156-215.81.20 Monitoring and Logging — All Questions With Answers

Question 1mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that logs are not appearing in SmartView Tracker for a specific Security Gateway. The gateway connectivity status is 'Unknown'. Which command is the primary method to verify the status of the log connection from the gateway to the Management Server?

Question 2mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to identify which policy rule is causing a high volume of 'Accept' logs for internal traffic. Which SmartView Tracker or SmartView feature is the most efficient way to aggregate and visualize this data?

Question 3hardmulti select

Read the full Monitoring and Logging explanation →

Which TWO of the following tasks are performed by the 'cp_log_export' tool in a Check Point environment?

Question 4hardmulti select

Read the full Monitoring and Logging explanation →

Which THREE of the following are valid methods to troubleshoot a situation where logs are not appearing in SmartView?

Question 5easymultiple choice

Read the full Monitoring and Logging explanation →

Which log tracking option should an administrator select to ensure that the log includes both the start and end of a connection?

Question 6mediummultiple choice

Read the full Monitoring and Logging explanation →

When troubleshooting log connectivity, which port is typically used for the communication between the Security Gateway and the Management Server for log transmission?

Question 7mediummultiple choice

Read the full Monitoring and Logging explanation →

Which feature in SmartView allows an administrator to combine multiple logs into a single report for compliance auditing?

Question 8hardmultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that logs are truncated in SmartView. What is the most likely cause for this behavior?

Question 9mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that logs are not appearing in SmartView Tracker for a specific gateway. The gateway is reachable, and the policy shows 'Log' enabled on all rules. Which command should be run on the Security Gateway to verify if the Log Server is receiving the connection correctly?

Question 10mediummultiple choice

Read the full Monitoring and Logging explanation →

Refer to the exhibit. An administrator is investigating why logs are missing from SmartView. The gateway status shows 'Connected' to the log server, but logs per second is zero. What is the most likely cause?

Exhibit

Log server: 192.168.1.10
Status: Connected
Log entries/sec: 0
Policy: Standard
Last log sent: 10:00:00

Question 11hardmulti select

Read the full network assurance explanation →

Which TWO of the following steps are required to properly configure Log Forwarding to an external syslog server?

Question 12mediummultiple choice

Read the full Monitoring and Logging explanation →

If logs are missing from the Management Server, but 'fw log' shows traffic on the Gateway, what is the first troubleshooting step to perform?

Question 13hardmulti select

Read the full Monitoring and Logging explanation →

Which THREE of the following are valid methods to free up disk space on a Security Management Server when log partitions are full?

Question 14mediummultiple choice

Read the full Monitoring and Logging explanation →

Refer to the exhibit. An administrator notices that logs are being rotated at 10:00 PM instead of midnight. What could be the cause of this unexpected behavior?

Exhibit

Log Switch time: 00:00
Log Switch size: 2048 MB
Threshold: 90%
Keep logs: 30 days

Question 15mediummultiple choice

Read the full Monitoring and Logging explanation →

Which log severity level should be filtered to reduce noise in the logs without missing critical security events?

Question 16mediummulti select

Read the full Monitoring and Logging explanation →

Which TWO actions should be taken if the Management Server log indexer service is crashing consistently?

Question 17mediummultiple choice

Read the full Monitoring and Logging explanation →

What must be installed on the Management Server to enable full log analysis and reporting features?

Question 18mediummultiple choice

Read the full Monitoring and Logging explanation →

When troubleshooting log gaps, which file on the Gateway is the most useful to check for connectivity errors?

Question 19mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that SmartView Monitor is not displaying real-time traffic data for a specific Security Gateway. Which action should the administrator perform first to troubleshoot this issue?

Question 20hardmultiple choice

Read the full Monitoring and Logging explanation →

Refer to the exhibit. An administrator is troubleshooting intermittent connectivity issues reported by users. Based on the CPView data provided, what is the most likely cause of the packet loss?

