Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #140
To view the policy installation history for each gateway, which tool would an administrator use?
- A . Revisions
- B . Gateway installations
- C . Installation history
- D . Gateway history
Correct Answer: C
C
Explanation:
To view the policy installation history for each gateway, an administrator would use the Installation history tool1, p. 22. The Installation history tool shows the date and time of each policy installation, the name of the administrator who installed it, and the status of the installation3. Revisions, Gateway installations, and Gateway history are not valid tools in SmartConsole.
Reference: Check Point CCSA –
R81: Practice Test & Explanation, Check Point SmartConsole R81 Help
C
Explanation:
To view the policy installation history for each gateway, an administrator would use the Installation history tool1, p. 22. The Installation history tool shows the date and time of each policy installation, the name of the administrator who installed it, and the status of the installation3. Revisions, Gateway installations, and Gateway history are not valid tools in SmartConsole.
Reference: Check Point CCSA –
R81: Practice Test & Explanation, Check Point SmartConsole R81 Help
Question #142
Name one limitation of using Security Zones in the network?
- A . Security zones will not work in Automatic NAT rules
- B . Security zone will not work in Manual NAT rules
- C . Security zones will not work in firewall policy layer
- D . Security zones cannot be used in network topology
Correct Answer: B
B
Explanation:
One limitation of using Security Zones in the network is that Security Zones will not work in Manual NAT rules. Manual NAT rules are rules that explicitly define how to translate the source and destination IP addresses and ports of each connection. Manual NAT rules do not support using Security Zones as objects, only network objects or groups. Automatic NAT rules are rules that automatically define how to translate the source and destination IP addresses and ports of each connection based on the network objects or groups properties. Automatic NAT rules support using Security Zones as objects. Security Zones can also work in firewall policy layer and network topology.
Reference: [Security Zones Best Practices], [NAT Methods]
B
Explanation:
One limitation of using Security Zones in the network is that Security Zones will not work in Manual NAT rules. Manual NAT rules are rules that explicitly define how to translate the source and destination IP addresses and ports of each connection. Manual NAT rules do not support using Security Zones as objects, only network objects or groups. Automatic NAT rules are rules that automatically define how to translate the source and destination IP addresses and ports of each connection based on the network objects or groups properties. Automatic NAT rules support using Security Zones as objects. Security Zones can also work in firewall policy layer and network topology.
Reference: [Security Zones Best Practices], [NAT Methods]
Question #143
You are the Check Point administrator for Alpha Corp. You received a call that one of the users is unable to browse the Internet on their new tablet which is connected to the company wireless, which goes through a Check Point Gateway.
How would you review the logs to see what is blocking this traffic?
- A . Open SmartLog and connect remotely to the wireless controller
- B . Open SmartEvent to see why they are being blocked
- C . Open SmartDashboard and review the logs tab
- D . From SmartConsole, go to the Log & Monitor and filter for the IP address of the tablet.
Correct Answer: D
D
Explanation:
From SmartConsole, go to the Log & Monitor and filter for the IP address of the tablet is the correct answer. This is because the Log & Monitor view in SmartConsole allows you to view and analyze logs and events from various sources, such as Security Gateways, Security Management Servers, and SmartEvent Servers. You can use filters to search for specific logs and events based on different criteria, such as source IP, destination IP, action, time, etc.
Reference: [Logging and Monitoring Administration Guide R80.20]
D
Explanation:
From SmartConsole, go to the Log & Monitor and filter for the IP address of the tablet is the correct answer. This is because the Log & Monitor view in SmartConsole allows you to view and analyze logs and events from various sources, such as Security Gateways, Security Management Servers, and SmartEvent Servers. You can use filters to search for specific logs and events based on different criteria, such as source IP, destination IP, action, time, etc.
Reference: [Logging and Monitoring Administration Guide R80.20]
Question #144
What is the purpose of a Clean-up Rule?
- A . Clean-up Rules do not server any purpose.
- B . Provide a metric for determining unnecessary rules.
