156-915.77 · Question #155
(Topic 14) Which command will erase all CRL's?
The correct answer is C. vpn crl_zap. See the full explanation below for the reasoning.
Question
- (Topic 14)
Which command will erase all CRL’s?
Options
- Avpn crladmin
- Bcpstop/cpstart
- Cvpn crl_zap
- Dvpn flush
How the community answered
(52 responses)- A10% (5)
- B4% (2)
- C83% (43)
- D4% (2)
Community Discussion
7
Dejan C.Nov 6, 2025vpn crl_zap is the command you want here. It specifically targets the CRL cache and wipes all stored certificate revocation lists, which is exactly what you need when you are troubleshooting stale or corrupt CRL data causing IKE failures, whereas vpn flush only clears the SA table and crladmin is not a real Check Point command.
Ola B.Oct 26, 2025vpn crl_zap is the one you want here, that command is specifically designed to wipe all cached Certificate Revocation Lists from the gateway. Spin up a lab with a Check Point gateway and run it yourself so you can see the CRL cache before and after, it makes the command stick in your memory way better than just reading about it.
Viktor S.Oct 26, 2025crl_zap is not a real Check Point command, so spin up that lab and you will find nothing to run, which is exactly the kind of test that saves you from memorizing garbage before the exam.
Nina C.Oct 12, 2025I almost circled D because "flush" sounds like it clears things out, but once I looked it up I saw that vpn flush deals with the SA table, not CRLs, so that one is a trap. The answer is C, vpn crl_zap, which is the specific command that wipes all cached CRLs on the gateway.
Dejan C.Oct 15, 2025vpn crl_zap is correct, and worth adding that after you run it you can confirm the cache is actually empty with vpn crl_print to make sure no stale entries survived.
Viktor S.Nov 12, 2025I keep seeing people throw out C on this one without thinking it through, and I think they are just pattern-matching on the word "zap" because it sounds destructive. Look at what crladmin actually does, it is the administrative interface for the entire CRL subsystem, and when you have admin-level control over a subsystem the erase or purge functionality lives there, not in some shortcut command. The logic is the same as any other management tool, you go to the admin command to do the heavy lifting. Flush is clearly for IKE SAs, cpstop/cpstart is a sledgehammer that restarts everything and does not target CRLs specifically, so the question is really between A and C, and I will take the command that puts you in the actual management seat over one that just sounds like it blows things up. A is my answer, vpn crladmin, and I am sticking with it until someone shows me documentation that says otherwise, not just another dump that lists C with no explanation.
Nina C.Nov 14, 2025Viktor, I actually had the same instinct as you at first, but Check Point documentation specifically lists "vpn zap" as the command that clears the CRL cache, which is exactly what the question is asking for. vpn crladmin manages CRL settings and lets you inspect or configure the subsystem, but it is vpn zap that does the actual cache flush.