Check Point 156-215.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #351
Which of the following is NOT a valid deployment option for R80?
- A . All-in-one (stand-alone)
- B . Log server
- C . SmartEvent
- D . Multi-domain management server
Correct Answer: D
D
Explanation:
Multi-domain management server is a valid deployment option for R81, not R80. R80 supports multi-domain security management, which is a centralized management solution for large-scale, distributed environments with many different domain networks1.
Reference: Multi-Domain Security Management Administration Guide R80
D
Explanation:
Multi-domain management server is a valid deployment option for R81, not R80. R80 supports multi-domain security management, which is a centralized management solution for large-scale, distributed environments with many different domain networks1.
Reference: Multi-Domain Security Management Administration Guide R80
Question #352
Which of the following is considered a "Subscription Blade", requiring renewal every 1-3 years?
- A . IPS blade
- B . IPSEC VPN Blade
- C . Identity Awareness Blade
- D . Firewall Blade
Correct Answer: A
A
Explanation:
The following is considered a “Subscription Blade”, requiring renewal every 1-3 years: IPS blade4. The IPS blade is a software blade that provides protection against network attacks and exploits by inspecting traffic and blocking malicious packets. The IPS blade requires a subscription license that includes updates for the IPS signatures and Geo Protection database. Other subscription blades include Anti-Bot, Anti-Virus, URL Filtering, Application Control, Threat Emulation, and Threat Extraction.
Reference: Check Point Licensing and Contract Operations User Guide
A
Explanation:
The following is considered a “Subscription Blade”, requiring renewal every 1-3 years: IPS blade4. The IPS blade is a software blade that provides protection against network attacks and exploits by inspecting traffic and blocking malicious packets. The IPS blade requires a subscription license that includes updates for the IPS signatures and Geo Protection database. Other subscription blades include Anti-Bot, Anti-Virus, URL Filtering, Application Control, Threat Emulation, and Threat Extraction.
Reference: Check Point Licensing and Contract Operations User Guide
Question #353
In which scenario will an administrator need to manually define Proxy ARP?
- A . When they configure an "Automatic Static NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.
- B . When they configure an "Automatic Hide NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.
- C . When they configure a "Manual Static NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.
- D . When they configure a "Manual Hide NAT" which translates to an IP address that belongs to one of the firewall’s interfaces.
Correct Answer: C
C
Explanation:
NAT (Network Address Translation) is a technique that modifies the IP addresses or ports of packets that pass through a security gateway. NAT can be configured in two ways: Automatic or Manual. Automatic NAT means that the NAT rules are generated automatically by the security gateway based on the NAT properties of network objects. Manual NAT means that the NAT rules are defined explicitly by the administrator in the NAT policy. Proxy ARP (Address Resolution Protocol) is a technique that allows a security gateway to answer ARP requests on behalf of other hosts. Proxy ARP is needed when a host on one network segment tries to communicate with a host on another network segment that has a different IP address than its own. In some scenarios, an administrator will need to manually define Proxy ARP for NAT to work properly. One such scenario is when they configure a Manual Static NAT which translates to an IP address that does not belong to one of the firewall’s interfaces2.
Reference: Check Point R81 Network Address Translation Administration Guide
C
Explanation:
NAT (Network Address Translation) is a technique that modifies the IP addresses or ports of packets that pass through a security gateway. NAT can be configured in two ways: Automatic or Manual. Automatic NAT means that the NAT rules are generated automatically by the security gateway based on the NAT properties of network objects. Manual NAT means that the NAT rules are defined explicitly by the administrator in the NAT policy. Proxy ARP (Address Resolution Protocol) is a technique that allows a security gateway to answer ARP requests on behalf of other hosts. Proxy ARP is needed when a host on one network segment tries to communicate with a host on another network segment that has a different IP address than its own. In some scenarios, an administrator will need to manually define Proxy ARP for NAT to work properly. One such scenario is when they configure a Manual Static NAT which translates to an IP address that does not belong to one of the firewall’s interfaces2.
