Check Point 156-215.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #11
Full synchronization between cluster members is handled by Firewall Kernel.
Which port is used for this?
- A . UDP port 265
- B . TCP port 265
- C . UDP port 256
- D . TCP port 256
Correct Answer: B
B
Explanation:
The port used for full synchronization between cluster members is TCP port 2654. This port is used by the Firewall Kernel to send and receive synchronization data, such as connection tables, NAT tables, and VPN keys4. UDP port 8116 is used by the Cluster Control Protocol (CCP) for internal communications between cluster members4.
Reference: How does the Cluster Control Protocol function in working and failure scenarios for gateway clusters?
B
Explanation:
The port used for full synchronization between cluster members is TCP port 2654. This port is used by the Firewall Kernel to send and receive synchronization data, such as connection tables, NAT tables, and VPN keys4. UDP port 8116 is used by the Cluster Control Protocol (CCP) for internal communications between cluster members4.
Reference: How does the Cluster Control Protocol function in working and failure scenarios for gateway clusters?
Question #12
Identify the ports to which the Client Authentication daemon listens on by default?
- A . 259, 900
- B . 256, 257
- C . 8080, 529
- D . 80, 256
Correct Answer: A
A
Explanation:
The ports to which the Client Authentication daemon listens on by default are 259 and 900. Client Authentication is a method that allows users to authenticate with the Security Gateway before they are allowed access to protected resources. The Client Authentication daemon (fwauthd) runs on the Security Gateway and listens for authentication requests on TCP ports 259 and 900.
Reference: [Check Point R81 Remote Access VPN Administration Guide], [Check Point R81 Quantum Security Gateway Guide]
A
Explanation:
The ports to which the Client Authentication daemon listens on by default are 259 and 900. Client Authentication is a method that allows users to authenticate with the Security Gateway before they are allowed access to protected resources. The Client Authentication daemon (fwauthd) runs on the Security Gateway and listens for authentication requests on TCP ports 259 and 900.
Reference: [Check Point R81 Remote Access VPN Administration Guide], [Check Point R81 Quantum Security Gateway Guide]
Question #13
Fill in the blank: It is Best Practice to have a _____ rule at the end of each policy layer.
- A . Explicit Drop
- B . Implied Drop
- C . Explicit Cleanup
- D . Implicit Drop
Correct Answer: C
C
Explanation:
It is Best Practice to have an Explicit CleanUp rule at the end of each policy layer. This rule will log and drop any traffic that does not match any of the preceding rules in the layer1, p. 23.
Reference: Check Point CCSA – R81: Practice Test & Explanation
C
Explanation:
It is Best Practice to have an Explicit CleanUp rule at the end of each policy layer. This rule will log and drop any traffic that does not match any of the preceding rules in the layer1, p. 23.
Reference: Check Point CCSA – R81: Practice Test & Explanation
Question #14
Which SmartConsole tab is used to monitor network and security performance?
- A . Manage & Settings
- B . Security Policies
- C . Gateway & Servers
- D . Logs & Monitor
Correct Answer: D
D
Explanation:
Logs & Monitor is the SmartConsole tab that is used to monitor network and security performance. This tab allows you to view and analyze logs and events from various sources, such as Security Gateways, Security Management Servers, and SmartEvent Servers. You can also use this tab to generate reports and troubleshoot issues.
Reference: [Logging and Monitoring Administration Guide R80.20]
D
Explanation:
Logs & Monitor is the SmartConsole tab that is used to monitor network and security performance. This tab allows you to view and analyze logs and events from various sources, such as Security Gateways, Security Management Servers, and SmartEvent Servers. You can also use this tab to generate reports and troubleshoot issues.
Reference: [Logging and Monitoring Administration Guide R80.20]
Question #15
The default shell of the Gaia CLI is cli.sh.
How do you change from the cli.sh shell to the advanced shell to run Linux commands?
- A . Execute the command ‘enable’ in the cli.sh shell
- B . Execute the ‘conf t’ command in the cli.sh shell
- C . Execute the command ‘expert’ in the cli.sh shell
- D . Execute the ‘exit’ command in the cli.sh shell
Correct Answer: C
C
Explanation:
The default shell of the Gaia CLI is cli.sh, which provides a limited set of commands for basic configuration and troubleshooting. To change from the cli.sh shell to the advanced shell (also known as expert mode) to run Linux commands, the administrator needs to execute the command ‘expert’ in the cli.sh shell
C
Explanation:
The default shell of the Gaia CLI is cli.sh, which provides a limited set of commands for basic configuration and troubleshooting. To change from the cli.sh shell to the advanced shell (also known as expert mode) to run Linux commands, the administrator needs to execute the command ‘expert’ in the cli.sh shell
Question #16
Which Threat Prevention Software Blade provides protection from malicious software that can infect your network computers? (Choose the best answer.)
- A . IPS
- B . Anti-Virus
- C . Anti-Malware
- D . Content Awareness
Correct Answer: B
B
Explanation:
The Threat Prevention Software Blade that provides protection from malicious software that can infect your network computers is Anti-Virus. Anti-Virus is a software blade that scans files and traffic for viruses, worms, trojans, spyware, and other malware. Anti-Virus can block or clean infected files and prevent malware outbreaks. IPS is a software blade that provides protection from network attacks and exploits. Anti-Malware is not a software blade, but rather a term that refers to any software that can detect and remove malware. Content Awareness is a software blade that provides visibility and control over data that enters or leaves the network based on file types, data types, and keywords.