Exhibit

CPView output showing: Load: 15% | Memory: 40% | Connections: 850,000 | Conns/sec: 1200 | Packets/sec: 4500

Question 21hardmulti select

Read the full Monitoring and Logging explanation →

An administrator is troubleshooting why logs are not appearing in SmartView for a specific Security Gateway. The gateway is configured to send logs to the Management Server, and other gateways are logging correctly. Which TWO of the following are the most likely causes for this issue? (Choose two.)

Question 22mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that the Security Management Server is running out of disk space because logs are being stored indefinitely. The company policy requires that logs be retained for 90 days before being automatically deleted. Where should the administrator configure this retention period?

Question 23hardmultiple choice

Read the full network assurance explanation →

An administrator needs to ensure that all logs generated by a Security Gateway are sent to an external SIEM system via syslog. The administrator configures Log Exporter on the gateway. Which additional component must be installed and configured on the Management Server to define the export parameters?

Question 24mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that the Security Management Server is receiving an excessive number of logs from a specific Security Gateway, causing performance degradation. The administrator wants to reduce the log volume without losing critical security events. Which action should the administrator take?

Question 25easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator is reviewing logs in SmartView and notices that a particular connection is logged multiple times with different rule numbers. Which SmartView feature should the administrator use to group these related log entries into a single, consolidated view?

Question 26hardmulti select

Read the full Monitoring and Logging explanation →

An administrator must reduce the volume of logs stored on the Management Server without losing visibility into security events. Which TWO actions achieve this goal? (Choose two.)

Question 27hardmultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to analyze logs to determine which internal host is generating the most traffic to a specific external IP address. The administrator wants to see a summary of the top talkers and the total volume of connections. Which SmartConsole tool should be used to achieve this?

Question 28hardmulti select

Read the full network assurance explanation →

An administrator is configuring Log Exporter on a Check Point R81 Security Gateway to send logs to an external syslog server. The administrator wants to ensure that only logs from a specific network range are exported. Which TWO of the following actions are required to achieve this? (Choose two.)

Question 29mediummultiple choice

Read the full Monitoring and Logging explanation →

A security administrator notices that the SmartView log repository is growing rapidly and consuming excessive disk space on the Management Server. Which command should the administrator use to safely remove old log files and free up space?

Question 30mediummulti select

Read the full Monitoring and Logging explanation →

An administrator needs to configure log retention to comply with a policy that requires logs to be kept for 90 days. The Management Server has limited disk space. Which TWO actions should the administrator take to ensure logs are retained for the required period while managing disk usage? (Choose two.)

Question 31mediummultiple choice

Read the full Monitoring and Logging explanation →

A security administrator suspects that the Security Gateway is silently dropping traffic to an internal web server. To confirm, they want to see log entries for packets that are dropped by the implicit cleanup rule, even though no explicit rule matches this traffic. Which log tracking option on the cleanup rule should they verify is set to Log?

Question 32hardmultiple choice

Read the full Monitoring and Logging explanation →

A Security Management Server is experiencing performance degradation. The administrator suspects that a large number of logs are being indexed unnecessarily. The administrator wants to exclude certain low-risk traffic from being indexed to improve search performance. Which configuration should the administrator modify?

Question 33hardmultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that SmartLog is not displaying any logs from a specific Security Gateway, even though the gateway is up and passing traffic. The administrator confirms that the gateway's log server is the Management Server and that the gateway is sending logs. Which action should the administrator take to verify that the logs are being indexed correctly on the Management Server?

Question 34mediummulti select

Read the full network assurance explanation →

An administrator is configuring a Security Gateway to send logs to an external syslog server for long-term retention. The administrator needs to ensure that the logs are sent in a format that includes the original log fields. Which TWO of the following actions are required to achieve this? (Choose two.)

Question 35easymultiple choice

Read the full Monitoring and Logging explanation →

A security administrator needs to review logs to determine which user accessed a specific confidential file on a server. The logs are stored in SmartLog. Which SmartLog feature should the administrator use to quickly find all log entries related to that file?

