Free 156-551 sample questions

Correct answer: cphaprob syncstat

The Expert-mode command 'cphaprob syncstat' (Gaia Clish: 'show cluster statistics sync') shows the Delta Sync transport statistics (sent/received updates, lost/retransmitted packets, queue sizes), and 'cphaprob -reset syncstat' resets them (R81.10 ClusterXL Admin Guide). vsx_util has no sync sub-command; 'cphaprob -a if' shows interfaces and 'fw ctl multik stat' shows CoreXL instances.

Correct answer: A Virtual Router with a Warp Link connected to each Virtual System.

To achieve Layer 3 routing between Virtual Systems within a single VSX Gateway, a Virtual Router (VR) is required. Each Virtual System then connects to this VR using a special virtual interface called a Warp Link. The VR handles the routing decisions to forward traffic between the networks associated with each VS. A Virtual Switch provides only Layer 2 connectivity. A shared physical interface or bridge mode are not used for this type of internal routing.

Correct answers: A new Virtual System object.; A VLAN interface on eth3 with VLAN tag 200 (eth3.200) in the new Virtual System's topology.

You need a Virtual System object (the new virtual firewall). In its Topology you add a Regular interface on eth3 with VLAN Tag 200 (VSX names it eth3.200). For more than one VLAN or Virtual System on the same port, eth3 is marked as a VLAN Trunk on the VSX Gateway object's Physical Interfaces page. A Bond, a Virtual Router or a Virtual Switch is not required for this scenario.

You need a Virtual System object (the new virtual firewall). In its Topology you add a Regular interface on eth3 with VLAN Tag 200 (VSX names it eth3.200). For more than one VLAN or Virtual System on the same port, eth3 is marked as a VLAN Trunk on the VSX Gateway object's Physical Interfaces page. A Bond, a Virtual Router or a Virtual Switch is not required for this scenario.

Correct answer: cpconfig

`cpconfig` is the primary command-line, menu-driven utility for initial and fundamental configuration of a Check Point gateway, including a VSX Gateway. It allows an administrator to enable or disable features like ClusterXL and CoreXL, and to set the number of firewall kernel instances for CoreXL. The other commands are used for different specific tasks: `vsx_util` for VSX maintenance, `fwaccel` for SecureXL, and `cphaconf` for clustering.

Correct answer: Convert the cluster to Virtual System Load Sharing with vsx_util convert_cluster, then use vsx_util vsls to make member B the Active member (priority 0) for VS_Trading while the other Virtual Systems remain Active on member A.

In a VSLS cluster each Virtual System is Active on exactly one member at a time (a single VS is not split across members). Load is spread by making different Virtual Systems Active on different members. A cluster that was upgraded to R81.10 in High Availability mode is converted with 'vsx_util convert_cluster' (after enabling Per Virtual System State and ClusterXL for Bridge Active/Standby in cpconfig on each member), and 'vsx_util vsls' option 'Manually set priority and weight' then sets priority 0 (Active) on member B for VS_Trading while the other Virtual Systems keep priority 0 on member A and priority 1 (Standby) on member B, so they still have an Active/Standby peer. There is no 'Per-VS High Availability' mixed mode; in High Availability mode all VSs are Active on the same member. (R81.10 VSX Administration Guide p161-162, p187-188, p192, p201)

Correct answer: False

A Virtual Switch (VSW) operates at Layer 2 of the OSI model, just like a physical Ethernet switch. Its purpose is to forward frames between connected interfaces within the same broadcast domain. It does not have the capability to inspect IP headers and make Layer 3 routing decisions. For inter-VLAN or inter-subnet routing, a Virtual Router is required.

Correct answer: vsenv

In the Expert mode, 'vsenv [ | ]' changes the shell context to the specified Virtual Device (no argument = VS0); the prompt then shows the context, e.g. [Expert@GW:4]#. 'set virtual-system ' is the equivalent in Gaia Clish, not in the Expert shell (R81.10 VSX Admin Guide).

Correct answer: On member C, VS_Web was in the Backup state, which has the latest configuration and policy but does not receive state table synchronization.

VSLS adds a Backup state to the Active and Standby states. The Standby peer (priority 1) is state-synchronized with the Active peer and can take over without losing connections, but a Backup peer (priority 2 and lower) has only the latest configuration and policy and does not receive state table synchronization until a failover makes it Standby. If the Active and Standby peers fail together, the Backup becomes Active without the connection table, so existing connections are lost. (R81.10 VSX Administration Guide p192-194)

Correct answer: Edit the VS_CORP object, go to Topology, click New > Regular and select eth2.

In R81.10 you open the Virtual System object, go to Topology, and in the Interfaces section click New > Regular. Then select the physical interface (eth2) and configure its IP address and topology. Clicking OK pushes the VSX configuration, and then you install the Access Control Policy on the Virtual System. The VSX Gateway object's Physical Interfaces page only lists the physical interfaces and marks VLAN trunks.

Correct answer: To connect a Virtual System to a Virtual Router for inter-VS routing.

A Warp Link is a virtual point-to-point connection between a Virtual System and a Virtual Router or Virtual Switch. The interface on the Virtual System side gets the prefix wrp and the interface on the Virtual Router / Virtual Switch side gets the prefix wrpj, followed by a unique number. When a Virtual System connects to a Virtual Router through a Warp Link, the Virtual Router can route traffic between that Virtual System and other Virtual Systems or a shared (for example, Internet-facing) interface. Warp Links are not used for cluster synchronization and do not connect a Virtual System directly to a physical interface. (R81.10 VSX Administration Guide, Warp Links / Virtual Routers)