Free 156-836 sample questions

Correct answer: Latency between the Layer 2 switches on different sites must be lower than 100 ms, and packet loss lower than 5%.

The Quantum Maestro Getting Started Guide (Dual Site with switches) requires: 'Latency between the Layer 2 switches on different sites must be lower than 100ms' and 'Packet lost between the Layer 2 switches on different sites must be lower than 5%.' The sites synchronize both connections and configuration, so the inter-site path matters. Direct connection between sites is the best practice; the switch-based designs carry the Site Sync VLANs (default 3600/3601).

Correct answer: asg perf -v

"asg perf -v" adds a "Per SGM Distribution Summary" to the continuously updated asg perf view. The summary shows each Security Group Member's throughput, packet rate, connection rate, concurrent connections, core loads and memory usage, which makes a connection or load imbalance between members visible. "cphaprob stat" is not the Maestro tool for this. "asg stat -i tasks" shows which member runs the SMO and the other tasks. "asg monitor" continuously shows the same member and component status as "asg stat".

Correct answer: Stop the Orchestrator service (`orchd stop`) and revert the Gaia snapshot that the upgrade created automatically (`set snapshot revert`).

The R81.10 guide has a procedure titled "Rolling Back a Failed Upgrade of a Maestro Orchestrator". It reverts the Orchestrator to its pre-upgrade configuration: Gaia settings, Security Group topology and physical port configuration. Work on one Orchestrator at a time. In Expert mode, stop the Orchestrator service with "orchd stop". Then, in Gaia Clish, restore the Gaia snapshot created automatically during the upgrade with "set snapshot revert". The Orchestrator reboots and reverts. After that, align date and time with the other Orchestrators and verify connectivity. Both Orchestrators then run the same version again, which is required. Rebooting, continuing the upgrade on the other Orchestrator, or copying files by SCP does not restore a consistent state.

Correct answer: False

False. The Security Group has one management IP address, but all Security Appliances in the Security Group use this IPv4 address as their Gaia management IP address; it is not a virtual IP that moves to the SMO Master. The SMO Master (the Active Security Group Member with the lowest ID) handles the management tasks, such as policy installation and logging, and updates the other members.

Correct answers: Layer 4 distribution is enabled by default in a new Security Group.; With Layer 4 distribution enabled, User (Internal) mode assigns packets based on the Source Port and the Destination IP address.

R81.10 Admin Guide, Working with the Distribution Mode: "The default mode is Auto-Topology (Per-Port) and the Layer 4 distribution is enabled." With Layer 4 distribution enabled, User (Internal) mode assigns packets by Source Port + Destination IP, Network (External) mode by Source IP + Destination Port, and General mode by Source IP, Source Port, Destination IP and Destination Port. You enable or disable it in gClish with `set distribution l4-mode {enabled|disabled}` and check it with `show distribution l4-mode`. Maestro has no payload-offset (user-defined) distribution and no `asg_user_distribution` or `g_asg_distribution_gslb_by_ip` command.

R81.10 Admin Guide, Working with the Distribution Mode: "The default mode is Auto-Topology (Per-Port) and the Layer 4 distribution is enabled." With Layer 4 distribution enabled, User (Internal) mode assigns packets by Source Port + Destination IP, Network (External) mode by Source IP + Destination Port, and General mode by Source IP, Source Port, Destination IP and Destination Port. You enable or disable it in gClish with `set distribution l4-mode {enabled|disabled}` and check it with `show distribution l4-mode`. Maestro has no payload-offset (user-defined) distribution and no `asg_user_distribution` or `g_asg_distribution_gslb_by_ip` command.

Correct answer: Connect to the new Security Group (its SMO) and run `asg_cp2blades /path/to/script` in Gaia gClish or Expert mode

There is no `asg_file` or `asg_cp2all` command in Quantum Maestro. The documented tool is `asg_cp2blades [-b ] [-r] [-s] [ ]`, run in Gaia gClish or Expert mode on a Security Group Member. It copies a file from the current SGM to the other SGMs; with no `-b` (or `-b all`) it targets all SGMs of that Security Group on all Maestro Sites. Each Security Group is a separate gateway, so running it on Security Group the new group copies the file only to that group's SGMs. The command does not run on the Orchestrator, `update_conf_file` only edits parameters in configuration files such as fwkern.conf, and `asg_config save` only saves the gClish configuration.