Question 36mediummultiple choice

Read the full Monitoring and Logging explanation →

Your organization requires that all log files be rotated when they reach a specific size limit to ensure efficient disk usage. Where should an administrator configure the automatic log rotation settings in SmartConsole?

Question 37mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator wants to ensure that specific logs are always sent to a remote Log Server, even if the primary Log Server becomes unreachable. Which feature should they configure?

Question 38easymultiple choice

Read the full Monitoring and Logging explanation →

Which tab in SmartConsole allows an administrator to view the status of the Security Management Server and its associated gateways, including CPU and memory usage?

Question 39mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator observes that logs are missing from the 'Logs & Monitor' tab, but the 'fw log' command shows logs are being generated on the gateway. What is the most likely cause?

Question 40hardmultiple choice

Read the full Monitoring and Logging explanation →

What is the consequence of setting the 'Log Severity' threshold too high on a Security Gateway?

Question 41mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator wants to ensure that logs are indexed properly for quick searching in SmartView. Which process is responsible for this indexing?

Question 42easymultiple choice

Read the full Monitoring and Logging explanation →

What is the primary function of the 'SmartEvent' blade in the context of logging?

Question 43mediummultiple choice

Read the full Monitoring and Logging explanation →

If an administrator needs to identify the source of a connection drop in the logs, which field is most useful to inspect first?

Question 44hardmultiple choice

Read the full Monitoring and Logging explanation →

Refer to the exhibit. What is the most likely reason this traffic was dropped?

Exhibit

Packet: Source 10.1.1.1 -> Dest 8.8.8.8
Action: Drop
Policy: Rule 5
Reason: Threat Prevention
Blade: IPS
Confidence: High

Question 45mediummultiple choice

Read the full network assurance explanation →

A security administrator needs to send only Security Gateway log records to an external SIEM over syslog, while keeping the Management Server's own audit logs local. Which Check Point configuration should be performed?

Question 46mediummultiple choice

Read the full network assurance explanation →

A security administrator needs to configure a Security Gateway to send its logs to a third-party SIEM via syslog. The SIEM is reachable only through an external interface, and the administrator wants to avoid sending logs over the internal network. Which Check Point feature should be used to achieve this requirement?

Question 47hardmultiple choice

Read the full Monitoring and Logging explanation →

During an investigation, an administrator must find all connections that were dropped by the Security Gateway in the last 24 hours for a specific source IP. Which SmartConsole tool provides the most efficient way to search and filter these logs?

Question 48mediummultiple choice

Read the full Monitoring and Logging explanation →

A security administrator is troubleshooting a performance issue on a Check Point R81 Security Gateway. The administrator suspects that a specific process is generating an excessive number of logs, causing high CPU usage. Which SmartConsole tool should the administrator use to view real-time, per-process resource consumption on the gateway?

Question 49easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that the Security Management Server disk is filling rapidly because log files are retained indefinitely. The retention policy must keep logs for 90 days and then remove older records automatically. Where should this be configured?

Question 50mediummultiple choice

Read the full Monitoring and Logging explanation →

A Security Gateway stops sending logs to the Management Server, and users report that SmartView Logs shows no new entries. The administrator confirms the gateway is passing traffic. Which action should be taken first to diagnose the log transmission problem?

Question 51mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that the Security Management Server's disk space is being consumed rapidly by log files. The administrator wants to automatically delete logs older than 90 days to free up space. Which Check Point feature should be configured to achieve this?

Question 52hardmultiple choice

Read the full Monitoring and Logging explanation →

A security analyst is investigating a suspected intrusion and needs to view all logs related to a specific source IP address across multiple Security Gateways. The logs are stored on a central Management Server. Which SmartConsole feature should the analyst use to efficiently search and filter these logs?

