Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #281
Fill in the blank Once a license is activated, a___________should be installed.
- A . Security Gateway Contract file
- B . Service Contract file
- C . License Management file
- D . License Contract file
Correct Answer: B
B
Explanation:
Once a license is activated, a Service Contract file should be installed. This file contains information about the license expiration date, support level, and other details3. The other options are not valid file names.
Reference: 3: Check Point R81 Security Management Administration Guide, page 15.
B
Explanation:
Once a license is activated, a Service Contract file should be installed. This file contains information about the license expiration date, support level, and other details3. The other options are not valid file names.
Reference: 3: Check Point R81 Security Management Administration Guide, page 15.
Question #282
Which of the following methods can be used to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server?
- A . Save Policy
- B . Install Database
- C . Save session
- D . Install Policy
Correct Answer: A
A
Explanation:
The method to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server is Save Policy. Saving a policy updates the trusted log server with the latest policy and configuration changes3.
Reference: Check Point R81 Logging and Monitoring Administration Guide
A
Explanation:
The method to update the trusted log server regarding the policy and configuration changes performed on the Security Management Server is Save Policy. Saving a policy updates the trusted log server with the latest policy and configuration changes3.
Reference: Check Point R81 Logging and Monitoring Administration Guide
Question #283
An administrator wishes to enable Identity Awareness on the Check Point firewalls. However they allow users to use company issued or personal laptops.
Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?
- A . AD Query
- B . Browser-Based Authentication
- C . Identity Agents
- D . Terminal Servers Agent
Correct Answer: B
B
Explanation:
Browser-Based Authentication is the best method for enabling Identity Awareness on the Check Point firewalls for users who use company issued or personal laptops. Browser-Based Authentication redirects users to a web page where they enter their credentials to access the network resources.
This method does not require any installation or configuration on the user’s device and supports any operating system and browser. AD Query is a method that queries Active Directory servers for user login events and maps them to IP addresses. This method does not work for personal laptops that are not joined to the domain. Identity Agents are software agents that run on Windows or macOS devices and provide user and machine identity information to the firewall. This method requires installation and management of the agents on each device, which may not be feasible for personal laptops. Terminal Servers Agent is a method that identifies users who connect to Windows Terminal Servers or Citrix servers via RDP or ICA protocols. This method does not apply to laptops that connect directly to the network910
Reference: Identity Awareness Reference Architecture and Best Practices, Part 10 – Identity
B
Explanation:
Browser-Based Authentication is the best method for enabling Identity Awareness on the Check Point firewalls for users who use company issued or personal laptops. Browser-Based Authentication redirects users to a web page where they enter their credentials to access the network resources.
This method does not require any installation or configuration on the user’s device and supports any operating system and browser. AD Query is a method that queries Active Directory servers for user login events and maps them to IP addresses. This method does not work for personal laptops that are not joined to the domain. Identity Agents are software agents that run on Windows or macOS devices and provide user and machine identity information to the firewall. This method requires installation and management of the agents on each device, which may not be feasible for personal laptops. Terminal Servers Agent is a method that identifies users who connect to Windows Terminal Servers or Citrix servers via RDP or ICA protocols. This method does not apply to laptops that connect directly to the network910
Reference: Identity Awareness Reference Architecture and Best Practices, Part 10 – Identity
Question #284
Which Check Point Software Wade provides visibility of users, groups and machines while also providing access control through identity-based policies?
- A . Firewall
- B . Identity Awareness
- C . Application Control
- D . URL Filtering
Correct Answer: B
B
Explanation:
Identity Awareness is the Check Point software blade that provides visibility of users, groups and machines while also providing access control through identity-based policies. Identity Awareness enables administrators to define granular access rules based on user or machine identity, rather than just IP addresses. Identity Awareness also allows administrators to monitor user activity and generate reports based on user or machine identity.
B
Explanation:
Identity Awareness is the Check Point software blade that provides visibility of users, groups and machines while also providing access control through identity-based policies. Identity Awareness enables administrators to define granular access rules based on user or machine identity, rather than just IP addresses. Identity Awareness also allows administrators to monitor user activity and generate reports based on user or machine identity.
Question #284
Which Check Point Software Wade provides visibility of users, groups and machines while also providing access control through identity-based policies?
- A . Firewall
- B . Identity Awareness
- C . Application Control
- D . URL Filtering
Correct Answer: B
B
Explanation:
Identity Awareness is the Check Point software blade that provides visibility of users, groups and machines while also providing access control through identity-based policies. Identity Awareness enables administrators to define granular access rules based on user or machine identity, rather than just IP addresses. Identity Awareness also allows administrators to monitor user activity and generate reports based on user or machine identity.
B
Explanation:
Identity Awareness is the Check Point software blade that provides visibility of users, groups and machines while also providing access control through identity-based policies. Identity Awareness enables administrators to define granular access rules based on user or machine identity, rather than just IP addresses. Identity Awareness also allows administrators to monitor user activity and generate reports based on user or machine identity.
Question #286
Log query results can be exported to what file format?
- A . Word Document (docx)
- B . Comma Separated Value (csv)
- C . Portable Document Format (pdf)
- D . Text (txt)
Correct Answer: B
B
Explanation:
Log query results can be exported to Comma Separated Value (csv) file format. CSV is a file format that stores tabular data in plain text. It is compatible with various applications, such as Excel, Google Sheets, etc. The other options are not valid file formats for exporting log query results.
