The Check Point Security Management Server, when functioning as a Log Server, receives logs from Security Gateways via the fw.log process. This process listens on TCP port 257 by default. The Firewall Daemon (FWD) process on the Security Gateway establishes a connection to this port on the Log Server to transmit log data. This is the primary and legacy mechanism for log collection in the Check Point architecture.

A. 18191: This port is used by the CPD (Check Point Daemon) process for Secure Internal Communication (SIC), primarily for operations like policy installation and status updates, not log collection.

B. 443: This is the standard port for HTTPS. It is used for web-based management (e.g., Gaia Portal) and for SmartConsole client connectivity to the Security Management Server.

C. 258: This port is used by the FWD process when a Log Server forwards logs to another Log Server. It is not used for the initial log collection from a Security Gateway.

1. Check Point Support Center, SecureKnowledge sk22564: "Ports used for communication by Check Point software". In the table "Ports on Security Management Server / Log Server / SmartEvent Server / Multi-Domain Server", the entry for port 257/tcp explicitly states the service is "Logging and monitoring" and the description is "Log server accepts logs from gateways (FWD process)".

2. Check Point R81.20 Logging and Monitoring Administration Guide: In Chapter 1, "Introduction to Logging", the section "The Logging Process" describes how logs are generated on the Security Gateway and sent by the fwd process to the Log Server. The communication port for this process is detailed in official port lists as 257.

3. Check Point R81.20 Security Management Administration Guide: In Chapter 2, "Security Management Architecture", the section "Communication and Security" implicitly covers the different communication channels. It reinforces that different daemons use specific ports for their functions, with logging being a distinct channel from management (CPD) or GUI access (HTTPS).

The Resource Advisor Daemon (RAD) is the core process for the URL Filtering and Application Control blades. When a user requests a URL, the Security Gateway first checks its local cache. If the URL is not in the cache, or if the cache limit has been exceeded causing frequent evictions, RAD must query the Check Point Online Web Service in the cloud. This cloud lookup is a significantly more resource-intensive operation than a local cache hit. When the cache limit is consistently exceeded under heavy traffic with many unique URLs, the gateway is forced to perform a large number of these cloud lookups, causing the RAD process's CPU utilization to spike, often reaching near 100 percent.

A. The URL Filtering blade is not disabled when the cache limit is reached, as this would create a significant security gap in the organization's policy enforcement.

B. Spawning multiple RAD processes is not the designed behavior for a full cache; this would likely exacerbate resource contention rather than resolve the issue.

D. The Security Gateway does not dynamically raise the cache limit indefinitely. The cache has a configurable, but fixed, memory allocation to prevent uncontrolled memory consumption and maintain system stability.

1. Check Point SecureKnowledge (SK) Article sk109676: "RAD process consumes high CPU on Security Gateway with enabled URL Filtering blade".

Symptom Section: "RAD process on Security Gateway with enabled URL Filtering blade consumes close to 100% of one CPU core."

Cause Section: "When the URL Filtering cache limit is reached, every new URL request that is not in the cache requires a query to the Check Point Online Web Service. This causes the RAD process to consume high CPU."

2. Check Point SecureKnowledge (SK) Article sk112153: "URL Filtering cache memory allocation".

Solution Section: This article details the kernel parameters for managing the URLF cache size (e.g., radurlfcachesize). It explains that there is a defined limit and describes the mechanism: "When the cache limit is reached, the oldest entries are replaced with new ones (LRU - Least Recently Used algorithm)." This confirms the cache has a fixed limit and does not grow dynamically (contradicting option D).

3. Check Point R81.1 Security Gateway Administration Guide:

Chapter: Monitoring Gateway Performance > CoreXL and Performance Tuning. While not directly stating the cache limit issue, this guide discusses how features like Application Control & URL Filtering are CPU intensive and require careful monitoring. It reinforces that processes like RAD are critical to performance and that resource exhaustion (like high CPU) is a key monitoring metric, which aligns with the problem described.

In a Check Point environment, the Security Management Server (SMS) serves as the central point for managing licenses and service contracts. The SMS connects to the Check Point User Center to download the latest contract information. Once the valid service contracts are stored on the SMS, they are then automatically distributed to the managed Security Gateways. This architecture ensures centralized control and allows the gateways to validate their software blade entitlements and fetch necessary updates, such as signatures for the Threat Prevention blades.

A. Contracts are managed centrally on the Security Management Server and then distributed to the gateways; they are not stored only on the gateways.

B. Service contracts are digital files managed electronically through the Check Point User Center and SmartConsole, not provided on paper.