Correct answer: The Mgmt1 interface was not set to state on (`set interface Mgmt1 state on`) with a default route and `save config`; Orchestrators up to R81.20 have no First Time Configuration Wizard.

On Maestro Orchestrators R80.20SP - R81.20 there is no Gaia First Time Configuration Wizard, and Orchestrators do not need a license. The Getting Started Guide procedure is: connect to the MGMT port (default 192.168.1.1, admin/admin) or the console, activate the Orchestrator (enter "y"; this enables the Downlink and Uplink ports), then in Gaia Clish run `set interface Mgmt1 ipv4-address mask-length `, `set interface Mgmt1 state on`, `set static-route default nexthop gateway address on` and `save config`. Only then is Gaia Portal reachable at https:// . If the port is not set to state on (or no route/save), the WebUI is unreachable even though an IP was assigned.

Correct answers: High availability for the orchestration and distribution plane.; Ability to upgrade or patch one Orchestrator at a time while the other Orchestrator keeps distributing traffic.; Redundancy for the physical downlink connections to the SGMs.

Two Orchestrators on the same site work together Active/Active: each Security Appliance is cabled to both Orchestrators, and Uplink and Management interfaces are configured as Bond interfaces across both, so the failure of one Orchestrator or one downlink cable does not stop traffic distribution. Orchestrators are upgraded or patched one at a time (a Jumbo Hotfix stops traffic processing only on the Orchestrator being updated). A second Orchestrator does not change SGM licensing (Orchestrators need no license), and Security Group management tasks run on the SMO, not on the Orchestrators.

Two Orchestrators on the same site work together Active/Active: each Security Appliance is cabled to both Orchestrators, and Uplink and Management interfaces are configured as Bond interfaces across both, so the failure of one Orchestrator or one downlink cable does not stop traffic distribution. Orchestrators are upgraded or patched one at a time (a Jumbo Hotfix stops traffic processing only on the Orchestrator being updated). A second Orchestrator does not change SGM licensing (Orchestrators need no license), and Security Group management tasks run on the SMO, not on the Orchestrators.

Two Orchestrators on the same site work together Active/Active: each Security Appliance is cabled to both Orchestrators, and Uplink and Management interfaces are configured as Bond interfaces across both, so the failure of one Orchestrator or one downlink cable does not stop traffic distribution. Orchestrators are upgraded or patched one at a time (a Jumbo Hotfix stops traffic processing only on the Orchestrator being updated). A second Orchestrator does not change SGM licensing (Orchestrators need no license), and Security Group management tasks run on the SMO, not on the Orchestrators.

Correct answer: `show smo verifiers report`

In Quantum Maestro R81.10, the built-in diagnostic tests are run with the "smo verifiers" commands in Gaia gClish on the Security Group. `show smo verifiers report` runs all tests (for example System Health = asg stat -v, Resources = asg resource, SSD Health = asg resource --ssd, Policy = asg policy verify -a, Licenses = asg_license_verifier -v, Bond, ARP Consistency, Core Dumps) and shows a Passed/Failed summary with a Reason column and the output file. `show smo verifiers print` shows the full output, and `report name ` / `report id ` run specific tests. There is no `asg diag --chassis/--blades`, `g_asg_diag` or `asg test` command.

Correct answer: Only the System component status, refreshed continuously (the same information as asg stat)

"asg monitor" continuously shows the same information as "asg stat", refreshed at an interval. The "-v" parameter shows only the System component status, and "-all" shows both the Security Group Member and System component status. The command does not trace packets, show distribution hashes, or capture traffic. To find which member handles a connection, use "asg search". To capture traffic, use "tcpdump -mcap".