Selected 156-587 CCTE Questions Answers

The Unified Policy is a feature that allows you to create a single policy layer that combines the functionality of Access Control, Threat Prevention, and HTTPS Inspection12. To debug the Unified Policy, you need to use the command fw ctl debug with the module name UP and the flag all or specific flags for different aspects of the Unified Policy inspection34. The possible flags for the Unified Policy module are:

up_match: Shows the matching process of the Unified Policy rules.

up_inspect: Shows the inspection process of the Unified Policy rules.

up_action: Shows the action process of the Unified Policy rules.

up_log: Shows the logging process of the Unified Policy rules.

up_tls: Shows the TLS inspection process of the Unified Policy rules.

up_clob: Shows the CLOB (Content Limitation and Optimization Blade) inspection process of the Unified Policy rules.

up_rulebase: Shows the rulebase loading process of the Unified Policy rules.

up_connection: Shows the connection tracking process of the Unified Policy rules.

The flag tls is not a valid flag for the Unified Policy module, as it is used for the TLS Inspection module5. Therefore, the correct answer is A. tls. The other options are valid flags for the Unified Policy module, as explained above34. References:

1: CCTE Courseware, Module 8: Advanced Access Control, Slide 7

2: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 5: Unified Policy, Page 29

3: CCTE Courseware, Module 8: Advanced Access Control, Slide 17

4: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 5: Unified Policy, Page 32

5: Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 6: TLS Inspection, Page 36

The Resource Application Daemon (RAD) is a critical component in Check Point’s Application Control and URL Filtering blades, responsible for processing and categorizing web traffic. The configuration file $FWDIR/conf/rad_settings.C on the Security Gateway defines settings related to RAD’s operation.

Option A: Incorrect. The rad_settings.C file does not store entitlement information for Application Control or URL Filtering. Entitlements are managed by the Security Management Server and stored in licensing databases, not in this file.

Option B: Incorrect. The rad_settings.C file does not specify how the Security Gateway communicates with the Security Management Server’s RAD service. Communication settings are typically handled by SIC (Secure Internal Communication) and other configuration files, such as $FWDIR/conf/fwopsec.conf.

Option C: Correct. The rad_settings.C file contains proxy settings for the RAD daemon, such as HTTP proxy configurations used for accessing external services (e.g., Check Point’s online URL Filtering database). This is critical when the Gateway requires a proxy to reach external resources for URL categorization.

Option D: Incorrect. Hostname settings for the online application detection engine are not stored in rad_settings.C. These are typically managed by the Application Database (application_db.C) or resolved via DNS.