Check Point 156-215.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #31
By default, which port does the WebUI listen on?
- A . 8080
- B . 80
- C . 4434
- D . 443
Correct Answer: B
B
Explanation:
By default, the WebUI listens on port 80. The WebUI is a web-based interface that allows administrators to configure and monitor Gaia OS settings and features from a web browser. The WebUI uses the HTTP protocol to communicate with the Gaia machine, which by default uses port 80 as the standard port number. The other port numbers are not used by the WebUI by default, but they can be changed by modifying the Gaia configuration file or using CLISH commands.
B
Explanation:
By default, the WebUI listens on port 80. The WebUI is a web-based interface that allows administrators to configure and monitor Gaia OS settings and features from a web browser. The WebUI uses the HTTP protocol to communicate with the Gaia machine, which by default uses port 80 as the standard port number. The other port numbers are not used by the WebUI by default, but they can be changed by modifying the Gaia configuration file or using CLISH commands.
Question #32
Which of the following is NOT a valid deployment option for R80?
- A . All-in-one (stand-alone)
- B . CloudGuard
- C . Distributed
- D . Bridge Mode
Correct Answer: B
B
Explanation:
CloudGuard is not a valid deployment option for R80. CloudGuard is a product name for Check Point’s cloud security solutions, not a deployment mode. The valid deployment options for R80 are all-in-one (stand-alone), distributed, and bridge mode. In an all-in-one deployment, the Security Management Server and Security Gateway are installed on the same machine. In a distributed deployment, the Security Management Server and Security Gateway are installed on separate machines. In a bridge mode deployment, the Security Gateway acts as a transparent bridge between two network segments and does not have an IP address of its own3
Reference: CloudGuard, [Part 4 – Installing Security Gateway], [Deployment Options]
B
Explanation:
CloudGuard is not a valid deployment option for R80. CloudGuard is a product name for Check Point’s cloud security solutions, not a deployment mode. The valid deployment options for R80 are all-in-one (stand-alone), distributed, and bridge mode. In an all-in-one deployment, the Security Management Server and Security Gateway are installed on the same machine. In a distributed deployment, the Security Management Server and Security Gateway are installed on separate machines. In a bridge mode deployment, the Security Gateway acts as a transparent bridge between two network segments and does not have an IP address of its own3
Reference: CloudGuard, [Part 4 – Installing Security Gateway], [Deployment Options]
Question #33
What are the three deployment considerations for a secure network?
- A . Distributed, Bridge Mode, and Remote
- B . Bridge Mode, Remote, and Standalone
- C . Remote, Standalone, and Distributed
- D . Standalone, Distributed, and Bridge Mode
Correct Answer: C
C
Explanation:
The three deployment considerations for a secure network are Remote, Standalone, and Distributed3. Remote deployment means that the Security Management Server and Security Gateway are installed on different machines. Standalone deployment means that the Security Management Server and Security Gateway are installed on the same machine. Distributed deployment means that there are multiple Security Gateways managed by one or more Security Management Servers3. Therefore, the correct answer is C. Remote, Standalone, and Distributed.
C
Explanation:
The three deployment considerations for a secure network are Remote, Standalone, and Distributed3. Remote deployment means that the Security Management Server and Security Gateway are installed on different machines. Standalone deployment means that the Security Management Server and Security Gateway are installed on the same machine. Distributed deployment means that there are multiple Security Gateways managed by one or more Security Management Servers3. Therefore, the correct answer is C. Remote, Standalone, and Distributed.
Question #34
You have discovered suspicious activity in your network.
What is the BEST immediate action to take?
- A . Create a policy rule to block the traffic.
- B . Create a suspicious action rule to block that traffic.
- C . Wait until traffic has been identified before making any changes.
- D . Contact ISP to block the traffic.
Correct Answer: B
B
Explanation:
The BEST immediate action to take when you have discovered suspicious activity in your network is to create a suspicious action rule to block that traffic. A suspicious action rule is a special type of rule that is triggered when a predefined condition is met, such as a malicious file download, a ransomware attack, or a data exfiltration attempt13. A suspicious action rule can block the traffic, quarantine the source, or send an alert to the administrator. Creating a policy rule to block the traffic may not be effective if the traffic does not match the rule criteria or if the policy installation is delayed. Waiting until traffic has been identified before making any changes may allow the threat to spread or cause more damage. Contacting ISP to block the traffic may not be feasible or timely, and may also affect legitimate traffic.
Reference: Check Point R81 Security Gateway Technical Administration Guide, Check Point CCSA – R81: Practice Test & Explanation | Udemy
B
Explanation:
The BEST immediate action to take when you have discovered suspicious activity in your network is to create a suspicious action rule to block that traffic. A suspicious action rule is a special type of rule that is triggered when a predefined condition is met, such as a malicious file download, a ransomware attack, or a data exfiltration attempt13. A suspicious action rule can block the traffic, quarantine the source, or send an alert to the administrator. Creating a policy rule to block the traffic may not be effective if the traffic does not match the rule criteria or if the policy installation is delayed. Waiting until traffic has been identified before making any changes may allow the threat to spread or cause more damage. Contacting ISP to block the traffic may not be feasible or timely, and may also affect legitimate traffic.
Reference: Check Point R81 Security Gateway Technical Administration Guide, Check Point CCSA – R81: Practice Test & Explanation | Udemy
Question #35
Which of the following is a new R80.10 Gateway feature that had not been available in R77.X and older?
