Check Point 156-215.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #391
When a SAM rule is required on Security Gateway to quickly block suspicious connections which are not restricted by the Security Policy, what actions does the administrator need to take?
- A . SmartView Monitor should be opened and then the SAM rule/s can be applied immediately.
Installing policy is not required. - B . The policy type SAM must be added to the Policy Package and a new SAM rule must be applied.
Simply Publishing the changes applies the SAM rule on the firewall. - C . The administrator must work on the firewall CLI (for example with SSH and PuTTY) and the command ‘sam block’ must be used with the right parameters.
- D . The administrator should open the LOGS & MONITOR view and find the relevant log. Right clicking on the log entry will show the Create New SAM rule option.
Correct Answer: A
A
Explanation:
When a SAM rule is required on Security Gateway to quickly block suspicious connections which are not restricted by the Security Policy, the administrator needs to take the following action: SmartView Monitor should be opened and then the SAM rule/s can be applied immediately. Installing policy is not required. SAM stands for Suspicious Activity Monitoring and is a feature that allows administrators to block or limit connections from specific sources or destinations without modifying the security policy. SAM rules can be created from SmartView Monitor or SmartEvent based on real-time network activity or security events.
Reference: [Check Point R81 SmartView Monitor Administration Guide]
A
Explanation:
When a SAM rule is required on Security Gateway to quickly block suspicious connections which are not restricted by the Security Policy, the administrator needs to take the following action: SmartView Monitor should be opened and then the SAM rule/s can be applied immediately. Installing policy is not required. SAM stands for Suspicious Activity Monitoring and is a feature that allows administrators to block or limit connections from specific sources or destinations without modifying the security policy. SAM rules can be created from SmartView Monitor or SmartEvent based on real-time network activity or security events.
Reference: [Check Point R81 SmartView Monitor Administration Guide]
Question #392
In SmartConsole, on which tab are Permissions and Administrators defined?
- A . Manage and Settings
- B . Logs and Monitor
- C . Security Policies
- D . Gateways and Servers
Correct Answer: A
A
Explanation:
Permissions and Administrators are defined on the Manage and Settings tab in SmartConsole3. This tab allows you to create and manage administrator accounts, roles, permissions, and authentication methods for accessing SmartConsole and other Check Point management interfaces.
Reference: Check Point R81 Security Management Administration Guide
A
Explanation:
Permissions and Administrators are defined on the Manage and Settings tab in SmartConsole3. This tab allows you to create and manage administrator accounts, roles, permissions, and authentication methods for accessing SmartConsole and other Check Point management interfaces.
Reference: Check Point R81 Security Management Administration Guide
Question #393
What are the types of Software Containers?
- A . Smart Console, Security Management, and Security Gateway
- B . Security Management, Security Gateway, and Endpoint Security
- C . Security Management, Log & Monitoring, and Security Policy
- D . Security Management, Standalone, and Security Gateway
Correct Answer: B
B
Explanation:
The types of Software Containers are Security Management, Security Gateway, and Endpoint Security. Software Containers are virtual environments that run on top of Gaia OS and allow multiple instances of Check Point products to coexist on the same physical machine. The other options are not valid types of Software Containers.
B
Explanation:
The types of Software Containers are Security Management, Security Gateway, and Endpoint Security. Software Containers are virtual environments that run on top of Gaia OS and allow multiple instances of Check Point products to coexist on the same physical machine. The other options are not valid types of Software Containers.
Question #394
Fill in the blank: When tunnel test packets no longer invoke a response, SmartView Monitor displays _____________ for the given VPN tunnel.
- A . Down
- B . No Response
- C . Inactive
- D . Failed
Correct Answer: A
A
Explanation:
When tunnel test packets no longer invoke a response, SmartView Monitor displays Down for the given VPN tunnel1. This means that the VPN tunnel is not operational and there is no IKE or IPsec traffic passing through it. No Response, Inactive, and Failed are not valid statuses for VPN tunnels in SmartView Monitor.