Question 53easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to review logs from a specific Security Gateway that occurred between 2:00 AM and 4:00 AM yesterday. Which SmartConsole application should the administrator use to efficiently filter and analyze these logs?

Question 54hardmultiple choice

Read the full Monitoring and Logging explanation →

An administrator is troubleshooting an issue where logs from a Security Gateway are not appearing in SmartLog. The administrator verifies that the gateway is sending logs to the Management Server, but the logs are not indexed. Which service should the administrator check on the Management Server to ensure proper log indexing?

Question 55mediummultiple choice

Read the full Monitoring and Logging explanation →

A security administrator is investigating a suspicious connection to an external IP. The administrator needs to see the raw packet-level details captured by the Security Gateway's IPS blade to determine the exact payload that triggered the protection. Which SmartConsole tool should the administrator use to view this information?

Question 56easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to verify that a Security Gateway is sending logs to the Management Server. The administrator wants to see a real-time count of log messages received by the management server from each gateway. Which SmartConsole tool provides this information?

Question 57easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator wants to receive immediate notification when a critical security event, such as a malware infection, is detected by a Security Gateway. Which Check Point feature should the administrator configure to send an alert?

Question 58easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to review all logs generated by a specific Security Gateway over the past week. The administrator wants to see the logs in a tabular format and apply filters based on source IP. Which SmartConsole tool should the administrator use?

Question 59mediummulti select

Read the full network assurance explanation →

An administrator is configuring a Security Gateway to send logs to an external SIEM via syslog. They want to ensure that the logs include the action taken and the rule number for each connection. Which TWO of the following log fields must be included in the exported syslog messages to meet this requirement? (Choose two.)

Question 60hardmultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting why logs from a Security Gateway are not appearing in SmartLog, even though the gateway is configured to send logs to the Management Server and the connection is established. The administrator runs 'cp_log_export' on the Management Server and sees that logs are being exported to an external syslog server successfully. What is the most likely reason for the logs not appearing in SmartLog?

Question 1mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that logs are not appearing in SmartView Tracker for a specific Security Gateway. The gateway connectivity status is 'Unknown'. Which command is the primary method to verify the status of the log connection from the gateway to the Management Server?

Question 2mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to identify which policy rule is causing a high volume of 'Accept' logs for internal traffic. Which SmartView Tracker or SmartView feature is the most efficient way to aggregate and visualize this data?

Question 3hardmulti select

Read the full Monitoring and Logging explanation →

Which TWO of the following tasks are performed by the 'cp_log_export' tool in a Check Point environment?

Question 4hardmulti select

Read the full Monitoring and Logging explanation →

Which THREE of the following are valid methods to troubleshoot a situation where logs are not appearing in SmartView?

Question 5easymultiple choice

Read the full Monitoring and Logging explanation →

Which log tracking option should an administrator select to ensure that the log includes both the start and end of a connection?

Question 6mediummultiple choice

Read the full Monitoring and Logging explanation →

When troubleshooting log connectivity, which port is typically used for the communication between the Security Gateway and the Management Server for log transmission?

Question 7mediummultiple choice

Read the full Monitoring and Logging explanation →

Which feature in SmartView allows an administrator to combine multiple logs into a single report for compliance auditing?

Question 8hardmultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that logs are truncated in SmartView. What is the most likely cause for this behavior?

Question 9mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that logs are not appearing in SmartView Tracker for a specific gateway. The gateway is reachable, and the policy shows 'Log' enabled on all rules. Which command should be run on the Security Gateway to verify if the Log Server is receiving the connection correctly?

Question 10mediummultiple choice

Read the full Monitoring and Logging explanation →

Refer to the exhibit. An administrator is investigating why logs are missing from SmartView. The gateway status shows 'Connected' to the log server, but logs per second is zero. What is the most likely cause?

Exhibit

Log server: 192.168.1.10
Status: Connected
Log entries/sec: 0
Policy: Standard
Last log sent: 10:00:00

Question 11hardmulti select

Read the full network assurance explanation →

Which TWO of the following steps are required to properly configure Log Forwarding to an external syslog server?

