156-215.81.20 Monitoring and Logging Practice Test 2 — 15 Questions

Question 1

Which TWO actions should be taken if the Management Server log indexer service is crashing consistently?

Accepted Answer

Check the '/var/log/messages' for indexer errors.. A crashing indexer prevents log searches. Administrators must check for both hardware limitations and log corruption. By investigating system logs and ensuring the indexer has the necessary resources, administrators can restore search functionality, which is critical for incident response. If these steps fail, professional support is required to address deep-seated file system or process issues.

Answer

Increase the gateway log partition size.

Answer

Run 'cpstop' followed by 'cpstart'.

Answer

Change the SIC password.

Question 2

What must be installed on the Management Server to enable full log analysis and reporting features?

Accepted Answer

SmartEvent and SmartReporter. Some advanced reporting and correlation features require specific license-enabled blades. Ensuring these are installed and active is essential for deep security analysis. Without the proper blades, administrators are limited to basic logging, missing out on the advanced reporting and automated event correlation that modern security teams rely on to maintain their posture.

Answer

Management High Availability

Answer

Gateway Management

Answer

Endpoint Connect

Question 3

When troubleshooting log gaps, which file on the Gateway is the most useful to check for connectivity errors?

Accepted Answer

$FWDIR/log/fwd.elg. The 'fw.log' or related system files contain the detailed logs for the daemon's activity. By reviewing the correct file, administrators can find the exact error message indicating why the communication with the log server failed. This methodical approach is superior to guessing, as it directly surfaces the underlying cause, whether it be an authentication error or a network timeout.

Answer

/var/log/messages

Answer

$CPDIR/log/cpd.elg

Answer

/etc/syslog.conf

Question 4

An administrator notices that SmartView Monitor is not displaying real-time traffic data for a specific Security Gateway. Which action should the administrator perform first to troubleshoot this issue?

Accepted Answer

Run 'cpwd_admin list' on the Security Gateway to verify the status of the cpd process.. SmartView Monitor relies on the CPView and the monitoring daemon (cpviewd) to report system and traffic statistics. Verifying the connectivity and state of the monitoring service ensures the Management Server is correctly polling the gateway. This is a critical first step in determining if the issue is a communication failure, a service outage on the gateway, or a configuration mismatch within the SmartConsole environment.

Answer

Reinstall the Security Gateway policy package.

Answer

Execute 'cpstat os -f multi_cpu' on the Security Gateway.

Answer

Restart the Management Server's FWD daemon.

Question 5

Refer to the exhibit. An administrator is troubleshooting intermittent connectivity issues reported by users. Based on the CPView data provided, what is the most likely cause of the packet loss?

Accepted Answer

The connection table limit has been reached.. The connection table size is the critical metric here. With 850,000 active connections, the gateway is approaching or exceeding its configured connection table limit, which is a common trigger for dropping new connections. Monitoring these limits is essential for capacity planning and preventing service degradation. The CPView tool provides granular, real-time visibility into these specific kernel-level constraints that are often invisible in standard log files.

Answer

The CPU load is too high, causing packet drops.

Answer

The memory usage is excessive, triggering kernel-level drops.

Answer

The packets per second rate exceeds the hardware capacity.

Question 6

An administrator is troubleshooting why logs are not appearing in SmartView for a specific Security Gateway. The gateway is configured to send logs to the Management Server, and other gateways are logging correctly. Which TWO of the following are the most likely causes for this issue? (Choose two.)

Accepted Answer

The Security Gateway's log forwarding configuration is disabled or misconfigured.. Logs from a specific gateway can fail to appear in SmartView if that gateway's log forwarding configuration is disabled or misconfigured, or if firewall rules are blocking log traffic from that gateway to the Management Server. Both are common, gateway-specific issues that would not affect other gateways. Checking the gateway's logging settings and the relevant firewall rules is the appropriate troubleshooting step.

Answer

The Management Server's disk space is full, preventing new logs from being written.

Answer

The log indexer process on the Management Server is not running.

Answer

The Security Gateway's log server is not defined correctly in the gateway object.

Question 7

An administrator notices that the Security Management Server is running out of disk space because logs are being stored indefinitely. The company policy requires that logs be retained for 90 days before being automatically deleted. Where should the administrator configure this retention period?

Accepted Answer

In the Security Management Server's log storage settings, configure the retention period to 90 days.. Log retention is configured on the Security Management Server itself, not on gateways or in Global Properties. The Management Server's log storage settings include an option to specify how many days logs should be retained before automatic deletion. Setting this to 90 days meets the company's policy and frees disk space. Other settings control logging destinations or general logging behavior but not retention.

Answer

In the Global Properties under Logging and Monitoring, set the log retention period to 90 days.

Answer

In the Security Management Server object's Logs and Masters settings, set the log retention period to 90 days.

Answer

In the Security Gateway object's Logs and Masters settings, set the log retention period to 90 days.

Question 8

An administrator needs to ensure that all logs generated by a Security Gateway are sent to an external SIEM system via syslog. The administrator configures Log Exporter on the gateway. Which additional component must be installed and configured on the Management Server to define the export parameters?

