Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #271
What SmartEvent component creates events?
- A . Consolidation Policy
- B . Correlation Unit
- C . SmartEvent Policy
- D . SmartEvent GUI
Correct Answer: B
B
Explanation:
Correlation Unit is the SmartEvent component that creates events. It analyzes logs received from Security Gateways and Servers, and generates security events according to the definitions in the Consolidation Policy.
Reference: [SmartEvent R80.40 Administration Guide], [Correlation Unit]
B
Explanation:
Correlation Unit is the SmartEvent component that creates events. It analyzes logs received from Security Gateways and Servers, and generates security events according to the definitions in the Consolidation Policy.
Reference: [SmartEvent R80.40 Administration Guide], [Correlation Unit]
Question #272
From the Gaia web interface, which of the following operations CANNOT be performed on a Security Management Server?
- A . Verify a Security Policy
- B . Open a terminal shell
- C . Add a static route
- D . View Security Management GUI Clients
Correct Answer: A
A
Explanation:
From the Gaia web interface, the operation that CANNOT be performed on a Security Management Server is Verify a Security Policy. This operation can only be done from SmartConsole4.
Reference: Check Point R81 SmartConsole Online Help
A
Explanation:
From the Gaia web interface, the operation that CANNOT be performed on a Security Management Server is Verify a Security Policy. This operation can only be done from SmartConsole4.
Reference: Check Point R81 SmartConsole Online Help
Question #272
From the Gaia web interface, which of the following operations CANNOT be performed on a Security Management Server?
- A . Verify a Security Policy
- B . Open a terminal shell
- C . Add a static route
- D . View Security Management GUI Clients
Correct Answer: A
A
Explanation:
From the Gaia web interface, the operation that CANNOT be performed on a Security Management Server is Verify a Security Policy. This operation can only be done from SmartConsole4.
Reference: Check Point R81 SmartConsole Online Help
A
Explanation:
From the Gaia web interface, the operation that CANNOT be performed on a Security Management Server is Verify a Security Policy. This operation can only be done from SmartConsole4.
Reference: Check Point R81 SmartConsole Online Help
Question #274
DLP and Geo Policy are examples of what type of Policy?
- A . Inspection Policies
- B . Shared Policies
- C . Unified Policies
- D . Standard Policies
Correct Answer: B
B
Explanation:
DLP and Geo Policy are examples of Shared Policies. Shared Policies are policies that can be shared with other policy packages to save time and effort when managing multiple gateways with similar security requirements. Shared Policies can be applied to Access Control, Threat Prevention, and HTTPS Inspection layers. Other types of policies include Inspection Policies, Unified Policies, and Standard Policies.
Reference: [Check Point R81 Security Management Administration Guide], [Check Point R81 SmartConsole R81 Resolved Issues]
B
Explanation:
DLP and Geo Policy are examples of Shared Policies. Shared Policies are policies that can be shared with other policy packages to save time and effort when managing multiple gateways with similar security requirements. Shared Policies can be applied to Access Control, Threat Prevention, and HTTPS Inspection layers. Other types of policies include Inspection Policies, Unified Policies, and Standard Policies.
Reference: [Check Point R81 Security Management Administration Guide], [Check Point R81 SmartConsole R81 Resolved Issues]
Question #275
In R80 Management, apart from using SmartConsole, objects or rules can also be modified using:
- A . 3rd Party integration of CLI and API for Gateways prior to R80.
- B . A complete CLI and API interface using SSH and custom CPCode integration.
- C . 3rd Party integration of CLI and API for Management prior to R80.
- D . A complete CLI and API interface for Management with 3rd Party integration.
Correct Answer: B
B
Explanation:
In R80 Management, apart from using SmartConsole, objects or rules can also be modified using a complete CLI and API interface using SSH and custom CPCode integration. This allows you to automate tasks, integrate with third-party tools, and create custom scripts. 3rd Party integration of CLI and API for Gateways or Management prior to R80 is not relevant for R80 Management. A complete CLI and API interface for Management with 3rd Party integration is not a specific option.
Reference: [Check Point R81 Security Management Administration Guide], [Check Point Learning and Training Frequently Asked Questions (FAQs)]
B
Explanation:
In R80 Management, apart from using SmartConsole, objects or rules can also be modified using a complete CLI and API interface using SSH and custom CPCode integration. This allows you to automate tasks, integrate with third-party tools, and create custom scripts. 3rd Party integration of CLI and API for Gateways or Management prior to R80 is not relevant for R80 Management. A complete CLI and API interface for Management with 3rd Party integration is not a specific option.
Reference: [Check Point R81 Security Management Administration Guide], [Check Point Learning and Training Frequently Asked Questions (FAQs)]
Question #276
Which configuration element determines which traffic should be encrypted into a VPN tunnel vs. sent in the clear?
- A . The firewall topologies
- B . NAT Rules
- C . The Rule Base
- D . The VPN Domains
Correct Answer: D
D
Explanation:
The VPN Domains configuration element determines which traffic should be encrypted into a VPN tunnel vs. sent in the clear. The VPN Domain is the set of hosts and networks that are allowed to communicate securely with the gateway12. The firewall topologies, NAT rules, and the rule base do not directly affect the VPN encryption decision.
