Check Point 156-215.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #331
When comparing Stateful Inspection and Packet Filtering, what is a benefit that Stateful Inspection offers over Packer Filtering?
- A . Stateful Inspection offers unlimited connections because of virtual memory usage.
- B . Stateful Inspection offers no benefits over Packet Filtering.
- C . Stateful Inspection does not use memory to record the protocol used by the connection.
- D . Only one rule is required for each connection.
Correct Answer: D
D
Explanation:
Stateful Inspection is a firewall technology that inspects both the header and the payload of each packet and keeps track of the state and context of each connection. Packet Filtering is a firewall technology that inspects only the header of each packet and does not keep track of the state or context of each connection. A benefit that Stateful Inspection offers over Packet Filtering is that only one rule is required for each connection, whereas Packet Filtering requires two rules for each connection (one for each direction). Stateful Inspection also offers other benefits over Packet Filtering, such as enhanced security, performance, and flexibility. Stateful Inspection does not offer unlimited connections because of virtual memory usage, nor does it avoid using memory to record the protocol used by the connection.
Reference: [Stateful Inspection], [Packet Filtering], [Firewall Technologies]
D
Explanation:
Stateful Inspection is a firewall technology that inspects both the header and the payload of each packet and keeps track of the state and context of each connection. Packet Filtering is a firewall technology that inspects only the header of each packet and does not keep track of the state or context of each connection. A benefit that Stateful Inspection offers over Packet Filtering is that only one rule is required for each connection, whereas Packet Filtering requires two rules for each connection (one for each direction). Stateful Inspection also offers other benefits over Packet Filtering, such as enhanced security, performance, and flexibility. Stateful Inspection does not offer unlimited connections because of virtual memory usage, nor does it avoid using memory to record the protocol used by the connection.
Reference: [Stateful Inspection], [Packet Filtering], [Firewall Technologies]
Question #332
Which of the following are types of VPN communities?
- A . Pentagon, star, and combination
- B . Star, octagon, and combination
- C . Combined and star
- D . Meshed, star, and combination
Correct Answer: D
D
Explanation:
The types of VPN communities are Meshed, Star, and Combination. A Meshed community is a group of Security Gateways that have VPN connections between every pair of members. A Star community has one Security Gateway as the center and other Security Gateways or hosts as satellites. A Combination community is a group of Meshed and Star communities.
Reference: [Check Point R81 Site-to-Site VPN Administration Guide]
D
Explanation:
The types of VPN communities are Meshed, Star, and Combination. A Meshed community is a group of Security Gateways that have VPN connections between every pair of members. A Star community has one Security Gateway as the center and other Security Gateways or hosts as satellites. A Combination community is a group of Meshed and Star communities.
Reference: [Check Point R81 Site-to-Site VPN Administration Guide]
Question #333
You had setup the VPN Community NPN-Stores’ with 3 gateways. There are some issues with one remote gateway(l .1.1.1) and an your local gateway.
What will be the best log filter to see only the IKE Phase 2 agreed networks for both gateways.
- A . action:”Key Install" AND 1.1.1.1 AND Quick Mode
- B . Blade:”VPN”AND VPN-Stores AND Main Mode
- C . action:”Key Install” AND 1.1.1.1 AND Main Mode
- D . Blade:”VPN”AND VPN-Stores AND Quick Mode
Correct Answer: A
A
Explanation:
This log filter will show only the logs that have the action of “Key Install”, which means that the Security Gateway installed a new encryption key for the VPN tunnel1. It will also show only the logs that have the IP address of 1.1.1.1, which is the remote gateway that has some issues. Finally, it will show only the logs that have the Quick Mode, which is the IKE Phase 2 negotiation that establishes the agreed networks for both gateways2.
The other log filters are not correct because they either include the Main Mode, which is the IKE Phase 1 negotiation that establishes the secure channel between the gateways2, or they do not specify the IP address of the remote gateway.
Logging and Monitoring R81.20 Administration Guide
Remote Access VPN R81.20 Administration Guide
Remote Access VPN R81 Administration Guide
A
Explanation:
This log filter will show only the logs that have the action of “Key Install”, which means that the Security Gateway installed a new encryption key for the VPN tunnel1. It will also show only the logs that have the IP address of 1.1.1.1, which is the remote gateway that has some issues. Finally, it will show only the logs that have the Quick Mode, which is the IKE Phase 2 negotiation that establishes the agreed networks for both gateways2.
The other log filters are not correct because they either include the Main Mode, which is the IKE Phase 1 negotiation that establishes the secure channel between the gateways2, or they do not specify the IP address of the remote gateway.
Logging and Monitoring R81.20 Administration Guide
Remote Access VPN R81.20 Administration Guide
Remote Access VPN R81 Administration Guide
Question #334
Which type of Check Point license ties the package license to the IP address of the Security Management Server?
- A . Central
- B . Corporate
- C . Local
- D . Formal
Correct Answer: A
A
Explanation:
The type of Check Point license that ties the package license to the IP address of the Security Management Server is Central license. A Central license is a license that is installed on the Security Management Server and applies to all the Security Gateways that are managed by it. The Central license is based on the IP address of the Security Management Server and cannot be transferred to another Security Management Server with a different IP address.
Reference: [Check Point R81 Licensing Guide], [Managing and Installing license via SmartUpdate]
A
Explanation:
The type of Check Point license that ties the package license to the IP address of the Security Management Server is Central license. A Central license is a license that is installed on the Security Management Server and applies to all the Security Gateways that are managed by it. The Central license is based on the IP address of the Security Management Server and cannot be transferred to another Security Management Server with a different IP address.
Reference: [Check Point R81 Licensing Guide], [Managing and Installing license via SmartUpdate]
Question #335
What is the default shell for the Gaia command line interface?
