156-587: Check Point Certified Troubleshooting Expert - R81.20Demo

By Checkpoint · Browse Mode
About the Exam

This exam validates advanced troubleshooting skills for managing Check Point security environments. It is aimed at security experts and Check Point resellers who need deeper skills in diagnosing and resolving complex issues. The exam covers troubleshooting management servers, site-to-site and client-to-site VPNs, Identity Awareness, Access Control, gateway issues, logs and events, and kernel debugging. Passing demonstrates readiness to handle advanced Check Point security troubleshooting tasks.

Exam Topics

  • Troubleshooting Management Servers25%
  • Troubleshooting Site-to-Site VPNs25%
  • Troubleshooting Client-to-Site VPNs25%
  • Troubleshooting Identity Awareness25%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated August 5, 2025 at 7:38 PM

Topic filter
Retired questions
Question sort

QuestionQ1

Troubleshooting Site-to-Site VPNs

What is the proper syntax to enable VPN debugging and create new, empty debug files?

  • A vpndebug trunc on
  • B vpn debug truncon
  • C vpn debug trunkon
  • D vpn kdebug on
Explanation

The vpn debug truncon command starts VPN debugging while rotating/truncating the existing VPN and IKE debug output, creating fresh debug files. truncon is a valid vpn debug parameter in the Check Point CLI.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Troubleshooting Management Servers

After performing kernel debugging with fw ctl debug, you received a huge amount of information. It was saved in a very large file that is hard to open and analyze using standard text editors. Suggest a solution for this issue.

  • A Reduce debug buffer to 1024KB and run debug for several times
  • B Use Check Point InfoView utility to analyze debug output
  • C Use “fw ctl zdebug” because of 1024KB buffer size
  • D Divide debug information into smaller files. Use “fw ctl kdebug -f -o “filename” -m 25 - s “1024”
Explanation

Check Point kernel-debug collection supports cyclic output files. With fw ctl kdebug -f -o, the -m parameter sets the number of cyclic files and -s sets the size of each file in KB, preventing debug output from accumulating in one impractically large file.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Troubleshooting Identity Awareness

Which of the following daemons is used by Threat Extraction?

  • A extractd
  • B tedex
  • C tex
  • D scrubd
Explanation

The scrubd process is the main daemon for Check Point Threat Extraction.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Troubleshooting Site-to-Site VPNs

You changed kernel parameters and, after rebooting the gateway, substantial production traffic is being dropped and the gateway behaves unexpectedly. What should you do?

  • A Run command fw ctl set int fw1_kernel_all_disable=1
  • B Restore fwkern.conf from backup and reboot the gateway
  • C run fw unloadlocal to remove parameters from kernel
  • D Remove all kernel parameters from fwkern.conf and reboot
Explanation

Firewall kernel parameters configured to persist across reboots are stored in $FWDIR/boot/modules/fwkern.conf. Restoring the known-good backup of that file and rebooting removes the faulty persistent changes while preserving any valid preexisting kernel-parameter configuration.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Troubleshooting Management Servers

RAD is started when the Application Control and URL Filtering blades are enabled on the Security Gateway. What is the purpose of the following RAD configuration file: $FWDIR/conf/rad_settings.C?

  • A This file contains the location information for Application Control and/or URL Filtering entitlements
  • B This file contains the information on how the Security Gateway reaches the Security Managers RAD service for Application Control and URL Filtering
  • C This file contains RAD proxy settings
  • D This file contains all the host name settings for the online application detection engine
Explanation

$FWDIR/conf/rad_settings.C stores RAD proxy settings, allowing the RAD service to use a proxy when reaching its online categorization services.

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home