Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #211
Which Security Blade needs to be enabled in order to sanitize and remove potentially malicious content from files, before those files enter the network?
- A . Threat Emulation
- B . Anti-Malware
- C . Anti-Virus
- D . Threat Extraction
Correct Answer: D
D
Explanation:
Threat Extraction is the Security Blade that needs to be enabled in order to sanitize and remove potentially malicious content from files, before those files enter the network. It can strip out active content, embedded objects, and other risky elements from documents and deliver a safe version of the file to the user.
Reference: Remote Access VPN R81.20 Administration Guide, page 18.
D
Explanation:
Threat Extraction is the Security Blade that needs to be enabled in order to sanitize and remove potentially malicious content from files, before those files enter the network. It can strip out active content, embedded objects, and other risky elements from documents and deliver a safe version of the file to the user.
Reference: Remote Access VPN R81.20 Administration Guide, page 18.
Question #212
Name the file that is an electronically signed file used by Check Point to translate the features in the license into a code?
- A . Both License (.lic) and Contract (.xml) files
- B . cp.macro
- C . Contract file (.xml)
- D . license File (.lie)
Correct Answer: B
B
Explanation:
The file that is an electronically signed file used by Check Point to translate the features in the license into a code is cp.macro. This file contains a list of macros that define the license features and their values. It is located in the $FWDIR/conf directory on the Security Management Server or Security Gateway.
Reference: [Check Point R81 Licensing Guide], [Check Point R80.40 Licensing Guide]
B
Explanation:
The file that is an electronically signed file used by Check Point to translate the features in the license into a code is cp.macro. This file contains a list of macros that define the license features and their values. It is located in the $FWDIR/conf directory on the Security Management Server or Security Gateway.
Reference: [Check Point R81 Licensing Guide], [Check Point R80.40 Licensing Guide]
Question #213
In order to see real-time and historical graph views of Security Gateway statistics in SmartView Monitor, what feature needs to be enabled on the Security Gateway?
- A . Logging & Monitoring
- B . None – the data is available by default
- C . Monitoring Blade
- D . SNMP
Correct Answer: C
C
Explanation:
In order to see real-time and historical graph views of Security Gateway statistics in SmartView Monitor, the Monitoring Blade feature needs to be enabled on the Security Gateway. The Monitoring Blade is a software blade that collects and displays network and security performance data from the Security Gateway, such as traffic, throughput, connections, CPU usage, memory usage, etc. The Monitoring Blade can be enabled or disabled on each Security Gateway from the SmartConsole.
Reference: [Monitoring Blade], [SmartView Monitor]
C
Explanation:
In order to see real-time and historical graph views of Security Gateway statistics in SmartView Monitor, the Monitoring Blade feature needs to be enabled on the Security Gateway. The Monitoring Blade is a software blade that collects and displays network and security performance data from the Security Gateway, such as traffic, throughput, connections, CPU usage, memory usage, etc. The Monitoring Blade can be enabled or disabled on each Security Gateway from the SmartConsole.
Reference: [Monitoring Blade], [SmartView Monitor]
Question #214
What is the purpose of Captive Portal?
- A . It manages user permission in SmartConsole
- B . It provides remote access to SmartConsole
- C . It authenticates users, allowing them access to the Internet and corporate resources
- D . It authenticates users, allowing them access to the Gaia OS
Correct Answer: C
C
Explanation:
Captive Portal is a feature of Identity Awareness that allows you to authenticate users through a web browser before they access the Internet or corporate resources. Captive Portal can be used for various authentication methods, such as user name and password, one-time password (OTP), or certificate3. Captive Portal does not manage user permission in SmartConsole, provide remote access to SmartConsole, or authenticate users to the Gaia OS. Those are different functions that are not related to Captive Portal.
Reference: Check Point R81 Identity Awareness Administration Guide
C
Explanation:
Captive Portal is a feature of Identity Awareness that allows you to authenticate users through a web browser before they access the Internet or corporate resources. Captive Portal can be used for various authentication methods, such as user name and password, one-time password (OTP), or certificate3. Captive Portal does not manage user permission in SmartConsole, provide remote access to SmartConsole, or authenticate users to the Gaia OS. Those are different functions that are not related to Captive Portal.
Reference: Check Point R81 Identity Awareness Administration Guide
Question #215
Fill in the blanks: The _______ collects logs and sends them to the _______.
- A . Log server; Security Gateway
- B . Log server; security management server
- C . Security management server; Security Gateway
- D . Security Gateways; log server
Correct Answer: D
D
Explanation:
The Security Gateways collect logs and send them to the log server. The Security Gateways are the components that enforce the security policy on network traffic and generate logs for each connection that matches a rule with a tracking option. The log server is the component that receives and stores the logs from the Security Gateways and provides a centralized interface for viewing and analyzing
them. The log server can be either a dedicated server or integrated with the Security Management Server.