- A . Admin
- B . Clish
- C . Expert
- D . Bash
Correct Answer: B
B
Explanation:
In Check Point Gaia OS, the default command-line shell is Clish (B).
Clish (Command Line Shell) is a restricted shell used in Gaia for role-based administration. It controls user access and limits the number of available commands.
Expert mode (C) is an elevated shell that provides full system root access, but it is not the default shell. Users must explicitly enter expert mode.
Bash (D) is the underlying Linux shell, but it is not the default.
Admin (A) is not a shell but rather a user role in Gaia.
Thus, the correct answer is B. Clish.
Reference: Check Point documentation confirms that the default shell in Gaia is Clish.
B
Explanation:
In Check Point Gaia OS, the default command-line shell is Clish (B).
Clish (Command Line Shell) is a restricted shell used in Gaia for role-based administration. It controls user access and limits the number of available commands.
Expert mode (C) is an elevated shell that provides full system root access, but it is not the default shell. Users must explicitly enter expert mode.
Bash (D) is the underlying Linux shell, but it is not the default.
Admin (A) is not a shell but rather a user role in Gaia.
Thus, the correct answer is B. Clish.
Reference: Check Point documentation confirms that the default shell in Gaia is Clish.
Question #336
When you upload a package or license to the appropriate repository in SmartUpdate. where is the package or license stored?
- A . SmartConsole installed device
- B . Check Point user center
- C . Security Management Server
- D . Security Gateway
Correct Answer: C
C
Explanation:
When you upload a package or license to the appropriate repository in SmartUpdate, the package or license is stored on the Security Management Server. SmartUpdate is a tool that allows you to centrally manage software updates and licenses for all Check Point products on your network.
Reference: Check Point R81 Security Management Administration Guide, page 16.
C
Explanation:
When you upload a package or license to the appropriate repository in SmartUpdate, the package or license is stored on the Security Management Server. SmartUpdate is a tool that allows you to centrally manage software updates and licenses for all Check Point products on your network.
Reference: Check Point R81 Security Management Administration Guide, page 16.
Question #337
In the Check Point Security Management Architecture, which component(s) can store logs?
- A . SmartConsole
- B . Security Management Server and Security Gateway
- C . Security Management Server
- D . SmartConsole and Security Management Server
Correct Answer: B
B
Explanation:
The Security Management Server and the Security Gateway are the components that can store logs in the Check Point Security Management Architecture. The Security Management Server stores logs in a database and can also forward them to external log servers. The Security Gateway can store logs locally in a buffer or a local log file, and can also send them to the Security Management Server or a log server.
Reference: Check Point Security Management Administration Guide R81, p. 11-12
B
Explanation:
The Security Management Server and the Security Gateway are the components that can store logs in the Check Point Security Management Architecture. The Security Management Server stores logs in a database and can also forward them to external log servers. The Security Gateway can store logs locally in a buffer or a local log file, and can also send them to the Security Management Server or a log server.
Reference: Check Point Security Management Administration Guide R81, p. 11-12
Question #338
Fill in the blank: By default, the SIC certificates issued by R80 Management Server are based on the ____________ algorithm.
- A . SHA-256
- B . SHA-200
- C . MD5
- D . SHA-128
Correct Answer: A
A
Explanation:
By default, the SIC certificates issued by R80 Management Server are based on the SHA-256 algorithm1. SHA-256 is a secure hash algorithm that produces a 256-bit digest. SHA-200, MD5, and SHA-128 are not valid algorithms for SIC certificates.
Reference: SHA-1 and SHA-256 certificates in Check Point Internal CA (ICA)
A
Explanation:
By default, the SIC certificates issued by R80 Management Server are based on the SHA-256 algorithm1. SHA-256 is a secure hash algorithm that produces a 256-bit digest. SHA-200, MD5, and SHA-128 are not valid algorithms for SIC certificates.
Reference: SHA-1 and SHA-256 certificates in Check Point Internal CA (ICA)
Question #339
What is the difference between SSL VPN and IPSec VPN?
- A . IPSec VPN does not require installation of a resident VPN client
- B . SSL VPN requires installation of a resident VPN client
- C . SSL VPN and IPSec VPN are the same
- D . IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser
Correct Answer: D
D
Explanation:
The difference between SSL VPN and IPSec VPN is that IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed browser5. IPSec VPN uses a pre-shared key or certificates to authenticate the endpoints and encrypts the data at the network layer. SSL VPN uses SSL/TLS protocols to authenticate the endpoints and encrypts the data at the application layer.
Reference: Check Point Remote Access VPN Administration Guide R81, [Free Check Point CCSA Sample Questions and Study Guide]
D
Explanation:
The difference between SSL VPN and IPSec VPN is that IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed browser5. IPSec VPN uses a pre-shared key or certificates to authenticate the endpoints and encrypts the data at the network layer. SSL VPN uses SSL/TLS protocols to authenticate the endpoints and encrypts the data at the application layer.
Reference: Check Point Remote Access VPN Administration Guide R81, [Free Check Point CCSA Sample Questions and Study Guide]
Question #340
Fill in the blank: ____________ is the Gaia command that turns the server off.
- A . sysdown
- B . exit
- C . halt
- D . shut-down
Correct Answer: C
C
Explanation:
halt is the Gaia command that turns the server off. This command shuts down the operating system and powers off the machine. Other commands that can be used to shut down the server are shutdown and poweroff.
Reference: [Gaia Administration Guide R80.40]
C
Explanation:
halt is the Gaia command that turns the server off. This command shuts down the operating system and powers off the machine. Other commands that can be used to shut down the server are shutdown and poweroff.
Reference: [Gaia Administration Guide R80.40]