Check Point 156-215.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #341
When changes are made to a Rule base, it is important to _______________ to enforce changes.
- A . Publish database
- B . Activate policy
- C . Install policy
- D . Save changes
Correct Answer: A
A
Explanation:
When changes are made to a Rule base, it is important to Publish database to enforce changes5. Publishing database saves the changes to the database and makes them available to other administrators. Installing policy applies the changes to the Security Gateways.
Reference: Check Point R81 Security Management Administration Guide, [Check Point R81 SmartConsole R81 Resolved Issues], [Check Point R81 Firewall Administration Guide]
A
Explanation:
When changes are made to a Rule base, it is important to Publish database to enforce changes5. Publishing database saves the changes to the database and makes them available to other administrators. Installing policy applies the changes to the Security Gateways.
Reference: Check Point R81 Security Management Administration Guide, [Check Point R81 SmartConsole R81 Resolved Issues], [Check Point R81 Firewall Administration Guide]
Question #342
Which Check Point software blade prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud?
- A . Firewall
- B . Application Control
- C . Anti-spam and Email Security
- D . Anti-Virus
Correct Answer: D
D
Explanation:
Anti-Virus is the Check Point software blade that prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud. Anti-Virus scans files and email attachments for viruses, worms, trojans, and other types of malware. It also uses ThreatCloud,
a collaborative network that delivers real-time dynamic security intelligence, to detect unknown malware based on their behavior. Firewall is a software blade that enforces security policy by inspecting and controlling network traffic. Application Control is a software blade that enables administrators to control access to web applications. Anti-spam and Email Security is a software blade that protects email infrastructure from spam, phishing, and malware attacks.
D
Explanation:
Anti-Virus is the Check Point software blade that prevents malicious files from entering a network using virus signatures and anomaly-based protections from ThreatCloud. Anti-Virus scans files and email attachments for viruses, worms, trojans, and other types of malware. It also uses ThreatCloud,
a collaborative network that delivers real-time dynamic security intelligence, to detect unknown malware based on their behavior. Firewall is a software blade that enforces security policy by inspecting and controlling network traffic. Application Control is a software blade that enables administrators to control access to web applications. Anti-spam and Email Security is a software blade that protects email infrastructure from spam, phishing, and malware attacks.
Question #343
You can see the following graphic:
What is presented on it?
- A . Properties of personal. p12 certificate file issued for user John.
- B . Shared secret properties of John’s password.
- C . VPN certificate properties of the John’s gateway.
- D . Expired. p12 certificate properties for user John.
Correct Answer: A
A
Explanation:
The answer is A because the graphic shows the properties of a personal .p12 certificate file issued for user John. A .p12 file is a file format that contains a user’s private key and public key certificate. The graphic shows that the certificate file is valid and has an expiration date of 07-Apr-2018. The graphic also shows that the certificate file is issued by an internal CA, which is a Check Point component that manages certificates for users and gateways.
Reference: Check Point R81 Certificate Management, Check Point R81 Internal CA
A
Explanation:
The answer is A because the graphic shows the properties of a personal .p12 certificate file issued for user John. A .p12 file is a file format that contains a user’s private key and public key certificate. The graphic shows that the certificate file is valid and has an expiration date of 07-Apr-2018. The graphic also shows that the certificate file is issued by an internal CA, which is a Check Point component that manages certificates for users and gateways.
Reference: Check Point R81 Certificate Management, Check Point R81 Internal CA
Question #344
Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?
- A . AES-GCM-256
- B . AES-CBC-256
- C . AES-GCM-128
Correct Answer: B
B
Explanation:
The answer is B because AES-CBC-256 is not a supported encryption algorithm for IPsec Security Associations (Phase 2) in R81. The supported encryption algorithms are AES-GCM-128, AES-GCM-256, AES-CBC-128, 3DES, and NULL3
Reference: Check Point R81 VPN Administration Guide
B
Explanation:
The answer is B because AES-CBC-256 is not a supported encryption algorithm for IPsec Security Associations (Phase 2) in R81. The supported encryption algorithms are AES-GCM-128, AES-GCM-256, AES-CBC-128, 3DES, and NULL3
Reference: Check Point R81 VPN Administration Guide
Question #345
Which option will match a connection regardless of its association with a VPN community?
- A . All Site-to-Site VPN Communities
- B . Accept all encrypted traffic
- C . All Connections (Clear or Encrypted)
- D . Specific VPN Communities
Correct Answer: B
B
Explanation:
Accept all encrypted traffic is the option that will match a connection regardless of its association with a VPN community2. This option allows encrypted traffic from any VPN peer, even if it is not defined in a VPN community2.
Reference: Site to Site VPN in R80.x – Tutorial for Beginners
B
Explanation:
Accept all encrypted traffic is the option that will match a connection regardless of its association with a VPN community2. This option allows encrypted traffic from any VPN peer, even if it is not defined in a VPN community2.
Reference: Site to Site VPN in R80.x – Tutorial for Beginners
Question #346
Which of these is NOT a feature or benefit of Application Control?
- A . Eliminate unknown and unwanted applications in your network to reduce IT complexity and application risk.
- B . Identify and control which applications are in your IT environment and which to add to the IT environment.
- C . Scans the content of files being downloaded by users in order to make policy decisions.
- D . Automatically identify trusted software that has authorization to run
Correct Answer: C
C
Explanation:
Application Control is a blade that enables administrators to control access to applications and web sites by users, groups, machines, and time. Application Control can eliminate unknown and unwanted applications in your network to reduce IT complexity and application risk, identify and control which applications are in your IT environment and which to add to the IT environment, and automatically identify trusted software that has authorization to run1. However, Application Control cannot scan the content of files being downloaded by users in order to make policy decisions. That is the function of another blade called Content Awareness, which can inspect files based on their type, size, name, and data2.
Reference: Check Point R81 Application Control Administration Guide, Check Point R81 Content Awareness Administration Guide
C
Explanation:
Application Control is a blade that enables administrators to control access to applications and web sites by users, groups, machines, and time. Application Control can eliminate unknown and unwanted applications in your network to reduce IT complexity and application risk, identify and control which applications are in your IT environment and which to add to the IT environment, and automatically identify trusted software that has authorization to run1. However, Application Control cannot scan the content of files being downloaded by users in order to make policy decisions. That is the function of another blade called Content Awareness, which can inspect files based on their type, size, name, and data2.
Reference: Check Point R81 Application Control Administration Guide, Check Point R81 Content Awareness Administration Guide
Question #347
Fill in the blank: Once a certificate is revoked from the Security GateWay by the Security Management Server, the certificate information is _______.
- A . Sent to the Internal Certificate Authority.
- B . Sent to the Security Administrator.
- C . Stored on the Security Management Server.
- D . Stored on the Certificate Revocation List.
Correct Answer: D
D
Explanation:
Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is stored on the Certificate Revocation List (CRL)1, p. 47. The CRL is a list of certificates that have been revoked before their expiration date4.
Reference: Check Point CCSA – R81: Practice Test & Explanation, Free Check Point CCSA Sample Questions and Study Guide
D
Explanation:
Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is stored on the Certificate Revocation List (CRL)1, p. 47. The CRL is a list of certificates that have been revoked before their expiration date4.
Reference: Check Point CCSA – R81: Practice Test & Explanation, Free Check Point CCSA Sample Questions and Study Guide
Question #348
Which of the following is NOT a component of Check Point Capsule?
- A . Capsule Docs
- B . Capsule Cloud
- C . Capsule Enterprise
- D . Capsule Workspace
Correct Answer: C
C
Explanation:
The components of Check Point Capsule are Capsule Docs, Capsule Cloud, and Capsule Workspace123. There is no Capsule Enterprise component. Capsule Docs protects business documents everywhere they go. Capsule Cloud protects mobile users outside the enterprise security perimeter. Capsule Workspace creates a secure business environment on mobile devices.
Reference: Check Point Capsule Datasheet, Check Point Capsule Workspace Datasheet, Mobile Secure Workspace with Capsule
C
Explanation:
The components of Check Point Capsule are Capsule Docs, Capsule Cloud, and Capsule Workspace123. There is no Capsule Enterprise component. Capsule Docs protects business documents everywhere they go. Capsule Cloud protects mobile users outside the enterprise security perimeter. Capsule Workspace creates a secure business environment on mobile devices.
Reference: Check Point Capsule Datasheet, Check Point Capsule Workspace Datasheet, Mobile Secure Workspace with Capsule
Question #349
AdminA and AdminB are both logged into SmartConsole.
What does it mean if AdminB sees a lock icon on a rule? Choose the BEST answer.
- A . Rule is locked by AdminA and will be made available if the session is published.
- B . Rule is locked by AdminA and if the session is saved, the rule will be made available.
- C . Rule is locked by AdminB because the save button has not been pressed.
- D . Rule is locked by AdminB because the rule is currently being edited.
Correct Answer: A
A
Explanation:
In Check Point SmartConsole, when multiple administrators work on security policies, a lock icon appears on rules or objects that are being modified.
If AdminB sees a lock, it means that AdminA is currently editing the rule, and it is locked for others.
Once AdminA publishes the session, the rule becomes available to other administrators.
Option B (incorrect): Saving a session does not release the lock; it must be published.
Option C (incorrect): The lock is not caused by AdminB but by another user (AdminA).
Option D (incorrect): A lock appears when another user (AdminA) is editing, not the current user.
Thus, the correct answer is
A
Explanation:
In Check Point SmartConsole, when multiple administrators work on security policies, a lock icon appears on rules or objects that are being modified.
If AdminB sees a lock, it means that AdminA is currently editing the rule, and it is locked for others.
Once AdminA publishes the session, the rule becomes available to other administrators.
Option B (incorrect): Saving a session does not release the lock; it must be published.
Option C (incorrect): The lock is not caused by AdminB but by another user (AdminA).
Option D (incorrect): A lock appears when another user (AdminA) is editing, not the current user.
Thus, the correct answer is
Question #350
Which of the following commands is used to monitor cluster members?
- A . cphaprob state
- B . cphaprob status
- C . cphaprob
- D . cluster state
Correct Answer: A
A
Explanation:
The command that is used to monitor cluster members is cphaprob state. This command shows the state of each cluster member (Active, Standby, Down, etc.) and the reason for the state (OK, HA Failure, CCP Failure, etc.). It also shows the state synchronization status (Synchronized or Not Synchronized) and the uptime of each cluster member. The other options are incorrect.
Option B is a command to show the status of cluster services, not cluster members.
Option C is not a valid command by itself, as it requires an argument such as state, status, list, etc.
Option D is not a valid command at all.
Reference: [cphaprob]
A
Explanation:
The command that is used to monitor cluster members is cphaprob state. This command shows the state of each cluster member (Active, Standby, Down, etc.) and the reason for the state (OK, HA Failure, CCP Failure, etc.). It also shows the state synchronization status (Synchronized or Not Synchronized) and the uptime of each cluster member. The other options are incorrect.
Option B is a command to show the status of cluster services, not cluster members.
Option C is not a valid command by itself, as it requires an argument such as state, status, list, etc.
Option D is not a valid command at all.
Reference: [cphaprob]