Question 12mediummultiple choice

Read the full Monitoring and Logging explanation →

If logs are missing from the Management Server, but 'fw log' shows traffic on the Gateway, what is the first troubleshooting step to perform?

Question 13hardmulti select

Read the full Monitoring and Logging explanation →

Which THREE of the following are valid methods to free up disk space on a Security Management Server when log partitions are full?

Question 14mediummultiple choice

Read the full Monitoring and Logging explanation →

Refer to the exhibit. An administrator notices that logs are being rotated at 10:00 PM instead of midnight. What could be the cause of this unexpected behavior?

Exhibit

Log Switch time: 00:00
Log Switch size: 2048 MB
Threshold: 90%
Keep logs: 30 days

Question 15mediummultiple choice

Read the full Monitoring and Logging explanation →

Which log severity level should be filtered to reduce noise in the logs without missing critical security events?

Question 16mediummulti select

Read the full Monitoring and Logging explanation →

Which TWO actions should be taken if the Management Server log indexer service is crashing consistently?

Question 17mediummultiple choice

Read the full Monitoring and Logging explanation →

What must be installed on the Management Server to enable full log analysis and reporting features?

Question 18mediummultiple choice

Read the full Monitoring and Logging explanation →

When troubleshooting log gaps, which file on the Gateway is the most useful to check for connectivity errors?

Question 19mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that SmartView Monitor is not displaying real-time traffic data for a specific Security Gateway. Which action should the administrator perform first to troubleshoot this issue?

Question 20hardmultiple choice

Read the full Monitoring and Logging explanation →

Refer to the exhibit. An administrator is troubleshooting intermittent connectivity issues reported by users. Based on the CPView data provided, what is the most likely cause of the packet loss?

Exhibit

CPView output showing: Load: 15% | Memory: 40% | Connections: 850,000 | Conns/sec: 1200 | Packets/sec: 4500

Question 21hardmulti select

Read the full Monitoring and Logging explanation →

An administrator is troubleshooting why logs are not appearing in SmartView for a specific Security Gateway. The gateway is configured to send logs to the Management Server, and other gateways are logging correctly. Which TWO of the following are the most likely causes for this issue? (Choose two.)

Question 22mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that the Security Management Server is running out of disk space because logs are being stored indefinitely. The company policy requires that logs be retained for 90 days before being automatically deleted. Where should the administrator configure this retention period?

Question 23hardmultiple choice

Read the full network assurance explanation →

An administrator needs to ensure that all logs generated by a Security Gateway are sent to an external SIEM system via syslog. The administrator configures Log Exporter on the gateway. Which additional component must be installed and configured on the Management Server to define the export parameters?

Question 24mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that the Security Management Server is receiving an excessive number of logs from a specific Security Gateway, causing performance degradation. The administrator wants to reduce the log volume without losing critical security events. Which action should the administrator take?

Question 25easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator is reviewing logs in SmartView and notices that a particular connection is logged multiple times with different rule numbers. Which SmartView feature should the administrator use to group these related log entries into a single, consolidated view?

Question 26hardmulti select

Read the full Monitoring and Logging explanation →

An administrator must reduce the volume of logs stored on the Management Server without losing visibility into security events. Which TWO actions achieve this goal? (Choose two.)

Question 27hardmultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to analyze logs to determine which internal host is generating the most traffic to a specific external IP address. The administrator wants to see a summary of the top talkers and the total volume of connections. Which SmartConsole tool should be used to achieve this?

Question 28hardmulti select

Read the full network assurance explanation →

An administrator is configuring Log Exporter on a Check Point R81 Security Gateway to send logs to an external syslog server. The administrator wants to ensure that only logs from a specific network range are exported. Which TWO of the following actions are required to achieve this? (Choose two.)

