Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #171
What is the user ID of a user that have all the privileges of a root user?
- A . User ID 1
- B . User ID 2
- C . User ID 0
- D . User ID 99
Correct Answer: C
C
Explanation:
The user ID (UID) of a user that has all the privileges of a root user is 0. The root user is the superuser account that can perform any action on the system, such as changing file ownership, binding to network ports below 1024, or executing any command. The root user is identified by the UID 0, not by the name “root”, which is just a convention. It is possible to have another user account with the name “root”, but not with the same UID 0.
C
Explanation:
The user ID (UID) of a user that has all the privileges of a root user is 0. The root user is the superuser account that can perform any action on the system, such as changing file ownership, binding to network ports below 1024, or executing any command. The root user is identified by the UID 0, not by the name “root”, which is just a convention. It is possible to have another user account with the name “root”, but not with the same UID 0.
Question #172
Using AD Query, the security gateway connections to the Active Directory Domain Controllers using what protocol?
- A . Windows Management Instrumentation (WMI)
- B . Hypertext Transfer Protocol Secure (HTTPS)
- C . Lightweight Directory Access Protocol (LDAP)
- D . Remote Desktop Protocol (RDP)
Correct Answer: C
C
Explanation:
Using AD Query, the security gateway connections to the Active Directory Domain Controllers using
LDAP (Lightweight Directory Access Protocol). The other protocols are not used for this purpose.
Reference: [Check Point R81 Identity Awareness Administration Guide], page 14.
C
Explanation:
Using AD Query, the security gateway connections to the Active Directory Domain Controllers using
LDAP (Lightweight Directory Access Protocol). The other protocols are not used for this purpose.
Reference: [Check Point R81 Identity Awareness Administration Guide], page 14.
Question #173
Which of the following is NOT a type of Endpoint Identity Agent?
- A . Custom
- B . Terminal
- C . Full
- D . Light
Correct Answer: A
A
Explanation:
There are three types of Endpoint Identity Agents: Full, Light, and Terminal. Custom is not a valid type2.
Reference: 2: Check Point R81 Endpoint Security Administration Guide, page 18.
A
Explanation:
There are three types of Endpoint Identity Agents: Full, Light, and Terminal. Custom is not a valid type2.
Reference: 2: Check Point R81 Endpoint Security Administration Guide, page 18.
Question #173
Which of the following is NOT a type of Endpoint Identity Agent?
- A . Custom
- B . Terminal
- C . Full
- D . Light
Correct Answer: A
A
Explanation:
There are three types of Endpoint Identity Agents: Full, Light, and Terminal. Custom is not a valid type2.
Reference: 2: Check Point R81 Endpoint Security Administration Guide, page 18.
A
Explanation:
There are three types of Endpoint Identity Agents: Full, Light, and Terminal. Custom is not a valid type2.
Reference: 2: Check Point R81 Endpoint Security Administration Guide, page 18.
Question #175
Which command shows detailed information about VPN tunnels?
- A . cat $FWDIR/conf/vpn.conf
- B . vpn tu tlist
- C . vpn tu
- D . cpview
Correct Answer: C
C
Explanation:
The correct command to show detailed information about VPN tunnels is vpn tu.
vpn tu is an interactive command that provides detailed VPN tunnel status and allows you to clear specific VPN-related connections.
vpn tu tlist (Option B) is not a valid command.
cat $FWDIR/conf/vpn.conf (Option A) only displays configuration settings but does not provide real-time VPN tunnel details.
cpview (Option D) is a general system monitoring tool and does not focus specifically on VPN tunnels.
Thus, the correct answer is C. vpn tu.
Reference: Check Point documentation confirms vpn tu is the primary tool for managing VPN tunnels.
C
Explanation:
The correct command to show detailed information about VPN tunnels is vpn tu.
vpn tu is an interactive command that provides detailed VPN tunnel status and allows you to clear specific VPN-related connections.
vpn tu tlist (Option B) is not a valid command.
cat $FWDIR/conf/vpn.conf (Option A) only displays configuration settings but does not provide real-time VPN tunnel details.
cpview (Option D) is a general system monitoring tool and does not focus specifically on VPN tunnels.
Thus, the correct answer is C. vpn tu.
Reference: Check Point documentation confirms vpn tu is the primary tool for managing VPN tunnels.
Question #176
Where is the “Hit Count” feature enabled or disabled in SmartConsole?
- A . On the Policy Package
- B . On each Security Gateway
- C . On the Policy layer
- D . In Global Properties for the Security Management Server
Correct Answer: C
C
Explanation:
The “Hit Count” feature is enabled or disabled on the Policy layer in SmartConsole1. To enable or disable the “Hit Count” feature, right-click on the Policy layer and select “Edit Layer”. Then, check or uncheck the “Enable Hit Count” option1.
Reference: Solved: Hit Count in R80.x
C
Explanation:
The “Hit Count” feature is enabled or disabled on the Policy layer in SmartConsole1. To enable or disable the “Hit Count” feature, right-click on the Policy layer and select “Edit Layer”. Then, check or uncheck the “Enable Hit Count” option1.
Reference: Solved: Hit Count in R80.x
Question #177
What licensing feature automatically verifies current licenses and activates new licenses added to the License and Contracts repository?
- A . Automatic Licensing and Verification tool
- B . Verification licensing
- C . Verification tool
- D . Automatic licensing
Correct Answer: A
A
Explanation:
Check Point provides an Automatic Licensing and Verification tool that ensures licenses are properly validated. This tool:
Automatically checks current licenses against Check Point’s online license repository.
Activates newly added licenses.
Ensures compliance with active contracts.
Option B (incorrect): "Verification licensing" is not an official Check Point feature.
Option C (incorrect): "Verification tool" is too generic and does not refer to Check Point’s licensing
system.
Option D (incorrect): "Automatic licensing" does not fully describe the verification and activation process.
Thus, the correct answer is
A
Explanation:
Check Point provides an Automatic Licensing and Verification tool that ensures licenses are properly validated. This tool:
Automatically checks current licenses against Check Point’s online license repository.
Activates newly added licenses.
Ensures compliance with active contracts.
Option B (incorrect): "Verification licensing" is not an official Check Point feature.
Option C (incorrect): "Verification tool" is too generic and does not refer to Check Point’s licensing
system.
Option D (incorrect): "Automatic licensing" does not fully describe the verification and activation process.
Thus, the correct answer is
Question #178
Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?
- A . Active Directory Query
- B . User Directory Query
- C . Account Unit Query
- D . UserCheck
Correct Answer: A
A
Explanation:
Active Directory Query is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers. Active Directory Query enables the Security Gateway to query the Active Directory Domain Controllers for user and computer information, such as IP addresses, group memberships, and login events.
Reference: Check Point R81 Identity Awareness Administration Guide, page 14.
A
Explanation:
Active Directory Query is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers. Active Directory Query enables the Security Gateway to query the Active Directory Domain Controllers for user and computer information, such as IP addresses, group memberships, and login events.
Reference: Check Point R81 Identity Awareness Administration Guide, page 14.
Question #179
Which of the following blades is NOT subscription-based and therefore does not have to be renewed on a regular basis?
- A . Application Control
- B . Threat Emulation
- C . Anti-Virus
- D . Advanced Networking Blade
Correct Answer: D
D
Explanation:
The Advanced Networking Blade is NOT subscription-based and therefore does not have to be renewed on a regular basis1011. The Advanced Networking Blade provides advanced routing capabilities such as BGP, OSPF, VRRP, and multicast routing10. The other blades are subscription-based and require annual renewal to receive updates and support from Check Point1012.
Reference: Check Point License Guide, IPS Software Blade contracts, Product Catalog
D
Explanation:
The Advanced Networking Blade is NOT subscription-based and therefore does not have to be renewed on a regular basis1011. The Advanced Networking Blade provides advanced routing capabilities such as BGP, OSPF, VRRP, and multicast routing10. The other blades are subscription-based and require annual renewal to receive updates and support from Check Point1012.
Reference: Check Point License Guide, IPS Software Blade contracts, Product Catalog
Question #180
The “Hit count” feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits even if the Track option is set to “None”?
- A . No, it will not work independently. Hit Count will be shown only for rules with Track options set as Log or alert
- B . Yes, it will work independently as long as “analyze all rules” tick box is enabled on the Security Gateway
- C . No, it will not work independently because hit count requires all rules to be logged
- D . Yes, it will work independently because when you enable Hit Count, the SMS collects the data from supported Security Gateways
Correct Answer: D
D
Explanation:
The Hit count feature will work independently from logging and track the hits even if the Track option is set to “None”1, p. 23. When you enable Hit Count, the Security Management Server collects the data from supported Security Gateways and displays the number of connections that each rule matches in SmartConsole3.
Reference: Check Point CCSA – R81: Practice Test & Explanation, Check Point Security Management Administration Guide R81
D
Explanation:
The Hit count feature will work independently from logging and track the hits even if the Track option is set to “None”1, p. 23. When you enable Hit Count, the Security Management Server collects the data from supported Security Gateways and displays the number of connections that each rule matches in SmartConsole3.
Reference: Check Point CCSA – R81: Practice Test & Explanation, Check Point Security Management Administration Guide R81