Reference: Check Point R81 Network Address Translation Administration Guide
Question #354
URL Filtering employs a technology, which educates users on web usage policy in real time.
What is the name of that technology?
- A . WebCheck
- B . UserCheck
- C . Harmony Endpoint
- D . URL categorization
Correct Answer: B
B
Explanation:
URL Filtering employs a technology called UserCheck, which educates users on web usage policy in real time. UserCheck is a feature that allows the firewall to interact with the users and inform them about the web usage policy and its violations. UserCheck can also allow users to request access to blocked websites or report false positives. UserCheck helps users understand and comply with the web usage policy and reduces the workload of the administrators.
B
Explanation:
URL Filtering employs a technology called UserCheck, which educates users on web usage policy in real time. UserCheck is a feature that allows the firewall to interact with the users and inform them about the web usage policy and its violations. UserCheck can also allow users to request access to blocked websites or report false positives. UserCheck helps users understand and comply with the web usage policy and reduces the workload of the administrators.
Question #355
Which part of SmartConsole allows administrators to add, edit delete, and clone objects?
- A . Object Browser
- B . Object Editor
- C . Object Navigator
- D . Object Explorer
Correct Answer: D
D
Explanation:
The Object Explorer is the part of SmartConsole that allows administrators to add, edit, delete, and clone objects. Objects are entities that represent network elements, such as hosts, networks, gateways, services, users, etc. The Object Explorer provides a tree view of all the objects in the database and allows searching, filtering, and grouping them2.
Reference: Check Point R81 SmartConsole R81 User Guide
D
Explanation:
The Object Explorer is the part of SmartConsole that allows administrators to add, edit, delete, and clone objects. Objects are entities that represent network elements, such as hosts, networks, gateways, services, users, etc. The Object Explorer provides a tree view of all the objects in the database and allows searching, filtering, and grouping them2.
Reference: Check Point R81 SmartConsole R81 User Guide
Question #356
When configuring Anti-Spoofing, which tracking options can an Administrator select?
- A . Log, Alert, None
- B . Log, Allow Packets, Email
- C . Drop Packet, Alert, None
- D . Log, Send SNMP Trap, Email
Correct Answer: A
A
Explanation:
Log, Alert, and None are the tracking options that an Administrator can select when configuring Anti-Spoofing. Log means that the packet will be logged in SmartView Tracker. Alert means that the packet will trigger an alert in SmartView Monitor. None means that no action will be taken2. The other options are not valid tracking options.
A
Explanation:
Log, Alert, and None are the tracking options that an Administrator can select when configuring Anti-Spoofing. Log means that the packet will be logged in SmartView Tracker. Alert means that the packet will trigger an alert in SmartView Monitor. None means that no action will be taken2. The other options are not valid tracking options.
Question #357
John is the administrator of a R80 Security Management server managing r R77.30 Check Point Security Gateway. John is currently updating the network objects and amending the rules using SmartConsole.
To make John’s changes available to other administrators, and to save the database before installing a policy, what must John do?
- A . Logout of the session
- B . File > Save
- C . Install database
- D . Publish the session
Correct Answer: D
D
Explanation:
To make John’s changes available to other administrators, and to save the database before installing a policy, John must publish the session. Publishing the session saves the changes to the database and makes them visible to other administrators1. The other options do not achieve this goal.
Reference: Publishing a Session
D
Explanation:
To make John’s changes available to other administrators, and to save the database before installing a policy, John must publish the session. Publishing the session saves the changes to the database and makes them visible to other administrators1. The other options do not achieve this goal.
Reference: Publishing a Session
Question #358
When a Security Gateway communicates about its status to an IP address other than its own, which deployment option was chosen?
- A . Targeted
- B . Bridge Mode
- C . Distributed
- D . Standalone
Correct Answer: C
C
Explanation:
A Distributed Deployment is when the Security Management Server and Security Gateway are installed on separate machines. In this setup, the Security Gateway communicates its status to the Security Management Server, which resides at a different IP address.
Option A (Incorrect): "Targeted" is not an official Check Point deployment mode.