Question 29mediummultiple choice

Read the full Monitoring and Logging explanation →

A security administrator notices that the SmartView log repository is growing rapidly and consuming excessive disk space on the Management Server. Which command should the administrator use to safely remove old log files and free up space?

Question 30mediummulti select

Read the full Monitoring and Logging explanation →

An administrator needs to configure log retention to comply with a policy that requires logs to be kept for 90 days. The Management Server has limited disk space. Which TWO actions should the administrator take to ensure logs are retained for the required period while managing disk usage? (Choose two.)

Question 31mediummultiple choice

Read the full Monitoring and Logging explanation →

A security administrator suspects that the Security Gateway is silently dropping traffic to an internal web server. To confirm, they want to see log entries for packets that are dropped by the implicit cleanup rule, even though no explicit rule matches this traffic. Which log tracking option on the cleanup rule should they verify is set to Log?

Question 32hardmultiple choice

Read the full Monitoring and Logging explanation →

A Security Management Server is experiencing performance degradation. The administrator suspects that a large number of logs are being indexed unnecessarily. The administrator wants to exclude certain low-risk traffic from being indexed to improve search performance. Which configuration should the administrator modify?

Question 33hardmultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that SmartLog is not displaying any logs from a specific Security Gateway, even though the gateway is up and passing traffic. The administrator confirms that the gateway's log server is the Management Server and that the gateway is sending logs. Which action should the administrator take to verify that the logs are being indexed correctly on the Management Server?

Question 34mediummulti select

Read the full network assurance explanation →

An administrator is configuring a Security Gateway to send logs to an external syslog server for long-term retention. The administrator needs to ensure that the logs are sent in a format that includes the original log fields. Which TWO of the following actions are required to achieve this? (Choose two.)

Question 35easymultiple choice

Read the full Monitoring and Logging explanation →

A security administrator needs to review logs to determine which user accessed a specific confidential file on a server. The logs are stored in SmartLog. Which SmartLog feature should the administrator use to quickly find all log entries related to that file?

Question 36mediummultiple choice

Read the full Monitoring and Logging explanation →

Your organization requires that all log files be rotated when they reach a specific size limit to ensure efficient disk usage. Where should an administrator configure the automatic log rotation settings in SmartConsole?

Question 37mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator wants to ensure that specific logs are always sent to a remote Log Server, even if the primary Log Server becomes unreachable. Which feature should they configure?

Question 38easymultiple choice

Read the full Monitoring and Logging explanation →

Which tab in SmartConsole allows an administrator to view the status of the Security Management Server and its associated gateways, including CPU and memory usage?

Question 39mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator observes that logs are missing from the 'Logs & Monitor' tab, but the 'fw log' command shows logs are being generated on the gateway. What is the most likely cause?

Question 40hardmultiple choice

Read the full Monitoring and Logging explanation →

What is the consequence of setting the 'Log Severity' threshold too high on a Security Gateway?

Question 41mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator wants to ensure that logs are indexed properly for quick searching in SmartView. Which process is responsible for this indexing?

Question 42easymultiple choice

Read the full Monitoring and Logging explanation →

What is the primary function of the 'SmartEvent' blade in the context of logging?

Question 43mediummultiple choice

Read the full Monitoring and Logging explanation →

If an administrator needs to identify the source of a connection drop in the logs, which field is most useful to inspect first?

Question 44hardmultiple choice

Read the full Monitoring and Logging explanation →

Refer to the exhibit. What is the most likely reason this traffic was dropped?

Exhibit

Packet: Source 10.1.1.1 -> Dest 8.8.8.8
Action: Drop
Policy: Rule 5
Reason: Threat Prevention
Blade: IPS
Confidence: High

Question 45mediummultiple choice

Read the full network assurance explanation →

A security administrator needs to send only Security Gateway log records to an external SIEM over syslog, while keeping the Management Server's own audit logs local. Which Check Point configuration should be performed?

