156-585

156-585 practice questions, page 3 of 3, with answer review and explanations.

Question 11

During firewall kernel debug with fw ctl zdebug you received less information that expected. You noticed that a lot of messages were lost since the time the debug was started. What should you do to resolve this issue?

  1. Increase debug buffer; Use fw ctl debug -buf 32768
  2. Redirect debug output file; Use fw ctl zdebug -o ./debug.elg
  3. Increase debug buffer; Use fw ctl zdebug -buf 32768
  4. Redirect debug output file; Use fw ctl debug -o ./debug.elg

Question 12

Where do Protocol parsers register themselves for IPS?

  1. Passive Streaming Library
  2. Other handlers register to Protocol parser
  3. Protections database
  4. Context Management Infrastructure

Question 13

Which command can be run in Expert mode to verify the core dump settings?

  1. grep cdm /config/db/coredump
  2. grep cdm /config/db/initial
  3. grep $FWDIR/config/db/initial
  4. cat /etc/sysconfig/coredump/cdm.conf

Question 14

The two procedures available for debugging in the firewall kernel are: i. fw ctl zdebug ii. fw ctl debug/kdebug Choose the correct statement explaining the difference in the two.

  1. (i) Is used for general debugging, has a small buffer and is a quick way to set kernel debug flags to get an output via command line whereas (ii) is useful when there is a need for detailed debugging and requires additional steps to set the buffer and get an output via command line
  2. (i) is used to debug the access control policy only, however (ii) can be used to debug a unified policy
  3. (i) is used to debug only issues related to dropping traffic, however (ii) can be used for any firewall issue including NATing, clustering etc.
  4. (i) is used on a Security Gateway, whereas (ii) is used on a Security Management Server

Question 15

If the cpsemd process of SmartEvent has crashed or is having trouble to coming up, then it usually indicates that _______________.

  1. Postgres database is down
  2. Cpd daemon is unable to connect to the log server
  3. The SmartEvent core on the Solr indexer has been deleted
  4. The logged in administrator does not have permissions to run SmartEvent