Reference: [Anti-Virus Software Blade], [IPS Software Blade], [What is Anti-Malware?], [Content Awareness Software Blade]
B
Explanation:
The Threat Prevention Software Blade that provides protection from malicious software that can infect your network computers is Anti-Virus. Anti-Virus is a software blade that scans files and traffic for viruses, worms, trojans, spyware, and other malware. Anti-Virus can block or clean infected files and prevent malware outbreaks. IPS is a software blade that provides protection from network attacks and exploits. Anti-Malware is not a software blade, but rather a term that refers to any software that can detect and remove malware. Content Awareness is a software blade that provides visibility and control over data that enters or leaves the network based on file types, data types, and keywords.
Reference: [Anti-Virus Software Blade], [IPS Software Blade], [What is Anti-Malware?], [Content Awareness Software Blade]
Question #17
Can you use the same layer in multiple policies or rulebases?
- A . Yes – a layer can be shared with multiple policies and rules.
- B . No – each layer must be unique.
- C . No – layers cannot be shared or reused, but an identical one can be created.
- D . Yes – but it must be copied and pasted with a different name.
Correct Answer: A
A
Explanation:
You can use the same layer in multiple policies or rulebases. A layer is a set of rules that can be shared, reused, or inherited by different policies. This allows you to create modular and flexible security policies that can be applied to different scenarios.
Reference: [Layers], [Policy Layers and Sub-Policies]
A
Explanation:
You can use the same layer in multiple policies or rulebases. A layer is a set of rules that can be shared, reused, or inherited by different policies. This allows you to create modular and flexible security policies that can be applied to different scenarios.
Reference: [Layers], [Policy Layers and Sub-Policies]
Question #18
What are two basic rules Check Point recommending for building an effective security policy?
- A . Accept Rule and Drop Rule
- B . Cleanup Rule and Stealth Rule
- C . Explicit Rule and Implied Rule
- D . NAT Rule and Reject Rule
Correct Answer: B
B
Explanation:
Two basic rules that Check Point recommends for building an effective security policy are Cleanup Rule and Stealth Rule. A Cleanup Rule is a rule that is placed at the end of the rule base and drops or logs any traffic that does not match any of the previous rules2. A Stealth Rule is a rule that is placed at the top of the rule base and protects the Security Gateway from direct access by unauthorized users3. The other options are not basic rules for building a security policy, but rather types or categories of rules.
B
Explanation:
Two basic rules that Check Point recommends for building an effective security policy are Cleanup Rule and Stealth Rule. A Cleanup Rule is a rule that is placed at the end of the rule base and drops or logs any traffic that does not match any of the previous rules2. A Stealth Rule is a rule that is placed at the top of the rule base and protects the Security Gateway from direct access by unauthorized users3. The other options are not basic rules for building a security policy, but rather types or categories of rules.
Question #19
When should you generate new licenses?
- A . Before installing contract files.
- B . After a device upgrade.
- C . When the existing license expires, license is upgraded or the IP-address associated with the license changes.
- D . Only when the license is upgraded.
Correct Answer: C
C
Explanation:
You should generate new licenses when the existing license expires, the license is upgraded, or the IP address associated with the license changes. These situations invalidate the current license and require a new one to be obtained from the Check Point User Center and installed on the Security Management Server or Security Gateway. Installing contract files or upgrading devices do not affect the validity of the license12
Reference: Check Point R81, Managing and Installing license via SmartUpdate
C
Explanation:
You should generate new licenses when the existing license expires, the license is upgraded, or the IP address associated with the license changes. These situations invalidate the current license and require a new one to be obtained from the Check Point User Center and installed on the Security Management Server or Security Gateway. Installing contract files or upgrading devices do not affect the validity of the license12
Reference: Check Point R81, Managing and Installing license via SmartUpdate
Question #20
After a new Log Server is added to the environment and the SIC trust has been established with the SMS what will the gateways do?
- A . The gateways can only send logs to an SMS and cannot send logs to a Log Server. Log Servers are proprietary log archive servers.
- B . Gateways will send new firewall logs to the new Log Server as soon as the SIC trust is set up between the SMS and the new Log Server.
- C . The firewalls will detect the new Log Server after the next policy install and redirect the new logs to the new Log Server.
- D . Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server.
Correct Answer: D
D
Explanation:
Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server. After adding a new Log Server and establishing the SIC trust with the SMS, the administrator must use SmartConsole to assign the Log Server to each gateway in the Logs and Masters section of the gateway properties2. The other options are not correct, as gateways can send logs to both SMS and Log Server, Log Servers are not proprietary log archive servers, and gateways will not detect the new Log Server after the next policy install.
D
Explanation:
Logs are not automatically forwarded to a new Log Server. SmartConsole must be used to manually configure each gateway to send its logs to the server. After adding a new Log Server and establishing the SIC trust with the SMS, the administrator must use SmartConsole to assign the Log Server to each gateway in the Logs and Masters section of the gateway properties2. The other options are not correct, as gateways can send logs to both SMS and Log Server, Log Servers are not proprietary log archive servers, and gateways will not detect the new Log Server after the next policy install.