Accepted Answer

Log Exporter configuration in SmartConsole. To configure Log Exporter, the administrator must define export parameters such as destination, format, and filters in SmartConsole. This configuration is then installed on the Security Gateway. Other components like SmartEvent or Log Server are not prerequisites for syslog export. Therefore, the Log Exporter configuration in SmartConsole is the necessary additional step.

Answer

SmartEvent server

Answer

Log Server

Answer

Log Exporter policy

Question 9

An administrator notices that the Security Management Server is receiving an excessive number of logs from a specific Security Gateway, causing performance degradation. The administrator wants to reduce the log volume without losing critical security events. Which action should the administrator take?

Accepted Answer

Adjust the Track setting on relevant rules to Log or None instead of Detailed Log.. The correct action is to adjust the Track setting on rules generating excessive logs. By changing from Detailed Log to Log or None, the administrator reduces the data recorded per event, lowering the overall log volume and alleviating performance degradation. This maintains visibility of critical security events while optimizing resource usage.

Answer

Enable Log Implied Rules in the Global Properties.

Answer

Configure the Security Gateway to send logs to a dedicated Log Server.

Answer

Increase the log storage size on the Management Server.

Question 10

An administrator is reviewing logs in SmartView and notices that a particular connection is logged multiple times with different rule numbers. Which SmartView feature should the administrator use to group these related log entries into a single, consolidated view?

Accepted Answer

Log consolidation. Log consolidation in SmartView is designed to combine multiple log entries from the same session into a single record. This helps administrators see the full context of a connection without clutter. Other features like indexing or forwarding serve different purposes and do not address the need for grouped log viewing.

Answer

Log forwarding

Answer

Log stitching

Answer

Log indexing

Question 11

An administrator must reduce the volume of logs stored on the Management Server without losing visibility into security events. Which TWO actions achieve this goal? (Choose two.)

Accepted Answer

Enable implicit drop logging suppression so that dropped packets from the Cleanup rule are not logged.. Reducing log volume while keeping security visibility comes from logging selectively. Suppressing implicit drop logging eliminates noise from the Cleanup rule, and relying on per-rule logging means only rules of interest generate records. Together these cut storage consumption without discarding the events an investigator needs, unlike blanket disabling of Accept logs or aggressive retention cuts.

Answer

Move the log database to an external syslog server and stop storing logs locally.

Answer

Set the log retention period to one day so old logs are purged quickly.

Answer

Disable logging on all Accept rules to eliminate the largest log category.

Question 12

An administrator needs to analyze logs to determine which internal host is generating the most traffic to a specific external IP address. The administrator wants to see a summary of the top talkers and the total volume of connections. Which SmartConsole tool should be used to achieve this?

Accepted Answer

SmartLog with a filter for the external IP address and the 'Aggregate' option enabled.. SmartLog's aggregation capability allows summarizing logs by fields like source IP, showing counts and total connection volumes. Filtering for the external IP address and aggregating on source IP yields a ranked list of internal hosts by traffic volume. Other tools like SmartView Monitor are for real-time monitoring, SmartEvent for event correlation, and SmartView Logs lacks aggregation. Thus, SmartLog is the correct tool for this analysis.

Answer

SmartEvent with a custom event query for the external IP address.

Answer

SmartView Logs with a filter for the external IP address, then sort by source IP.

Answer

SmartView Monitor with a traffic view for the external IP address.

Question 13

An administrator is configuring Log Exporter on a Check Point R81 Security Gateway to send logs to an external syslog server. The administrator wants to ensure that only logs from a specific network range are exported. Which TWO of the following actions are required to achieve this? (Choose two.)

Accepted Answer

Configure the syslog server to accept logs from the gateway.. To export only logs from a specific network range, the administrator must define a filter in the Log Exporter configuration to select those logs, and ensure the external syslog server is configured to receive them. These two actions directly address the requirement. Other options are either not separate steps or not required for this specific filtering objective.

Answer

Install the Log Exporter policy on the Security Gateway.

Answer

Create a new Security Policy rule to allow outbound syslog traffic.

Answer

Enable the Log Exporter blade on the Security Gateway.

Question 14

A security administrator notices that the SmartView log repository is growing rapidly and consuming excessive disk space on the Management Server. Which command should the administrator use to safely remove old log files and free up space?

Accepted Answer

SmartConsole Logs > Delete Old Logs. The correct method to safely remove old logs is through SmartConsole's 'Delete Old Logs' feature. It allows administrators to specify retention criteria and deletes logs without disrupting the log database. Other commands like cp_log_export or cp_log_switch serve different purposes and do not directly free space by removing old logs.

Answer

cp_log_switch

Answer

cp_log_rotate

Answer

cp_log_export

Question 15

An administrator needs to configure log retention to comply with a policy that requires logs to be kept for 90 days. The Management Server has limited disk space. Which TWO actions should the administrator take to ensure logs are retained for the required period while managing disk usage? (Choose two.)

Accepted Answer

Enable log rotation based on size and time.. To meet the 90-day retention requirement while managing disk space, the administrator should enable log rotation based on size and time, and set the log retention policy to 90 days. Log rotation ensures that older logs are archived or deleted systematically, preventing disk exhaustion, while the retention policy enforces the minimum storage duration for compliance.

Answer

Increase the disk space on the Management Server.

Answer

Disable logging for non-critical traffic.

Answer

Configure log forwarding to an external syslog server.