Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #291
Where can administrator edit a list of trusted SmartConsole clients?
- A . cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server.
- B . In cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, in SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients.
- C . WebUI client logged to Security Management Server, SmartDashboard: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients, via cpconfig on a Security Gateway.
- D . Only using SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients.
Correct Answer: B
B
Explanation:
The administrator can edit a list of trusted SmartConsole clients in three ways: in cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, and in SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients
B
Explanation:
The administrator can edit a list of trusted SmartConsole clients in three ways: in cpconfig on a Security Management Server, in the WebUI logged into a Security Management Server, and in SmartConsole: Manage and Settings > Permissions and Administrators > Advanced > Trusted Clients
Question #292
What are valid authentication methods for mutual authenticating the VPN gateways?
- A . Pre-shared Secret and PKI Certificates
- B . PKI Certificates and Kerberos Tickets
- C . Pre-Shared Secrets and Kerberos Ticket
- D . PKI Certificates and DynamiciD OTP
Correct Answer: A
A
Explanation:
This answer is correct because these are two valid methods for mutually authenticating the VPN gateways, which means that both sides of the communication verify each other’s identity using a shared secret or a public key certificate1. A pre-shared secret is a password or a passphrase that both gateways know and use to encrypt and decrypt the VPN traffic2. A PKI certificate is a digital document that contains the public key and other information that helps identify the gateway, such as the issuer, the subject, and the expiration date3. The certificate is signed by a trusted certificate authority (CA) that vouches for the authenticity of the gateway3.
The other answers are not correct because they either include invalid or irrelevant methods for mutual authentication. PKI certificates and Kerberos tickets are not compatible methods for mutual authentication, because Kerberos tickets are issued by a Kerberos server and not by a CA4. Pre-shared secrets and Kerberos tickets are also not compatible methods for mutual authentication, because they use different protocols and encryption algorithms4. PKI certificates and DynamiciD OTP are not valid methods for mutual authentication, because DynamiciD OTP is a one-time password that is used for user authentication, not for gateway authentication5.
What is mutual authentication? | Two-way authentication
Mutual authentication – AWS Client VPN
VPN authentication options – Windows Security
Mutual Authentication | Top 3 Methods of Mutual Authentication
Authentication methods and features – Microsoft Entra
A
Explanation:
This answer is correct because these are two valid methods for mutually authenticating the VPN gateways, which means that both sides of the communication verify each other’s identity using a shared secret or a public key certificate1. A pre-shared secret is a password or a passphrase that both gateways know and use to encrypt and decrypt the VPN traffic2. A PKI certificate is a digital document that contains the public key and other information that helps identify the gateway, such as the issuer, the subject, and the expiration date3. The certificate is signed by a trusted certificate authority (CA) that vouches for the authenticity of the gateway3.
The other answers are not correct because they either include invalid or irrelevant methods for mutual authentication. PKI certificates and Kerberos tickets are not compatible methods for mutual authentication, because Kerberos tickets are issued by a Kerberos server and not by a CA4. Pre-shared secrets and Kerberos tickets are also not compatible methods for mutual authentication, because they use different protocols and encryption algorithms4. PKI certificates and DynamiciD OTP are not valid methods for mutual authentication, because DynamiciD OTP is a one-time password that is used for user authentication, not for gateway authentication5.
What is mutual authentication? | Two-way authentication
Mutual authentication – AWS Client VPN
VPN authentication options – Windows Security
Mutual Authentication | Top 3 Methods of Mutual Authentication
Authentication methods and features – Microsoft Entra
Question #293
Fill in the blank: Back up and restores can be accomplished through_________.
- A . SmartConsole, WebUI, or CLI
- B . WebUI, CLI, or SmartUpdate
- C . CLI, SmartUpdate, or SmartBackup
- D . SmartUpdate, SmartBackup, or SmartConsole
Correct Answer: A
A
Explanation:
Back up and restores can be accomplished through SmartConsole, WebUI, or CLI12. These are the methods to perform system backup and restore, which save and restore the Gaia OS configuration and the Security Management Server database1. WebUI, CLI, or SmartUpdate are not valid methods, as SmartUpdate is used to install software packages and patches, not to back up or restore the system3. CLI, SmartUpdate, or SmartBackup are not valid methods, as SmartBackup is a feature of SmartProvisioning that allows backing up and restoring the configuration of Security Gateways and VSX clusters4. SmartUpdate, SmartBackup, or SmartConsole are not valid methods, as SmartConsole is used to configure and manage the Security Policy, not to back up or restore the system5.
