CCSM Advanced Firewall Troubleshooting Practice Question
A security engineer is troubleshooting intermittent connectivity to a new internal web application. Connections sometimes succeed, but often hang after the TCP handshake. No drops are seen in 'fw ctl zdebug drop' output. The engineer suspects the issue is related to TCP stream handling by the firewall kernel. Which command should be used to inspect the state and statistics of the TCP streaming subsystem in real time?
⚠ Common exam trap
The trap here is assuming that any connectivity problem must produce a drop log, leading administrators to repeatedly run drop-debug commands instead of investigating stream-level statistics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
fw ctl stream stat
When connections complete the TCP handshake but then hang and no drops are logged, the issue often lies in the TCP streaming layer rather than in policy enforcement. The 'fw ctl stream stat' command is the correct tool because it exposes per-instance stream statistics, including active streams, sequence errors, and queue overflows. These metrics can confirm whether the stream table is exhausted or streams are being mishandled, directly addressing the symptom.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
fw ctl zdebug + drop
Why it's wrong here
The zdebug drop command enables verbose logging of packets dropped by the firewall kernel, which is helpful for identifying rule-based or inspection-based drops. However, the scenario explicitly states that no drops are seen in the existing drop debug output, meaning the problem is not a drop action but a stream handling stall. Re-running drop debugging would not reveal stream state information.
- ✗
fw monitor -e 'accept tcp;'
Why it's wrong here
fw monitor captures packets at various inspection points, but it does not expose the internal state or statistics of the TCP streaming module. While it can show whether packets traverse the firewall, it cannot reveal stream table exhaustion, sequence validation failures, or other stream-level anomalies. Using it here would consume significant CPU and still leave the root cause of the intermittent hangs unidentified.
- ✗
cpstat fw -f policy
Why it's wrong here
cpstat with the policy filter reports on policy installation status, policy names, and timestamps, not on active TCP streams or kernel-level stream handling. It is useful for verifying that the correct policy is loaded and synchronized across cluster members, but it provides no visibility into per-connection stream state. Therefore, it cannot diagnose why connections hang after the TCP handshake.
- ✓
fw ctl stream stat
Why this is correct
This command queries the kernel's TCP streaming module and displays per-instance statistics, including active streams, sequence number validation errors, and out-of-order packet counters. In this scenario, the absence of drop logs combined with hangs after handshake strongly suggests a stream inspection issue, and 'fw ctl stream stat' provides the exact telemetry needed to confirm whether streams are being improperly reset or stalled.
Visual reference
About these practice questions
This CCSM question is part of Courseiva's 219-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This CCSM practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSM exam.