Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #251
Where can alerts be viewed?
- A . Alerts can be seen in SmartView Monitor
- B . Alerts can be seen in the Threat Prevention policy.
- C . Alerts can be seen in SmartUpdate.
- D . Alerts can be seen from the CLI of the gateway.
Correct Answer: A
A
Explanation:
Alerts can be viewed in SmartView Monitor, which is a graphical tool that provides real-time information about the network and security activities, such as traffic, VPN tunnels, threats, and performance4.
Reference: 4: Check Point R81 Security Management Administration Guide, page 25.
A
Explanation:
Alerts can be viewed in SmartView Monitor, which is a graphical tool that provides real-time information about the network and security activities, such as traffic, VPN tunnels, threats, and performance4.
Reference: 4: Check Point R81 Security Management Administration Guide, page 25.
Question #252
Access roles allow the firewall administrator to configure network access according to:
- A . remote access clients.
- B . a combination of computer or computer groups and networks.
- C . users and user groups.
- D . All of the above.
Correct Answer: D
D
Explanation:
Access roles allow the firewall administrator to configure network access according to remote access clients, a combination of computer or computer groups and networks, and users and user groups12. Therefore, the correct answer is D.
D
Explanation:
Access roles allow the firewall administrator to configure network access according to remote access clients, a combination of computer or computer groups and networks, and users and user groups12. Therefore, the correct answer is D.
Question #253
Which product correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices?
- A . SmartDashboard
- B . SmartEvent
- C . SmartView Monitor
- D . SmartUpdate
Correct Answer: B
B
Explanation:
The product that correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices is SmartEvent. SmartEvent is a software blade that
analyzes logs from various sources such as Security Gateways, Endpoint Security Servers, Identity Awareness Servers, etc. and generates security events based on predefined or custom rules. SmartEvent provides a graphical interface for viewing and managing security events in real-time or historical mode.
Reference: [Check Point R81 SmartEvent Administration Guide]
B
Explanation:
The product that correlates logs and detects security threats, providing a centralized display of potential attack patterns from all network devices is SmartEvent. SmartEvent is a software blade that
analyzes logs from various sources such as Security Gateways, Endpoint Security Servers, Identity Awareness Servers, etc. and generates security events based on predefined or custom rules. SmartEvent provides a graphical interface for viewing and managing security events in real-time or historical mode.
Reference: [Check Point R81 SmartEvent Administration Guide]
Question #254
Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic.
Assuming acceleration is enable which path is handling the traffic?
- A . Slow Path
- B . Medium Path
- C . Fast Path
- D . Accelerated Path
Correct Answer: A
A
Explanation:
The correct answer is A because the traffic from source 192.168.1.1 to www.google.com is handled by the Slow Path if the Application Control Blade on the gateway is inspecting the traffic2. The Slow Path is used when traffic requires inspection by one or more Software Blades2. The other paths are used for different scenarios2.
Reference: Check Point R81 Performance Tuning Administration Guide
A
Explanation:
The correct answer is A because the traffic from source 192.168.1.1 to www.google.com is handled by the Slow Path if the Application Control Blade on the gateway is inspecting the traffic2. The Slow Path is used when traffic requires inspection by one or more Software Blades2. The other paths are used for different scenarios2.
Reference: Check Point R81 Performance Tuning Administration Guide
Question #255
True or False: In R80, more than one administrator can login to the Security Management Server with write permission at the same time.
- A . False, this feature has to be enabled in the Global Properties.
- B . True, every administrator works in a session that is independent of the other administrators.
- C . True, every administrator works on a different database that is independent of the other administrators.
- D . False, only one administrator can login with write permission.
Correct Answer: B
B
Explanation:
The answer is B because in R80 and above, more than one administrator can login to the Security Management Server with write permission at the same time. Every administrator works in a session that is independent of the other administrators. This is called concurrent administration and it allows multiple administrators to work on the same policy package simultaneously34
Reference: Check Point R80.10 Concurrent Administration, Check Point R80.40 Security Management Administration Guide
B
Explanation:
The answer is B because in R80 and above, more than one administrator can login to the Security Management Server with write permission at the same time. Every administrator works in a session that is independent of the other administrators. This is called concurrent administration and it allows multiple administrators to work on the same policy package simultaneously34
Reference: Check Point R80.10 Concurrent Administration, Check Point R80.40 Security Management Administration Guide
Question #256
To provide updated malicious data signatures to all Threat Prevention blades, the Threat Prevention gateway does what with the data?
- A . Cache the data to speed up its own function.
- B . Share the data to the ThreatCloud for use by other Threat Prevention blades.
- C . Log the traffic for Administrator viewing.
- D . Delete the data to ensure an analysis of the data is done each time.
Correct Answer: B
B
Explanation:
To provide updated malicious data signatures to all Threat Prevention blades, the Threat Prevention gateway does share the data to the ThreatCloud for use by other Threat Prevention blades. The ThreatCloud is a collaborative network and cloud-driven knowledge base that delivers real-time dynamic security intelligence to security gateways. The Threat Prevention gateway can send and receive updates from the ThreatCloud about new threats and malicious data signatures.
