Checkpoint 156-587 - Check Point Certified Troubleshooting Expert - R81.20 (CCTE)

While specific Check Point CCTE R81.20 official documentation that explicitly singles out "Handlers" from the given options as the sole component for storing Rule Base matching state-related information is not readily available in the provided search snippets, CCTE exam preparation materials consistently point to "Handlers" as the correct answer for this question.

In the broader context of Check Point's packet processing and Unified Policy architecture, several components are involved in rule base matching:

According to Check Point's sk120964 - ATRG: Unified Policy (relevant for R81.20):

Connection/Transaction: This logical entity "Saves rulebase matching state and classification objects (CLOBs)."

Manager: This component acts as a "Mediator between other components. Responsible for the whole rule base execution process. Creates connection/transactions, as required. Sends logs."  

Classifiers: These are "CMI_LOADER applications" (e.g., Network, Identity, Application Control) that provide classification data (CLOBs) used in the matching process.

Observers: An "Observer is a unit collecting CLOBs for classification refinement."

"Handlers" in a general firewall architecture are typically components (which can be kernel modules or processes) responsible for managing active connections and their progression through policy enforcement. As such, they would inherently be involved in maintaining and accessing state information related to rule base matching for those connections. The "Connection/Transaction" objects, which store the rule base matching state, are created by the Manager and would be managed by such Handlers during the lifecycle of a connection.

Therefore, in the context of the CCTE R81.20 exam, "Handlers" are understood to be the packet processing components that store this Rule Base matching state-related information. The state itself is conceptually saved within Connection/Transaction objects, which are orchestrated by the Manager and utilized by various processing components often referred to as Handlers.

Reference (based on Unified Policy component roles from official Check Point documentation):

Check Point Support Center sk120964: ATRG: Unified Policy. (Last Modified: 2024-12-29, relevant for R81.20)."Connection/Transaction. Saves rulebase matching state and classification objects (CLOBs)."

"Manager. Mediator between other components. Responsible for the whole rule base execution process. Creates connection/transactions, as required.

When a Security Gateway performs a URL lookup and the URL is not found in the local caches, a request for online categorization is necessary. This process involves the Resource Advisor Daemon (RAD), which has components in both kernel space and user space.

Based on descriptions of the URL Filtering categorization process (often cited in CCTE R81.20 materials):

A client (internal component, potentially the URLF Kernel Client or a similar kernel module handling the traffic) initiates a URL lookup.

The URL is first checked against kernel caches.

If the URL is not found in the kernel cache (a cache miss), the RAD kernel component is notified.

The client component then typically sends an asynchronous request to the RAD kernel component.

The RAD Kernel Space component is then responsible for forwarding this request to the RAD User Space module.

The RAD User Space module handles the actual online categorization, often by querying the URLF Online Service (Check Point's cloud-based categorization service).

The result is then returned, and the kernel cache is updated.

The question asks where the sync-request (or a request requiring immediate online lookup) is forwarded from. In this flow, the RAD Kernel Space acts as the intermediary that forwards the request from the initial kernel-level lookup mechanism to the user-space RAD process for further handling.

Supporting Information (derived from CCTE R81.20 related materials/discussions):

The typical flow for URL categorization when an online lookup is needed involves these steps:

"The kernel cache notifies the RAD kernel of hits and misses."

"The client sends an a-sync request back to RAD if the URL was not found." (This request goes to the RAD Kernel Space).

"The a-sync request is forwarded to the RAD User space via the RAD kernel for online categorization."

This indicates that the RAD Kernel (RAD Kernel Space) is the component that forwards the request to the RAD User Space.

Therefore, if a sync-request (a request needing immediate online lookup) is required, it is forwarded from the RAD Kernel Space to the RAD User Space.

Reference Context (based on CCTE R81.20 materials and general Check Point URL Filtering architecture):

Discussions and explanations related to Check Point Certified Troubleshooting Expert (CCTE) R81.20 curriculum often detail this RAD architecture. For example, study materials might state: "RAD has a kernel module that looks up the kernel cache, notifies client about hits and misses and forwards a-sync requests to RAD user space module which is responsible for online categorization." The 1 "RAD kernel module" corresponds to the RAD Kernel Space, and it is this component that performs the forwarding action to the RAD User Space.(Exact page numbers like "CCTE R81.20, p338/339" have been referenced in public CCTE exam discussions pointing to this flow)

 The CPD process controls logging on the Security Management Server or the Log Server. It is responsible for receiving logs from the Security Gateways, storing them in the log files, and forwarding them to the SmartLog and SmartEvent servers. It also handles the communication with the SmartConsole clients and the CPM process. The CPD process runs on the Security Management Server or the Log Server as part of the Management High Availability module.

The input that is suitable for debugging HTTPS inspection issues is fw debug tls on TDERROR_ALL_ALL=5. This input will enable the TLS debug mode and set the debug level to 5, which is the highest level of verbosity. The fw debug command is used to control the debug features of the firewall modules, such as TLS, CPTLS, HTTP, etc. The tls option will enable the debug mode for the TLS module, which is responsible for handling the HTTPS inspection feature. The TDERROR_ALL_ALL environment variable will set the debug level to 5, which will generate the most detailed and comprehensive debug output. The debug output will be written to the $FWDIR/log/tls.elg file, whichcan be collected and analyzed with the TLSView tool1 to see the details of the HTTPS inspection process, such as certificate validation, SSL/TLS negotiation, encryption/decryption, etc. The other options are incorrect because:

fw ctl debug -m fw + conn drop cptls will enable the kernel debug mode for the firewall module, with the flags conn, drop, and cptls. The kernel debug mode will generate the kdebug.txt file in the $FWDIR/log directory, which contains information about the firewall traffic processing in the kernel. The kernel debug mode is useful for troubleshooting issues related to policy, NAT, routing, and inspection, but not for issues related to HTTPS inspection, which is handled by the TLS module in the user space2.

vpn debug cptls on will enable the IKE debug mode for the CPTLS module, which is a component of the VPN module. The IKE debug mode will generate the ike.elg and ikev2.xmll files in the $FWDIR/log directory, which contain information about the IKE negotiation, authentication, and key exchange between the VPN peers. The CPTLS module is responsible for handling the SSL/TLS encryption/decryption for the VPN traffic, but not for the HTTPS inspection traffic3.

fw diag debug tls enable is not a valid command and will not enable the TLS debug mode. The fw diag command is used to control the diagnostic features of the firewall, such as packet capture, core dump, etc. The debug option is not a valid option for the fw diag command, and the tls option is not a valid option for the debug option. References:

How to use the TLSView tool

How to debug the Firewall kernel (fw) module

How to debug VPN issues on Quantum Spark (SMB) Appliances

[fw diag - Check Point CLI Reference Card]

The ADLOG function receives the AD log event information from the Domain Controllers. The ADLOG function is part of the Identity Awareness feature that enablesthe Security Gateway to identify users and machines in the network and enforce Access Control policy rules based on their identities. The ADLOG function uses the AD Query (ADQ) method to connect to the Active Directory Domain Controllers using WMI and subscribe to receive Security Event logs that are generated when users perform login. The ADLOG function then extracts the user and machine information that maps to an IP address from the event logs and sends it to the PEP function, which enforces the policy based on the identity information.