Check Point 156-215.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #361
Fill in the blank When LDAP is integrated with Check Point Security Management it is then referred to as_____
- A . User Center
- B . User Administration
- C . User Directory
- D . UserCheck
Correct Answer: C
C
Explanation:
When LDAP is integrated with Check Point Security Management, it is then referred to as User Directory. User Directory is a feature that allows administrators to manage users and user groups from an external LDAP server, such as Active Directory2.
Reference: 2: Check Point R81 Identity Awareness Administration Guide, page 9.
C
Explanation:
When LDAP is integrated with Check Point Security Management, it is then referred to as User Directory. User Directory is a feature that allows administrators to manage users and user groups from an external LDAP server, such as Active Directory2.
Reference: 2: Check Point R81 Identity Awareness Administration Guide, page 9.
Question #362
You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don’t have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher.
How can you enable them?
- A . fw ctl multik dynamic_dispatching on
- B . fw ctl multik dynamic_dispatching set_mode 9
- C . fw ctl multik set_mode 9
- D . fw ctl miltik pq enable
Correct Answer: C
C
Explanation:
To optimize drops, you can use Priority Queues and fully enable Dynamic Dispatcher on the Security Gateway23. Priority Queues are a mechanism that prioritizes part of the traffic when the Security Gateway is stressed and needs to drop packets. Dynamic Dispatcher is a feature that dynamically assigns new connections to a CoreXL FW instance based on the utilization of CPU cores. To enable both features, you need to run the command fw ctl multik set_mode 9 on the Security Gateway4. Therefore, the correct answer is C. fw ctl multik set_mode 9.
Reference: CoreXL Dynamic Dispatcher – Check Point Software, Firewall Priority Queues in R80.x / R81.x – Check Point Software, Separate Config for Dynamic Dispatcher and Priority Queues
C
Explanation:
To optimize drops, you can use Priority Queues and fully enable Dynamic Dispatcher on the Security Gateway23. Priority Queues are a mechanism that prioritizes part of the traffic when the Security Gateway is stressed and needs to drop packets. Dynamic Dispatcher is a feature that dynamically assigns new connections to a CoreXL FW instance based on the utilization of CPU cores. To enable both features, you need to run the command fw ctl multik set_mode 9 on the Security Gateway4. Therefore, the correct answer is C. fw ctl multik set_mode 9.
Reference: CoreXL Dynamic Dispatcher – Check Point Software, Firewall Priority Queues in R80.x / R81.x – Check Point Software, Separate Config for Dynamic Dispatcher and Priority Queues
Question #363
How many users can have read/write access in Gaia Operating System at one time?
- A . One
- B . Three
- C . Two
- D . Infinite
Correct Answer: A
A
Explanation:
Only one user can have read/write access in Gaia Operating System at one time2. This is to prevent conflicts and errors when multiple users try to modify the same configuration settings.
Reference: Check Point Gaia Administration Guide
A
Explanation:
Only one user can have read/write access in Gaia Operating System at one time2. This is to prevent conflicts and errors when multiple users try to modify the same configuration settings.
Reference: Check Point Gaia Administration Guide
Question #364
When URL Filtering is set, what identifying data gets sent to the Check Point Online Web Service?
- A . The URL and server certificate are sent to the Check Point Online Web Service
- B . The full URL, including page data, is sent to the Check Point Online Web Service
- C . The host part of the URL is sent to the Check Point Online Web Service
- D . The URL and IP address are sent to the Check Point Online Web Service
Correct Answer: C
C
Explanation:
When URL Filtering is set, only the host part of the URL is sent to the Check Point Online Web Service for analysis. The host part is the part of the URL that identifies the web server, such as www.example.com. The Check Point Online Web Service uses this information to categorize the URL and return the appropriate action to the Security Gateway. The other options are not sent to the Check Point Online Web Service for analysis, as they may contain sensitive or irrelevant data.
Reference: 1: Policy Layers 2: Adding a New Log Server 3: Suspicious Activity Monitoring: [URL Filtering]
C
Explanation:
When URL Filtering is set, only the host part of the URL is sent to the Check Point Online Web Service for analysis. The host part is the part of the URL that identifies the web server, such as www.example.com. The Check Point Online Web Service uses this information to categorize the URL and return the appropriate action to the Security Gateway. The other options are not sent to the Check Point Online Web Service for analysis, as they may contain sensitive or irrelevant data.
