Check Point 156-215.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #21
When a Security Gateways sends its logs to an IP address other than its own, which deployment option is installed?
- A . Distributed
- B . Standalone
- C . Bridge
Correct Answer: A
A
Explanation:
When a Security Gateway sends its logs to an IP address other than its own, it means that the Security Gateway and the Log Server are installed on different machines. This is a characteristic of a Distributed deployment3. Therefore, the correct answer is A
A
Explanation:
When a Security Gateway sends its logs to an IP address other than its own, it means that the Security Gateway and the Log Server are installed on different machines. This is a characteristic of a Distributed deployment3. Therefore, the correct answer is A
Question #22
Which command shows the installed licenses in Expert mode?
- A . print cplic
- B . show licenses
- C . fwlic print
- D . cplic print
Correct Answer: D
D
Explanation:
The command that shows the installed licenses in Expert mode is cplic print. This command displays information about the licenses that are installed on the local machine or a remote machine1. The other commands are not valid for showing licenses in Expert mode.
D
Explanation:
The command that shows the installed licenses in Expert mode is cplic print. This command displays information about the licenses that are installed on the local machine or a remote machine1. The other commands are not valid for showing licenses in Expert mode.
Question #23
Which single Security Blade can be turned on to block both malicious files from being downloaded as well as block websites known to host malware?
- A . Anti-Bot
- B . None – both Anti-Virus and Anti-Bot are required for this
- C . Anti-Virus
- D . None – both URL Filtering and Anti-Virus are required for this.
Correct Answer: C
C
Explanation:
Anti-Virus is the single Security Blade that can be turned on to block both malicious files from being downloaded as well as block websites known to host malware. Anti-Virus scans files and email attachments for viruses, worms, trojans, and other types of malware. It also uses ThreatCloud, a collaborative network that delivers real-time dynamic security intelligence, to detect unknown malware based on their behavior3. Anti-Bot is a Security Blade that detects and blocks botnet communications, but it does not scan files or block websites. URL Filtering is a Security Blade that enables administrators to control access to web applications, but it does not scan files or detect malware.
C
Explanation:
Anti-Virus is the single Security Blade that can be turned on to block both malicious files from being downloaded as well as block websites known to host malware. Anti-Virus scans files and email attachments for viruses, worms, trojans, and other types of malware. It also uses ThreatCloud, a collaborative network that delivers real-time dynamic security intelligence, to detect unknown malware based on their behavior3. Anti-Bot is a Security Blade that detects and blocks botnet communications, but it does not scan files or block websites. URL Filtering is a Security Blade that enables administrators to control access to web applications, but it does not scan files or detect malware.
Question #24
How can the changes made by an administrator before publishing the session be seen by a superuser administrator?
- A . By impersonating the administrator with the ‘Login as…’ option
- B . They cannot be seen
- C . From the SmartView Tracker audit log
- D . From Manage and Settings > Sessions, right click on the session and click ‘View Changes…’
Correct Answer: D
D
Explanation:
The changes made by an administrator before publishing the session can be seen by a superuser administrator from Manage and Settings > Sessions, right click on the session and click ‘View Changes…’. This option allows the superuser to review the changes made by another administrator in a pending session1.
Reference: Check Point R81 Security Management Administration Guide
D
Explanation:
The changes made by an administrator before publishing the session can be seen by a superuser administrator from Manage and Settings > Sessions, right click on the session and click ‘View Changes…’. This option allows the superuser to review the changes made by another administrator in a pending session1.
Reference: Check Point R81 Security Management Administration Guide
Question #25
Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU. After installation, is the administrator required to perform any additional tasks?
- A . Go to clash-Run cpstop | Run cpstart
- B . Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway
- C . Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores
- D . Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway | Install Security Policy
Correct Answer: B
B
Explanation:
The correct answer is B because after installing a new multicore CPU, the administrator needs to configure CoreXL to make use of the additional cores and reboot the Security Gateway. Installing the Security Policy is not necessary because it does not affect the CoreXL configuration1.
Reference: Check Point R81 Security Management Administration Guide
B
Explanation:
The correct answer is B because after installing a new multicore CPU, the administrator needs to configure CoreXL to make use of the additional cores and reboot the Security Gateway. Installing the Security Policy is not necessary because it does not affect the CoreXL configuration1.
Reference: Check Point R81 Security Management Administration Guide
Question #26
A security zone is a group of one or more network interfaces from different centrally managed gateways.
What is considered part of the zone?
- A . The zone is based on the network topology and determined according to where the interface leads to.
- B . Security Zones are not supported by Check Point firewalls.
- C . The firewall rule can be configured to include one or more subnets in a zone.
- D . The local directly connected subnet defined by the subnet IP and subnet mask.
Correct Answer: A
A
Explanation:
A security zone is a group of one or more network interfaces from different centrally managed gateways that have the same security requirements. The zone is based on the network topology and determined according to where the interface leads to. For example, a zone can be defined as internal, external, DMZ, VPN, etc. Security zones are supported by Check Point firewalls and can be used to simplify security policies and network segmentation. The firewall rule can be configured to include one or more zones as source or destination objects. The local directly connected subnet defined by the subnet IP and subnet mask is not considered part of the zone, but rather a property of the interface.
