Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #261
Session unique identifiers are passed to the web api using which http header option?
- A . X-chkp-sid
- B . Accept-Charset
- C . Proxy-Authorization
- D . Application
Correct Answer: A
A
Explanation:
The correct answer is A because session unique identifiers are passed to the web api using the X-chkp-sid http header option1. The X-chkp-sid header is used to authenticate and authorize API calls1. The other options are not related to session unique identifiers.
Reference: Check Point R81 Security Management Administration Guide
A
Explanation:
The correct answer is A because session unique identifiers are passed to the web api using the X-chkp-sid http header option1. The X-chkp-sid header is used to authenticate and authorize API calls1. The other options are not related to session unique identifiers.
Reference: Check Point R81 Security Management Administration Guide
Question #262
Which tool is used to enable ClusterXL?
- A . SmartUpdate
- B . cpconfig
- C . SmartConsole
- D . sysconfig
Correct Answer: B
B
Explanation:
The tool that is used to enable ClusterXL is cpconfig. ClusterXL is a software-based Load Sharing and High Availability solution that distributes network traffic between clusters of redundant Security Gateways1. To enable ClusterXL, you need to run the cpconfig command on each cluster member and select Enable Cluster membership for this gateway2. Therefore, the correct answer is B. cpconfig.
B
Explanation:
The tool that is used to enable ClusterXL is cpconfig. ClusterXL is a software-based Load Sharing and High Availability solution that distributes network traffic between clusters of redundant Security Gateways1. To enable ClusterXL, you need to run the cpconfig command on each cluster member and select Enable Cluster membership for this gateway2. Therefore, the correct answer is B. cpconfig.
Question #263
Which command shows detailed information about VPN tunnels?
- A . cat $FWDlR/conf/vpn.conf
- B . vpn tu tlist
- C . vpn tu
- D . cpview
Correct Answer: C
C
Explanation:
This answer is correct because the vpn tu command is used for VPN tunnel management and shows detailed information about VPN tunnels, such as the tunnel ID, peer IP, encryption domain, and status1. This command will bring up a menu for you to choose from, such as list all IPsec SAs, delete all IPsec SAs, or delete IPsec SA for given peer1.
The other answers are not correct because they either show different information or do not exist as commands. The cat $FWDlR/conf/vpn.conf command shows the VPN configuration file, which contains the VPN domains, communities, and encryption settings2. The vpn tu tlist command does not exist, but it might be confused with the vpn tunnelutil tlist command, which shows the tunnel utilization statistics3. The cpview command shows the Check Point real-time performance monitoring tool, which displays various system and network parameters, such as CPU, memory, disk, interfaces, and VPN4.
How to use the “vpn tu” command for VPN tunnel management New VPN daemons in R81.10 / R81.20 – Check Point CheckMates Remote Access VPN R81.20 Administration Guide – Check Point Software Remote Access VPN R81 Administration Guide – Check Point Software
C
Explanation:
This answer is correct because the vpn tu command is used for VPN tunnel management and shows detailed information about VPN tunnels, such as the tunnel ID, peer IP, encryption domain, and status1. This command will bring up a menu for you to choose from, such as list all IPsec SAs, delete all IPsec SAs, or delete IPsec SA for given peer1.
The other answers are not correct because they either show different information or do not exist as commands. The cat $FWDlR/conf/vpn.conf command shows the VPN configuration file, which contains the VPN domains, communities, and encryption settings2. The vpn tu tlist command does not exist, but it might be confused with the vpn tunnelutil tlist command, which shows the tunnel utilization statistics3. The cpview command shows the Check Point real-time performance monitoring tool, which displays various system and network parameters, such as CPU, memory, disk, interfaces, and VPN4.
How to use the “vpn tu” command for VPN tunnel management New VPN daemons in R81.10 / R81.20 – Check Point CheckMates Remote Access VPN R81.20 Administration Guide – Check Point Software Remote Access VPN R81 Administration Guide – Check Point Software
Question #264
Which of the completed statements is NOT true? The WebUI can be used to manage Operating System user accounts and
- A . add users to your Gaia system.
- B . assign privileges to users.
- C . assign user rights to their home directory in the Security Management Server.
- D . edit the home directory of the user.
Correct Answer: C
C
Explanation:
The WebUI can be used to manage Operating System user accounts and add users to your Gaia system, assign privileges to users, and edit the home directory of the user. However, it cannot assign user rights to their home directory in the Security Management Server. This is done by the SmartConsole1.
Reference: 1: Check Point R81 Security Management Administration Guide, page 11.
C
Explanation:
The WebUI can be used to manage Operating System user accounts and add users to your Gaia system, assign privileges to users, and edit the home directory of the user. However, it cannot assign user rights to their home directory in the Security Management Server. This is done by the SmartConsole1.
Reference: 1: Check Point R81 Security Management Administration Guide, page 11.
Question #265
After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?
- A . Security Gateway IP-address cannot be changed without re-establishing the trust
- B . The Security Gateway name cannot be changed in command line without re-establishing trust
- C . The Security Management Server name cannot be changed in SmartConsole without re-establishing trust
- D . The Security Management Server IP-address cannot be changed without re-establishing the trust
Correct Answer: A
A
Explanation:
The answer is A because changing the Security Gateway IP-address requires re-establishing the trust with the Security Management Server by initializing the Secure Internal Communication (SIC). Changing the Security Gateway name in command line or changing the Security Management Server name or IP-address in SmartConsole does not require re-establishing the trust, but it may require updating the topology and pushing the policy.
