Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #201
An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server (SMS). While configuring the VPN community to specify the pre-shared secret, the administrator did not find a box to input the pre-shared secret.
Why does it not allow him to specify the pre-shared secret?
- A . The Gateway is an SMB device
- B . The checkbox “Use only Shared Secret for all external members” is not checked
- C . Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS
- D . Pre-shared secret is already configured in Global Properties
Correct Answer: C
C
Explanation:
Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS. This is because certificate based authentication provides stronger security and easier management than pre-shared secret authentication. The other options are either incorrect or irrelevant for this scenario.
Reference: [Check Point R80.10 – Part 6 – Certificate Based Authentication]
C
Explanation:
Certificate based Authentication is the only authentication method available between two Security Gateway managed by the same SMS. This is because certificate based authentication provides stronger security and easier management than pre-shared secret authentication. The other options are either incorrect or irrelevant for this scenario.
Reference: [Check Point R80.10 – Part 6 – Certificate Based Authentication]
Question #202
To enforce the Security Policy correctly, a Security Gateway requires:
- A . a routing table
- B . awareness of the network topology
- C . a Demilitarized Zone
- D . a Security Policy install
Correct Answer: B
B
Explanation:
To enforce the Security Policy correctly, a Security Gateway requires awareness of the network topology. This means that the gateway knows which networks and interfaces are internal and external, and how to route packets between them.
Reference: [Check Point R81 Security Gateway Technical Administration Guide], Check Point CCSA – R81: Practice Test & Explanation
B
Explanation:
To enforce the Security Policy correctly, a Security Gateway requires awareness of the network topology. This means that the gateway knows which networks and interfaces are internal and external, and how to route packets between them.
Reference: [Check Point R81 Security Gateway Technical Administration Guide], Check Point CCSA – R81: Practice Test & Explanation
Question #203
Fill in the blank: The _____ feature allows administrators to share a policy with other policy packages.
- A . Concurrent policy packages
- B . Concurrent policies
- C . Global Policies
- D . Shared policies
Correct Answer: D
D
Explanation:
The Shared policies feature allows administrators to share a policy with other policy packages3. This can save time and effort when managing multiple gateways with similar security requirements. Shared policies can be applied to Access Control, Threat Prevention, and HTTPS Inspection layers4.
Reference: Check Point R81 Security Management Administration Guide, Check Point R81 SmartConsole R81 Resolved Issues
D
Explanation:
The Shared policies feature allows administrators to share a policy with other policy packages3. This can save time and effort when managing multiple gateways with similar security requirements. Shared policies can be applied to Access Control, Threat Prevention, and HTTPS Inspection layers4.
Reference: Check Point R81 Security Management Administration Guide, Check Point R81 SmartConsole R81 Resolved Issues
Question #204
Fill in the blank: Service blades must be attached to a ______________.
- A . Security Gateway
- B . Management container
- C . Management server
- D . Security Gateway container
Correct Answer: A
A
Explanation:
Service blades must be attached to a Security Gateway. A Security Gateway is a device that enforces security policies on traffic that passes through it. A service blade is a software module that provides a specific security function, such as firewall, VPN, IPS, etc. A Security Gateway can have one or more service blades attached to it, depending on the license and hardware capabilities. The other options are incorrect. A management container is a virtualized environment that hosts a Security Management Server or a Log Server. A management server is a device that manages security policies and distributes them to Security Gateways. A Security Gateway container is not a valid term in Check Point terminology.
Reference: [Check Point R81 Security Management Administration Guide], [Check Point R81 CloudGuard Administration Guide]
A
Explanation:
Service blades must be attached to a Security Gateway. A Security Gateway is a device that enforces security policies on traffic that passes through it. A service blade is a software module that provides a specific security function, such as firewall, VPN, IPS, etc. A Security Gateway can have one or more service blades attached to it, depending on the license and hardware capabilities. The other options are incorrect. A management container is a virtualized environment that hosts a Security Management Server or a Log Server. A management server is a device that manages security policies and distributes them to Security Gateways. A Security Gateway container is not a valid term in Check Point terminology.
Reference: [Check Point R81 Security Management Administration Guide], [Check Point R81 CloudGuard Administration Guide]
Question #205
When enabling tracking on a rule, what is the default option?
- A . Accounting Log
- B . Extended Log
- C . Log
- D . Detailed Log
Correct Answer: C
C
Explanation:
When enabling tracking on a rule, the default option is Log. This option generates a log entry for each connection that matches the rule. The log entry contains information such as the source, destination, service, action, and time of the connection.