Reference: Check Point R81 Security Gateway Technical Administration Guide, CCSA/CCSE Exam Tips & Content – R80.X vs. R81.X – Check Point CheckMates
D
Explanation:
The VPN Domains configuration element determines which traffic should be encrypted into a VPN tunnel vs. sent in the clear. The VPN Domain is the set of hosts and networks that are allowed to communicate securely with the gateway12. The firewall topologies, NAT rules, and the rule base do not directly affect the VPN encryption decision.
Reference: Check Point R81 Security Gateway Technical Administration Guide, CCSA/CCSE Exam Tips & Content – R80.X vs. R81.X – Check Point CheckMates
Question #277
Which of the following commands is used to monitor cluster members in CLI?
- A . show cluster state
- B . show active cluster
- C . show clusters
- D . show running cluster
Correct Answer: A
A
Explanation:
The command show cluster state is used to monitor cluster members in CLI. It displays information such as the cluster mode, the cluster members, their status, their priority, and their interfaces.
Reference: [ClusterXL Administration Guide], [Check Point CLI Reference Card]
A
Explanation:
The command show cluster state is used to monitor cluster members in CLI. It displays information such as the cluster mode, the cluster members, their status, their priority, and their interfaces.
Reference: [ClusterXL Administration Guide], [Check Point CLI Reference Card]
Question #278
Identity Awareness lets an administrator easily configure network access and auditing based on three items Choose the correct statement.
- A . Network location, the identity of a user and the active directory membership.
- B . Network location, the identity of a user and the identity of a machine.
- C . Network location, the telephone number of a user and the UID of a machine
- D . Geographical location, the identity of a user and the identity of a machine
Correct Answer: B
B
Explanation:
Identity Awareness is a software blade that lets an administrator easily configure network access and auditing based on three items: network location, the identity of a user, and the identity of a machine. These items are used to identify and authenticate users and machines, and to enforce identity-based policies. Network location refers to the IP address or subnet of the source or destination of the traffic. The identity of a user can be obtained from various sources, such as Active Directory, LDAP, or Captive Portal. The identity of a machine can be verified by using Secure Domain Logon or Identity Agent.
B
Explanation:
Identity Awareness is a software blade that lets an administrator easily configure network access and auditing based on three items: network location, the identity of a user, and the identity of a machine. These items are used to identify and authenticate users and machines, and to enforce identity-based policies. Network location refers to the IP address or subnet of the source or destination of the traffic. The identity of a user can be obtained from various sources, such as Active Directory, LDAP, or Captive Portal. The identity of a machine can be verified by using Secure Domain Logon or Identity Agent.
Question #279
You are the Check Point administrator for Alpha Corp with an R80 Check Point estate. You have received a call by one of the management users stating that they are unable to browse the Internet with their new tablet connected to the company Wireless. The Wireless system goes through the Check Point Gateway.
How do you review the logs to see what the problem may be?
- A . Open SmartLog and connect remotely to the IP of the wireless controller
- B . Open SmartView Tracker and filter the logs for the IP address of the tablet
- C . Open SmartView Tracker and check all the IP logs for the tablet
- D . Open SmartLog and query for the IP address of the Manager’s tablet
Correct Answer: D
D
Explanation:
SmartLog is a unified log viewer that provides fast and easy access to logs from all Check Point components3. It allows the administrator to query for any log field, such as the IP address of the tablet, and filter the results by time, severity, blade, action, and more4. SmartView Tracker is a legacy tool that displays network activity logs from Security Gateways and other Check Point devices. It does not support remote connection to the wireless controller or querying for specific IP addresses.
Reference: SmartLog, SmartLog Queries, [SmartView Tracker]
D
Explanation:
SmartLog is a unified log viewer that provides fast and easy access to logs from all Check Point components3. It allows the administrator to query for any log field, such as the IP address of the tablet, and filter the results by time, severity, blade, action, and more4. SmartView Tracker is a legacy tool that displays network activity logs from Security Gateways and other Check Point devices. It does not support remote connection to the wireless controller or querying for specific IP addresses.
Reference: SmartLog, SmartLog Queries, [SmartView Tracker]
Question #280
What are the steps to configure the HTTPS Inspection Policy?
- A . Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard
- B . Go to Application&url filtering blade > Advanced > Https Inspection > Policy
- C . Go to Manage&Settings > Blades > HTTPS Inspection > Policy
- D . Go to Application&url filtering blade > Https Inspection > Policy
Correct Answer: C
C
Explanation:
The steps to configure the HTTPS Inspection Policy are as follows34:
Go to Manage & Settings > Blades > HTTPS Inspection > Policy.
Click on New HTTPS Inspection Rule or select an existing rule and click on Edit Rule.
Define the Source, Destination, and Action for the rule. The action can be either Inspect, Bypass, or Ask.
Click on OK and then on Install Policy to apply the changes.
Reference: HTTPS Inspection R81
Administration Guide, Check Point CCSA – R81: Practice Test & Explanation
C
Explanation:
The steps to configure the HTTPS Inspection Policy are as follows34:
Go to Manage & Settings > Blades > HTTPS Inspection > Policy.
Click on New HTTPS Inspection Rule or select an existing rule and click on Edit Rule.
Define the Source, Destination, and Action for the rule. The action can be either Inspect, Bypass, or Ask.
Click on OK and then on Install Policy to apply the changes.
Reference: HTTPS Inspection R81
Administration Guide, Check Point CCSA – R81: Practice Test & Explanation