exam questions

Exam 156-585 All Questions

View all questions & answers for the 156-585 exam

Exam 156-585 topic 1 question 24 discussion

Actual exam question from Checkpoint's 156-585
Question #: 24
Topic #: 1
[All 156-585 Questions]

How many captures does the command “fw monitor -p all” take?

  • A. All 15 of the inbound and outbound modules
  • B. All 4 points of the VM modules
  • C. 1 from every inbound and outbound module of the chain
  • D. The -p option takes the same number of captures, but gathers all of the data packet
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
sx89andjey
2 months ago
Selected Answer: C
Capture everything on all Check Point kernel chains: fw monitor -p all
upvoted 1 times
...
jrugel
2 months ago
I consider the correct answer C. The sk30583 describes the parameter for chain positions and includes "-p All." "Especially when using "-p all" switch, you will find the same packet captured multiples times at different chain positions" With this text, confirm that only one packet is captured over each chain.
upvoted 1 times
...
crisjohn
1 year, 5 months ago
the question is a bit ambiguous and leaves the option of interpretation that could also be A, but reading the SK carefully, I lean more towards C. C is the best answer // Sk30583 What is FW Monitor? -pi position -pI position -po position -pO position -p all Inserts FW Monitor chain module at a specific position between Check Point kernel chains. //
upvoted 2 times
...
nmrouter
1 year, 6 months ago
Selected Answer: A
It should be A. It captures packets at every chain module.
upvoted 1 times
...
Samooj
1 year, 11 months ago
Selected Answer: C
the answer is C
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago