Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #161
One of major features in R80.x SmartConsole is concurrent administration.
Which of the following is NOT possible considering that AdminA, AdminB, and AdminC are editing the same Security Policy?
- A . AdminC sees a lock icon which indicates that the rule is locked for editing by another administrator.
- B . AdminA and AdminB are editing the same rule at the same time.
- C . AdminB sees a pencil icon next the rule that AdminB is currently editing.
- D . AdminA, AdminB and AdminC are editing three different rules at the same time.
Correct Answer: B
B
Explanation:
One of the major features in R80.x SmartConsole is concurrent administration, which allows multiple administrators to work on the same Security Policy at the same time12. However, only one administrator can edit a rule at a time. If AdminA and AdminB are editing the same rule at the same time, it will cause a conflict and prevent them from saving their changes12. Therefore, the correct answer is B. AdminA and AdminB are editing the same rule at the same time.
B
Explanation:
One of the major features in R80.x SmartConsole is concurrent administration, which allows multiple administrators to work on the same Security Policy at the same time12. However, only one administrator can edit a rule at a time. If AdminA and AdminB are editing the same rule at the same time, it will cause a conflict and prevent them from saving their changes12. Therefore, the correct answer is B. AdminA and AdminB are editing the same rule at the same time.
Question #162
What is required for a certificate-based VPN tunnel between two gateways with separate
management systems?
- A . Shared Secret Passwords
- B . Unique Passwords
- C . Shared User Certificates
- D . Mutually Trusted Certificate Authorities
Correct Answer: D
D
Explanation:
This answer is correct because for a certificate-based VPN tunnel, both gateways need to have a certificate issued by a certificate authority (CA) that they trust1. A CA is a trusted entity that verifies the identity of the gateways and signs their certificates2. The gateways can either use the same CA or different CAs, as long as they trust each other’s CA3. This way, the gateways can authenticate each other using their certificates and establish a secure VPN tunnel.
The other answers are not correct because they are either irrelevant or incompatible with certificate-based VPN tunnel. Shared secret passwords and unique passwords are used for pre-shared key (PSK) authentication, which is a different method than certificate authentication4. PSK authentication is less secure and more vulnerable to brute force attacks than certificate authentication. Shared user certificates are not used for gateway authentication, but for user authentication, which is a different level of authentication than gateway authentication. User authentication is optional and can be used in addition to gateway authentication to provide more granular access control.
Configure server settings for P2S VPN Gateway connections – certificate authentication VPN certificates and how they work
Create Certificate Based Site to Site VPN between 2 Check Point Gateways HowTo Set Up Certificate Based VPNs with Check Point Appliances
D
Explanation:
This answer is correct because for a certificate-based VPN tunnel, both gateways need to have a certificate issued by a certificate authority (CA) that they trust1. A CA is a trusted entity that verifies the identity of the gateways and signs their certificates2. The gateways can either use the same CA or different CAs, as long as they trust each other’s CA3. This way, the gateways can authenticate each other using their certificates and establish a secure VPN tunnel.
The other answers are not correct because they are either irrelevant or incompatible with certificate-based VPN tunnel. Shared secret passwords and unique passwords are used for pre-shared key (PSK) authentication, which is a different method than certificate authentication4. PSK authentication is less secure and more vulnerable to brute force attacks than certificate authentication. Shared user certificates are not used for gateway authentication, but for user authentication, which is a different level of authentication than gateway authentication. User authentication is optional and can be used in addition to gateway authentication to provide more granular access control.
Configure server settings for P2S VPN Gateway connections – certificate authentication VPN certificates and how they work
Create Certificate Based Site to Site VPN between 2 Check Point Gateways HowTo Set Up Certificate Based VPNs with Check Point Appliances
Question #163
When using Monitored circuit VRRP, what is a priority delta?
- A . When an interface fails the priority changes to the priority delta
- B . When an interface fails the delta claims the priority
- C . When an interface fails the priority delta is subtracted from the priority
- D . When an interface fails the priority delta decides if the other interfaces takes over
Correct Answer: C
C
Explanation:
When using Monitored circuit VRRP, the priority delta is the value that is subtracted from the priority of a cluster member when one of its monitored interfaces fails2. For example, if the priority of a cluster member is 100 and the priority delta is 10, then when one of its monitored interfaces fails, its priority becomes 90.
Reference: Check Point R81 ClusterXL Administration Guide
C
Explanation:
When using Monitored circuit VRRP, the priority delta is the value that is subtracted from the priority of a cluster member when one of its monitored interfaces fails2. For example, if the priority of a cluster member is 100 and the priority delta is 10, then when one of its monitored interfaces fails, its priority becomes 90.
Reference: Check Point R81 ClusterXL Administration Guide
Question #164
In order to modify Security Policies, the administrator can use which of the following tools? (Choose the best answer.)
- A . SmartConsole and WebUI on the Security Management Server.
- B . SmartConsole or mgmt_cli (API) on any computer where SmartConsole is installed.
- C . Command line of the Security Management Server or mgmt_cli.exe on any Windows computer.
- D . mgmt_cli (API) or WebUI on Security Gateway and SmartConsole on the Security Management Server.
Correct Answer: B
B
Explanation:
In order to modify Security Policies, the administrator can use SmartConsole or mgmt_cli (API) on any computer where SmartConsole is installed. SmartConsole is a graphical tool that allows the administrator to create, edit, and manage security policies using a web browser. mgmt_cli (API) is a command-line tool that allows the administrator to perform the same tasks using commands and scripts. Both tools can connect to the Security Management Server remotely from any computer that has SmartConsole installed.
Reference: [SmartConsole Overview], [mgmt_cli (API)]
B
Explanation:
In order to modify Security Policies, the administrator can use SmartConsole or mgmt_cli (API) on any computer where SmartConsole is installed. SmartConsole is a graphical tool that allows the administrator to create, edit, and manage security policies using a web browser. mgmt_cli (API) is a command-line tool that allows the administrator to perform the same tasks using commands and scripts. Both tools can connect to the Security Management Server remotely from any computer that has SmartConsole installed.
Reference: [SmartConsole Overview], [mgmt_cli (API)]
Question #165
When a gateway requires user information for authentication, what order does it query servers for user information?
- A . First – Internal user database, then LDAP servers in order of priority, finally the generic external user profile
- B . First the Internal user database, then generic external user profile, finally LDAP servers in order of priority.
- C . First the highest priority LDAP server, then the internal user database, then lower priority LDAP servers, finally the generic external profile
- D . The external generic profile, then the internal user database finally the LDAP servers in order of
priority.
Correct Answer: B
B
Explanation:
When a gateway requires user information for authentication, it queries servers for user information in the following order: first the internal user database, then the generic external user profile, and finally LDAP servers in order of priority. The internal user database is a local database that stores user information on the Security Gateway or Security Management Server. The generic external user profile is a predefined profile that allows users to authenticate with any external server that supports RADIUS or TACACS protocols. LDAP servers are external servers that use the Lightweight Directory Access Protocol to store and retrieve user information. The gateway queries LDAP servers according to the priority that is defined in the LDAP Account Unit object properties.
B
Explanation:
When a gateway requires user information for authentication, it queries servers for user information in the following order: first the internal user database, then the generic external user profile, and finally LDAP servers in order of priority. The internal user database is a local database that stores user information on the Security Gateway or Security Management Server. The generic external user profile is a predefined profile that allows users to authenticate with any external server that supports RADIUS or TACACS protocols. LDAP servers are external servers that use the Lightweight Directory Access Protocol to store and retrieve user information. The gateway queries LDAP servers according to the priority that is defined in the LDAP Account Unit object properties.
Question #166
What Identity Agent allows packet tagging and computer authentication?
- A . Endpoint Security Client
- B . Full Agent
- C . Light Agent
- D . System Agent
Correct Answer: B
B
Explanation:
The Full Identity Agent allows packet tagging and computer authentication2. Packet tagging is a feature that enables the Security Gateway to identify the source user and machine of each packet, regardless of NAT or routing. Computer authentication is a feature that enables the Security Gateway to authenticate machines that are not associated with any user, such as servers or unattended workstations. The other options are incorrect. Endpoint Security Client is not an Identity Agent, but a software that provides endpoint security features such as firewall, antivirus, VPN, etc. Light Agent is an Identity Agent that does not require installation and runs on a web browser, but it does not support packet tagging or computer authentication. System Agent is not an Identity Agent, but a software that provides system information and health monitoring for endpoints.
Reference: Check Point Identity Agent for Microsoft Windows 10
B
Explanation:
The Full Identity Agent allows packet tagging and computer authentication2. Packet tagging is a feature that enables the Security Gateway to identify the source user and machine of each packet, regardless of NAT or routing. Computer authentication is a feature that enables the Security Gateway to authenticate machines that are not associated with any user, such as servers or unattended workstations. The other options are incorrect. Endpoint Security Client is not an Identity Agent, but a software that provides endpoint security features such as firewall, antivirus, VPN, etc. Light Agent is an Identity Agent that does not require installation and runs on a web browser, but it does not support packet tagging or computer authentication. System Agent is not an Identity Agent, but a software that provides system information and health monitoring for endpoints.