Option B (Incorrect): In Bridge Mode, the Security Gateway acts as a Layer 2 bridge and does not communicate its status to another IP.
Option D (Incorrect): In Standalone Mode, the Security Gateway and Management Server are on the same machine, meaning it does not communicate status to a different IP. Thus, the correct answer is C. Distributed.
Reference: Check Point documentation confirms that in Distributed Deployments, the Security Gateway communicates with the Management Server, which is located at a different IP address.
C
Explanation:
A Distributed Deployment is when the Security Management Server and Security Gateway are installed on separate machines. In this setup, the Security Gateway communicates its status to the Security Management Server, which resides at a different IP address.
Option A (Incorrect): "Targeted" is not an official Check Point deployment mode.
Option B (Incorrect): In Bridge Mode, the Security Gateway acts as a Layer 2 bridge and does not communicate its status to another IP.
Option D (Incorrect): In Standalone Mode, the Security Gateway and Management Server are on the same machine, meaning it does not communicate status to a different IP. Thus, the correct answer is C. Distributed.
Reference: Check Point documentation confirms that in Distributed Deployments, the Security Gateway communicates with the Management Server, which is located at a different IP address.
Question #359
Which statement is TRUE of anti-spoofing?
- A . Anti-spoofing is not needed when IPS software blade is enabled
- B . It is more secure to create anti-spoofing groups manually
- C . It is BEST Practice to have anti-spoofing groups in sync with the routing table
- D . With dynamic routing enabled, anti-spoofing groups are updated automatically whenever there is a routing change
Correct Answer: C
C
Explanation:
The statement that is TRUE of anti-spoofing is that it is BEST Practice to have anti-spoofing groups in sync with the routing table. Anti-spoofing prevents attackers from sending packets with a false source IP address. Anti-spoofing groups define which IP addresses are expected on each interface of the Security Gateway. If the routing table changes, the anti-spoofing groups should be updated accordingly34.
Reference: Check Point R81 ClusterXL Administration Guide, Network Defined by Routes: Anti-Spoofing
C
Explanation:
The statement that is TRUE of anti-spoofing is that it is BEST Practice to have anti-spoofing groups in sync with the routing table. Anti-spoofing prevents attackers from sending packets with a false source IP address. Anti-spoofing groups define which IP addresses are expected on each interface of the Security Gateway. If the routing table changes, the anti-spoofing groups should be updated accordingly34.
Reference: Check Point R81 ClusterXL Administration Guide, Network Defined by Routes: Anti-Spoofing
Question #360
In the Check Point Security Management Architecture, which component(s) can store logs?
- A . Security Management Server and Security Gateway
- B . SmartConsole
- C . SmartConsole and Security Management Server
- D . Security Management Server
Correct Answer: A
A
Explanation:
In Check Point’s Security Management Architecture, logs can be stored on the Security Management Server and Security Gateway.
Security Management Server stores logs when configured to do so.
Security Gateways can store logs locally, but they are often forwarded to a Security Management Server or a dedicated Log Server.
Option B (Incorrect): SmartConsole is only a management interface and does not store logs.
Option C (Incorrect): SmartConsole does not store logs.
Option D (Incorrect): Logs are not exclusively stored on the Security Management Server―they can also be stored on the Security Gateway.
Thus, the correct answer is A. Security Management Server and Security Gateway.
Reference: Check Point documentation confirms that logs can be stored on both the Security Gateway and the Security Management Server.
A
Explanation:
In Check Point’s Security Management Architecture, logs can be stored on the Security Management Server and Security Gateway.
Security Management Server stores logs when configured to do so.
Security Gateways can store logs locally, but they are often forwarded to a Security Management Server or a dedicated Log Server.
Option B (Incorrect): SmartConsole is only a management interface and does not store logs.
Option C (Incorrect): SmartConsole does not store logs.
Option D (Incorrect): Logs are not exclusively stored on the Security Management Server―they can also be stored on the Security Gateway.
Thus, the correct answer is A. Security Management Server and Security Gateway.
Reference: Check Point documentation confirms that logs can be stored on both the Security Gateway and the Security Management Server.