Reference: 1: Policy Layers 2: Adding a New Log Server 3: Suspicious Activity Monitoring: [URL Filtering]
Question #365
Choose what BEST describes the reason why querying logs now is very fast.
- A . New Smart-1 appliances double the physical memory install
- B . Indexing Engine indexes logs for faster search results
- C . SmartConsole now queries results directly from the Security Gateway
- D . The amount of logs been store is less than the usual in older versions
Correct Answer: B
B
Explanation:
The answer is B because querying logs now is very fast because the Indexing Engine indexes logs for faster search results. The Indexing Engine is a component of the Smart-1 appliance that creates indexes for log fields and values, such as source, destination, action, and time. The indexes enable quick and efficient searches of large amounts of log data.
Reference: [Check Point R81 Logging and Monitoring Administration Guide], [Check Point R81 Indexing Engine]
B
Explanation:
The answer is B because querying logs now is very fast because the Indexing Engine indexes logs for faster search results. The Indexing Engine is a component of the Smart-1 appliance that creates indexes for log fields and values, such as source, destination, action, and time. The indexes enable quick and efficient searches of large amounts of log data.
Reference: [Check Point R81 Logging and Monitoring Administration Guide], [Check Point R81 Indexing Engine]
Question #366
By default, which port is used to connect to the GAiA Portal?
- A . 4434
- B . 80
- C . 8080
- D . 443
Correct Answer: D
D
Explanation:
The GAiA Portal is the WebUI for Check Point security appliances. By default, it uses the HTTPS protocol for secure communication. The default port for HTTPS-based web access is port 443. Port 4434 (A) is not the default port for GAiA Portal.
Port 80 (B) is the default for standard HTTP, but GAiA Portal requires HTTPS.
Port 8080 (C) is sometimes used for alternative web services, but not for GAiA Portal.
Port 443 (D) is the correct default port for GAiA Portal access.
Thus, the correct answer is D. 443.
Reference: This default configuration is confirmed in Check Point GAiA documentation.
D
Explanation:
The GAiA Portal is the WebUI for Check Point security appliances. By default, it uses the HTTPS protocol for secure communication. The default port for HTTPS-based web access is port 443. Port 4434 (A) is not the default port for GAiA Portal.
Port 80 (B) is the default for standard HTTP, but GAiA Portal requires HTTPS.
Port 8080 (C) is sometimes used for alternative web services, but not for GAiA Portal.
Port 443 (D) is the correct default port for GAiA Portal access.
Thus, the correct answer is D. 443.
Reference: This default configuration is confirmed in Check Point GAiA documentation.
Question #367
Which SmartConsole application shows correlated logs and aggregated data to provide an overview of potential threats and attack patterns?
- A . SmartEvent
- B . SmartView Tracker
- C . SmartLog
- D . SmartView Monitor
Correct Answer: A
A
Explanation:
SmartEvent is a unified security management solution that provides real-time visibility into security events across the network. SmartEvent shows correlated logs and aggregated data to provide an overview of potential threats and attack patterns, as well as generate reports and alerts based on predefined or customized indicators. SmartView Tracker, SmartLog, and SmartView Monitor are other SmartConsole applications that can show logs, search queries, and network statistics respectively, but they do not provide the same level of correlation and analysis as SmartEvent.
Reference: [Check Point R81 SmartEvent Administration Guide]
A
Explanation:
SmartEvent is a unified security management solution that provides real-time visibility into security events across the network. SmartEvent shows correlated logs and aggregated data to provide an overview of potential threats and attack patterns, as well as generate reports and alerts based on predefined or customized indicators. SmartView Tracker, SmartLog, and SmartView Monitor are other SmartConsole applications that can show logs, search queries, and network statistics respectively, but they do not provide the same level of correlation and analysis as SmartEvent.
Reference: [Check Point R81 SmartEvent Administration Guide]
Question #368
In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?
