Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #121
Which information is included in the “Extended Log” tracking option, but is not included in the “Log” tracking option?
- A . file attributes
- B . application information
- C . destination port
- D . data type information
Correct Answer: B
B
Explanation:
Application information is included in the “Extended Log” tracking option, but is not included in the “Log” tracking option4. The “Extended Log” option provides additional information about the application, such as name, category, risk, and technology4.
Reference: LOGGINGAND MONITORING R80
B
Explanation:
Application information is included in the “Extended Log” tracking option, but is not included in the “Log” tracking option4. The “Extended Log” option provides additional information about the application, such as name, category, risk, and technology4.
Reference: LOGGINGAND MONITORING R80
Question #122
What kind of NAT enables Source Port Address Translation by default?
- A . Automatic Static NAT
- B . Manual Hide NAT
- C . Automatic Hide NAT
- D . Manual Static NAT
Correct Answer: C
C
Explanation:
Automatic Hide NAT enables Source Port Address Translation by default1. This means that the source IP address and port number are translated to a different IP address and port number. This allows multiple hosts to share a single IP address for outbound connections.
Reference: Check Point R81 Firewall Administration Guide
C
Explanation:
Automatic Hide NAT enables Source Port Address Translation by default1. This means that the source IP address and port number are translated to a different IP address and port number. This allows multiple hosts to share a single IP address for outbound connections.
Reference: Check Point R81 Firewall Administration Guide
Question #123
What is the purpose of a Stealth Rule?
- A . A rule used to hide a server’s IP address from the outside world.
- B . A rule that allows administrators to access SmartDashboard from any device.
- C . To drop any traffic destined for the firewall that is not otherwise explicitly allowed.
- D . A rule at the end of your policy to drop any traffic that is not explicitly allowed.
Correct Answer: C
C
Explanation:
The purpose of a Stealth Rule is to drop any traffic destined for the firewall that is not otherwise explicitly allowed1, p. 32. A Stealth Rule is usually placed at the top of the rule base, before any other rule that allows traffic to the Security Gateway2, p. 13. A Stealth Rule is not used to hide a server’s IP address, to allow administrators to access SmartDashboard, or to drop any traffic that is not explicitly allowed.
Reference: Check Point CCSA – R81: Practice Test & Explanation, 156-315.81 Checkpoint Exam Info and Free Practice Test
C
Explanation:
The purpose of a Stealth Rule is to drop any traffic destined for the firewall that is not otherwise explicitly allowed1, p. 32. A Stealth Rule is usually placed at the top of the rule base, before any other rule that allows traffic to the Security Gateway2, p. 13. A Stealth Rule is not used to hide a server’s IP address, to allow administrators to access SmartDashboard, or to drop any traffic that is not explicitly allowed.
Reference: Check Point CCSA – R81: Practice Test & Explanation, 156-315.81 Checkpoint Exam Info and Free Practice Test
Question #124
Which of the following is NOT a valid configuration screen of an Access Role Object?
- A . Users
- B . Networks
- C . Time
- D . Machines
Correct Answer: C
C
Explanation:
An Access Role Object has four configuration screens: Users, Machines, Networks, and Identity
Tags1, p. 27. Time is not a valid configuration screen of an Access Role Object.
Reference: Check Point
CCSA – R81: Practice Test & Explanation
C
Explanation:
An Access Role Object has four configuration screens: Users, Machines, Networks, and Identity
Tags1, p. 27. Time is not a valid configuration screen of an Access Role Object.
Reference: Check Point
CCSA – R81: Practice Test & Explanation
Question #125
Which Check Point supported authentication scheme typically requires a user to possess a token?
- A . RADIUS
- B . Check Point password
- C . TACACS
- D . SecurlD
Correct Answer: D
D
Explanation:
SecurID is a Check Point supported authentication scheme that typically requires a user to possess a token. A token is a physical device that generates a one-time password that changes periodically. The user must enter the password along with their username to authenticate.
Reference: Remote Access VPN R81.20 Administration Guide, page 30.
D
Explanation:
SecurID is a Check Point supported authentication scheme that typically requires a user to possess a token. A token is a physical device that generates a one-time password that changes periodically. The user must enter the password along with their username to authenticate.
Reference: Remote Access VPN R81.20 Administration Guide, page 30.
Question #126
Why is a Central License the preferred and recommended method of licensing?
- A . Central Licensing is actually not supported with Gaia.
- B . Central Licensing is the only option when deploying Gaia
- C . Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed.
- D . Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.
Correct Answer: D
D
Explanation:
Central License is the preferred and recommended method of licensing because it ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. Central License allows administrators to manage licenses for all Security Gateways from one central location. If the IP address of a gateway changes, the license remains valid as long as it is connected to the same management server. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and can not be changed to any gateway if needed.
