Check Point 156-215.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #371
Which statement describes what Identity Sharing is in Identity Awareness?
- A . Management servers can acquire and share identities with Security Gateways
- B . Users can share identities with other users
- C . Security Gateways can acquire and share identities with other Security Gateways
- D . Administrators can share identifies with other administrators
Correct Answer: C
C
Explanation:
Identity Sharing is a feature that allows Security Gateways to acquire and share identities with other Security Gateways, enabling identity-based access control across different network segments or domains13. Management servers, users, and administrators do not share identities with Security Gateways.
Reference: Identity Awareness R81.10 Administration Guide, Check Point R81.10
C
Explanation:
Identity Sharing is a feature that allows Security Gateways to acquire and share identities with other Security Gateways, enabling identity-based access control across different network segments or domains13. Management servers, users, and administrators do not share identities with Security Gateways.
Reference: Identity Awareness R81.10 Administration Guide, Check Point R81.10
Question #372
How would you determine the software version from the CLI?
- A . fw ver
- B . fw stat
- C . fw monitor
- D . cpinfo
Correct Answer: A
A
Explanation:
The command that can be used to determine the software version from the CLI is fw ver. This command displays the version of the firewall module and the build number3. fw stat, fw monitor, and cpinfo are not commands for software version identification.
Reference: Check Point R81 Command Line Interface Reference Guide, [156-315.81 Checkpoint Exam Info and Free Practice Test – ExamTopics]
A
Explanation:
The command that can be used to determine the software version from the CLI is fw ver. This command displays the version of the firewall module and the build number3. fw stat, fw monitor, and cpinfo are not commands for software version identification.
Reference: Check Point R81 Command Line Interface Reference Guide, [156-315.81 Checkpoint Exam Info and Free Practice Test – ExamTopics]
Question #373
What are the three components for Check Point Capsule?
- A . Capsule Docs, Capsule Cloud, Capsule Connect
- B . Capsule Workspace, Capsule Cloud, Capsule Connect
- C . Capsule Workspace, Capsule Docs, Capsule Connect
- D . Capsule Workspace, Capsule Docs, Capsule Cloud
Correct Answer: D
D
Explanation:
The three components for Check Point Capsule are Capsule Workspace, Capsule Docs, and Capsule Cloud123. Capsule Workspace provides a secure container on the mobile device that isolates business data and applications from personal data and applications2. Capsule Docs protects business documents everywhere they go with encryption and access control1. Capsule Cloud provides cloud-based security services to protect mobile users from threats3.
Reference: Check Point Capsule, Check Point Capsule Workspace, Mobile Secure Workspace with Capsule
D
Explanation:
The three components for Check Point Capsule are Capsule Workspace, Capsule Docs, and Capsule Cloud123. Capsule Workspace provides a secure container on the mobile device that isolates business data and applications from personal data and applications2. Capsule Docs protects business documents everywhere they go with encryption and access control1. Capsule Cloud provides cloud-based security services to protect mobile users from threats3.
Reference: Check Point Capsule, Check Point Capsule Workspace, Mobile Secure Workspace with Capsule
Question #374
Which option would allow you to make a backup copy of the OS and Check Point configuration, without stopping Check Point processes?
- A . All options stop Check Point processes
- B . backup
- C . migrate export
- D . snapshot
Correct Answer: D
D
Explanation:
The snapshot option would allow you to make a backup copy of the OS and Check Point configuration, without stopping Check Point processes. A snapshot is a full system backup, including network interfaces, routing tables, and Check Point products and configuration. The other options require stopping Check Point processes or do not backup the OS.
Reference: Check Point Security Management Administration Guide R81, p. 15-16
D
Explanation:
The snapshot option would allow you to make a backup copy of the OS and Check Point configuration, without stopping Check Point processes. A snapshot is a full system backup, including network interfaces, routing tables, and Check Point products and configuration. The other options require stopping Check Point processes or do not backup the OS.
Reference: Check Point Security Management Administration Guide R81, p. 15-16
Question #375
What are the three deployment options available for a security gateway?
- A . Standalone, Distributed, and Bridge Mode
- B . Bridge Mode, Remote, and Standalone
- C . Remote, Standalone, and Distributed
- D . Distributed, Bridge Mode, and Remote
Correct Answer: A
A
Explanation:
A security gateway is a device that enforces the security policy on the traffic that passes through it. There are three deployment options available for a security gateway: Standalone, Distributed, and Bridge Mode. Standalone means that the security gateway and the security management server are installed on the same machine. Distributed means that the security gateway and the security management server are installed on separate machines. Bridge Mode means that the security gateway acts as a transparent bridge between two network segments, without changing the IP addressing scheme1.
Reference: Check Point R81 Security Gateway Technical Administration Guide
A
Explanation:
A security gateway is a device that enforces the security policy on the traffic that passes through it. There are three deployment options available for a security gateway: Standalone, Distributed, and Bridge Mode. Standalone means that the security gateway and the security management server are installed on the same machine. Distributed means that the security gateway and the security management server are installed on separate machines. Bridge Mode means that the security gateway acts as a transparent bridge between two network segments, without changing the IP addressing scheme1.
Reference: Check Point R81 Security Gateway Technical Administration Guide
Question #376
Identity Awareness allows easy configuration for network access and auditing based on what three items?
- A . Client machine IP address.
- B . Network location, the identity of a user and the identity of a machine.
- C . Log server IP address.
- D . Gateway proxy IP address.
