Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #191
Identity Awareness allows the Security Administrator to configure network access based on which of the following?
- A . Name of the application, identity of the user, and identity of the machine
- B . Identity of the machine, username, and certificate
- C . Network location, identity of a user, and identity of a machine
- D . Browser-Based Authentication, identity of a user, and network location
Correct Answer: C
C
Explanation:
Identity Awareness allows the Security Administrator to configure network access based on network location, identity of a user, and identity of a machine1. These are the three main identity sources that Identity Awareness supports1.
Reference: Identity Awareness R80.40 Administration Guide
C
Explanation:
Identity Awareness allows the Security Administrator to configure network access based on network location, identity of a user, and identity of a machine1. These are the three main identity sources that Identity Awareness supports1.
Reference: Identity Awareness R80.40 Administration Guide
Question #192
Fill in the blank Backup and restores can be accomplished through
- A . SmartUpdate, SmartBackup. or SmartConsole
- B . WebUI. CLI. or SmartUpdate
- C . CLI. SmartUpdate, or SmartBackup
- D . SmartConsole, WebUI. or CLI
Correct Answer: D
D
Explanation:
Backup and restores can be accomplished through SmartConsole, WebUI, or CLI. SmartUpdate and SmartBackup are not valid options1.
Reference: 1: Check Point R81 Security Management Administration Guide, page
D
Explanation:
Backup and restores can be accomplished through SmartConsole, WebUI, or CLI. SmartUpdate and SmartBackup are not valid options1.
Reference: 1: Check Point R81 Security Management Administration Guide, page
Question #193
Which tool is used to enable cluster membership on a Gateway?
- A . SmartUpdate
- B . cpconfig
- C . SmartConsole
- D . sysconfig
Correct Answer: B
B
Explanation:
The tool used to enable cluster membership on a Gateway is cpconfig2. This tool allows you to
configure basic settings of Check Point products, such as cluster membership, administrator name and password, GUI clients, and Secure Internal Communication (SIC)2.
Reference: Next Generation Security Gateway Guide R80
B
Explanation:
The tool used to enable cluster membership on a Gateway is cpconfig2. This tool allows you to
configure basic settings of Check Point products, such as cluster membership, administrator name and password, GUI clients, and Secure Internal Communication (SIC)2.
Reference: Next Generation Security Gateway Guide R80
Question #194
Phase 1 of the two-phase negotiation process conducted by IKE operates in ______ mode.
- A . Main
- B . Authentication
- C . Quick
- D . High Alert
Correct Answer: A
A
Explanation:
Phase 1 of the two-phase negotiation process conducted by IKE operates in Main mode or Aggressive mode12. Main mode is more secure than Aggressive mode, as it protects the identities of the peers and uses six messages to establish the IKE SA13. Authentication, Quick, and High Alert are not valid modes for IKE phase 1.
Reference: Understand IPsec IKEv1 Protocol, Internet Key Exchange for IPsec VPNs Configuration Guide, Internet Key Exchange
A
Explanation:
Phase 1 of the two-phase negotiation process conducted by IKE operates in Main mode or Aggressive mode12. Main mode is more secure than Aggressive mode, as it protects the identities of the peers and uses six messages to establish the IKE SA13. Authentication, Quick, and High Alert are not valid modes for IKE phase 1.
Reference: Understand IPsec IKEv1 Protocol, Internet Key Exchange for IPsec VPNs Configuration Guide, Internet Key Exchange
Question #195
You are going to perform a major upgrade.
Which back up solution should you use to ensure your database can be restored on that device?
- A . backup
- B . logswitch
- C . Database Revision
- D . snapshot
Correct Answer: D
D
Explanation:
The back up solution that should be used to ensure your database can be restored on that device is snapshot. A snapshot creates a binary image of the entire root (lv_current) disk partition. This includes Check Point products, configuration, and operating system. A snapshot can be used to restore a Security Gateway or Security Management Server to its previous state at any time. Therefore, the correct answer is D. snapshot.
D
Explanation:
The back up solution that should be used to ensure your database can be restored on that device is snapshot. A snapshot creates a binary image of the entire root (lv_current) disk partition. This includes Check Point products, configuration, and operating system. A snapshot can be used to restore a Security Gateway or Security Management Server to its previous state at any time. Therefore, the correct answer is D. snapshot.
Question #196
How is communication between different Check Point components secured in R80? As with all questions, select the best answer.
- A . By using IPSEC
- B . By using SIC
- C . By using ICA
- D . By using 3DES
Correct Answer: B
B
Explanation:
The communication between different Check Point components is secured in R80 by using SIC. SIC stands for Secure Internal Communication and it is a mechanism that ensures the authenticity and confidentiality of communication between Check Point components, such as Security Gateways, Security Management Servers, Log Servers, etc. SIC uses certificates issued by the Internal CA (ICA) and encryption algorithms such as AES-25634.