Reference: [Logging and Monitoring R81], [Logging and Monitoring]
C
Explanation:
When enabling tracking on a rule, the default option is Log. This option generates a log entry for each connection that matches the rule. The log entry contains information such as the source, destination, service, action, and time of the connection.
Reference: [Logging and Monitoring R81], [Logging and Monitoring]
Question #206
When should you generate new licenses?
- A . Before installing contract files.
- B . After an RMA procedure when the MAC address or serial number of the appliance changes.
- C . When the existing license expires, license is upgraded or the IP-address where the license is tied changes.
- D . Only when the license is upgraded.
Correct Answer: C
C
Explanation:
You should generate new licenses when the existing license expires, license is upgraded or the IP-address where the license is tied changes13. These scenarios require a new license to be generated and activated on the Security Gateway or Management Server13. Therefore, the correct answer is C. When the existing license expires, license is upgraded or the IP-address where the license is tied changes
C
Explanation:
You should generate new licenses when the existing license expires, license is upgraded or the IP-address where the license is tied changes13. These scenarios require a new license to be generated and activated on the Security Gateway or Management Server13. Therefore, the correct answer is C. When the existing license expires, license is upgraded or the IP-address where the license is tied changes
Question #207
Application Control/URL filtering database library is known as:
- A . Application database
- B . AppWiki
- C . Application-Forensic Database
- D . Application Library
Correct Answer: B
B
Explanation:
Application Control/URL filtering database library is known as AppWiki. AppWiki is an application classification and identification database that enables administrators to control access to thousands of applications and millions of websites.
Reference: [Check Point R81 Application Control Administration Guide], [Check Point AppWiki]
B
Explanation:
Application Control/URL filtering database library is known as AppWiki. AppWiki is an application classification and identification database that enables administrators to control access to thousands of applications and millions of websites.
Reference: [Check Point R81 Application Control Administration Guide], [Check Point AppWiki]
Question #208
Which option, when applied to a rule, allows all encrypted and non-VPN traffic that matches the rule?
- A . All Site-to-Site VPN Communities
- B . Accept all encrypted traffic
- C . All Connections (Clear or Encrypted)
- D . Specific VPN Communities
Correct Answer: B
B
Explanation:
The option that allows all encrypted and non-VPN traffic that matches the rule is Accept all encrypted traffic. This option enables you to allow traffic to any destination that is encrypted, regardless of whether it is part of a VPN community or not2. Therefore, the correct answer is B. Accept all encrypted traffic.
B
Explanation:
The option that allows all encrypted and non-VPN traffic that matches the rule is Accept all encrypted traffic. This option enables you to allow traffic to any destination that is encrypted, regardless of whether it is part of a VPN community or not2. Therefore, the correct answer is B. Accept all encrypted traffic.
Question #208
Which option, when applied to a rule, allows all encrypted and non-VPN traffic that matches the rule?
- A . All Site-to-Site VPN Communities
- B . Accept all encrypted traffic
- C . All Connections (Clear or Encrypted)
- D . Specific VPN Communities
Correct Answer: B
B
Explanation:
The option that allows all encrypted and non-VPN traffic that matches the rule is Accept all encrypted traffic. This option enables you to allow traffic to any destination that is encrypted, regardless of whether it is part of a VPN community or not2. Therefore, the correct answer is B. Accept all encrypted traffic.
B
Explanation:
The option that allows all encrypted and non-VPN traffic that matches the rule is Accept all encrypted traffic. This option enables you to allow traffic to any destination that is encrypted, regardless of whether it is part of a VPN community or not2. Therefore, the correct answer is B. Accept all encrypted traffic.
Question #210
When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?
- A . None, Security Management Server would be installed by itself.
- B . SmartConsole
- C . SecureClient
- D . SmartEvent
Correct Answer: A
A
Explanation:
When doing a Stand-Alone Installation, you would install the Security Management Server with none of the other Check Point architecture components. A Stand-Alone Installation is a type of installation that combines the Security Management Server and the Security Gateway on one computer or appliance3, p. 14. SmartConsole, SecureClient, and SmartEvent are not Check Point architecture components, but software applications that can be installed separately.
Reference: Check Point CCSA – R81: Practice Test & Explanation, [Check Point Installation and Upgrade Guide R81]
A
Explanation:
When doing a Stand-Alone Installation, you would install the Security Management Server with none of the other Check Point architecture components. A Stand-Alone Installation is a type of installation that combines the Security Management Server and the Security Gateway on one computer or appliance3, p. 14. SmartConsole, SecureClient, and SmartEvent are not Check Point architecture components, but software applications that can be installed separately.
Reference: Check Point CCSA – R81: Practice Test & Explanation, [Check Point Installation and Upgrade Guide R81]