156-587: Check Point Certified Troubleshooting Expert - R81.20

By Checkpoint · Browse Mode
About the Exam

This exam validates advanced troubleshooting skills for managing Check Point security environments. It is aimed at security experts and Check Point resellers who need deeper skills in diagnosing and resolving complex issues. The exam covers troubleshooting management servers, site-to-site and client-to-site VPNs, Identity Awareness, Access Control, gateway issues, logs and events, and kernel debugging. Passing demonstrates readiness to handle advanced Check Point security troubleshooting tasks.

Exam Topics

  • Troubleshooting Management Servers25%
  • Troubleshooting Site-to-Site VPNs25%
  • Troubleshooting Client-to-Site VPNs25%
  • Troubleshooting Identity Awareness25%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated August 5, 2025 at 7:38 PM

Topic filter
Retired questions
Question sort
Questions per page

QuestionQ1

Troubleshooting Site-to-Site VPNs

What is the proper syntax to enable VPN debugging and create new, empty debug files?

Explanation

The vpn debug truncon command starts VPN debugging while rotating/truncating the existing VPN and IKE debug output, creating fresh debug files. truncon is a valid vpn debug parameter in the Check Point CLI.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Troubleshooting Management Servers

After performing kernel debugging with fw ctl debug, you received a huge amount of information. It was saved in a very large file that is hard to open and analyze using standard text editors. Suggest a solution for this issue.

Explanation

Check Point kernel-debug collection supports cyclic output files. With fw ctl kdebug -f -o, the -m parameter sets the number of cyclic files and -s sets the size of each file in KB, preventing debug output from accumulating in one impractically large file.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Troubleshooting Identity Awareness

Which of the following daemons is used by Threat Extraction?

Explanation

The scrubd process is the main daemon for Check Point Threat Extraction.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Troubleshooting Site-to-Site VPNs

You changed kernel parameters and, after rebooting the gateway, substantial production traffic is being dropped and the gateway behaves unexpectedly. What should you do?

Explanation

Firewall kernel parameters configured to persist across reboots are stored in $FWDIR/boot/modules/fwkern.conf. Restoring the known-good backup of that file and rebooting removes the faulty persistent changes while preserving any valid preexisting kernel-parameter configuration.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Troubleshooting Management Servers

RAD is started when the Application Control and URL Filtering blades are enabled on the Security Gateway. What is the purpose of the following RAD configuration file: $FWDIR/conf/rad_settings.C?

Explanation

$FWDIR/conf/rad_settings.C stores RAD proxy settings, allowing the RAD service to use a proxy when reaching its online categorization services.

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home