- C . To drop any traffic that is not explicitly allowed.
- D . Used to better optimize a policy.
Correct Answer: C
C
Explanation:
A clean-up rule is a rule that is placed at the end of the security policy to drop any traffic that is not explicitly allowed by the previous rules. It is a best practice to have a clean-up rule to prevent unauthorized access and log the dropped packets for analysis12. The other options are not the purpose of a clean-up rule.
Reference: Clean-up Rule, Check Point CCSA – R81: Practice Test & Explanation
C
Explanation:
A clean-up rule is a rule that is placed at the end of the security policy to drop any traffic that is not explicitly allowed by the previous rules. It is a best practice to have a clean-up rule to prevent unauthorized access and log the dropped packets for analysis12. The other options are not the purpose of a clean-up rule.
Reference: Clean-up Rule, Check Point CCSA – R81: Practice Test & Explanation
Question #145
Which of the following is NOT a component of a Distinguished Name?
- A . Common Name
- B . Country
- C . User container
- D . Organizational Unit
Correct Answer: C
C
Explanation:
A Distinguished Name (DN) is a unique identifier for an entry in an LDAP directory. A DN consists of a
sequence of relative distinguished names (RDNs) separated by commas. Each RDN is composed of an attribute type and an attribute value, such as cn=John Smith or ou=Sales. A DN can have different components depending on the structure and schema of the LDAP directory, but some common components are: Common Name (cn), Country ©, Organizational Unit (ou), Organization (o), State or Province (st), and Locality (l). User container is not a component of a DN3.
Reference: Check Point R81 Identity Awareness Administration Guide
C
Explanation:
A Distinguished Name (DN) is a unique identifier for an entry in an LDAP directory. A DN consists of a
sequence of relative distinguished names (RDNs) separated by commas. Each RDN is composed of an attribute type and an attribute value, such as cn=John Smith or ou=Sales. A DN can have different components depending on the structure and schema of the LDAP directory, but some common components are: Common Name (cn), Country ©, Organizational Unit (ou), Organization (o), State or Province (st), and Locality (l). User container is not a component of a DN3.
Reference: Check Point R81 Identity Awareness Administration Guide
Question #146
To quickly review when Threat Prevention signatures were last updated, which Threat Tool would an administrator use?
- A . Protections
- B . IPS Protections
- C . Profiles
- D . ThreatWiki
Correct Answer: B
B
Explanation:
According to the Learn More About Threat Signatures4, to quickly review when Threat Prevention signatures were last updated, you can use the IPS Protections tool. This tool shows you the date and time of the last update, as well as the number of signatures and their categories.
Reference: Learn More About Threat Signatures
B
Explanation:
According to the Learn More About Threat Signatures4, to quickly review when Threat Prevention signatures were last updated, you can use the IPS Protections tool. This tool shows you the date and time of the last update, as well as the number of signatures and their categories.
Reference: Learn More About Threat Signatures
Question #147
Which Threat Prevention profile uses sanitization technology?
- A . Cloud/data Center
- B . perimeter
- C . Sandbox
- D . Guest Network
Correct Answer: B
B
Explanation:
Threat Prevention is a comprehensive solution that protects networks from malicious attacks by using multiple security blades, such as Anti-Bot, Anti-Virus, IPS, Threat Emulation, and Threat Extraction. A Threat Prevention profile defines the actions and settings for each blade and can be applied to different network segments or scenarios. The Perimeter profile is one of the predefined profiles that uses sanitization technology to protect users from malicious files and links. Sanitization technology includes Threat Emulation and Threat Extraction blades, which can detect and remove malware from files and web content.
Reference: [Check Point R81 Threat Prevention Administration Guide]
B
Explanation:
Threat Prevention is a comprehensive solution that protects networks from malicious attacks by using multiple security blades, such as Anti-Bot, Anti-Virus, IPS, Threat Emulation, and Threat Extraction. A Threat Prevention profile defines the actions and settings for each blade and can be applied to different network segments or scenarios. The Perimeter profile is one of the predefined profiles that uses sanitization technology to protect users from malicious files and links. Sanitization technology includes Threat Emulation and Threat Extraction blades, which can detect and remove malware from files and web content.
