Check Point 156-215.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #1
Gaia has two default user accounts that cannot be deleted.
What are those user accounts?
- A . Admin and Default
- B . Expert and Clish
- C . Control and Monitor
- D . Admin and Monitor
Correct Answer: D
D
Explanation:
Gaia has two default user accounts that cannot be deleted. They are Admin and Monitor. Admin is the user account that has full administrative privileges and can access both WebUI and CLI. Monitor is the user account that has read-only privileges and can access only WebUI2. The other options are not default user accounts in Gaia.
D
Explanation:
Gaia has two default user accounts that cannot be deleted. They are Admin and Monitor. Admin is the user account that has full administrative privileges and can access both WebUI and CLI. Monitor is the user account that has read-only privileges and can access only WebUI2. The other options are not default user accounts in Gaia.
Question #2
Fill in the blank: The position of an implied rule is manipulated in the __________________ window.
- A . NAT
- B . Firewall
- C . Global Properties
- D . Object Explorer
Correct Answer: C
C
Explanation:
The position of an implied rule is manipulated in the Global Properties window. Implied rules are predefined rules that are not displayed in the rule base. They allow or block traffic for essential services such as communication with Check Point servers, logging, and VPN traffic. The position of an implied rule can be changed in the Global Properties > Firewall > Implied Rules section56.
Reference: How to view Implied Rules in R80.x / R81.x SmartConsole, Implied Rules
C
Explanation:
The position of an implied rule is manipulated in the Global Properties window. Implied rules are predefined rules that are not displayed in the rule base. They allow or block traffic for essential services such as communication with Check Point servers, logging, and VPN traffic. The position of an implied rule can be changed in the Global Properties > Firewall > Implied Rules section56.
Reference: How to view Implied Rules in R80.x / R81.x SmartConsole, Implied Rules
Question #3
A SAM rule Is implemented to provide what function or benefit?
- A . Allow security audits.
- B . Handle traffic as defined in the policy.
- C . Monitor sequence activity.
- D . Block suspicious activity.
Correct Answer: D
D
Explanation:
A SAM (Suspicious Activity Monitoring) rule is implemented to provide the function or benefit of blocking suspicious activity. A SAM rule is a rule that defines an action to be taken by the firewall when it detects a suspicious activity, such as an attack, a scan, or a policy violation. The action can be blocking, dropping, rejecting, or logging the traffic that triggered the suspicious activity. A SAM rule can be created manually or automatically by other security features, such as IPS, Anti-Bot, or SmartEvent.
Reference: [SAM Rules], [Suspicious Activity Rules]
D
Explanation:
A SAM (Suspicious Activity Monitoring) rule is implemented to provide the function or benefit of blocking suspicious activity. A SAM rule is a rule that defines an action to be taken by the firewall when it detects a suspicious activity, such as an attack, a scan, or a policy violation. The action can be blocking, dropping, rejecting, or logging the traffic that triggered the suspicious activity. A SAM rule can be created manually or automatically by other security features, such as IPS, Anti-Bot, or SmartEvent.
Reference: [SAM Rules], [Suspicious Activity Rules]
Question #4
In the Check Point three-tiered architecture, which of the following is NOT a function of the Security Management Server?
- A . Display policies and logs on the administrator’s workstation.
- B . Processing and sending alerts such as SNMP traps and email notifications.
- C . Verify and compile Security Policies.
- D . Store firewall logs to hard drive storage.
Correct Answer: A
A
Explanation:
The Security Management Server does not display policies and logs on the administrator’s workstation. That is the function of the SmartConsole, which is a separate component that connects to the Security Management Server.
Reference: Certified Security Administrator (CCSA) R81.20
Course Overview, page 4.
A
Explanation:
The Security Management Server does not display policies and logs on the administrator’s workstation. That is the function of the SmartConsole, which is a separate component that connects to the Security Management Server.
Reference: Certified Security Administrator (CCSA) R81.20
Course Overview, page 4.
Question #5
Fill in the blanks: Default port numbers for an LDAP server is ______ for standard connections and _______ SSL connections.
- A . 675, 389
- B . 389, 636
- C . 636, 290
- D . 290, 675
Correct Answer: B
B
Explanation:
The default port numbers for an LDAP server are 389 for standard connections and 636 for SSL connections. LDAP (Lightweight Directory Access Protocol) is a protocol that allows access to directory services over TCP/IP. Therefore, the correct answer is B. 389, 636.
B
Explanation:
The default port numbers for an LDAP server are 389 for standard connections and 636 for SSL connections. LDAP (Lightweight Directory Access Protocol) is a protocol that allows access to directory services over TCP/IP. Therefore, the correct answer is B. 389, 636.
Question #6
Which backup utility captures the most information and tends to create the largest archives?
- A . backup
- B . snapshot
- C . Database Revision
- D . migrate export
Correct Answer: B
B
Explanation:
Snapshot is the backup utility that captures the most information and tends to create the largest archives. Snapshot creates an image of the entire system, including operating system files, configuration files, databases, and logs. It can be used to restore the system in case of a failure or corruption. Backup creates a compressed file that contains configuration files and databases, but not operating system files or logs. It can be used to restore configuration settings and policies. Database Revision creates a backup of only the database files that store policies and objects. It can be used to revert to a previous revision of the database. Migrate export creates a compressed file that contains configuration files, databases, and logs, but not operating system files. It can be used to migrate data from one machine to another with different hardware or software versions.
