156-587 · Question #116
You run cpwd_admin list on a Security Gateway and notice that the CPM process is not listed. Select the best answer.
The correct answer is A. The output is different between Gateway and Management Server.. The cpwd_admin list command is used to display the status of processes monitored by the Check Point WatchDog Daemon (CPWD). The CPM (Check Point Management) process is a core process on the Security Management Server, responsible for management operations. However, on a Security
Question
You run cpwd_admin list on a Security Gateway and notice that the CPM process is not listed. Select the best answer.
Options
- AThe output is different between Gateway and Management Server.
- BCPM is not running and can't be monitored by WatchDog.
- CIf you want to monitor CPM, you have to manually add it to WatchDog.
- DCPM is not there because it has its own monitoring system. Only lower processes are monitored
How the community answered
(39 responses)- A72% (28)
- B5% (2)
- C8% (3)
- D15% (6)
Explanation
The cpwd_admin list command is used to display the status of processes monitored by the Check Point WatchDog Daemon (CPWD). The CPM (Check Point Management) process is a core process on the Security Management Server, responsible for management operations. However, on a Security Gateway, the CPM process is not typically present, as it is specific to management The output of cpwd_admin list differs between a Security Gateway and a Security Management Server. On a Security Gateway, processes like FWD, VPND, and PEP are monitored, but CPM is not present because it runs on the Management Server. Thus, CPM will not appear in the cpwd_admin list output on a Gateway.
Topics
Community Discussion
17
Bahar F.May 10, 2026A is correct. CPM, the Check Point Policy Management process, runs on the Management Server, not on the Security Gateway, so when you run cpwd_admin list on a gateway you simply will not see it there. The output of that command differs between a gateway and a management server because each platform runs a different set of processes.
Samuel O.May 11, 2026Worth adding that if anyone is studying on a standalone deployment where the management and gateway roles share the same box, they WILL see CPM in cpwd_admin list, which is exactly the kind of lab environment that trips people up when they sit the exam expecting a clean separation.
Brenda K.May 24, 2026Quick win, do not overthink this one, you should be past it in under 60 seconds. A is correct because cpwd_admin list output depends entirely on what role the machine plays. On a dedicated Security Gateway, CPM (the Check Point Policy Management process) simply does not run, so it will never appear in that list. CPM lives on the Management Server, and that is the only place you will see it show up in WatchDog output. The other options are traps for people who memorized process names without thinking about the Gateway-vs-Management architecture split.
Ola B.May 26, 2026CPM running only on the Management Server is exactly right, and worth adding that if you actually spin up a lab with both a standalone gateway and a management server you can run cpwd_admin list on each box side by side and the difference is impossible to forget.
Nina C.May 7, 2026I almost picked B, but CPM only runs on the Management Server, not the Gateway.
Samuel O.May 8, 2026Right, and that distinction burned us in production once when a junior tried to restart CPM on the gateway box and couldn't figure out why the process wasn't there, so tying "management plane lives on the management server" to a real-world mental model is exactly the kind of thing that sticks for the exam and on the job.
Wesley A.May 29, 2026I kept staring at B thinking CPM just crashed and WatchDog couldn't pick it up, but then I remembered that cpwd_admin list output is specific to what is running on that type of machine, and CPM is a Management Server process, not a Gateway process, so of course it won't show on a Gateway. A is the one.
Anjali D.May 13, 2026Our group went back and forth on this one, and D was the big trap because it sounds authoritative, like CPM is somehow too important for WatchDog and runs its own thing, but that is not how it works. The real reason CPM does not show up is that you are running the command on a Gateway, and CPM is a Management Server process, so of course it is absent there. Run the same cpwd_admin list on a Management Server and CPM shows right up, which is exactly what answer A is pointing to. B tripped up a couple of us too because we assumed "not listed" meant "not running," but that is conflating two different things. Anyone else want to weigh in on whether they have seen this framed differently in other practice sets?
Toby R.May 13, 2026Exactly right on CPM being Management-only, and the B trap is worth emphasizing because on a live gateway under load you might see transient gaps in cpwd_admin output that make you second-guess yourself before you remember that "not listed" and "not running" are not the same thing.
Toby R.May 22, 2026I actually went with D first because I figured CPM had its own thing going on and WatchDog just handled the lower-level processes, but then I remembered that cpwd_admin list output genuinely looks different depending on whether you run it on a Gateway versus a Management Server, and CPM is a Management Server process so you just won't see it on a Gateway at all. Once that clicked, A was the only one that made sense.
Anjali D.May 24, 2026Right, and a good mental shortcut to carry into the exam is that whenever a question shows cpwd_admin list output, the platform context is basically doing half the elimination work for you before you even read the process names.
Samuel O.Jun 3, 2026I actually had B circled at first because my gut said a missing process means it crashed, but then I remembered from my SA days that CPM is a Management Server process, not a Gateway process, so of course it won't show up in cpwd_admin list on a Gateway. The output is just architecturally different between the two, which is exactly what A is saying.
Anjali D.Jun 3, 2026Samuel, that is exactly right, and it is worth adding that if you do run cpwd_admin list on a Management Server you will see CPM listed there, which is a handy sanity check to cement the concept in your memory before exam day.
Mei-Ling H.Jun 14, 2026CPM not in list means WatchDog cannot see it, so B fits exactly.
Wesley A.Jun 15, 2026Mei-Ling, I get the reasoning but that logic actually supports A, because WatchDog does not need to see CPM in its list to trigger a reset when CPM stops responding, and that automatic recovery action is exactly what option A describes. B would only fit if the question asked what WatchDog reports, not what it does.
Ola B.Jun 4, 2026Makes sense to me, CPM needs manual WatchDog registration since it manages itself.
Brenda K.Jun 6, 2026Ola, the correct answer is A because CPM (Cluster Profile Manager) relies on the platform's WatchDog for health monitoring, so it does NOT manage its own registration, the system handles that automatically.