Reference: 1: Rugged Appliances 2: SmartUpdate 3: Check Point Software Deployment Options: [Anti-Virus]: [Check Point Software Blades]: [Central License]
D
Explanation:
Central License is the preferred and recommended method of licensing because it ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. Central License allows administrators to manage licenses for all Security Gateways from one central location. If the IP address of a gateway changes, the license remains valid as long as it is connected to the same management server. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and can not be changed to any gateway if needed.
Reference: 1: Rugged Appliances 2: SmartUpdate 3: Check Point Software Deployment Options: [Anti-Virus]: [Check Point Software Blades]: [Central License]
Question #127
What command would show the API server status?
- A . cpm status
- B . api restart
- C . api status
- D . show api status
Correct Answer: D
D
Explanation:
The command api status shows the API server status, including whether it is enabled or not, the port number, and the API version1.
Reference: Check Point R81 API Reference Guide
D
Explanation:
The command api status shows the API server status, including whether it is enabled or not, the port number, and the API version1.
Reference: Check Point R81 API Reference Guide
Question #128
Check Point licenses come in two forms.
What are those forms?
- A . Security Gateway and Security Management.
- B . On-premise and Public Cloud
- C . Central and Local.
- D . Access Control and Threat Prevention.
Correct Answer: C
C
Explanation:
This answer is correct because these are the two forms of Check Point licenses that are used to activate the software blades on the Security Gateways and the Security Management Servers1. A central license is a license that is attached to a Security Management Server and can be used to manage multiple Security Gateways1. A local license is a license that is attached to a specific Security Gateway and can only be used by that gateway1.
The other answers are not correct because they are either irrelevant or inaccurate options for Check Point licenses forms. Security Gateway and Security Management are not license forms, but software components that provide firewall, VPN, and other security features2. On-premise and Public Cloud are not license forms, but deployment options for Check Point products3. Access Control and Threat Prevention are not license forms, but software blades that provide different security functions.
Check Point License Guide
Check Point Software Blade Quick Licensing Guide
Check Point CloudGuard Network Security
[Check Point Software Blades]
C
Explanation:
This answer is correct because these are the two forms of Check Point licenses that are used to activate the software blades on the Security Gateways and the Security Management Servers1. A central license is a license that is attached to a Security Management Server and can be used to manage multiple Security Gateways1. A local license is a license that is attached to a specific Security Gateway and can only be used by that gateway1.
The other answers are not correct because they are either irrelevant or inaccurate options for Check Point licenses forms. Security Gateway and Security Management are not license forms, but software components that provide firewall, VPN, and other security features2. On-premise and Public Cloud are not license forms, but deployment options for Check Point products3. Access Control and Threat Prevention are not license forms, but software blades that provide different security functions.
Check Point License Guide
Check Point Software Blade Quick Licensing Guide
Check Point CloudGuard Network Security
[Check Point Software Blades]
Question #129
Which tool allows for the automatic updating of the Gaia OS and Check Point products installed on the Gaia OS?
- A . CPASE – Check Point Automatic Service Engine
- B . CPAUE – Check Point Automatic Update Engine
- C . CPDAS – Check Point Deployment Agent Service
- D . CPUSE – Check Point Upgrade Service Engine
Correct Answer: D
D
Explanation:
CPUSE – Check Point Upgrade Service Engine is the tool that allows for the automatic updating of the Gaia OS and Check Point products installed on the Gaia OS. CPUSE is a web-based tool that simplifies the installation of software updates, hotfixes, and upgrade packages on Gaia OS2. The other options are not valid tools for updating Gaia OS and Check Point products.
D
Explanation:
CPUSE – Check Point Upgrade Service Engine is the tool that allows for the automatic updating of the Gaia OS and Check Point products installed on the Gaia OS. CPUSE is a web-based tool that simplifies the installation of software updates, hotfixes, and upgrade packages on Gaia OS2. The other options are not valid tools for updating Gaia OS and Check Point products.
Question #130
How do logs change when the "Accounting" tracking option is enabled on a traffic rule?
- A . Involved traffic logs will be forwarded to a log server.
- B . Provides log details view email to the Administrator.
- C . Involved traffic logs are updated every 10 minutes to show how much data has passed on the connection.
- D . Provides additional information to the connected user.
Correct Answer: C
C
Explanation:
The Accounting tracking option is used to monitor the amount of data that passes through a connection. When this option is enabled on a traffic rule, the involved traffic logs are updated every 10 minutes to show how much data has passed on the connection. This information can be used for billing or auditing purposes3.
Reference: Check Point R81 Logging and Monitoring Administration Guide
C
Explanation:
The Accounting tracking option is used to monitor the amount of data that passes through a connection. When this option is enabled on a traffic rule, the involved traffic logs are updated every 10 minutes to show how much data has passed on the connection. This information can be used for billing or auditing purposes3.
Reference: Check Point R81 Logging and Monitoring Administration Guide