Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #111
What are the two types of NAT supported by the Security Gateway?
- A . Destination and Hide
- B . Hide and Static
- C . Static and Source
- D . Source and Destination
Correct Answer: B
B
Explanation:
The two types of NAT supported by the Security Gateway are hide NAT and static NAT. Hide NAT translates many source IP addresses into one IP address, usually the external interface of the gateway. Static NAT translates one source IP address into another IP address, usually a public IP address34. The other options are not valid types of NAT.
Reference: Network Address Translation (NAT), Check Point CCSA – R81: Practice Test & Explanation
B
Explanation:
The two types of NAT supported by the Security Gateway are hide NAT and static NAT. Hide NAT translates many source IP addresses into one IP address, usually the external interface of the gateway. Static NAT translates one source IP address into another IP address, usually a public IP address34. The other options are not valid types of NAT.
Reference: Network Address Translation (NAT), Check Point CCSA – R81: Practice Test & Explanation
Question #112
Fill in the blanks: A Security Policy is created in_____, stored in the_____ and Distributed to the various
- A . Rule base. Security Management Server Security Gateways
- B . The Check Point database. SmartConsole, Security Gateways
- C . SmartConsole, Security Gateway, Security Management Servers
- D . SmartConsole, Security Management Server, Security Gateways
Correct Answer: D
D
Explanation:
A Security Policy is created in SmartConsole, stored in the Security Management Server, and distributed to the various Security Gateways. SmartConsole is a graphical user interface that allows administrators to create and edit security policies. The Security Management Server is a central server that stores and manages the security policies. The Security Gateways are devices that enforce the security policies on the network traffic.
Reference: Check Point R81 Security Gateway Administration Guide, page 9.
D
Explanation:
A Security Policy is created in SmartConsole, stored in the Security Management Server, and distributed to the various Security Gateways. SmartConsole is a graphical user interface that allows administrators to create and edit security policies. The Security Management Server is a central server that stores and manages the security policies. The Security Gateways are devices that enforce the security policies on the network traffic.
Reference: Check Point R81 Security Gateway Administration Guide, page 9.
Question #113
What is the main difference between Static NAT and Hide NAT?
- A . Static NAT only allows incoming connections to protect your network.
- B . Static NAT allow incoming and outgoing connections. Hide NAT only allows outgoing connections.
- C . Static NAT only allows outgoing connections. Hide NAT allows incoming and outgoing connections.
- D . Hide NAT only allows incoming connections to protect your network.
Correct Answer: B
B
Explanation:
The main difference between Static NAT and Hide NAT is that Static NAT allows incoming and outgoing connections, while Hide NAT only allows outgoing connections4. Static NAT translates a single IP address to another single IP address, while Hide NAT translates a group of IP addresses to a single IP address. Static NAT is used to expose internal servers to external networks, while Hide NAT is used to hide internal hosts from external networks.
Reference: Check Point R81 Firewall Administration Guide
B
Explanation:
The main difference between Static NAT and Hide NAT is that Static NAT allows incoming and outgoing connections, while Hide NAT only allows outgoing connections4. Static NAT translates a single IP address to another single IP address, while Hide NAT translates a group of IP addresses to a single IP address. Static NAT is used to expose internal servers to external networks, while Hide NAT is used to hide internal hosts from external networks.
Reference: Check Point R81 Firewall Administration Guide
Question #114
Fill in the blank: To create policy for traffic to or from a particular location, use the _____________.
- A . DLP shared policy
- B . Geo policy shared policy
- C . Mobile Access software blade
- D . HTTPS inspection
Correct Answer: B
B
Explanation:
The answer is B because Geo policy shared policy is used to create policy for traffic to or from a particular location based on the source or destination country. DLP shared policy is used to prevent data loss by inspecting files and data for sensitive information. Mobile Access software blade is used to provide secure remote access to corporate resources from various devices. HTTPS inspection is used to inspect encrypted web traffic for threats and compliance4
Reference: Check Point R81 Geo Policy Administration Guide, [Check Point R81 Data Loss Prevention Administration Guide], [Check Point R81 Mobile Access Administration Guide], [Check Point R81 HTTPS Inspection Administration Guide]
B
Explanation:
The answer is B because Geo policy shared policy is used to create policy for traffic to or from a particular location based on the source or destination country. DLP shared policy is used to prevent data loss by inspecting files and data for sensitive information. Mobile Access software blade is used to provide secure remote access to corporate resources from various devices. HTTPS inspection is used to inspect encrypted web traffic for threats and compliance4
Reference: Check Point R81 Geo Policy Administration Guide, [Check Point R81 Data Loss Prevention Administration Guide], [Check Point R81 Mobile Access Administration Guide], [Check Point R81 HTTPS Inspection Administration Guide]
Question #115
What are the three main components of Check Point security management architecture?
- A . SmartConsole, Security Management, and Security Gateway
- B . Smart Console, Standalone, and Security Management
- C . SmartConsole, Security policy, and Logs & Monitoring
- D . GUI-Client, Security Management, and Security Gateway
Correct Answer: A
A
Explanation:
The three main components of Check Point security management architecture are SmartConsole, Security Management, and Security Gateway5. SmartConsole is the graphical user interface that allows administrators to manage and monitor Check Point products. Security Management is the server that stores the security policy and configuration data. Security Gateway is the device that enforces the security policy on the network traffic.
Reference: Check Point R81 Security Management Administration Guide
A
Explanation:
The three main components of Check Point security management architecture are SmartConsole, Security Management, and Security Gateway5. SmartConsole is the graphical user interface that allows administrators to manage and monitor Check Point products. Security Management is the server that stores the security policy and configuration data. Security Gateway is the device that enforces the security policy on the network traffic.