- A . SND is a feature to accelerate multiple SSL VPN connections
- B . SND is an alternative to IPSec Main Mode, using only 3 packets
- C . SND is used to distribute packets among Firewall instances
- D . SND is a feature of fw monitor to capture accelerated packets
Correct Answer: C
C
Explanation:
The Secure Network Distributor (SND) is a feature of the Security Gateway that is used to distribute packets among Firewall instances. It improves the performance and scalability of the Firewall by utilizing multiple CPU cores. The other options are not related to SND.
Reference: [Check Point Security Gateway Architecture and Packet Flow], [Free Check Point CCSA Sample Questions and Study Guide]
C
Explanation:
The Secure Network Distributor (SND) is a feature of the Security Gateway that is used to distribute packets among Firewall instances. It improves the performance and scalability of the Firewall by utilizing multiple CPU cores. The other options are not related to SND.
Reference: [Check Point Security Gateway Architecture and Packet Flow], [Free Check Point CCSA Sample Questions and Study Guide]
Question #369
Which tool allows you to monitor the top bandwidth on smart console?
- A . Logs & Monitoring
- B . Smart Event
- C . Gateways & Severs Tab
- D . SmartView Monitor
Correct Answer: D
D
Explanation:
SmartView Monitor is the tool that allows you to monitor the top bandwidth on SmartConsole. SmartView Monitor is a graphical tool that displays real-time network and security performance data, such as traffic, throughput, connections, CPU usage, memory usage, etc. You can use SmartView Monitor to identify the top bandwidth consumers and optimize your network performance.
Reference: [SmartView Monitor], [Monitoring Network Traffic]
D
Explanation:
SmartView Monitor is the tool that allows you to monitor the top bandwidth on SmartConsole. SmartView Monitor is a graphical tool that displays real-time network and security performance data, such as traffic, throughput, connections, CPU usage, memory usage, etc. You can use SmartView Monitor to identify the top bandwidth consumers and optimize your network performance.
Reference: [SmartView Monitor], [Monitoring Network Traffic]
Question #370
The Network Operations Center administrator needs access to Check Point Security devices mostly for troubleshooting purposes. You do not want to give her access to the expert mode, but she still should be able to run tcpdump.
How can you achieve this requirement?
- A . Add tcpdump to CLISH using add command.Create a new access role.Add tcpdump to the role.Create new user with any UID and assign role to the user.
- B . Add tcpdump to CLISH using add command.Create a new access role.Add tcpdump to the role.Create new user with UID 0 and assign role to the user.
- C . Create a new access role.Add expert-mode access to the role.Create new user with UID 0 and assign role to the user.
- D . Create a new access role.Add expert-mode access to the role.Create new user with any UID and assign role to the user.
Correct Answer: A
A
Explanation:
To achieve the requirement of giving the Network Operations Center administrator access to Check Point Security devices mostly for troubleshooting purposes, but not to the expert mode, and still allowing her to run tcpdump, you need to:
Add tcpdump to CLISH using add command. This command adds a new command to the Command Line Interface Shell (CLISH) that allows running tcpdump without entering the expert mode. Create a new access role. This option defines a set of permissions and commands that can be assigned to a user or a group of users.
Add tcpdump to the role. This option grants the permission to run tcpdump to the role.
Create new user with any UID and assign role to the user. This option creates a new user account with any User ID (UID) and assigns the role that has tcpdump permission to the user.
Reference: [How to add a new command to CLISH], [Check Point R81 Gaia Administration Guide], [Check Point R81 Identity Awareness Administration Guide]
A
Explanation:
To achieve the requirement of giving the Network Operations Center administrator access to Check Point Security devices mostly for troubleshooting purposes, but not to the expert mode, and still allowing her to run tcpdump, you need to:
Add tcpdump to CLISH using add command. This command adds a new command to the Command Line Interface Shell (CLISH) that allows running tcpdump without entering the expert mode. Create a new access role. This option defines a set of permissions and commands that can be assigned to a user or a group of users.
Add tcpdump to the role. This option grants the permission to run tcpdump to the role.
Create new user with any UID and assign role to the user. This option creates a new user account with any User ID (UID) and assigns the role that has tcpdump permission to the user.
Reference: [How to add a new command to CLISH], [Check Point R81 Gaia Administration Guide], [Check Point R81 Identity Awareness Administration Guide]