CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. Checkpoint
  5. 156-587

Free 156-587 Exam Braindumps (page: 4)

Page 3 of 21
PDF with 78 Questions

Which of the following file is commonly associated with troubleshooting crashes on a system such as the Security Gateway?

  1. tcpdump
  2. core dump
  3. fw monitor
  4. CPMIL dump

Answer(s): B

Explanation:

When troubleshooting crashes on a Security Gateway (or any Linux-based system), the file type that is typically generated and used for in-depth analysis is a core dump.

A core dump captures the memory state of a process at the time it crashed and is critical for root- cause analysis.

Other options:

A . tcpdump: A packet capture file, not a crash-related file.

C . fw monitor: A Check Point packet capture tool, but not for crash debugging.

D . CPMIL dump: Not a common or standard crash dump reference in Check Point.



When a User Mode process suddenly crashes, it may create a core dump file.
Which of the following information is available in the core dump and may be used to identify the root cause of the crash?

  1. Program Counter ii. Stack Pointer iii. Memory management information iv. Other Processor and OS flags / information
  2. iii and iv only
  3. i and ii only
  4. i, ii, iii and iv
  5. Only lii

Answer(s): C

Explanation:

A core dump file is essentially a snapshot of the process's memory at the time of the crash. This snapshot includes crucial information that can help diagnose the cause of the crash. Here's why all the options are relevant:

i. Program Counter: This register stores the address of the next instruction the CPU was supposed to execute. It pinpoints exactly where in the code the crash occurred.

ii. Stack Pointer: This register points to the top of the call stack, which shows the sequence of function calls that led to the crash. This helps trace the program's execution flow before the crash.

iii. Memory management information: This includes details about the process's memory allocations, which can reveal issues like memory leaks or invalid memory access attempts.

iv. Other Processor and OS flags/information: This encompasses various registers and system information that provide context about the state of the processor and operating system at the time of the crash.

By analyzing this information within the core dump, you can often identify the root cause of the crash, such as a segmentation fault, null pointer dereference, or stack overflow.

Check Point Troubleshooting


Reference:

While core dumps are a general concept in operating systems, Check Point's documentation touches upon them in the context of troubleshooting specific processes like fwd (firewall) or cpd (Check Point daemon). The fw ctl zdebug command, for example, can be used to trigger a core dump of the fwd process for debugging purposes.



Where will the usermode core files located?

  1. $FWDIRVar/log/dump/usermode
  2. /var/suroot
  3. /var/log/dump/usermode
  4. $CPDIR/var/log/dump/usermode

Answer(s): D

Explanation:

Usermode core files are generated when a user mode process crashes. They are located in the $CPDIR/var/log/dump/usermode directory on the Security Gateway or Security Management server. The core files can be used to analyze the cause of the crash and troubleshoot the issue. The core files are named according to the process name, date, and time of the crash. For example, cpd_2023_02_03_16_40_55.core is a core file for the cpd process that crashed on February 3, 2023 at 16:40:55



What is the function of the Core Dump Manager utility?

  1. To determine which process is slowing down the system
  2. To send crash information to an external analyzer
  3. To limit the number of core dump files per process as well as the total amount of disk space used by core files
  4. To generate a new core dump for analysis

Answer(s): C

Explanation:

The Core Dump Manager (CDM) is a utility that helps manage core dump files on Check Point systems. Its main functions include:

Limiting file size and number: CDM can be configured to limit the size of individual core dump files and the total amount of disk space used for core dumps. This prevents core dumps from filling up valuable disk space.

Compression: CDM can compress core dump files to reduce their storage size. This is particularly helpful when dealing with large core dumps.

Process filtering: CDM allows you to specify which processes should be allowed to generate core dumps. This can help prevent unnecessary core dumps from being created.

Remote collection: CDM can be configured to send core dump files to a remote server for analysis. This is useful in environments where direct access to the system generating the core dump is limited.

By using CDM, you can effectively manage core dump files and ensure that they are not overwhelming your system's resources.






Post your Comments and Discuss Checkpoint 156-587 exam with other Community members: