Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #181
What are the Threat Prevention software components available on the Check Point Security Gateway?
- A . IPS, Threat Emulation and Threat Extraction
- B . IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction
- C . IPS, Anti-Bot, Anti-Virus, Threat Emulation and Threat Extraction
- D . IDS, Forensics, Anti-Virus, Sandboxing
Correct Answer: C
C
Explanation:
Threat Prevention is a comprehensive solution that protects networks from malicious attacks by using multiple security blades, such as Anti-Bot, Anti-Virus, IPS, Threat Emulation, and Threat Extraction. These are the Threat Prevention software components available on the Check Point Security Gateway. IPS (Intrusion Prevention System) is a blade that detects and prevents network attacks by using signatures and behavioral patterns. Anti-Bot is a blade that detects and blocks botnet communications by using reputation services and heuristics. Anti-Virus is a blade that scans files and web content for malware by using signatures and emulation. Threat Emulation is a blade that analyzes suspicious files in a sandbox environment and blocks malicious files from entering the network. Threat Extraction is a blade that removes exploitable content from files and delivers clean files to users2.
Reference: Check Point R81 Threat Prevention Administration Guide
C
Explanation:
Threat Prevention is a comprehensive solution that protects networks from malicious attacks by using multiple security blades, such as Anti-Bot, Anti-Virus, IPS, Threat Emulation, and Threat Extraction. These are the Threat Prevention software components available on the Check Point Security Gateway. IPS (Intrusion Prevention System) is a blade that detects and prevents network attacks by using signatures and behavioral patterns. Anti-Bot is a blade that detects and blocks botnet communications by using reputation services and heuristics. Anti-Virus is a blade that scans files and web content for malware by using signatures and emulation. Threat Emulation is a blade that analyzes suspicious files in a sandbox environment and blocks malicious files from entering the network. Threat Extraction is a blade that removes exploitable content from files and delivers clean files to users2.
Reference: Check Point R81 Threat Prevention Administration Guide
Question #182
The SIC Status “Unknown” means
- A . There is connection between the gateway and Security Management Server but it is not trusted.
- B . The secure communication is established.
- C . There is no connection between the gateway and Security Management Server.
- D . The Security Management Server can contact the gateway, but cannot establish SIC.
Correct Answer: C
C
Explanation:
The SIC Status “Unknown” means that there is no connection between the gateway and Security Management Server. This can happen if the gateway is down, unreachable, or has not been initialized yet12.
Reference: Check Point R81 Security Management Administration Guide, Free Check
Point CCSA Sample Questions and Study Guide
C
Explanation:
The SIC Status “Unknown” means that there is no connection between the gateway and Security Management Server. This can happen if the gateway is down, unreachable, or has not been initialized yet12.
Reference: Check Point R81 Security Management Administration Guide, Free Check
Point CCSA Sample Questions and Study Guide
Question #183
Which of the following Windows Security Events will NOT map a username to an IP address in Identity Awareness?
- A . Kerberos Ticket Renewed
- B . Kerberos Ticket Requested
- C . Account Logon
- D . Kerberos Ticket Timed Out
Correct Answer: D
D
Explanation:
The Windows Security Event that will NOT map a username to an IP address in Identity Awareness is Kerberos Ticket Timed Out. This event occurs when a Kerberos ticket expires and is not renewed, which means that the user is no longer active on the network. Identity Awareness does not use this event to map a username to an IP address, as it does not indicate a valid user session. The other events are used by Identity Awareness to map a username to an IP address, as they indicate a successful user authentication or activity on the network.
Reference: [Kerberos Ticket Expiration and Renewal], [Identity Awareness AD Query]
D
Explanation:
The Windows Security Event that will NOT map a username to an IP address in Identity Awareness is Kerberos Ticket Timed Out. This event occurs when a Kerberos ticket expires and is not renewed, which means that the user is no longer active on the network. Identity Awareness does not use this event to map a username to an IP address, as it does not indicate a valid user session. The other events are used by Identity Awareness to map a username to an IP address, as they indicate a successful user authentication or activity on the network.
