Checkpoint Updated 156-587 Exam Questions and Answers by juliette

 Dynamic log distribution is a feature that allows the Security Gateway to distribute logs between the active Log Servers, instead of sending a copy of every log to each Log Server. This feature was introduced in Check Point R81.10 version, and it requires boththe Management and the Gateways to be at least on version R81.10 for this to be supported12. With dynamic log distribution, the Gateway can optimize the disk space usage and network bandwidth consumption of the Log Servers, and also improve theperformance and reliability of the logging system3. References: Dynamic logs distribution - Check Point CheckMates1, (CCTE) - Check Point Software2, SmartLog and SmartEvent R81.10 Administration Guide3

1: https://community.checkpoint.com/t5/Management/Dynamic-logs-distribution/td-p/142732  2: https://www.checkpoint.com/downloads/training/DOC-Training-Data-Sheet-CCTE-R81.10-V1.0.pdf  3: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_LoggingAndMonitoring_AdminGuide/html_frameset.htm

The correct directory where an administrator can find vpn debug log files generated during Site-to-Site VPN troubleshooting is $FWDIR/log/. This directory contains the following files related to vpn debug:

vpnd.elg: This file contains the high-level VPN debug information, such as the VPN tunnel establishment, deletion, and negotiation messages. It can be enabled by using thevpn debug oncommand on the Security Gateway CLI.

legacy_ike.elg: This file contains the low-level IKE debug information for IKEv1, such as the IKE packets, encryption, decryption, and authentication. It can be enabled by using thevpn debug ikeoncommand on the Security Gateway CLI.

legacy_ikev2.xml: This file contains the low-level IKE debug information for IKEv2, such as the IKE packets, encryption, decryption, and authentication. It can be enabled by using thevpn debug ikev2oncommand on the Security Gateway CLI.

These files can be viewed by using thevpn debug viewcommand on the Security Gateway CLI, or by using theIKEViewtool on the Security Management Server GUI.

CMI stands for Context Management Infrastructure, which is a component of the Access Control Policy that enables the Security Gateway to inspect traffic based on the context of the connection. Context includes information such as user identity, application, location, time, and device. CMI allows the Security Gateway to apply different security rules and actions based on the context of the traffic, and to dynamically update the context as it changes. CMI consists of three main elements: Unified Policy, Identity Awareness, and Content Awareness.