Checkpoint Updated 156-836 Exam Questions and Answers by cecilia

In a Check Point Maestro environment, a splitter is used to divide a single high-speed port (e.g., QSFP or QSFP28) into multiple lower-speed ports (e.g., SFP or SFP+). However, a splitter cannot be used to connect a single port on an Orchestrator to the same Appliance, as this would not align with the purpose of a splitter, which is to expand connectivity to multiple devices or ports, not to loop back to a single device.

Exact Extract:

“A splitter is used to divide a single high-speed port on the Orchestrator (e.g., QSFP or QSFP28) into multiple lower-speed ports (e.g., SFP or SFP+). Splitters are typically used to connect a single Orchestrator port to multiple ports on an external switch or to multiple Appliances. However, a splitter cannot be used to connect a single Orchestrator port to the same Appliance, as this does not align with the splitter’s purpose of expanding connectivity.”

—Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 3: Dual Orchestrator Environment, Lesson 3.2: Connectivity Options, page 3-10

—Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section: Connectivity, page 3-10

Explanation of Options:

A. To connect a single port on an Orchestrator to the same Appliance: Correct, as a splitter is not designed for this purpose and cannot be used to connect an Orchestrator port to a single Appliance.

B. To connect a single port on an Orchestrator to multiple ports on an external switch: Incorrect, as this is a valid use case for a splitter.

C. To connect a single port on an Appliance to multiple ports on the Orchestrator: Incorrect, as splitters can be used in configurations where an Appliance connects to multipleOrchestrator ports.

D. To connect a single port on an Orchestrator to multiple Appliances: Incorrect, as this is another valid use case for a splitter.

The asg diag command is used for system diagnostics on both Maestro and Chassis systems. The asg diag command can perform various tests and checks on the system components, such as hardware, software, network, clock, ARP, and more. The asg diag command can help identify and troubleshoot any issues or errors that may affect the system functionality or performance.

References =

•Check Point Maestro R81.X Administration Guide, page 66, section “asg diag” 1

•Check Point Maestro R81.X Getting Started Guide, page 28, section “asg diag” 2

•Check Point Maestro Under the Hood presentation by Lari Luoma, slide 25

1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frameset.htm : https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20Maestro%20under%20the%20hood%202022.pptx

This is the correct answer because Layer 4 distribution is not recommended when dynamic routing protocols are used in Maestro. Layer 4 distribution is a feature that adds the source and/or destination ports to the distribution equation, which can improve the load balancing among the SGMs. However, it can also cause issues with the correction layer, which is a mechanism that ensures the packets are processed by the correct SGM. Dynamic routing protocols, such as BGP or OSPF, use specific ports to exchange routing information and establish neighbor relationships. If Layer 4 distribution is enabled, it can interfere with the routing protocol packets and cause routing instability or failures.

References

•Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 2: Maestro Security Groups, Lesson 2.4: Traffic Flow, page 2-20

•Check Point R81 Maestro Administration Guide, Chapter 2: Maestro Security Groups, Section: Traffic Distribution, page 2-8

•Layer 4 Distribution - Yes or No? - Check Point CheckMates

•Support, Support Requests, Training … - Check Point Software

This command is used to set the number of sites in a Maestro environment, which can be either one or two. The number of sites determines the site-sync configuration and the failover policies for the Security Groups and the Security Group Members. The default value is one, and it can be changed only before the first Security Group is created.

References =

•Maestro basic setup documentation - Page 2 - Check Point CheckMates

•Check Point R81.10 for Scalable Platforms - Check Point Software

•CHECK POINT MAESTRO EXPERT