Reference: Check Point R81 Security Management Administration Guide
Question #116
Which of the following is NOT a tracking option? (Select three)
- A . Partial log
- B . Log
- C . Network log
- D . Full log
Correct Answer: A, C, D
A, C, D
Explanation:
The options that are not tracking options are Partial log, Network log, and Full log. Tracking options are settings that determine how the Security Gateway handles traffic that matches a rule in the security policy. The valid tracking options are Log, Detailed Log, Extended Log, Alert, Mail, SNMP trap, User Defined Alert, and None. The other options are incorrect. Log is a tracking option that records basic information about the traffic, such as source, destination, service, action, etc. Detailed Log is a tracking option that records additional information about the traffic, such as NAT details, data amount, etc. Extended Log is a tracking option that records even more information about the traffic, such as matched IPS protections, application details, etc.
Reference: [Logging and Monitoring Administration Guide R80 – Check Point Software]
A, C, D
Explanation:
The options that are not tracking options are Partial log, Network log, and Full log. Tracking options are settings that determine how the Security Gateway handles traffic that matches a rule in the security policy. The valid tracking options are Log, Detailed Log, Extended Log, Alert, Mail, SNMP trap, User Defined Alert, and None. The other options are incorrect. Log is a tracking option that records basic information about the traffic, such as source, destination, service, action, etc. Detailed Log is a tracking option that records additional information about the traffic, such as NAT details, data amount, etc. Extended Log is a tracking option that records even more information about the traffic, such as matched IPS protections, application details, etc.
Reference: [Logging and Monitoring Administration Guide R80 – Check Point Software]
Question #117
Examine the sample Rule Base.
What will be the result of a verification of the policy from SmartConsole?
- A . No errors or Warnings
- B . Verification Error. Empty Source-List in Rule 5 (Mail Inbound)
- C . Verification Error. Rule 4 (Web Inbound) hides Rule 6 (Webmaster access)
- D . Verification Error. Rule 7 (Clean-Up Rule) hides Implicit Clean-up Rule
Correct Answer: C
C
Explanation:
Verification Error. Rule 4 (Web Inbound) hides Rule 6 (Webmaster access) is the correct answer. This is because Rule 4 has a broader source and destination than Rule 6, and both rules have the same service (HTTP). Therefore, Rule 6 will never be matched, and the Webmaster access will be denied.
Reference: Check Point R80.10 – Part 3 – Rule Base Order
C
Explanation:
Verification Error. Rule 4 (Web Inbound) hides Rule 6 (Webmaster access) is the correct answer. This is because Rule 4 has a broader source and destination than Rule 6, and both rules have the same service (HTTP). Therefore, Rule 6 will never be matched, and the Webmaster access will be denied.
Reference: Check Point R80.10 – Part 3 – Rule Base Order
Question #118
Fill in the blanks: A Check Point software license consists of a__________ and _______.
- A . Software blade; software container
- B . Software package: signature
- C . Signature; software blade
- D . Software container software package
Correct Answer: A
A
Explanation:
A Check Point software license consists of a Software blade and a Software container. A Software blade is a modular security feature that delivers security functionality to the gateway or management server. A Software container is a set of Software blades that can be purchased as a bundle.
Reference: Check Point R81 Security Management Administration Guide, page 14.
A
Explanation:
A Check Point software license consists of a Software blade and a Software container. A Software blade is a modular security feature that delivers security functionality to the gateway or management server. A Software container is a set of Software blades that can be purchased as a bundle.
Reference: Check Point R81 Security Management Administration Guide, page 14.
Question #119
Fill in the blank RADIUS protocol uses_____to communicate with the gateway
- A . UDP
- B . CCP
- C . TDP
- D . HTTP
Correct Answer: A
A
Explanation:
RADIUS protocol uses UDP (User Datagram Protocol) to communicate with the gateway. UDP is a connectionless protocol that does not require a handshake or acknowledgment before sending or receiving data2.
Reference: 2: [Check Point R81 Identity Awareness Administration Guide], page 14.
A
Explanation:
RADIUS protocol uses UDP (User Datagram Protocol) to communicate with the gateway. UDP is a connectionless protocol that does not require a handshake or acknowledgment before sending or receiving data2.
Reference: 2: [Check Point R81 Identity Awareness Administration Guide], page 14.
Question #120
What is the most recommended installation method for Check Point appliances?
- A . SmartUpdate installation
- B . DVD media created with Check Point ISOMorphic
- C . USB media created with Check Point ISOMorphic
- D . Cloud based installation
Correct Answer: C
C
Explanation:
USB media created with Check Point ISOMorphic is the most recommended installation method for Check Point appliances, as it provides a fast and easy way to install the Gaia operating system and the latest software version4. SmartUpdate installation requires an existing Gaia installation and does not support fresh installations4. DVD media created with Check Point ISOMorphic is less convenient than USB media, as it requires burning the image to a DVD and inserting it into the appliance4. Cloud based installation is not applicable for Check Point appliances, as it is intended for cloud environments such as AWS or Azure4.
Reference: INSTALLATION AND UPGRADE GUIDE R81.10, Chassis R81 Installation and Upgrade Guide, Check Point R81.10
C
Explanation:
USB media created with Check Point ISOMorphic is the most recommended installation method for Check Point appliances, as it provides a fast and easy way to install the Gaia operating system and the latest software version4. SmartUpdate installation requires an existing Gaia installation and does not support fresh installations4. DVD media created with Check Point ISOMorphic is less convenient than USB media, as it requires burning the image to a DVD and inserting it into the appliance4. Cloud based installation is not applicable for Check Point appliances, as it is intended for cloud environments such as AWS or Azure4.
Reference: INSTALLATION AND UPGRADE GUIDE R81.10, Chassis R81 Installation and Upgrade Guide, Check Point R81.10