Reference: [Backup and Restore], [Database Revision Control], [Migrate Tools], [Hewlett Packard Enterprise Support Center]
B
Explanation:
Snapshot is the backup utility that captures the most information and tends to create the largest archives. Snapshot creates an image of the entire system, including operating system files, configuration files, databases, and logs. It can be used to restore the system in case of a failure or corruption. Backup creates a compressed file that contains configuration files and databases, but not operating system files or logs. It can be used to restore configuration settings and policies. Database Revision creates a backup of only the database files that store policies and objects. It can be used to revert to a previous revision of the database. Migrate export creates a compressed file that contains configuration files, databases, and logs, but not operating system files. It can be used to migrate data from one machine to another with different hardware or software versions.
Reference: [Backup and Restore], [Database Revision Control], [Migrate Tools], [Hewlett Packard Enterprise Support Center]
Question #7
To ensure that VMAC mode is enabled, which CLI command you should run on all cluster members? Choose the best answer.
- A . fw ctl set int fwha vmac global param enabled
- B . fw ctl get int fwha vmac global param enabled; result of command should return value 1
- C . cphaprob Ca if
- D . fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1
Correct Answer: B
B
Explanation:
To ensure that VMAC mode is enabled, you should run the command fw ctl get int fwha_vmac_global_param_enabled on all cluster members and check that the result of the command returns the value 11. This command shows the current value of the global kernel parameter fwha_vmac_global_param_enabled, which controls whether VMAC mode is enabled or disabled. VMAC mode is a feature that associates a Virtual MAC address with each Virtual IP address of the cluster, which reduces the need for Gratuitous ARP packets and improves failover performance1. The other options are incorrect.
Option A is not a valid command.
Option C is a command to show the status of cluster interfaces, not VMAC mode2.
Option D is a command to show the value of a different global kernel parameter, fwha_vmac_global_param_enabled, which controls whether VMAC mode is enabled for all interfaces or only for non-VLAN interfaces1.
Reference: How to enable ClusterXL Virtual MAC (VMAC) mode, cphaprob
B
Explanation:
To ensure that VMAC mode is enabled, you should run the command fw ctl get int fwha_vmac_global_param_enabled on all cluster members and check that the result of the command returns the value 11. This command shows the current value of the global kernel parameter fwha_vmac_global_param_enabled, which controls whether VMAC mode is enabled or disabled. VMAC mode is a feature that associates a Virtual MAC address with each Virtual IP address of the cluster, which reduces the need for Gratuitous ARP packets and improves failover performance1. The other options are incorrect.
Option A is not a valid command.
Option C is a command to show the status of cluster interfaces, not VMAC mode2.
Option D is a command to show the value of a different global kernel parameter, fwha_vmac_global_param_enabled, which controls whether VMAC mode is enabled for all interfaces or only for non-VLAN interfaces1.
Reference: How to enable ClusterXL Virtual MAC (VMAC) mode, cphaprob
Question #8
An administrator wishes to use Application objects in a rule in their policy but there are no Application objects listed as options to add when clicking the"+" to add new items to the "Services & Applications" column of a rule.
What should be done to fix this?
- A . The administrator should drag-and-drop the needed Application objects from the Object Explorer into the new rule
- B . The "Application Control" blade should be enabled on a gateway
- C . "Applications & URL Filtering" should first be enabled on the policy layer where the rule is being created.
- D . The administrator should first create some applications to add to the rule.
Correct Answer: C
C
Explanation:
To use Application objects in a rule, the “Applications & URL Filtering” blade should be enabled on the policy layer where the rule is being created. Enabling the “Application Control” blade on a gateway is not enough3.
Reference: 3: Check Point R81 Security Management Administration Guide, page 102.
C
Explanation:
To use Application objects in a rule, the “Applications & URL Filtering” blade should be enabled on the policy layer where the rule is being created. Enabling the “Application Control” blade on a gateway is not enough3.
Reference: 3: Check Point R81 Security Management Administration Guide, page 102.
Question #9
To view statistics on detected threats, which Threat Tool would an administrator use?
- A . Protections
- B . IPS Protections
- C . Profiles
- D . ThreatWiki
Correct Answer: D
D
Explanation:
ThreatWiki is a web-based tool that provides statistics on detected threats, such as attack types, sources, destinations, and severity. It also allows the administrator to search for specific threats and view their details and mitigation methods. The other options are not tools for viewing statistics on detected threats.
Reference: [ThreatWiki], [ThreatWiki – Threat Emulation]
D
Explanation:
ThreatWiki is a web-based tool that provides statistics on detected threats, such as attack types, sources, destinations, and severity. It also allows the administrator to search for specific threats and view their details and mitigation methods. The other options are not tools for viewing statistics on detected threats.
Reference: [ThreatWiki], [ThreatWiki – Threat Emulation]
Question #10
What is UserCheck?
- A . Messaging tool user to verify a user’s credentials
- B . Communication tool used to inform a user about a website or application they are trying to access
- C . Administrator tool used to monitor users on their network
- D . Communication tool used to notify an administrator when a new user is created
Correct Answer: B
B
Explanation:
UserCheck is a communication tool used to inform a user about a website or application they are trying to access. UserCheck allows administrators to define actions that require user interaction, such as asking for confirmation, informing about risks, or blocking access3, p. 38. UserCheck is not a messaging tool, an administrator tool, or a notification tool.
Reference: Check Point CCSA – R81: Practice Test & Explanation, [Check Point UserCheck Administration Guide R81]
B
Explanation:
UserCheck is a communication tool used to inform a user about a website or application they are trying to access. UserCheck allows administrators to define actions that require user interaction, such as asking for confirmation, informing about risks, or blocking access3, p. 38. UserCheck is not a messaging tool, an administrator tool, or a notification tool.
Reference: Check Point CCSA – R81: Practice Test & Explanation, [Check Point UserCheck Administration Guide R81]