Upgrade Verifier should be run before importing the R81.10 software package and before performing the actual upgrade.
References =
*Check Point R81.10 for Scalable Platforms - Check Point Software
*CHECK POINT MAESTRO EXPERT
NEW QUESTION # 36
Which distribution mode assigns packets to an SGM based solely on the packet destination IP?
- A. Auto-topology mode
- B. User mode
- C. Manual mode
- D. Network mode
Answer: D
Explanation:
Explanation
Network mode is the distribution mode that assigns packets to an SGM based solely on the packet destination IP. In this mode, the Orchestrator uses a hash function to map each destination IP to a specific SGM. This mode ensures that all packets with the same destination IP are processed by the same SGM, regardless of the source IP or port. This mode is suitable for scenarios where the destination IP is the main factor for load balancing, such as NAT or VPN.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-19
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-7
*Maestro basic setup documentation - Page 2 - Check Point CheckMates
NEW QUESTION # 37
Where should the sx_api_ports_dump.py command be run?
- A. Security Group
- B. SMO Appliance
- C. Management server
- D. Orchestrator
Answer: D
Explanation:
The sx_api_ports_dump.py command is used to display port mapping and traffic distribution details for Security Groups and Orchestrator ports. This command must be run on the Maestro Hyperscale Orchestrator (MHO), as it is the device responsible for managing communication and configuration of Security Groups and Security Group Members (SGMs). It does not function on the Management server, Security Group, or SMO Appliance, as these components do not have the same role or access to Orchestrator-specific port data.
Exact Extract:
"The sx_api_ports_dump.py command should be run on the Orchestrator, which is the device that manages the communication and the configuration of the Security Groups and the SGMs. The command shows the port mapping and the traffic distribution for each Security Group, as well as the backplane bonds and the Orchestrator ports. The command does not work on the Management server, the Security Group, or the SMO Appliance, as they do not have the same role and functionality as the Orchestrator."
-Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-20
-Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-8 Explanation of Options:
* A. Management server: Incorrect, as the Management server does not manage Orchestrator port configurations or traffic distribution.
* B. Security Group: Incorrect, as Security Groups (SGMs) do not have direct access to Orchestrator port data.
* C. Orchestrator: Correct, as the Orchestrator is the device where this command is executed to retrieve port and traffic distribution information.
* D. SMO Appliance: Incorrect, as the Single Management Object (SMO) Appliance does not handle Orchestrator-specific port management.
References:
Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-20 Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-8
NEW QUESTION # 38
What does asg monitor command do?
- A. Monitor traffic on Appliances in Security Group
- B. This command does not exist
- C. Monitor health status of entire system
- D. Show real-time cluster status of Appliances in Security Group
Answer: D
Explanation:
The "asg monitor" command generally would show real-time cluster status of appliances in a security group, focusing on health and operational status.
NEW QUESTION # 39
What is HealthCheck Point?
- A. Can be used to let you visualize the Firewall topology for the SG and view live statistics, which includes throughput, problem notes, and CPU utilization.
- B. Performs a system health check and is meant to replace both a CPInfo and the health check script.
- C. Is a self-updatable suite of tools for MHOs with the capability to assess the health of the system and provide a timeline of critical and informative events that might have occurred in a production system.
- D. Is a self-updatable suite of tools for SGMs with the capability to assess the health of the system, visualize the Firewall topology, provide a timeline of critical and informative events that might have occurred in a production system.
Answer: B
Explanation:
HealthCheck Point (HCP) is a tool designed to perform a comprehensive system health check for the Maestro environment. It is intended to replace both the CPInfo tool and traditional health check scripts by providing a streamlined way to assess the health of Maestro Orchestrators (MHOs) and Security Group Members (SGMs).
HCP evaluates system status, configuration, and potential issues, generating detailed reports for troubleshooting and maintenance.
Exact Extract:
"HealthCheck Point (HCP) performs a system health check and is meant to replace both a CPInfo and the health check script. It assesses the health of the Maestro environment, including MHOs and SGMs, by checking system status, configuration settings, and potential issues. HCP provides detailed reports to aid in troubleshooting and maintenance."
-Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using theCommand Line Interface and WebUI, Lesson 4.4: System Diagnostics, page 4-15
-Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: HealthCheck Point, page 4-12 Explanation of Options:
* A. Is a self-updatable suite of tools for MHOs...: Incorrect, as HCP is not limited to MHOs and does not focus on visualizing topology or event timelines. It is a general health check tool for the entire Maestro environment.