Question 46mediummultiple choice

Read the full network assurance explanation →

A security administrator needs to configure a Security Gateway to send its logs to a third-party SIEM via syslog. The SIEM is reachable only through an external interface, and the administrator wants to avoid sending logs over the internal network. Which Check Point feature should be used to achieve this requirement?

Question 47hardmultiple choice

Read the full Monitoring and Logging explanation →

During an investigation, an administrator must find all connections that were dropped by the Security Gateway in the last 24 hours for a specific source IP. Which SmartConsole tool provides the most efficient way to search and filter these logs?

Question 48mediummultiple choice

Read the full Monitoring and Logging explanation →

A security administrator is troubleshooting a performance issue on a Check Point R81 Security Gateway. The administrator suspects that a specific process is generating an excessive number of logs, causing high CPU usage. Which SmartConsole tool should the administrator use to view real-time, per-process resource consumption on the gateway?

Question 49easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that the Security Management Server disk is filling rapidly because log files are retained indefinitely. The retention policy must keep logs for 90 days and then remove older records automatically. Where should this be configured?

Question 50mediummultiple choice

Read the full Monitoring and Logging explanation →

A Security Gateway stops sending logs to the Management Server, and users report that SmartView Logs shows no new entries. The administrator confirms the gateway is passing traffic. Which action should be taken first to diagnose the log transmission problem?

Question 51mediummultiple choice

Read the full Monitoring and Logging explanation →

An administrator notices that the Security Management Server's disk space is being consumed rapidly by log files. The administrator wants to automatically delete logs older than 90 days to free up space. Which Check Point feature should be configured to achieve this?

Question 52hardmultiple choice

Read the full Monitoring and Logging explanation →

A security analyst is investigating a suspected intrusion and needs to view all logs related to a specific source IP address across multiple Security Gateways. The logs are stored on a central Management Server. Which SmartConsole feature should the analyst use to efficiently search and filter these logs?

Question 53easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to review logs from a specific Security Gateway that occurred between 2:00 AM and 4:00 AM yesterday. Which SmartConsole application should the administrator use to efficiently filter and analyze these logs?

Question 54hardmultiple choice

Read the full Monitoring and Logging explanation →

An administrator is troubleshooting an issue where logs from a Security Gateway are not appearing in SmartLog. The administrator verifies that the gateway is sending logs to the Management Server, but the logs are not indexed. Which service should the administrator check on the Management Server to ensure proper log indexing?

Question 55mediummultiple choice

Read the full Monitoring and Logging explanation →

A security administrator is investigating a suspicious connection to an external IP. The administrator needs to see the raw packet-level details captured by the Security Gateway's IPS blade to determine the exact payload that triggered the protection. Which SmartConsole tool should the administrator use to view this information?

Question 56easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to verify that a Security Gateway is sending logs to the Management Server. The administrator wants to see a real-time count of log messages received by the management server from each gateway. Which SmartConsole tool provides this information?

Question 57easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator wants to receive immediate notification when a critical security event, such as a malware infection, is detected by a Security Gateway. Which Check Point feature should the administrator configure to send an alert?

Question 58easymultiple choice

Read the full Monitoring and Logging explanation →

An administrator needs to review all logs generated by a specific Security Gateway over the past week. The administrator wants to see the logs in a tabular format and apply filters based on source IP. Which SmartConsole tool should the administrator use?

Question 59mediummulti select

Read the full network assurance explanation →

An administrator is configuring a Security Gateway to send logs to an external SIEM via syslog. They want to ensure that the logs include the action taken and the rule number for each connection. Which TWO of the following log fields must be included in the exported syslog messages to meet this requirement? (Choose two.)

Question 60hardmultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting why logs from a Security Gateway are not appearing in SmartLog, even though the gateway is configured to send logs to the Management Server and the connection is established. The administrator runs 'cp_log_export' on the Management Server and sees that logs are being exported to an external syslog server successfully. What is the most likely reason for the logs not appearing in SmartLog?