Reference: [Check Point R81 Threat Prevention Administration Guide]
B
Explanation:
To provide updated malicious data signatures to all Threat Prevention blades, the Threat Prevention gateway does share the data to the ThreatCloud for use by other Threat Prevention blades. The ThreatCloud is a collaborative network and cloud-driven knowledge base that delivers real-time dynamic security intelligence to security gateways. The Threat Prevention gateway can send and receive updates from the ThreatCloud about new threats and malicious data signatures.
Reference: [Check Point R81 Threat Prevention Administration Guide]
Question #257
What is the BEST method to deploy Identity Awareness for roaming users?
- A . Use Office Mode
- B . Use identity agents
- C . Share user identities between gateways
- D . Use captive portal
Correct Answer: B
B
Explanation:
The BEST method to deploy Identity Awareness for roaming users is to use identity agents, which are software components installed on endpoints that provide user and machine identity information to the Security Gateway45. Identity agents are more secure and reliable than other methods, as they do not require network changes or user interaction4. Office Mode, sharing user identities between gateways, and using captive portal are not methods to deploy Identity Awareness, but rather features or options that can be used with Identity Awareness46.
Reference: Identity Awareness Reference Architecture and Best Practices, Identity Awareness PDP Broker, Identity Awareness Datasheet
B
Explanation:
The BEST method to deploy Identity Awareness for roaming users is to use identity agents, which are software components installed on endpoints that provide user and machine identity information to the Security Gateway45. Identity agents are more secure and reliable than other methods, as they do not require network changes or user interaction4. Office Mode, sharing user identities between gateways, and using captive portal are not methods to deploy Identity Awareness, but rather features or options that can be used with Identity Awareness46.
Reference: Identity Awareness Reference Architecture and Best Practices, Identity Awareness PDP Broker, Identity Awareness Datasheet
Question #258
Which of the following is NOT an identity source used for Identity Awareness?
- A . Remote Access
- B . UserCheck
- C . AD Query
- D . RADIUS
Correct Answer: B
B
Explanation:
UserCheck is not an identity source used for Identity Awareness. UserCheck is a feature that allows you to interact with users when they trigger Data Loss Prevention or Threat Prevention incidents2. Identity Awareness uses different methods to acquire identities, such as AD Query, Identity Agent, Browser-Based Authentication, Terminal Servers, Captive Portal, and RADIUS3. Therefore, the correct answer is B. UserCheck.
B
Explanation:
UserCheck is not an identity source used for Identity Awareness. UserCheck is a feature that allows you to interact with users when they trigger Data Loss Prevention or Threat Prevention incidents2. Identity Awareness uses different methods to acquire identities, such as AD Query, Identity Agent, Browser-Based Authentication, Terminal Servers, Captive Portal, and RADIUS3. Therefore, the correct answer is B. UserCheck.
Question #259
Which command is used to add users to or from existing roles?
- A . add rba user <User Name> roles <List>
- B . add user <User Name>
- C . add rba user <User Name>
- D . add user <User Name> roles <List>
Correct Answer: A
A
Explanation:
The command add rba user <User Name> roles <List> is used to add users to or from existing roles. RBA stands for Role-Based Administration, which is a feature that allows administrators to assign different permissions and access levels to users based on their roles2.
Reference: 2: Check Point R81 Security Management Administration Guide, page 20.
A
Explanation:
The command add rba user <User Name> roles <List> is used to add users to or from existing roles. RBA stands for Role-Based Administration, which is a feature that allows administrators to assign different permissions and access levels to users based on their roles2.
Reference: 2: Check Point R81 Security Management Administration Guide, page 20.
Question #260
A layer can support different combinations of blades What are the supported blades:
- A . Firewall. URLF, Content Awareness and Mobile Access
- B . Firewall (Network Access Control). Application & URL Filtering. Content Awareness and Mobile Access
- C . Firewall. NAT, Content Awareness and Mobile Access
- D . Firewall (Network Access Control). Application & URL Filtering and Content Awareness
Correct Answer: D
D
Explanation:
A layer can support different combinations of blades, but the supported blades are Firewall (Network Access Control), Application & URL Filtering, and Content Awareness. These blades provide granular control over network traffic based on applications, users, content, and risk1. Mobile Access is not a supported blade in a layer2.
Reference: 1: Check Point R81 Security Management Administration Guide, page 101. 2: Check Point R81 Security Gateway Administration Guide, page 11.
D
Explanation:
A layer can support different combinations of blades, but the supported blades are Firewall (Network Access Control), Application & URL Filtering, and Content Awareness. These blades provide granular control over network traffic based on applications, users, content, and risk1. Mobile Access is not a supported blade in a layer2.
Reference: 1: Check Point R81 Security Management Administration Guide, page 101. 2: Check Point R81 Security Gateway Administration Guide, page 11.