Reference: [Check Point R81 Threat Prevention Administration Guide]
Question #148
In HTTPS Inspection policy, what actions are available in the "Actions" column of a rule?
- A . "Inspect", "Bypass"
- B . "Inspect", "Bypass", "Categorize"
- C . "Inspect", "Bypass", "Block"
- D . "Detect", "Bypass"
Correct Answer: A
A
Explanation:
The actions available in the “Actions” column of a rule in HTTPS Inspection policy are “Inspect” and “Bypass”. “Inspect” means that the HTTPS traffic will be decrypted and inspected according to the Access Control policy. “Bypass” means that the HTTPS traffic will not be decrypted and will be allowed without inspection1. The other options are not valid actions for HTTPS Inspection policy.
A
Explanation:
The actions available in the “Actions” column of a rule in HTTPS Inspection policy are “Inspect” and “Bypass”. “Inspect” means that the HTTPS traffic will be decrypted and inspected according to the Access Control policy. “Bypass” means that the HTTPS traffic will not be decrypted and will be allowed without inspection1. The other options are not valid actions for HTTPS Inspection policy.
Question #149
Bob and Joe both have Administrator Roles on their Gaia Platform. Bob logs in on the WebUI and then Joe logs in through CLI.
Choose what BEST describes the following scenario, where Bob and Joe are both logged in:
- A . Since they both are logged in on different interfaces, they will both be able to make changes.
- B . When Joe logs in. Bob will be logged out automatically.
- C . The database will be locked by Bob and Joe will not be able to make any changes.
- D . Bob will receive a prompt that Joe has logged in.
Correct Answer: A
A
Explanation:
Since Bob and Joe both have Administrator Roles on their Gaia Platform and they both are logged in on different interfaces, they will both be able to make changes. Gaia allows multiple administrators to log in simultaneously and perform different tasks without locking the database or logging out each other.
Reference: Gaia R81.20 Administration Guide, page 18.
A
Explanation:
Since Bob and Joe both have Administrator Roles on their Gaia Platform and they both are logged in on different interfaces, they will both be able to make changes. Gaia allows multiple administrators to log in simultaneously and perform different tasks without locking the database or logging out each other.
Reference: Gaia R81.20 Administration Guide, page 18.
Question #150
Choose what BEST describes the reason why querying logs now are very fast.
- A . The amount of logs being stored is less than previous versions.
- B . New Smart-1 appliances double the physical memory install.
- C . Indexing Engine indexes logs for faster search results.
- D . SmartConsole now queries results directly from the Security Gateway.
Correct Answer: C
C
Explanation:
The reason why querying logs now are very fast is that Indexing Engine indexes logs for faster search results. Indexing Engine is a component of R81 Management that creates and maintains an index of log data, which enables quick and efficient log searches4. The other options are not related to the speed of log querying. The amount of logs being stored may vary depending on the log retention settings. New Smart-1 appliances may have improved hardware specifications, but they do not affect the log querying process directly. SmartConsole queries results from the Security Management Server, not from the Security Gateway.
Reference: 1: HTTPS Inspection 2: Browser-Based Authentication 3: URL Filtering 4: Indexing Engine
C
Explanation:
The reason why querying logs now are very fast is that Indexing Engine indexes logs for faster search results. Indexing Engine is a component of R81 Management that creates and maintains an index of log data, which enables quick and efficient log searches4. The other options are not related to the speed of log querying. The amount of logs being stored may vary depending on the log retention settings. New Smart-1 appliances may have improved hardware specifications, but they do not affect the log querying process directly. SmartConsole queries results from the Security Management Server, not from the Security Gateway.
Reference: 1: HTTPS Inspection 2: Browser-Based Authentication 3: URL Filtering 4: Indexing Engine