Latest 156-836 Exam Questions

A.   orchd restart

Answer DescriptionExplanation:

Page 313 from the training manual:

- Restart the service:
orchd restart

- Restart the service without confirmation

service orchd restart

B.   Maestro Hyperscale Orchestrator (MHO)

Answer DescriptionExplanation:

•The Quantum Maestro Orchestrator uses the Distribution Mode to assign incoming traffic to Security Group Members.
•Reference: Working with the Distribution Mode

D.   Port 1 in Slot 1 and Port 2 in Slot 1

Answer DescriptionExplanation:

This configuration likely provides balanced and redundant connectivity for orchestrator redundancy.

References

•Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 3: Dual Orchestrator Environment, Lesson 3.1: Introduction to Dual Orchestrator Environment, page 3-7
•Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section: Downlinks, page 3-8
•Check Point 23800 Appliance Datasheet - Check Point Software, page 2

B.   Show all devices discovered by LLDP protocol on all ports

Answer DescriptionExplanation:

The lldpctl command is a tool to display information about the devices discovered by the Link Layer Discovery Protocol (LLDP) on all ports of the Maestro Orchestrator and the Security Group Members. LLDP is a protocol that enables devices to exchange information about their identity, capabilities, and configuration. LLDP can help to discover the topology and connectivity of the Maestro environment.

References

•Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.2: LLDP, page 4-9
•Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section: LLDP, page 3-9

A.   No licenses are required for Orchestrator

Answer DescriptionExplanation:

Orchestrators in many network environments do not require separate licenses, as they primarily function to manage and distribute network traffic.

References

•Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 1: Introduction to Check Point Maestro, Lesson 1.2: Maestro Licensing, page 1-8
•Check Point R81 Maestro Administration Guide, Chapter 1: Introduction to Check Point Maestro, Section: Maestro Licensing, page 1-6
•Activation of a Quantum Maestro Orchestrator - Check Point Software

C.   The MHO does not require a license.

Answer DescriptionExplanation:

The MHO (Maestro Hyperscale Orchestrator) does not require a license by itself, but each SGM (Security Group Module) that is attached to the MHO needs a license. The license type depends on the features and blades that are enabled on the SGM. For example, if the SGM is running VSX, it needs a VSX license.

References:

•Maestro Expert (CCME) Course - Check Point Software, page 71
•Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline

C.   asg perf -v

Answer DescriptionExplanation:

The asg perf -v command is used to find bottlenecks in the system that are affecting performance, even functionality in some cases. The asg perf -v command displays the performance statistics of the Security Group Modules (SGMs) in the Security Group, such as throughput, packet rate, CPU utilization, memory usage, and more. The asg perf -v command also shows the distribution mode and the correction rate of each SGM, which can indicate potential issues with asymmetric routing or load balancing. The asg perf -v command can help identify which SGMs are overloaded, underutilized, or misconfigured, and provide insights for troubleshooting and optimization.

References =

•Check Point Maestro R81.X Administration Guide, page 67, section “asg perf” 1
•Check Point Maestro R81.X Getting Started Guide, page 29, section “asg perf” 2
•Check Point Maestro Under the Hood presentation by Lari Luoma, slide 26
1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frameset.htm
https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20Maestro%20under%20the%20hood%202022.pptx

A.   The next SGM with the current lowest SGM ID assumes the role of the SMO Master.

Answer DescriptionExplanation:

This aligns with the principle of redundancy in network systems, where the next available device with the lowest ID typically takes over management roles in case of a failure.

References:

•Maestro Expert (CCME) Course - Check Point Software, page 91
•Check Point Certified Maestro Expert (CCME) R81.X - Global Knowledge, course outline

A.   Load Sharing Active / Active

Answer DescriptionExplanation:

A Security Group can be compared to a Load Sharing Active / Active cluster because it consists of multiple Security Group Members that share the traffic load and provide high availability and scalability. Each Security Group Member is an active firewall that processes traffic according to the Security Group policy and synchronizes its state with other members. The Maestro Orchestrator acts as a load balancer that distributes the traffic among the Security Group Members based on their capacity and availability.

B.   Correction Layer is a mechanism which handles asymmetric connections in multi-appliance system. For example, in case of NAT

Answer DescriptionExplanation:

The Correction Layer is a Maestro component that ensures that packets from the same connection are handled by the same Security Group Module (SGM) in a multi-appliance system. This is especially important when NAT is involved, as packets sent from the client to the server can be distributed to a different SGM than packets from the same session sent from the server to the client. The Correction Layer must then forward the packet to the correct SGM.