Reference: Check Point R81 Quantum Security
Gateway Guide, Check Point R81 Quantum Security Management Administration Guide
B
Explanation:
The communication between different Check Point components is secured in R80 by using SIC. SIC stands for Secure Internal Communication and it is a mechanism that ensures the authenticity and confidentiality of communication between Check Point components, such as Security Gateways, Security Management Servers, Log Servers, etc. SIC uses certificates issued by the Internal CA (ICA) and encryption algorithms such as AES-25634.
Reference: Check Point R81 Quantum Security
Gateway Guide, Check Point R81 Quantum Security Management Administration Guide
Question #197
What is the Transport layer of the TCP/IP model responsible for?
- A . It transports packets as datagrams along different routes to reach their destination.
- B . It manages the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application.
- C . It defines the protocols that are used to exchange data between networks and how host programs interact with the Application layer.
- D . It deals with all aspects of the physical components of network connectivity and connects with different network types.
Correct Answer: B
B
Explanation:
The Transport layer of the TCP/IP model is responsible for managing the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application. It also provides error detection and correction, flow control, and multiplexing. The Transport layer uses protocols such as TCP and UDP.
Reference: Check Point Security Engineering Study Guide, p. 10-11
B
Explanation:
The Transport layer of the TCP/IP model is responsible for managing the flow of data between two hosts to ensure that the packets are correctly assembled and delivered to the target application. It also provides error detection and correction, flow control, and multiplexing. The Transport layer uses protocols such as TCP and UDP.
Reference: Check Point Security Engineering Study Guide, p. 10-11
Question #198
Security Zones do no work with what type of defined rule?
- A . Application Control rule
- B . Manual NAT rule
- C . IPS bypass rule
- D . Firewall rule
Correct Answer: B
B
Explanation:
Security Zones are a feature of Application Control and Identity Awareness that allow you to define groups of network objects based on their level of trust. Security Zones do not work with Manual NAT rules, because Manual NAT rules are applied before the Application Control and Identity Awareness policy is enforced1.
Reference: Check Point R81 Security Management Administration Guide
B
Explanation:
Security Zones are a feature of Application Control and Identity Awareness that allow you to define groups of network objects based on their level of trust. Security Zones do not work with Manual NAT rules, because Manual NAT rules are applied before the Application Control and Identity Awareness policy is enforced1.
Reference: Check Point R81 Security Management Administration Guide
Question #199
Fill in the blanks: A ____ license requires an administrator to designate a gateway for attachment whereas a _____ license is automatically attached to a Security Gateway.
- A . Formal; corporate
- B . Local; formal
- C . Local; central
- D . Central; local
Correct Answer: D
D
Explanation:
A central license is automatically attached to a Security Gateway when it is installed. A local license requires an administrator to designate a gateway for attachment1, p. 8.
Reference: Check Point CCSA – R81: Practice Test & Explanation
D
Explanation:
A central license is automatically attached to a Security Gateway when it is installed. A local license requires an administrator to designate a gateway for attachment1, p. 8.
Reference: Check Point CCSA – R81: Practice Test & Explanation
Question #200
In ____________ NAT, the ____________ is translated.
- A . Hide; source
- B . Static; source
- C . Simple; source
- D . Hide; destination
Correct Answer: A
A
Explanation:
In hide NAT, the source IP address is translated. Hide NAT is also known as many-to-one NAT or PAT (Port Address Translation). It maps multiple private IP addresses to one public IP address by using different port numbers. Hide NAT allows outbound connections from the private network to the public network, but not inbound connections from the public network to the private network. In static NAT, the source or destination IP address is translated depending on the direction of the traffic. Static NAT is also known as one-to-one NAT or bi-directional NAT. It maps one private IP address to one public IP address and allows both outbound and inbound connections. In simple NAT, there is no translation of IP addresses. Simple NAT is also known as routing mode or transparent mode. It allows traffic to pass through the NAT device without any modification. There is no hide NAT for destination IP address translation5678
Reference: What Is Network Address Translation (NAT)?, Network address translation, Network Address Translation Definition, Network Address Translation (NAT)
A
Explanation:
In hide NAT, the source IP address is translated. Hide NAT is also known as many-to-one NAT or PAT (Port Address Translation). It maps multiple private IP addresses to one public IP address by using different port numbers. Hide NAT allows outbound connections from the private network to the public network, but not inbound connections from the public network to the private network. In static NAT, the source or destination IP address is translated depending on the direction of the traffic. Static NAT is also known as one-to-one NAT or bi-directional NAT. It maps one private IP address to one public IP address and allows both outbound and inbound connections. In simple NAT, there is no translation of IP addresses. Simple NAT is also known as routing mode or transparent mode. It allows traffic to pass through the NAT device without any modification. There is no hide NAT for destination IP address translation5678
Reference: What Is Network Address Translation (NAT)?, Network address translation, Network Address Translation Definition, Network Address Translation (NAT)