Reference: [Kerberos Ticket Expiration and Renewal], [Identity Awareness AD Query]
Question #184
AdminA and AdminB are both logged in on SmartConsole What does it mean if AdmmB sees a lock icon on a rule? Choose the BEST answer.
- A . Rule is locked by AdminA and will be made available if the session is published
- B . Rule is locked by AdminA because the rule is currently being edited
- C . Rule is locked by AdminA and if the session is saved, the rule will be made available
- D . Rule is locked by AdminA because the save button has not been pressed
Correct Answer: A
A
Explanation:
If AdminB sees a lock icon on a rule, it means that the rule is locked by AdminA and will be made available if the session is published. A session is a set of changes made by an administrator in SmartConsole. A session can be published to save and share the changes with other administrators, or discarded to cancel the changes and unlock the objects1.
Reference: 1: Check Point R81 Security Management Administration Guide, page 18.
A
Explanation:
If AdminB sees a lock icon on a rule, it means that the rule is locked by AdminA and will be made available if the session is published. A session is a set of changes made by an administrator in SmartConsole. A session can be published to save and share the changes with other administrators, or discarded to cancel the changes and unlock the objects1.
Reference: 1: Check Point R81 Security Management Administration Guide, page 18.
Question #185
In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories.
Which of the following is NOT an objects category?
- A . Limit
- B . Resource
- C . Custom Application / Site
- D . Network Object
Correct Answer: B
B
Explanation:
Resource is NOT an objects category in SmartConsole1, p. 18. The objects categories in SmartConsole are Network Object, Host, Network, Group, Gateway, Cluster, VPN Community, Service, Time Object, Access Role, Custom Application / Site, Data Center Object, Limit.
Reference: Check Point CCSA – R81: Practice Test & Explanation, [Check Point SmartConsole R81 Help]
B
Explanation:
Resource is NOT an objects category in SmartConsole1, p. 18. The objects categories in SmartConsole are Network Object, Host, Network, Group, Gateway, Cluster, VPN Community, Service, Time Object, Access Role, Custom Application / Site, Data Center Object, Limit.
Reference: Check Point CCSA – R81: Practice Test & Explanation, [Check Point SmartConsole R81 Help]
Question #186
If there are two administrators logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available to other administrators? Choose the BEST answer
- A . Save and install the Policy
- B . Delete older versions of database
- C . Revert the session.
- D . Publish or discard the session
Correct Answer: D
D
Explanation:
If there are two administrators logged in at the same time to the SmartConsole, and there are objects locked for editing, the administrator who locked the objects must publish or discard the session to make them available to other administrators. Publishing or discarding the session will save or discard the changes made by the administrator and unlock the objects for editing by others3.
Reference: 3: Check Point R81 Security Management Administration Guide, page 18.
D
Explanation:
If there are two administrators logged in at the same time to the SmartConsole, and there are objects locked for editing, the administrator who locked the objects must publish or discard the session to make them available to other administrators. Publishing or discarding the session will save or discard the changes made by the administrator and unlock the objects for editing by others3.
Reference: 3: Check Point R81 Security Management Administration Guide, page 18.
Question #187
Which icon in the WebUI indicates that read/write access is enabled?
- A . Pencil
- B . Padlock
- C . Book
- D . Eyeglasses
Correct Answer: A
A
Explanation:
The icon in the WebUI that indicates that read/write access is enabled is the Pencil icon. The Pencil icon appears next to the name of the device when it is in Read/Write mode, which allows making changes to the configuration. The Padlock icon indicates that read-only access is enabled, which prevents making changes to the configuration. The Book icon indicates that online help is available, which provides information and guidance on using the WebUI. The Eyeglasses icon indicates that a view-only mode is enabled, which allows viewing the configuration without logging in.
Reference: Gaia R81.10 Administration Guide, WebUI Overview
A
Explanation:
The icon in the WebUI that indicates that read/write access is enabled is the Pencil icon. The Pencil icon appears next to the name of the device when it is in Read/Write mode, which allows making changes to the configuration. The Padlock icon indicates that read-only access is enabled, which prevents making changes to the configuration. The Book icon indicates that online help is available, which provides information and guidance on using the WebUI. The Eyeglasses icon indicates that a view-only mode is enabled, which allows viewing the configuration without logging in.
Reference: Gaia R81.10 Administration Guide, WebUI Overview
Question #188
How are the backups stored in Check Point appliances?
- A . Saved as*.tar under /var/log/CPbackup/backups
- B . Saved as*tgz under /var/CPbackup
- C . Saved as*tar under /var/CPbackup
- D . Saved as*tgz under /var/log/CPbackup/backups
Correct Answer: B
B
Explanation:
The backups are stored in Check Point appliances as *.tgz files under /var/CPbackup. This is the default location for backup files created by the backup command. Therefore, the correct answer is B. Saved as *.tgz under /var/CPbackup
B
Explanation:
The backups are stored in Check Point appliances as *.tgz files under /var/CPbackup. This is the default location for backup files created by the backup command. Therefore, the correct answer is B. Saved as *.tgz under /var/CPbackup
Question #189
An administrator can use section titles to more easily navigate between large rule bases.
Which of these statements is FALSE?
- A . Section titles are not sent to the gateway side.
- B . These sections are simple visual divisions of the Rule Base and do not hinder the order of rule enforcement.
- C . A Sectional Title can be used to disable multiple rules by disabling only the sectional title.
- D . Sectional Titles do not need to be created in the SmartConsole.
Correct Answer: C
C
Explanation:
The statement that a Sectional Title can be used to disable multiple rules by disabling only the sectional title is false. A Sectional Title is a visual divider that helps organize and navigate large rule bases. It does not affect the rule enforcement order or the rule functionality. Disabling a Sectional Title does not disable the rules under it. To disable multiple rules, you need to select them individually or use Shift+Click or Ctrl+Click to select them in bulk, and then right-click and choose Disable Rule(s). The other statements are true. Section titles are not sent to the gateway side, they are only displayed in SmartConsole. These sections are simple visual divisions of the Rule Base and do not hinder the order of rule enforcement. Sectional Titles do not need to be created in SmartConsole, they can also be created using SmartConsole CLI or API commands.
Reference: [Sectional Titles], [SmartConsole CLI Guide], [SmartConsole API Reference Guide]
C
Explanation:
The statement that a Sectional Title can be used to disable multiple rules by disabling only the sectional title is false. A Sectional Title is a visual divider that helps organize and navigate large rule bases. It does not affect the rule enforcement order or the rule functionality. Disabling a Sectional Title does not disable the rules under it. To disable multiple rules, you need to select them individually or use Shift+Click or Ctrl+Click to select them in bulk, and then right-click and choose Disable Rule(s). The other statements are true. Section titles are not sent to the gateway side, they are only displayed in SmartConsole. These sections are simple visual divisions of the Rule Base and do not hinder the order of rule enforcement. Sectional Titles do not need to be created in SmartConsole, they can also be created using SmartConsole CLI or API commands.
Reference: [Sectional Titles], [SmartConsole CLI Guide], [SmartConsole API Reference Guide]
Question #190
What data MUST be supplied to the SmartConsole System Restore window to restore a backup?
- A . Server, Username, Password, Path, Version
- B . Username, Password, Path, Version
- C . Server, Protocol, Username, Password, Destination Path
- D . Server, Protocol, Username, Password, Path
Correct Answer: D
D
Explanation:
According to the Check Point R81.10 SmartConsole for Windows1, to restore a backup, you need to supply the following data: Server, Protocol, Username, Password, and Path. The Server is the IP address or hostname of the Security Management Server. The Protocol is either SCP or SFTP. The Username and Password are the credentials for the Security Management Server. The Path is the location of the backup file on the Security Management Server.
Reference: Check Point R81.10 SmartConsole for Windows
D
Explanation:
According to the Check Point R81.10 SmartConsole for Windows1, to restore a backup, you need to supply the following data: Server, Protocol, Username, Password, and Path. The Server is the IP address or hostname of the Security Management Server. The Protocol is either SCP or SFTP. The Username and Password are the credentials for the Security Management Server. The Path is the location of the backup file on the Security Management Server.
Reference: Check Point R81.10 SmartConsole for Windows