* B. Performs a system health check and is meant to replace both a CPInfo and the health check script:
Correct, as HCP's primary function is to perform system health checks, replacing CPInfo and health check scripts, as per the documentation.
* C. Can be used to let you visualize the Firewall topology...: Incorrect, as HCP does not provide visualization of firewall topology or live statistics like throughput and CPU utilization.
* D. Is a self-updatable suite of tools for SGMs...: Incorrect, as HCP is not exclusive to SGMs and does not include topology visualization or event timeline features.
References:
Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.4: System Diagnostics, page 4-15 Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: HealthCheck Point, page 4-12
NEW QUESTION # 40
HealthCheck Point _____
- A. performs a system health check and is meant to replace both a CPInfo and the health check script.
- B. can be used to let you visualize the Firewall topology for the SG and view live statistics, which includes throughput, problem notes, and CPU utilization.
- C. is a self-updatable suite of tools for SGMs with the capability to assess the health of the system, visualize the Firewall topology, provide a timeline of critical and informative events that might have occurred in a production system.
- D. is a self-updatable suite of tools for MHOs with the capability to assess the health of the system and provide a timeline of critical and informative events that might have occurred in a production system.
Answer: C
Explanation:
HealthCheck Point (HCP) is a tool that can perform various tests and checks on the system components of the Security Group Modules (SGMs), such as hardware, software, network, clock, ARP, and more. It can also display the performance statistics of the SGMs, such as throughput, packet rate, CPU utilization, memory usage, and more. Additionally, HCP can provide a graphical representation of the Firewall topology for the Security Group, showing the connections and statuses of the SGMs and the Orchestrators. Furthermore, HCP can generate a report of the critical and informative events that occurred on the system, such as configuration changes, errors, warnings, and alerts. HCP can help identify and troubleshoot any issues or errors that may affect the system functionality or performance.
References =
*HealthCheck Point (HCP) Release Updates - Check Point Software 1
*Professional Services Healthcheck - Check Point Software 2
*HealthCheck Point - Check Point CheckMates 3
NEW QUESTION # 41
What is the purpose of g_tcpdump command?
- A. Collects traffic dump from CIN network
- B. The same as tcpdump, just on Scalable Platform
- C. Collects traffic dump from all Active Appliances within Security Group
- D. Collects traffic dump from Sync network
Answer: C
Explanation:
_tcpdump" probably collects traffic dumps from all active appliances within a security group, aligning with the naming convention and function of similar commands in scalable platforms.
References
*Maestro Expert (CCME) Course - Check Point Software, page 331
*What is 'IN' and 'OUT' of g_tcpdump? - Check Point CheckMates2
*CHECK POINT MAESTRO EXPERT, page 23
NEW QUESTION # 42
What happens if you apply a hotfix using gClish?
- A. If you apply a hotfix using gclish, it causes an outage for the entire SG as all members reboot at roughly the same time.
- B. Logical groups "A" and "B" are created. Members of group "A" install and reboot first. Then members of group "B" does the same once reboots have finished with group "A."
- C. If you apply a hotfix using gclish, each SG members installs the hotfix and reboots after waiting it's turn to do so.
- D. If you apply a hotfix using gclish, the operation will fail because an outage would occur.
Answer: B
Explanation:
Explanation
This is the correct answer because it describes the hotfix installation process using gClish on a Maestro Security Group. gClish is the global Clish that allows users to run commands on all UP SG members of the current Security Group at once. When a hotfix is applied using gClish, the SG members are divided into two logical groups: "A" and "B". The members of group "A" install the hotfix and reboot first, while the members of group "B" wait for their turn. After all the members of group "A" are back online, the members of group
"B" install the hotfix and reboot.This way, the SG maintains high availability and does not cause an outage.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-11
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-9
*Global Expert Mode Commands - Check Point CheckMates
NEW QUESTION # 43
In a Maestro Dual Site environment, what is the definition of the term Standby Site?
- A. The Standby Site is the site that is not handling any traffic for the specific SG, but its connections are synced to its SGMs from the MHOs to be ready in the event of a failover.
- B. The Standby Site is the second site to have been defined in the process of configuring the Dual Site environment.
- C. There is no such thing as an active site. In a Dual Site environment, traffic is load balanced.
- D. The Standby Site is the site currently handling the enforcement on traffic passing for a specific SG.Connections are synced within the SGMs in the Active Site.