Reference: [Security Zones], [Security Zones Best Practices]
A
Explanation:
A security zone is a group of one or more network interfaces from different centrally managed gateways that have the same security requirements. The zone is based on the network topology and determined according to where the interface leads to. For example, a zone can be defined as internal, external, DMZ, VPN, etc. Security zones are supported by Check Point firewalls and can be used to simplify security policies and network segmentation. The firewall rule can be configured to include one or more zones as source or destination objects. The local directly connected subnet defined by the subnet IP and subnet mask is not considered part of the zone, but rather a property of the interface.
Reference: [Security Zones], [Security Zones Best Practices]
Question #27
Which of the following is NOT a role of the SmartCenter:
- A . Status monitoring
- B . Policy configuration
- C . Certificate authority
- D . Address translation
Correct Answer: D
D
Explanation:
Address translation is not a role of the SmartCenter, as it is performed by the Security Gateway based on the NAT policy configured in the SmartConsole5. The other options are roles of the SmartCenter, as it is responsible for status monitoring, policy configuration, and certificate authority for the Security Gateways5.
Reference: Gaia R81.10 Administration Guide, QUANTUM SECURITY MANAGEMENT R81, Remote Access VPN R81 Administration Guide
D
Explanation:
Address translation is not a role of the SmartCenter, as it is performed by the Security Gateway based on the NAT policy configured in the SmartConsole5. The other options are roles of the SmartCenter, as it is responsible for status monitoring, policy configuration, and certificate authority for the Security Gateways5.
Reference: Gaia R81.10 Administration Guide, QUANTUM SECURITY MANAGEMENT R81, Remote Access VPN R81 Administration Guide
Question #28
Fill in the blank: Authentication rules are defined for ____________.
- A . User groups
- B . Users using UserCheck
- C . Individual users
- D . All users in the database
Correct Answer: A
A
Explanation:
Authentication rules are defined for user groups rather than individual users1. To define authentication rules, you must first define users and groups. You can define users with the Check Point user database, or with an external server, such as LDAP1. UserCheck is a feature that enables user interaction with security events2. Individual users and all users in the database are not valid options for defining authentication rules.
Reference: How to Configure Client Authentication, UserCheck
A
Explanation:
Authentication rules are defined for user groups rather than individual users1. To define authentication rules, you must first define users and groups. You can define users with the Check Point user database, or with an external server, such as LDAP1. UserCheck is a feature that enables user interaction with security events2. Individual users and all users in the database are not valid options for defining authentication rules.
Reference: How to Configure Client Authentication, UserCheck
Question #29
Which of the following statements about Site-to-Site VPN Domain-based is NOT true?
- A . Route-based― The Security Gateways will have a Virtual Tunnel Interface (VTI) for each VPN Tunnel with a peer VPN Gateway. The Routing Table can have routes to forward traffic to these VTls. Any traffic routed through a VTI is automatically identified as VPN Traffic and is passed through the VPN Tunnel associated with the VTI.
- B . Domain-based― VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway.
- C . Domain-based― VPN domains are pre-defined for all VPN Gateways. A VPN domain is a host or network that can send or receive VPN traffic through a VPN Gateway.
- D . Domain-based― VPN domains are pre-defined for all VPN Gateways.
When the Security Gateway encounters traffic originating from one VPN Domain with the destination to a VPN Domain of another VPN Gateway, that traffic is identified as VPN traffic and is sent through the VPN Tunnel between the two Gateways.
Correct Answer: B
B
Explanation:
Domain-based― VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway.
This statement is not true because a VPN domain is not a service or user, but a host or network that can send or receive VPN traffic through a VPN Gateway1. This is the definition given in the Site to Site VPN R81 Administration Guide1. The other statements are true according to the same guide1.
Remote Access VPN R81.20 Administration Guide Site to Site VPN R81 Administration Guide
DeepDive Webinar – R81.20 Seamless VPN Connection to Public Cloud
B
Explanation:
Domain-based― VPN domains are pre-defined for all VPN Gateways. A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway.
This statement is not true because a VPN domain is not a service or user, but a host or network that can send or receive VPN traffic through a VPN Gateway1. This is the definition given in the Site to Site VPN R81 Administration Guide1. The other statements are true according to the same guide1.
Remote Access VPN R81.20 Administration Guide Site to Site VPN R81 Administration Guide
DeepDive Webinar – R81.20 Seamless VPN Connection to Public Cloud
Question #30
Which is a suitable command to check whether Drop Templates are activated or not?
- A . fw ctl get int activate_drop_templates
- B . fwaccel stat
- C . fwaccel stats
- D . fw ctl templates Cd
Correct Answer: B
B
Explanation:
The command fwaccel stat shows the status of SecureXL, including whether Drop Templates are enabled or not1.
Reference: Check Point SecureXL R81 Administration Guide
B
Explanation:
The command fwaccel stat shows the status of SecureXL, including whether Drop Templates are enabled or not1.
Reference: Check Point SecureXL R81 Administration Guide