Reference: Check Point Identity Agent for Microsoft Windows 10
Question #167
Fill in the blank: In Security Gateways R75 and above, SIC uses ______________ for encryption.
- A . AES-128
- B . AES-256
- C . DES
- D . 3DES
Correct Answer: A
A
Explanation:
In Security Gateways R75 and above, SIC uses AES-128 for encryption. SIC stands for Secure Internal Communication, which is a mechanism that establishes trust between Check Point components, such as Security Gateways, Security Management Servers, Log Servers, etc. SIC uses certificates to authenticate and encrypt the communication between the components. AES-128 is an encryption algorithm that uses a 128-bit key to encrypt and decrypt data. The other options are incorrect. AES-256 is an encryption algorithm that uses a 256-bit key, but it is not used by SIC. DES and 3DES are older encryption algorithms that use 56-bit and 168-bit keys respectively, but they are not used by SIC either.
Reference: [Secure Internal Communication (SIC) between Check Point components], AES – Wikipedia, DES – Wikipedia, Triple DES – Wikipedia
A
Explanation:
In Security Gateways R75 and above, SIC uses AES-128 for encryption. SIC stands for Secure Internal Communication, which is a mechanism that establishes trust between Check Point components, such as Security Gateways, Security Management Servers, Log Servers, etc. SIC uses certificates to authenticate and encrypt the communication between the components. AES-128 is an encryption algorithm that uses a 128-bit key to encrypt and decrypt data. The other options are incorrect. AES-256 is an encryption algorithm that uses a 256-bit key, but it is not used by SIC. DES and 3DES are older encryption algorithms that use 56-bit and 168-bit keys respectively, but they are not used by SIC either.
Reference: [Secure Internal Communication (SIC) between Check Point components], AES – Wikipedia, DES – Wikipedia, Triple DES – Wikipedia
Question #168
Which back up method uses the command line to create an image of the OS?
- A . System backup
- B . Save Configuration
- C . Migrate
- D . snapshot
Correct Answer: D
D
Explanation:
According to the Hewlett Packard Enterprise Support Center3, the snapshot command uses the command line to create an image of the OS. A snapshot is a point-in-time copy of a disk partition that can be used to restore the system in case of a failure or corruption.
Reference: Hewlett Packard Enterprise Support Center
D
Explanation:
According to the Hewlett Packard Enterprise Support Center3, the snapshot command uses the command line to create an image of the OS. A snapshot is a point-in-time copy of a disk partition that can be used to restore the system in case of a failure or corruption.
Reference: Hewlett Packard Enterprise Support Center
Question #169
The Online Activation method is available for Check Point manufactured appliances.
How does the administrator use the Online Activation method?
- A . The SmartLicensing GUI tool must be launched from the SmartConsole for the Online Activation tool to start automatically.
- B . No action is required if the firewall has internet access and a DNS server to resolve domain names.
- C . Using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts.
- D . The cpinfo command must be run on the firewall with the switch -online-license-activation.
Correct Answer: C
C
Explanation:
The Online Activation method is available for Check Point manufactured appliances. The administrator uses the Online Activation method by using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts. This method requires internet access and a valid User Center account.
Reference: [Check Point Licensing and Contract Operations User Guide], [Check Point R81 Gaia Installation and Upgrade Guide]
C
Explanation:
The Online Activation method is available for Check Point manufactured appliances. The administrator uses the Online Activation method by using the Gaia First Time Configuration Wizard, the appliance connects to the Check Point User Center and downloads all necessary licenses and contracts. This method requires internet access and a valid User Center account.
Reference: [Check Point Licensing and Contract Operations User Guide], [Check Point R81 Gaia Installation and Upgrade Guide]
Question #170
Fill in the blank: In order to install a license, it must first be added to the ____________.
- A . User Center
- B . Package repository
- C . Download Center Web site
- D . License and Contract repository
Correct Answer: D
D
Explanation:
In order to install a license, it must first be added to the License and Contract repository. The License and Contract repository is a centralized database that stores all the licenses and contracts for Check Point products. It allows you to manage, activate, and attach licenses to your Check Point products.
Reference: Check Point Security Management Administration Guide R81, p. 19-20
D
Explanation:
In order to install a license, it must first be added to the License and Contract repository. The License and Contract repository is a centralized database that stores all the licenses and contracts for Check Point products. It allows you to manage, activate, and attach licenses to your Check Point products.
Reference: Check Point Security Management Administration Guide R81, p. 19-20