Answer: A
Explanation:
In a Maestro Dual Site environment, the Standby Site is defined as the site that is not currently handling traffic for a specific Security Group (SG). Instead, it maintains synchronized connections with its Security Group Members (SGMs) via the Maestro Hyperscale Orchestrators (MHOs), ensuring it is ready to take over in the event of a failover. This setup enhances high availability and disaster recovery.
Exact Extract:
"In a Maestro Dual Site environment, the Standby Site is the site that is not handling any traffic for the specific Security Group, but its connections are synced to its Security Group Members (SGMs) from the Maestro Hyperscale Orchestrators (MHOs) to be ready in the event of a failover. This ensures high availability and seamless failover capabilities."
-Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 3: Dual Orchestrator Environment, Lesson 3.1: Introduction to Dual Orchestrator Environment, page 3-7
-Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section: Dual Site Configuration, page 3-9 Explanation of Options:
* A. The Standby Site is the site that is not handling any traffic...: Correct, as this accurately describes the role of the Standby Site in a Dual Site environment, per the documentation.
* B. There is no such thing as an active site...: Incorrect, as Maestro Dual Site environments explicitly define Active and Standby Sites, not load-balanced traffic across both sites.
* C. The Standby Site is the second site to have been defined...: Incorrect, as the Standby Site is defined by its role (not handling traffic), not the order of configuration.
* D. The Standby Site is the site currently handling the enforcement...: Incorrect, as this describes the Active Site, not the Standby Site.
References:
Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 3: Dual Orchestrator Environment, Lesson 3.1: Introduction to Dual Orchestrator Environment, page 3-7 Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section:
Dual Site Configuration, page 3-9
NEW QUESTION # 44
What Maestro component acts as a load balancer and network switch?
- A. Security Switching Module (SSM)
- B. Maestro Hyperscale Orchestrator (MHO)
- C. Security Group (SG)
- D. Security Gateway Module (SGM)
Answer: B
Explanation:
Explanation
*The Quantum Maestro Orchestrator uses the Distribution Mode to assign incoming traffic to Security Group Members.
*Reference: Working with the Distribution Mode
NEW QUESTION # 45
How does HyperSync work in a Dual Site environment?
- A. Each active connection has a backup connection on the second site (remote site.)
- B. Each active connection has a local backup (on the local site) and a second backup connection on each of the MHOs.
- C. Each active connection has a local backup (on the local site) and a second backup connection on the second site (remote site.)
- D. Each active connection has two local backups (on the local site) and a third backup connection on the second site (remote site.)
Answer: C
Explanation:
HyperSync is a feature of Maestro that enables stateful synchronization of connections and resources across different sites in a Dual Site environment. HyperSync works by creating two backup connections for each active connection: one on the same site as the active connection, and another on the remote site. This ensures that the connection can be seamlessly resumed in case of afailover event, either within the same site or across the sites. HyperSync uses the Site-Sync port and VLANs to transmit the synchronization packets between the Security Group Members and the Maestro Orchestrators.
References =
*Maestro Dual Site configuration with a direct connection through L2 switches
*Maestro Frequently Asked Questions (FAQ)
*CHECK POINT MAESTRO EXPERT
NEW QUESTION # 46
What happens when you make changes from Clish on the SMO Master?
- A. Changes are applied to all members in the SG.
- B. The changes are synchronized to the MHO as a backup.
- C. The changes are synchronized to the SMS/MDS as a backup.
- D. Changes are only applied on the SMO Master.
Answer: D
Explanation:
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.2: Security Group Configuration, page 2-10
*Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Security Group Configuration, page 2-9
*Security Group Configuration - Check Point Software
NEW QUESTION # 47
What is the purpose of g_tcpdump command?
- A. Collects traffic dump from CIN network
- B. The same as tcpdump, just on Scalable Platform
- C. Collects traffic dump from all Active Appliances within Security Group
- D. Collects traffic dump from Sync network
Answer: C
Explanation:
Explanation
_tcpdump" probably collects traffic dumps from all active appliances within a security group, aligning with the naming convention and function of similar commands in scalable platforms.
References
*Maestro Expert (CCME) Course - Check Point Software, page 331
*What is 'IN' and 'OUT' of g_tcpdump? - Check Point CheckMates2
*CHECK POINT MAESTRO EXPERT, page 23
NEW QUESTION # 48
Which command do you use to find bottlenecks in the system that are affecting performance, even functionality in some cases?