Correct Answer: B
B
Explanation:
Identity Awareness is a blade that enables administrators to define access rules based on the identity of users and machines, rather than just IP addresses. Identity Awareness allows easy configuration for network access and auditing based on three items: network location, the identity of a user, and the identity of a machine. Network location refers to the source or destination network segment of the traffic. The identity of a user refers to the username or group membership of the user who initiates or receives the traffic. The identity of a machine refers to the hostname or certificate of the machine that initiates or receives the traffic.
Reference: [Check Point R81 Identity Awareness Administration Guide]
B
Explanation:
Identity Awareness is a blade that enables administrators to define access rules based on the identity of users and machines, rather than just IP addresses. Identity Awareness allows easy configuration for network access and auditing based on three items: network location, the identity of a user, and the identity of a machine. Network location refers to the source or destination network segment of the traffic. The identity of a user refers to the username or group membership of the user who initiates or receives the traffic. The identity of a machine refers to the hostname or certificate of the machine that initiates or receives the traffic.
Reference: [Check Point R81 Identity Awareness Administration Guide]
Question #377
Which of the following is NOT a policy type available for each policy package?
- A . Threat Emulation
- B . Access Control
- C . Desktop Security
- D . Threat Prevention
Correct Answer: A
A
Explanation:
Reference: Threat Emulation is not a policy type available for each policy package. Threat Emulation is a software blade that is part of the Threat Prevention policy type. The other options are valid policy types that can be configured for each policy package.
Reference: [Threat Prevention Administration Guide R80.40], [Security Policies Administration Guide R80.40]
A
Explanation:
Reference: Threat Emulation is not a policy type available for each policy package. Threat Emulation is a software blade that is part of the Threat Prevention policy type. The other options are valid policy types that can be configured for each policy package.
Reference: [Threat Prevention Administration Guide R80.40], [Security Policies Administration Guide R80.40]
Question #378
Is it possible to have more than one administrator connected to a Security Management Server at once?
- A . Yes, but only if all connected administrators connect with read-only permissions.
- B . Yes, but objects edited by one administrator will be locked for editing by others until the session is published.
- C . No, only one administrator at a time can connect to a Security Management Server
- D . Yes, but only one of those administrators will have write-permissions. All others will have read-only permission.
Correct Answer: B
B
Explanation:
It is possible to have more than one administrator connected to a Security Management Server at once, but objects edited by one administrator will be locked for editing by others until the session is published. This feature is called concurrent administration and it allows multiple administrators to work on the same security policy at the same time. However, when one administrator edits an object, such as a gateway, a rule, or a network, that object is locked for other administrators until the change is published or discarded. The lock icon shows which objects are being edited by other administrators and prevents conflicts or overwrites.
Reference: [Concurrent Administration], [SmartConsole Overview]
B
Explanation:
It is possible to have more than one administrator connected to a Security Management Server at once, but objects edited by one administrator will be locked for editing by others until the session is published. This feature is called concurrent administration and it allows multiple administrators to work on the same security policy at the same time. However, when one administrator edits an object, such as a gateway, a rule, or a network, that object is locked for other administrators until the change is published or discarded. The lock icon shows which objects are being edited by other administrators and prevents conflicts or overwrites.
Reference: [Concurrent Administration], [SmartConsole Overview]
Question #379
When a Security Gateway sends its logs to an IP address other than its own, which deployment option is installed?
- A . Distributed
- B . Standalone
- C . Bridge Mode
- D . Targeted
Correct Answer: A
A
Explanation:
When a Security Gateway sends its logs to an IP address other than its own, it means that the deployment option is distributed. In a distributed deployment, the Security Management Server and the Security Gateway are installed on separate machines. The Security Management Server collects logs from one or more Security Gateways and manages them centrally. In a standalone deployment, the Security Management Server and the Security Gateway are installed on the same machine. The Security Gateway sends logs to its own IP address. In a bridge mode deployment, the Security Gateway acts as a transparent bridge between two network segments and does not have an IP address of its own. In a targeted deployment, the Security Gateway sends logs to a specific log server that is configured in the gateway object properties34
Reference: Part 4 – Installing Security Gateway, Deployment Options
A
Explanation:
When a Security Gateway sends its logs to an IP address other than its own, it means that the deployment option is distributed. In a distributed deployment, the Security Management Server and the Security Gateway are installed on separate machines. The Security Management Server collects logs from one or more Security Gateways and manages them centrally. In a standalone deployment, the Security Management Server and the Security Gateway are installed on the same machine. The Security Gateway sends logs to its own IP address. In a bridge mode deployment, the Security Gateway acts as a transparent bridge between two network segments and does not have an IP address of its own. In a targeted deployment, the Security Gateway sends logs to a specific log server that is configured in the gateway object properties34
Reference: Part 4 – Installing Security Gateway, Deployment Options
Question #380
Which of the following is used to initially create trust between a Gateway and Security Management Server?
- A . Internal Certificate Authority
- B . Token
- C . One-time Password
- D . Certificate
Correct Answer: C
C
Explanation:
A one-time password is used to initially create trust between a Gateway and Security Management Server. The administrator generates a one-time password from SmartConsole and enters it on the gateway command line interface using the cpconfig command. This establishes a Secure Internal Communication (SIC) between the gateway and the server. The other options are not used for this purpose.
Reference: [Configuring Secure Internal Communication (SIC)], [Check Point CCSA – R81: Practice Test & Explanation]
C
Explanation:
A one-time password is used to initially create trust between a Gateway and Security Management Server. The administrator generates a one-time password from SmartConsole and enters it on the gateway command line interface using the cpconfig command. This establishes a Secure Internal Communication (SIC) between the gateway and the server. The other options are not used for this purpose.
Reference: [Configuring Secure Internal Communication (SIC)], [Check Point CCSA – R81: Practice Test & Explanation]