156-587 Sample Questions & Answers

The correct command to set the kernel debug buffer size is fw ctl debug -buf . The fw ctl zdebug command is used to clear the buffer and view its contents, not to configure its size. The other options use incorrect syntax or commands.

This statement is false. The Policy Decision Point (pdp) process is responsible for acquiring identities and making policy decisions, and it runs on the Security Management Server or a dedicated Identity Collector. The Policy Enforcement Point (pep) daemon runs on the Security Gateway and is responsible for enforcing the decisions made by the PDP.

The vpn shell utility provides an interactive mode for advanced VPN troubleshooting. Within this shell, the tunnels all command provides detailed information about all active tunnels, including their DPD status, timers, and sequence numbers. This is the most direct and comprehensive way to investigate DPD behavior. vpn tu is a TUI tool for basic tunnel management, fw ctl vpn iflist lists VPN-related kernel interfaces, and cpstat vpn -f all gives general status but not detailed DPD timers.

In the gateway object's properties under 'Logs', there is a setting to 'Forward logs to Log Server'. Advanced options for this setting allow the gateway to start logging locally if the connection to the log server is lost or if the logging rate exceeds the connection's capacity. Even with stable connectivity, a very high log rate can trigger this local logging behavior, causing fw.log to be created and grow. This is the most common reason for unexpected local logging when a remote Log Server is configured.

fw monitor is the only standard tool that can show both kernel debug information and the packet data itself, across all inspection points (i, I, o, O). To see the unencrypted payload of HTTPS traffic, HTTPS Inspection must be enabled for that traffic flow. The -p all flag ensures fw monitor shows the packet data at every stage. This combination allows the consultant to see the decrypted application data and correlate it directly with kernel debug messages for NAT, routing, and policy decisions, providing a complete picture of the traffic flow.

The root cause of the high CPU on 'fwk' processes is the immense logging overhead from a high-connection-rate application. Each new connection must be processed by a Firewall Worker to generate a log, which consumes significant CPU resources. By changing the tracking option to 'None', the logging requirement is removed for new connections. This allows SecureXL to handle the connection setup (templating) without passing each one to a 'fwk' process, drastically reducing CPU load. While adding SGMs or creating custom applications are plausible actions, they don't address the core issue of logging overhead, which is the most immediate and effective problem to solve.

In the context of the fw monitor chain, the lowercase letters (i, o) represent inspection points before the Virtual Machine (firewall kernel) makes a forwarding decision. The uppercase letters (I, O) represent inspection points after the forwarding decision, just before the packet is sent to the network driver. 'VMAC' refers to the virtual MAC address used by the firewall kernel. Therefore, 'o' is before this stage, and 'O' is after, showing the packet as it is about to leave the gateway's OS.

The error points to a TCP connectivity failure despite the process listening. This suggests something is blocking the connection. Since the gateway's own firewall policy could be blocking the connection from the management server, the most logical step is to check for drops at the kernel level. Running a kernel debug (fw ctl zdebug) during the policy push attempt will reveal if the gateway's own security policy is dropping the incoming SIC connection on port 18191 from the management server, a common cause for this specific error.

The rad_admin utility is the correct tool for managing and debugging the Application Control and URL Filtering daemons (rad). The command rad_admin debug all sets the debug level for all rad components to the highest level, which includes the appscan daemon. The output is typically written to $FWDIR/log/rad_messages. The other commands are for different daemons or are syntactically incorrect.

This statement is false. CPView has a history mode that allows administrators to view performance data from the past. The utility collects and stores data at regular intervals, which can be accessed to troubleshoot issues that occurred previously. This is a critical feature for forensic analysis of performance problems.