- A. asg monitor
- B. asg perf -v
- C. asg diag verify
- D. asg stat -v
Answer: B
Explanation:
The asg perf -v command is used to find bottlenecks in the system that are affecting performance, even functionality in some cases. The asg perf -v command displays the performance statistics of the Security Group Modules (SGMs) in the Security Group, such as throughput, packet rate, CPU utilization, memory usage, and more. The asg perf -v command also shows the distribution mode and the correction rate of each SGM, which can indicate potential issues with asymmetric routing or load balancing. The asg perf -v command can help identify which SGMs are overloaded, underutilized, or misconfigured, and provide insights for troubleshooting and optimization.
References =
*Check Point Maestro R81.X Administration Guide, page 67, section "asg perf" 1
*Check Point Maestro R81.X Getting Started Guide, page 29, section "asg perf" 2
*Check Point Maestro Under the Hood presentation by Lari Luoma, slide 26
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2: https://sc1.
checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frameset.htm
2: https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%
20Maestro%20under%20the%20hood%202022.pptx
NEW QUESTION # 49
Complete the sentence: Dual Orchestrators work as.______
- A. Hot-Swap RAID
- B. Active-Active cluster
- C. Load Sharing cluster
- D. Active - Standby cluster
Answer: B
Explanation:
Dual Orchestrators work as an Active-Active cluster, which means that both Orchestrators are active and share the load of the traffic that is sent to and from the Security Group Members (SGMs). Active-Active cluster provides better performance and scalability than Active-Standby cluster, which only uses one Orchestrator at a time and keeps the other as a backup. Active-Active cluster also allows for faster failover and recovery in case of an Orchestrator failure, as the surviving Orchestrator can take over the traffic without interruption.
References
*Maestro Expert (CCME) Course - Check Point Software, page 25
*CheckPoint Certified Maestro Expert (CCME) - Skillzcafe, page 2
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, page 2
NEW QUESTION # 50
Which command should be used to restart Orchestrator service only?
- A. reboot
- B. cpstop; cpstart
- C. service orchestrator restart
- D. orchd restart
Answer: D
Explanation:
Explanation
Page 313 from the training manual:
- Restart the service:
orchd restart
- Restart the service without confirmation
service orchd restart
NEW QUESTION # 51
The drop_monitor command is useful for
- A. Monitoring Check Point code drops
- B. Viewing all interface drops such as RX-ERR, RX-DRP, and RX-OVR
- C. Viewing all drops by Check Point code or the Gaia OS, such as RX-DRP, RX-ERR, and Gaia OS drops.
- D. Showing the system temperature in real-time for multiple components, such as CPU, fan, and SSDs.
Answer: C
Explanation:
The drop_monitor command is a tool that monitors and displays the packets that are dropped by the Check Point code or the Gaia OS on the orchestrator and the appliances. It can help troubleshoot network issues and optimize performance. The command shows the drop reason, source, destination, protocol, and port of the dropped packets, as well as the interface and the module that dropped them.
References
*R81.20 Maestro Cheat Sheet version 7 - Check Point CheckMates1
*Support, Support Requests, Training ... - Check Point Software2
*Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge
NEW QUESTION # 52
The ______________ command will allow users to update the specified file on all SGMs.
- A. sed
- B. g_all"
- C. g_update_conf_file
- D. g_cat
Answer: C
Explanation:
The g_update_conf_file command is a global command that allows users to update the specified file on all Security Group Members of the current Security Group. The command takes the file name and the parameter- value pair as arguments and updates the file accordingly. For example, g_update_conf_file fwkern.conf fwha_enable_arp=1 will add or modify the fwha_enable_arp parameter in the fwkern.conf file on all SGMs.
References
*Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.3: Global Commands, page 4-12
*Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: Global Commands, page 4-10
*Maestro Commands for Security Groups - Check Point CheckMates
NEW QUESTION # 53
......
The CCME certification exam covers a range of topics, including the architecture and components of the Maestro solution, the deployment and configuration of Maestro clusters, as well as the monitoring, troubleshooting and optimization of Maestro environments. To prepare for the CCME exam, candidates should have a deep understanding of network security, virtualization technologies, and cloud computing concepts. They should also have hands-on experience with the Maestro solution, including the ability to configure and manage Maestro clusters.
Focus on 156-836 All-in-One Exam Guide For Quick Preparation: https://passleader.examtorrent.com/156-836-prep4sure-dumps.html
