We're so confident of our products that we provide no hassle product exchange.
CheckPoint 156-581 Exam Overview:
| Certification Vendor: | Check Point |
| Exam Name: | Check Point Certified Troubleshooting Administrator - R81 |
| Exam Number: | 156-581 |
| Related Certifications: | Check Point Certified Security Administrator (CCSA) R81 Check Point Certified Security Expert (CCSE) R81 |
| Exam Duration: | 90 minutes |
| Real Exam Qty: | 75-90 |
| Available Languages: | English |
| Passing Score: | 70% |
| Exam Format: | Multiple-choice, Scenario-based |
| Exam Price: | $250 USD |
| Certificate Validity Period: | 2 years |
| Recommended Training: | Check Point Troubleshooting Guide CCTA R81 Official Training |
| Exam Registration: | Pearson VUE Registration Check Point Certification Portal |
| Sample Questions: | CheckPoint 156-581 Sample Questions |
| Exam Way: | Online proctored or onsite at Pearson VUE test centers |
| Pre Condition: | Valid CCSA R80/R81 certification or equivalent hands-on experience; basic networking knowledge |
| Official Syllabus URL: | https://training.checkpoint.com/certification/exam/156-581 |
CheckPoint 156-581 Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Software Blades & Security Features | 20% | - Threat Prevention troubleshooting - Content Awareness issues - Logging & reporting problems - Application Control & URL Filtering |
| VPN & High Availability | 15% | - Redundancy & failover issues - Site-to-Site VPN connectivity - ClusterXL status & synchronization |
| Troubleshooting Fundamentals & Tools | 20% | - OSI model for problem isolation - Command-line utilities (fw monitor, tcpdump, fw ctl) - Log analysis and debug procedures - Gaia OS system monitoring |
| Traffic Flow & Access Control | 25% | - HTTPS Inspection problems - NAT configuration & resolution - Packet flow inspection & path analysis - Access Control Policy issues |
| Security Management & SmartConsole | 20% | - Communication between SMS and Gateways - License & contract troubleshooting - SmartConsole login & authentication issues - Policy installation failures |
CheckPoint Check Point Certified Troubleshooting Administrator - R81 Sample Questions:
1. Which if the following is NOT an account user classification?
A) Manager
B) Viewer
C) Administrator
D) Licensers
2. If you run the command "fw monitor -e "accept src.10.1.1.101 or src=172.21.201.10 or src=192.0.2.11 from the Cli.sh.
What will be captured?
A) fw monitor only works in expert mode so no packets will be captured
B) Packets from 10 1.1.201 going to 192.0.2.10
C) Packets destined to 172.21.101.10 from 10.1.1.101
D) Only packet going to 192.0.2.10
3. Is it possible to analyze ICMP packets with tcpdump?
A) Yes, tcpdump is not limited to tcp specific issues
B) No, use fw monitor instead
C) No, tcpdump works from layer 4. ICMP is located in the network layer (layer 3), therefore is not applicable to this scenario
D) No, since ICMP does not have any source or destination ports, but specification of port numbers is mandatory
4. Some users from your organization have been reporting some connection problems with CIFS since this morning. You suspect an IPS issue after an automatic IPS update last night. So you want to perform a packet capture on uppercase I only directly after the IPS chain module (position
4 in the chain) to check if the packets pass the IPS. What command do you need to run?
A) fw monitor -pI asm <filterexpression>
B) fw monitor -mI -pI 5 -e <filterexperession>
C) fw monitor -pi 5 -e <filterexpression>
D) tcpdump -eni any <fitterexpression>
5. How would you check the connection status of a gateway to the Log server?
A) run netstat -anp I grep :18187 in expert mode on Log server
B) run netstat -anp I grep :18187 in CLISH on Log server
C) run netstat -anp I grep :257 in expert mode on Log server
D) run netstat -anp I grep :257 in CLISH on Log server
Solutions:
| Question # 1 Answer: A | Question # 2 Answer: A | Question # 3 Answer: D | Question # 4 Answer: B | Question # 5 Answer: C |
By Nat