C. While contracts are stored and required on the SMS, they are also downloaded to the Security Gateways so the gateways can validate their services and download updates.

1. Check Point R81 Security Management Administration Guide, Chapter "Managing Licenses and Contracts", Section "Updating Contracts".

Quote/Paraphrase: The guide states, "The Security Management Server periodically connects to the Check Point User Center to get updated contract and license information. The Security Management Server then automatically distributes the updated information to the managed Security Gateways." This confirms the process where the SMS must first have the contract before it can be sent to a gateway.

2. Check Point SecureKnowledge (SK) Article sk94508: "How to update Contract File on Security Management Server / Multi-Domain Server".

Reference: This document outlines the procedures for updating the contract file directly on the management server, either automatically or manually. This reinforces the role of the SMS as the primary repository for contract information before it is distributed to other components.

3. Check Point SecureKnowledge (SK) Article sk110548: "How to update Contract File on Security Gateway / Cluster Member".

Reference: This article details how a gateway's contract file is updated. It explicitly mentions, "The recommended way to update the contract file on a Security Gateway / Cluster Member is to update it on its Security Management Server / Domain Management Server... and then install the policy." This directly supports the answer that the contract must be on the SMS first.

The command fw monitor captures packets at four distinct points in the Firewall kernel chain, often referred to as the FW Virtual Machine (VM). These points represent the packet's state before and after the inbound and outbound kernel chains are processed. The -p all option, contrary to what its name might imply, does not capture at a larger number of intermediate kernel module points. Instead, it modifies the output to display the full packet path through all kernel chains for each of the four captured packets, providing a comprehensive view of the packet's journey. Therefore, the command still fundamentally takes only four captures.

A. The number of kernel modules is not fixed at 15 and can vary. More importantly, fw monitor does not capture packets at every single module interface with the -p all flag; it captures at the four main points.

B. This option incorrectly describes the function of the -p flag. The flag for controlling the captured data length (gathering the entire packet) is -l, not -p.

C. This is conceptually incorrect. fw monitor does not capture "1 from every module." It captures at the four key inspection points at the beginning and end of the inbound and outbound chains.

1. Check Point SecureKnowledge (SK) Article sk111013: "How to debug packet flow with 'fw monitor' in R80.x". This document clarifies the behavior of fw monitor. In the section "FW Monitor flags", it explains the default capture points. The -p flag is described as controlling the "positions in the FW chain to inspect". The all parameter for -p is specifically noted to show the packet's path through the chains for the captures taken at the four standard points.

2. Check Point R81.10 Security Gateway Administration Guide: In the "Monitoring and Troubleshooting" chapter, the fw monitor command is detailed. The guide explains that the tool captures packets at four points by default: before the inbound chain (i), after the inbound chain (I), before the outbound chain (o), and after the outbound chain (O). The -p all option is documented to provide a "trace of the packet through the firewall chains," which is an enhancement of the output for the four captured packets, not an increase in the number of capture points.

3. Check Point Certified Security Expert (CCSE) R81.10 Courseware: The official training materials for the CCSE certification, which the 156-582 exam is based on, explicitly state that fw monitor captures packets at four points. The -p all flag is taught as a method to see the detailed kernel chain path for each of these four captures, not as a way to generate more captures.

To log the full URL for traffic matching a specific rule in the Access Control policy, the "Extended Log" track option must be selected for that rule. This is a per-rule setting configured in the "Track" column of the Rule Base. According to Check Point's official documentation, when "Extended Log" is enabled for a rule involving the Application Control blade, the generated log entry is enriched with more detailed information, which explicitly includes the full URL of the request. This provides granular control over logging verbosity for specific traffic without affecting the entire policy.

B. This describes a setting that does not exist in the specified location. The correct option is "Extended Log," not a "log URL" setting.

C. This is incorrect. Verbose logging, such as capturing full URLs, is not enabled by default to conserve system resources and log storage.

D. This refers to global blade settings. The question requires a configuration for a specific rule, not a global change that would affect all rules.

1. Check Point R81.10 Security Management Administration Guide, Chapter: "The Access Control Policy", Section: "Configuring the Track Setting for a Rule", Page 371.

The guide states: "For some rules, you can select Extended Log. This gives a more detailed log entry. For example, for a Firewall rule, an Extended Log includes the rule number. For an Application Control rule, an Extended Log includes the full URL."

2. Check Point R81.1 Certified Security Administrator (CCSA) Study Guide, Chapter 6: "Monitoring Security Gateways", Section: "Tracking and Logging", Page 161.

This official courseware lists "Extended Log" as a tracking option and explains it "Generates a log with a more detailed description than the Log option," confirming its purpose for enhanced logging detail.