Exam 156-215.80 topic 1 question 335 discussion

from CCSE R80 guide: Medium Path The packet is handled by the SecureXL device, except for IPS, Application Control, Antivirus, and Anti-Bot processing. The CoreXL layer passes the packet to one of the Firewall instances to perform processing. This path is only available when CoreXL is enabled. so answer is C

https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_PerformanceTuning_AdminGuide/html_frameset.htm?topic=documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_PerformanceTuning_AdminGuide/100935

shouldn't be there SecureXL instead of CoreXL under the link with diagrams of packet flows is written: Q: Why CoreXL is not on the diagrams? A: CoreXL is a mechanism to assign, balance and manage CPU cores. CoreXL SND makes a decision to "stick" particular connection going through FW or Medium Paths to a specific FWK instance. It is not part of the logical flow for a specific packet though. https://community.checkpoint.com/t5/General-Topics/Security-Gateway-Packet-Flow-and-Acceleration-with-Diagrams/td-p/40244

Should be A: Firewall path / Slow path (F2F) – Packet flow when the SecureXL device is unable to process the packet (refer to sk32578 – SecureXL Mechanism). The packet is passed on to the CoreXL layer and then to one of the CoreXL FW instances for full processing. This path also processes all packets when SecureXL is disabled.

following your link: " Medium path (PXL) - The CoreXL layer passes the packet to one of the CoreXL FW instances to perform the processing (even when CoreXL is disabled, the CoreXL infrastructure is used by SecureXL device to send the packet to the single FW instance that still functions)..... This path is available only when CoreXL is enabled. " So answer is C "medium path"

I think answer is SLOW path only as secureXL is disabled https://community.checkpoint.com/t5/General-Topics/R80-x-Security-Gateway-Architecture-Logical-Packet-Flow/td-p/41747