Reference: System Backup and Restore feature in Gaia, Check Point R81.10, INSTALLATION AND UPGRADE GUIDE R81.10, SmartProvisioning R81.10 Administration Guide, QUANTUM SECURITY MANAGEMENT R81
A
Explanation:
Back up and restores can be accomplished through SmartConsole, WebUI, or CLI12. These are the methods to perform system backup and restore, which save and restore the Gaia OS configuration and the Security Management Server database1. WebUI, CLI, or SmartUpdate are not valid methods, as SmartUpdate is used to install software packages and patches, not to back up or restore the system3. CLI, SmartUpdate, or SmartBackup are not valid methods, as SmartBackup is a feature of SmartProvisioning that allows backing up and restoring the configuration of Security Gateways and VSX clusters4. SmartUpdate, SmartBackup, or SmartConsole are not valid methods, as SmartConsole is used to configure and manage the Security Policy, not to back up or restore the system5.
Reference: System Backup and Restore feature in Gaia, Check Point R81.10, INSTALLATION AND UPGRADE GUIDE R81.10, SmartProvisioning R81.10 Administration Guide, QUANTUM SECURITY MANAGEMENT R81
Question #294
A network administrator has informed you that they have identified a malicious host on the network, and instructed you to block it. Corporate policy dictates that firewall policy changes cannot be made at this time.
What tool can you use to block this traffic?
- A . Anti-Bot protection
- B . Anti-Malware protection
- C . Policy-based routing
- D . Suspicious Activity Monitoring (SAM) rules
Correct Answer: D
D
Explanation:
If a network administrator has identified a malicious host on the network and instructed you to block it, but you cannot make any firewall policy changes at this time, you can use Suspicious Activity Monitoring (SAM) rules to block this traffic. SAM rules are temporary rules that allow you to block or limit traffic from specific sources or destinations without modifying the security policy. SAM rules are created and managed by SmartView Monitor and are enforced by the security gateway for a specified duration. Anti-Bot protection, Anti-Malware protection, and Policy-based routing are not tools that can be used to block traffic without changing the firewall policy.
Reference: [Check Point R81 SmartView Monitor Administration Guide]
D
Explanation:
If a network administrator has identified a malicious host on the network and instructed you to block it, but you cannot make any firewall policy changes at this time, you can use Suspicious Activity Monitoring (SAM) rules to block this traffic. SAM rules are temporary rules that allow you to block or limit traffic from specific sources or destinations without modifying the security policy. SAM rules are created and managed by SmartView Monitor and are enforced by the security gateway for a specified duration. Anti-Bot protection, Anti-Malware protection, and Policy-based routing are not tools that can be used to block traffic without changing the firewall policy.
Reference: [Check Point R81 SmartView Monitor Administration Guide]
Question #295
What are the advantages of a “shared policy” in R80?
- A . Allows the administrator to share a policy between all the users identified by the Security Gateway
- B . Allows the administrator to share a policy between all the administrators managing the Security Management Server
- C . Allows the administrator to share a policy so that it is available to use in another Policy Package
- D . Allows the administrator to install a policy on one Security Gateway and it gets installed on another managed Security Gateway
Correct Answer: C
C
Explanation:
A shared policy is a set of rules that can be used in multiple policy packages. It allows the administrator to create a common security policy for different gateways or domains, and avoid duplication and inconsistency. The other options are not advantages of a shared policy.
Reference: [Shared Policies Overview], [Shared Policies Best Practices]
C
Explanation:
A shared policy is a set of rules that can be used in multiple policy packages. It allows the administrator to create a common security policy for different gateways or domains, and avoid duplication and inconsistency. The other options are not advantages of a shared policy.
Reference: [Shared Policies Overview], [Shared Policies Best Practices]
Question #296
With URL Filtering, what portion of the traffic is sent to the Check Point Online Web Service for analysis?
- A . The complete communication is sent for inspection.
- B . The IP address of the source machine.
- C . The end user credentials.
- D . The host portion of the URL.
Correct Answer: D
D
Explanation:
With URL Filtering, only the host portion of the URL is sent to the Check Point Online Web Service for analysis. The host portion is the part of the URL that identifies the web server, such as www.example.com. The Check Point Online Web Service uses this information to categorize the URL and return the appropriate action to the Security Gateway3. The other options are not sent to the Check Point Online Web Service for analysis, as they may contain sensitive or irrelevant data.
D
Explanation:
With URL Filtering, only the host portion of the URL is sent to the Check Point Online Web Service for analysis. The host portion is the part of the URL that identifies the web server, such as www.example.com. The Check Point Online Web Service uses this information to categorize the URL and return the appropriate action to the Security Gateway3. The other options are not sent to the Check Point Online Web Service for analysis, as they may contain sensitive or irrelevant data.
