nerdexam
Check_Point

156-215.80 · Question #538

You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which g

The correct answer is D. Open SmartLog and filter for the IP address of the tablet. SmartLog is the correct Check Point tool for reviewing security logs, and filtering by the tablet's IP address directly targets the relevant traffic to identify the blocking cause.

Security Gateway Troubleshooting

Question

You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway. How would you review the logs to see what is blocking this traffic?

Options

  • AOpen SmartLog and connect remotely to the wireless controller
  • BOpen SmartEvent to see why they are being blocked
  • COpen SmartDashboard and review the logs tab
  • DOpen SmartLog and filter for the IP address of the tablet

How the community answered

(45 responses)
  • A
    7% (3)
  • B
    13% (6)
  • C
    2% (1)
  • D
    78% (35)

Why each option

SmartLog is the correct Check Point tool for reviewing security logs, and filtering by the tablet's IP address directly targets the relevant traffic to identify the blocking cause.

AOpen SmartLog and connect remotely to the wireless controller

SmartLog does not integrate with or connect to wireless controllers - wireless infrastructure logs are managed separately outside Check Point's management plane.

BOpen SmartEvent to see why they are being blocked

SmartEvent is used for correlation, reporting, and event analysis over time, not for real-time per-connection log review of a single user's blocked traffic.

COpen SmartDashboard and review the logs tab

SmartDashboard is used for policy configuration and does not provide a dedicated logs tab for reviewing live or historical connection logs.

DOpen SmartLog and filter for the IP address of the tabletCorrect

SmartLog provides a searchable, filterable log view across all Check Point gateways. By filtering on the tablet's source IP address, the administrator can quickly locate all connection attempts and identify which rule, blade, or policy is responsible for dropping the traffic. This is the standard and most efficient troubleshooting approach for user-specific connectivity issues.

Concept tested: Using SmartLog to troubleshoot blocked user traffic

Source: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGuide/Content/Topics-LMG/SmartLog.htm

Topics

#SmartLog#log filtering#troubleshooting blocked traffic

Community Discussion

No community discussion yet for this question.

Full 156-215.80 Practice