Reference: 1: Gaia Roles 2: Gaia Default Users 3: Anti-Virus: [Exporting Logs]
B
Explanation:
Log query results can be exported to Comma Separated Value (csv) file format. CSV is a file format that stores tabular data in plain text. It is compatible with various applications, such as Excel, Google Sheets, etc. The other options are not valid file formats for exporting log query results.
Reference: 1: Gaia Roles 2: Gaia Default Users 3: Anti-Virus: [Exporting Logs]
Question #287
At what point is the Internal Certificate Authority (ICA) created?
- A . During the primary Security Management Server installation process.
- B . Upon creation of a certificate
- C . When an administrator decides to create one
- D . When an administrator initially logs into SmartConsole.
Correct Answer: A
A
Explanation:
The Internal Certificate Authority (ICA) is created during the primary Security Management Server installation process. The ICA is a component that issues and manages certificates for Check Point products. The ICA is automatically installed and initialized when installing the Security Management Server.
Reference: Check Point R81 Security Management Administration Guide, page 26.
A
Explanation:
The Internal Certificate Authority (ICA) is created during the primary Security Management Server installation process. The ICA is a component that issues and manages certificates for Check Point products. The ICA is automatically installed and initialized when installing the Security Management Server.
Reference: Check Point R81 Security Management Administration Guide, page 26.
Question #288
Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?
- A . ThreatWiki
- B . Whitelist Files
- C . AppWiki
- D . IPS Protections
Correct Answer: A
A
Explanation:
ThreatWiki is a tool that provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed3. ThreatWiki is a web-based service that collects information about files from various sources, such as Check Point customers, partners, and researchers. Administrators can use ThreatWiki to view file reputation, upload files for analysis, and download indicators of compromise3. Whitelist Files, AppWiki, and IPS Protections are not tools that provide a list of trusted files.
Reference: Threat Prevention R80.40 Administration Guide
A
Explanation:
ThreatWiki is a tool that provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed3. ThreatWiki is a web-based service that collects information about files from various sources, such as Check Point customers, partners, and researchers. Administrators can use ThreatWiki to view file reputation, upload files for analysis, and download indicators of compromise3. Whitelist Files, AppWiki, and IPS Protections are not tools that provide a list of trusted files.
Reference: Threat Prevention R80.40 Administration Guide
Question #289
Fill in the blanks: The Application Layer Firewalls inspect traffic through the ______ layer(s) of the TCP/IP model and up to and including the ______ layer.
- A . Upper; Application
- B . First two; Internet
- C . Lower; Application
- D . First two; Transport
Correct Answer: C
C
Explanation:
The Application Layer Firewalls inspect traffic through the Lower layer(s) of the TCP/IP model and up to and including the Application layer. The lower layers are the Physical, Data Link, and Network layers, which deal with the transmission and routing of packets. The Application layer is the highest layer of the TCP/IP model, which provides services and protocols for specific applications such as HTTP, FTP, SMTP, etc. The Application Layer Firewalls can inspect the content and context of the traffic and enforce granular security policies based on various criteria such as user identity, application identity, content type, etc.
Reference: [Check Point R81 Firewall Administration Guide]
C
Explanation:
The Application Layer Firewalls inspect traffic through the Lower layer(s) of the TCP/IP model and up to and including the Application layer. The lower layers are the Physical, Data Link, and Network layers, which deal with the transmission and routing of packets. The Application layer is the highest layer of the TCP/IP model, which provides services and protocols for specific applications such as HTTP, FTP, SMTP, etc. The Application Layer Firewalls can inspect the content and context of the traffic and enforce granular security policies based on various criteria such as user identity, application identity, content type, etc.
Reference: [Check Point R81 Firewall Administration Guide]
Question #290
Fill in the blank: An LDAP server holds one or more ______________.
- A . Server Units
- B . Administrator Units
- C . Account Units
- D . Account Servers
Correct Answer: C
C
Explanation:
An LDAP server holds one or more Account Units. An Account Unit is a logical representation of an LDAP server in the Check Point database. It defines the connection parameters, authentication methods, and user and group information that are retrieved from the LDAP server. An Account Unit allows the Security Gateway to use the LDAP server for user authentication and identity awareness. The other options are incorrect. A Server Unit is a logical representation of a Check Point server in the Check Point database. An Administrator Unit is a logical representation of an administrator or an administrator group in the Check Point database. An Account Server is not a valid term in Check Point terminology.
Reference: [Check Point R81 Identity Awareness Administration Guide], [Check Point R81 Security Management Administration Guide], [Check Point R81 SmartConsole R81 Resolved Issues]
C
Explanation:
An LDAP server holds one or more Account Units. An Account Unit is a logical representation of an LDAP server in the Check Point database. It defines the connection parameters, authentication methods, and user and group information that are retrieved from the LDAP server. An Account Unit allows the Security Gateway to use the LDAP server for user authentication and identity awareness. The other options are incorrect. A Server Unit is a logical representation of a Check Point server in the Check Point database. An Administrator Unit is a logical representation of an administrator or an administrator group in the Check Point database. An Account Server is not a valid term in Check Point terminology.
Reference: [Check Point R81 Identity Awareness Administration Guide], [Check Point R81 Security Management Administration Guide], [Check Point R81 SmartConsole R81 Resolved Issues]