- A . The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.
- B . Limits the upload and download throughput for streaming media in the company to 1 Gbps.
- C . Time object to a rule to make the rule active only during specified times.
- D . Sub Policies are sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.
Correct Answer: D
D
Explanation:
Sub Policies are a new feature in R80.10 Gateway that allow creating and attaching sets of rules to specific rules in the main policy4. Sub Policies are useful for delegating permissions, managing large rule bases, and applying different inspection profiles4. The other options are not new features in R80.10 Gateway.
Reference: Check Point R80.10 Security Management Administration Guide
D
Explanation:
Sub Policies are a new feature in R80.10 Gateway that allow creating and attaching sets of rules to specific rules in the main policy4. Sub Policies are useful for delegating permissions, managing large rule bases, and applying different inspection profiles4. The other options are not new features in R80.10 Gateway.
Reference: Check Point R80.10 Security Management Administration Guide
Question #36
What are the three types of UserCheck messages?
- A . inform, ask, and block
- B . block, action, and warn
- C . action, inform, and ask
- D . ask, block, and notify
Correct Answer: A
A
Explanation:
The three types of UserCheck messages are inform, ask, and block. Inform messages notify users about security events and do not require any user action. Ask messages prompt users to choose whether to allow or block an action. Block messages prevent users from performing an action and display a reason1.
Reference: Check Point R81 Logging and Monitoring Administration Guide
A
Explanation:
The three types of UserCheck messages are inform, ask, and block. Inform messages notify users about security events and do not require any user action. Ask messages prompt users to choose whether to allow or block an action. Block messages prevent users from performing an action and display a reason1.
Reference: Check Point R81 Logging and Monitoring Administration Guide
Question #37
What is the purpose of the Stealth Rule?
- A . To prevent users from directly connecting to a Security Gateway.
- B . To reduce the number of rules in the database.
- C . To reduce the amount of logs for performance issues.
- D . To hide the gateway from the Internet.
Correct Answer: A
A
Explanation:
The Stealth Rule is used to prevent users from directly connecting to a Security Gateway. It is usually placed at the top of the rule base, before any other rule that allows traffic to the Security Gateway1, p. 32.
Reference: Check Point CCSA – R81: Practice Test & Explanation
A
Explanation:
The Stealth Rule is used to prevent users from directly connecting to a Security Gateway. It is usually placed at the top of the rule base, before any other rule that allows traffic to the Security Gateway1, p. 32.
Reference: Check Point CCSA – R81: Practice Test & Explanation
Question #38
Fill in the blank: With the User Directory Software Blade, you can create user definitions on a(n) ___________ Server.
- A . SecurID
- B . LDAP
- C . NT domain
- D . SMTP
Correct Answer: B
B
Explanation:
With the User Directory Software Blade, you can create user definitions on a(n) LDAP Server2. LDAP stands for Lightweight Directory Access Protocol and is a protocol for accessing and managing user information stored in a directory service. The User Directory Software Blade enables integration with LDAP servers such as Microsoft Active Directory, Novell eDirectory, and OpenLDAP.
Reference: Check Point R81 Identity Awareness Administration Guide
B
Explanation:
With the User Directory Software Blade, you can create user definitions on a(n) LDAP Server2. LDAP stands for Lightweight Directory Access Protocol and is a protocol for accessing and managing user information stored in a directory service. The User Directory Software Blade enables integration with LDAP servers such as Microsoft Active Directory, Novell eDirectory, and OpenLDAP.
Reference: Check Point R81 Identity Awareness Administration Guide
Question #39
You are asked to check the status of several user-mode processes on the management server and gateway.
Which of the following processes can only be seen on a Management Server?
- A . fwd
- B . fwm
- C . cpd
- D . cpwd
Correct Answer: B
B
Explanation:
The fwm process is responsible for managing the communication between the SmartConsole and the Security Management Server. It can only be seen on a Management Server12.
Reference: Check Point Processes and Daemons, Check Point CCSA – R81: Practice Test & Explanation
B
Explanation:
The fwm process is responsible for managing the communication between the SmartConsole and the Security Management Server. It can only be seen on a Management Server12.
Reference: Check Point Processes and Daemons, Check Point CCSA – R81: Practice Test & Explanation
Question #40
In which scenario is it a valid option to transfer a license from one hardware device to another?
- A . From a 4400 Appliance to a 2200 Appliance
- B . From a 4400 Appliance to an HP Open Server
- C . From an IBM Open Server to an HP Open Server
- D . From an IBM Open Server to a 2200 Appliance
Correct Answer: A
A
Explanation:
The scenario where it is a valid option to transfer a license from one hardware device to another is from a 4400 Appliance to a 2200 Appliance. This is because both appliances are Check Point products and have the same license type (Central License). You can transfer a license from one hardware device to another if they have the same license type and vendor3. Therefore, the correct answer is A. From a 4400 Appliance to a 2200 Appliance.
A
Explanation:
The scenario where it is a valid option to transfer a license from one hardware device to another is from a 4400 Appliance to a 2200 Appliance. This is because both appliances are Check Point products and have the same license type (Central License). You can transfer a license from one hardware device to another if they have the same license type and vendor3. Therefore, the correct answer is A. From a 4400 Appliance to a 2200 Appliance.