Question #297
The SmartEvent R80 Web application for real-time event monitoring is called:
- A . SmartView Monitor
- B . SmartEventWeb
- C . There is no Web application for SmartEvent
- D . SmartView
Correct Answer: D
D
Explanation:
SmartView is the web application for real-time event monitoring in SmartEvent R80 and above. It provides a unified view of security events across the network and allows for quick investigation and response34.
Reference: SmartEvent R80.40 Administration Guide, SmartView
D
Explanation:
SmartView is the web application for real-time event monitoring in SmartEvent R80 and above. It provides a unified view of security events across the network and allows for quick investigation and response34.
Reference: SmartEvent R80.40 Administration Guide, SmartView
Question #298
What is the main difference between Threat Extraction and Threat Emulation?
- A . Threat Emulation never delivers a file and takes more than 3 minutes to complete
- B . Threat Extraction always delivers a file and takes less than a second to complete
- C . Threat Emulation never delivers a file that takes less than a second to complete
- D . Threat Extraction never delivers a file and takes more than 3 minutes to complete
Correct Answer: B
B
Explanation:
The correct answer is B because Threat Extraction always delivers a file and takes less than a second to complete2. Threat Extraction removes exploitable content from files and delivers a clean and safe file to the user2. Threat Emulation analyzes files in a sandbox environment and delivers a verdict of malicious or benign2. Threat Emulation can take more than 3 minutes to complete depending on the file size and complexity2.
Reference: Check Point R81 Threat Prevention Administration Guide
B
Explanation:
The correct answer is B because Threat Extraction always delivers a file and takes less than a second to complete2. Threat Extraction removes exploitable content from files and delivers a clean and safe file to the user2. Threat Emulation analyzes files in a sandbox environment and delivers a verdict of malicious or benign2. Threat Emulation can take more than 3 minutes to complete depending on the file size and complexity2.
Reference: Check Point R81 Threat Prevention Administration Guide
Question #299
What is the SOLR database for?
- A . Used for full text search and enables powerful matching capabilities
- B . Writes data to the database and full text search
- C . Serves GUI responsible to transfer request to the DLE server
- D . Enables powerful matching capabilities and writes data to the database
Correct Answer: A
A
Explanation:
The SOLR database is used for full text search and enables powerful matching capabilities3. SOLR is an open source enterprise search platform that provides fast and scalable indexing and searching of data. It supports advanced features such as faceting, highlighting, spell checking, synonyms, etc. The SOLR database is used by Check Point products such as SmartLog and SmartEvent to store and query logs and events3. The other options are incorrect.
Option B is false, as SOLR does not write data to the database, but only reads data from it.
Option C is false, as SOLR does not serve GUI, but only provides a RESTful API for queries.
Option D is false, as SOLR does not enable powerful matching capabilities and write data to the database, but only enables powerful matching capabilities.
Reference: SOLR – Check Point Software, [Apache Solr]
A
Explanation:
The SOLR database is used for full text search and enables powerful matching capabilities3. SOLR is an open source enterprise search platform that provides fast and scalable indexing and searching of data. It supports advanced features such as faceting, highlighting, spell checking, synonyms, etc. The SOLR database is used by Check Point products such as SmartLog and SmartEvent to store and query logs and events3. The other options are incorrect.
Option B is false, as SOLR does not write data to the database, but only reads data from it.
Option C is false, as SOLR does not serve GUI, but only provides a RESTful API for queries.
Option D is false, as SOLR does not enable powerful matching capabilities and write data to the database, but only enables powerful matching capabilities.
Reference: SOLR – Check Point Software, [Apache Solr]
Question #300
What is the most complete definition of the difference between the Install Policy button on the SmartConsole’s tab, and the Install Policy within a specific policy?
- A . The Global one also saves and published the session before installation.
- B . The Global one can install multiple selected policies at the same time.
- C . The local one does not install the Anti-Malware policy along with the Network policy.
- D . The second one pre-select the installation for only the current policy and for the applicable gateways.
Correct Answer: D
D
Explanation:
The difference between the Install Policy button on the SmartConsole’s tab and the Install Policy within a specific policy is that the former installs all the policies that are selected in the Install Policy window, while the latter pre-selects the installation for only the current policy and for the applicable gateways5. The other options are not accurate differences.
Reference: Installing Policies, [Check Point CCSA – R81: Practice Test & Explanation]
D
Explanation:
The difference between the Install Policy button on the SmartConsole’s tab and the Install Policy within a specific policy is that the former installs all the policies that are selected in the Install Policy window, while the latter pre-selects the installation for only the current policy and for the applicable gateways5. The other options are not accurate differences.
Reference: Installing Policies, [Check Point CCSA – R81: Practice Test & Explanation]