Reference: [Check Point R81 Security Management Administration Guide]
D
Explanation:
The Security Gateways collect logs and send them to the log server. The Security Gateways are the components that enforce the security policy on network traffic and generate logs for each connection that matches a rule with a tracking option. The log server is the component that receives and stores the logs from the Security Gateways and provides a centralized interface for viewing and analyzing
them. The log server can be either a dedicated server or integrated with the Security Management Server.
Reference: [Check Point R81 Security Management Administration Guide]
Question #216
What type of NAT is a one-to-one relationship where each host is translated to a unique address?
- A . Source
- B . Static
- C . Hide
- D . Destination
Correct Answer: B
B
Explanation:
The type of NAT that is a one-to-one relationship where each host is translated to a unique address is Static NAT. Static NAT maps an unregistered IP address to a registered IP address on a one-to-one basis3. This means that for each internal host, there is a corresponding external address that represents it3. Therefore, the correct answer is B
B
Explanation:
The type of NAT that is a one-to-one relationship where each host is translated to a unique address is Static NAT. Static NAT maps an unregistered IP address to a registered IP address on a one-to-one basis3. This means that for each internal host, there is a corresponding external address that represents it3. Therefore, the correct answer is B
Question #217
Aggressive Mode in IKEv1 uses how many packages for negotiation?
- A . 6
- B . 3
- C . depends on the make of the peer gateway
- D . 5
Correct Answer: B
B
Explanation:
Aggressive Mode in IKEv1 uses three packets for negotiation, with all data required for the SA passed by the initiator1. The responder sends the proposal, key material, and ID, and authenticates the session in the next packet. The initiator replies and authenticates the session1.
The other answers are not correct because they either refer to the Main Mode in IKEv1, which uses six packets for negotiation2, or they are irrelevant to the number of packets used in Aggressive Mode.
Understand IPsec IKEv1 Protocol – Cisco Negotiation modes for phase 1 – IBM FAQ-What are the differences between IKEv1 and IKEv2- Huawei
B
Explanation:
Aggressive Mode in IKEv1 uses three packets for negotiation, with all data required for the SA passed by the initiator1. The responder sends the proposal, key material, and ID, and authenticates the session in the next packet. The initiator replies and authenticates the session1.
The other answers are not correct because they either refer to the Main Mode in IKEv1, which uses six packets for negotiation2, or they are irrelevant to the number of packets used in Aggressive Mode.
Understand IPsec IKEv1 Protocol – Cisco Negotiation modes for phase 1 – IBM FAQ-What are the differences between IKEv1 and IKEv2- Huawei
Question #218
When dealing with rule base layers, what two layer types can be utilized?
- A . Ordered Layers and Inline Layers
- B . Inbound Layers and Outbound Layers
- C . R81.10 does not support Layers
- D . Structured Layers and Overlap Layers
Correct Answer: A
A
Explanation:
When dealing with rule base layers, two layer types can be utilized: Ordered Layers and Inline Layers5. Ordered Layers are executed sequentially according to their order in the policy. Inline Layers are embedded in a parent layer and are executed only if the parent rule matches.
Reference: Check Point R81 Firewall Administration Guide, [Check Point R81 Security Management Administration Guide]
A
Explanation:
When dealing with rule base layers, two layer types can be utilized: Ordered Layers and Inline Layers5. Ordered Layers are executed sequentially according to their order in the policy. Inline Layers are embedded in a parent layer and are executed only if the parent rule matches.
Reference: Check Point R81 Firewall Administration Guide, [Check Point R81 Security Management Administration Guide]
Question #219
Which of the following is NOT a method used by Identity Awareness for acquiring identity?
- A . Remote Access
- B . Cloud IdP (Identity Provider)
- C . Active Directory Query
- D . RADIUS
Correct Answer: B
B
Explanation:
Identity Awareness uses several methods for acquiring identity, such as Active Directory Query, Identity Agent, Browser-Based Authentication, Terminal Servers, Captive Portal, and RADIUS12. Cloud IdP (Identity Provider) is not a method used by Identity Awareness12. Therefore, the correct answer is
B. Cloud IdP (Identity Provider).
B
Explanation:
Identity Awareness uses several methods for acquiring identity, such as Active Directory Query, Identity Agent, Browser-Based Authentication, Terminal Servers, Captive Portal, and RADIUS12. Cloud IdP (Identity Provider) is not a method used by Identity Awareness12. Therefore, the correct answer is
B. Cloud IdP (Identity Provider).
Question #220
Check Point ClusterXL Active/Active deployment is used when:
- A . Only when there is Multicast solution set up
- B . There is Load Sharing solution set up
- C . Only when there is Unicast solution set up
- D . There is High Availability solution set up
Correct Answer: B
B
Explanation:
Check Point ClusterXL Active/Active deployment is used when there is Load Sharing solution set up. Load Sharing enables multiple Security Gateways to share traffic and provide high availability12.
Reference: Check Point R81, Check Point R81 ClusterXL Administration Guide
B
Explanation:
Check Point ClusterXL Active/Active deployment is used when there is Load Sharing solution set up. Load Sharing enables multiple Security Gateways to share traffic and provide high availability12.
Reference: Check Point R81, Check Point R81 ClusterXL Administration Guide