Reference: [Check Point R81 Security Management Administration Guide], [Check Point R81 Security Gateway Administration Guide]
A
Explanation:
The answer is A because changing the Security Gateway IP-address requires re-establishing the trust with the Security Management Server by initializing the Secure Internal Communication (SIC). Changing the Security Gateway name in command line or changing the Security Management Server name or IP-address in SmartConsole does not require re-establishing the trust, but it may require updating the topology and pushing the policy.
Reference: [Check Point R81 Security Management Administration Guide], [Check Point R81 Security Gateway Administration Guide]
Question #266
You want to store the GAiA configuration in a file for later reference.
What command should you use?
- A . write mem <filename>
- B . show config -f <filename>
- C . save config -o <filename>
- D . save configuration <filename>
Correct Answer: D
D
Explanation:
The correct answer is D because the command save configuration <filename> stores the Gaia configuration in a file for later reference1. The other commands are not valid in Gaia Clish1.
Reference: Gaia R81.10 Administration Guide
D
Explanation:
The correct answer is D because the command save configuration <filename> stores the Gaia configuration in a file for later reference1. The other commands are not valid in Gaia Clish1.
Reference: Gaia R81.10 Administration Guide
Question #267
What Check Point tool is used to automatically update Check Point products for the Gaia OS?
- A . Check Point INSPECT Engine
- B . Check Point Upgrade Service Engine
- C . Check Point Update Engine
- D . Check Point Upgrade Installation Service
Correct Answer: B
B
Explanation:
The Check Point Upgrade Service Engine (CPUSE) is a tool that automates the process of upgrading and installing Check Point products on Gaia OS1. It can also be used to update the Gaia OS itself2. The other options are not valid tools for this purpose.
Reference: Check Point Upgrade Service Engine (CPUSE) – Gaia Deployment Agent, Check Point R81 Gaia Installation and Upgrade Guide
B
Explanation:
The Check Point Upgrade Service Engine (CPUSE) is a tool that automates the process of upgrading and installing Check Point products on Gaia OS1. It can also be used to update the Gaia OS itself2. The other options are not valid tools for this purpose.
Reference: Check Point Upgrade Service Engine (CPUSE) – Gaia Deployment Agent, Check Point R81 Gaia Installation and Upgrade Guide
Question #268
For Automatic Hide NAT rules created by the administrator what is a TRUE statement?
- A . Source Port Address Translation (PAT) is enabled by default
- B . Automate NAT rules are supported for Network objects only.
- C . Automatic NAT rules are supported for Host objects only.
- D . Source Port Address Translation (PAT) is disabled by default
Correct Answer: A
A
Explanation:
Automatic Hide NAT rules are created by the administrator when they configure NAT for network objects or groups in the object properties. Automatic Hide NAT rules allow multiple private IP addresses to share a single public IP address when accessing external networks. Source Port Address Translation (PAT) is enabled by default for Automatic Hide NAT rules, which means that the Security Gateway assigns a unique source port number for each connection from the same source IP address. This allows the Security Gateway to keep track of the connections and translate the reply packets correctly.
A
Explanation:
Automatic Hide NAT rules are created by the administrator when they configure NAT for network objects or groups in the object properties. Automatic Hide NAT rules allow multiple private IP addresses to share a single public IP address when accessing external networks. Source Port Address Translation (PAT) is enabled by default for Automatic Hide NAT rules, which means that the Security Gateway assigns a unique source port number for each connection from the same source IP address. This allows the Security Gateway to keep track of the connections and translate the reply packets correctly.
Question #269
What is NOT an advantage of Packet Filtering?
- A . Application Independence
- B . High Performance
- C . Scalability
- D . Low Security and No Screening above Network Layer
Correct Answer: D
D
Explanation:
Packet filtering is a technique that controls the flow of network data by examining the headers of packets and applying a set of rules to accept or reject them. Packet filtering has some advantages, such as efficiency, cost-effectiveness, ease of use, and transparency3. However, it also has some disadvantages, such as low security and no screening above the network layer4. Packet filtering firewalls cannot inspect the payload of packets or the application layer protocols, which makes them vulnerable to attacks that exploit higher-level vulnerabilitie
D
Explanation:
Packet filtering is a technique that controls the flow of network data by examining the headers of packets and applying a set of rules to accept or reject them. Packet filtering has some advantages, such as efficiency, cost-effectiveness, ease of use, and transparency3. However, it also has some disadvantages, such as low security and no screening above the network layer4. Packet filtering firewalls cannot inspect the payload of packets or the application layer protocols, which makes them vulnerable to attacks that exploit higher-level vulnerabilitie
Question #270
Secure Internal Communication (SIC) is handled by what process?
- A . CPM
- B . HTTPS
- C . FWD
- D . CPD
Correct Answer: D
D
Explanation:
Secure Internal Communication (SIC) is handled by the CPD process3. CPD is the Check Point Daemon that runs on all Check Point modules and handles internal licensing and SIC operations. SIC is a mechanism that ensures secure communication between Check Point components using certificates and encryption.
Reference: Check Point R81 Security Management Administration Guide
D
Explanation:
Secure Internal Communication (SIC) is handled by the CPD process3. CPD is the Check Point Daemon that runs on all Check Point modules and handles internal licensing and SIC operations. SIC is a mechanism that ensures secure communication between Check Point components using certificates and encryption.
Reference: Check Point R81 Security Management Administration Guide