Reference: Smart View Monitor displays status for all S2S VPN tunnels – Phase1 UP
A
Explanation:
When tunnel test packets no longer invoke a response, SmartView Monitor displays Down for the given VPN tunnel1. This means that the VPN tunnel is not operational and there is no IKE or IPsec traffic passing through it. No Response, Inactive, and Failed are not valid statuses for VPN tunnels in SmartView Monitor.
Reference: Smart View Monitor displays status for all S2S VPN tunnels – Phase1 UP
Question #395
What are the software components used by Autonomous Threat Prevention Profiles in R8I.20 and higher?
- A . Sandbox, ThreatCloud, Zero Phishing, Sanitization, C&C Protection, JPS, File and URL Reputation
- B . IPS, Threat Emulation and Threat Extraction
- C . Sandbox, ThreatCloud, Sanitization, C&C Protection, IPS
- D . IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction
Correct Answer: D
D
Explanation:
This answer is correct because these are the software components that are used by the pre-defined Autonomous Threat Prevention Profiles in R81.20 and higher1. These profiles provide zero-maintenance protection from zero-day threats and continuously and autonomously ensure that your protection is up-to-date with the latest cyber threats and prevention technologies2.
The other answers are not correct because they either include software components that are not part of the Autonomous Threat Prevention Profiles, such as Sandbox, ThreatCloud, Zero Phishing, Sanitization, C&C Protection, JPS, File and URL Reputation, or they omit some of the software components that are part of the Autonomous Threat Prevention Profiles, such as Anti-Bot, Anti-Virus, and Macro Extraction.
Autonomous Threat Prevention Management – Check Point Software
Check Point Quantum R81.20 (Titan) Release
Threat Prevention R81.20 Best Practices – Check Point Software
Check Point R81
D
Explanation:
This answer is correct because these are the software components that are used by the pre-defined Autonomous Threat Prevention Profiles in R81.20 and higher1. These profiles provide zero-maintenance protection from zero-day threats and continuously and autonomously ensure that your protection is up-to-date with the latest cyber threats and prevention technologies2.
The other answers are not correct because they either include software components that are not part of the Autonomous Threat Prevention Profiles, such as Sandbox, ThreatCloud, Zero Phishing, Sanitization, C&C Protection, JPS, File and URL Reputation, or they omit some of the software components that are part of the Autonomous Threat Prevention Profiles, such as Anti-Bot, Anti-Virus, and Macro Extraction.
Autonomous Threat Prevention Management – Check Point Software
Check Point Quantum R81.20 (Titan) Release
Threat Prevention R81.20 Best Practices – Check Point Software
Check Point R81
Question #396
The ______ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.
- A . Next Generation Threat Prevention
- B . Next Generation Threat Emulation
- C . Next Generation Threat Extraction
- D . Next Generation Firewall
Correct Answer: B
B
Explanation:
The Next Generation Threat Emulation software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware1, p. 41. It emulates files in a virtual environment and inspects their behavior for malicious activity3.
Reference: Check Point CCSA – R81: Practice Test & Explanation, Check Point Threat Emulation Administration Guide R81
B
Explanation:
The Next Generation Threat Emulation software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware1, p. 41. It emulates files in a virtual environment and inspects their behavior for malicious activity3.
Reference: Check Point CCSA – R81: Practice Test & Explanation, Check Point Threat Emulation Administration Guide R81
Question #397
Which of the following is NOT supported by Bridge Mode Check Point Security Gateway
- A . Antivirus
- B . Data Loss Prevention
- C . NAT
- D . Application Control
Correct Answer: C
C
Explanation:
Bridge Mode Check Point Security Gateway does not support NAT. Bridge Mode is a deployment option that allows the Security Gateway to inspect traffic without being a routing hop. In Bridge Mode, the Security Gateway does not have an IP address and cannot perform NAT1. Therefore, the correct answer is C. NAT.
C
Explanation:
Bridge Mode Check Point Security Gateway does not support NAT. Bridge Mode is a deployment option that allows the Security Gateway to inspect traffic without being a routing hop. In Bridge Mode, the Security Gateway does not have an IP address and cannot perform NAT1. Therefore, the correct answer is C. NAT.
Question #398
Stateful Inspection compiles and registers connections where?
- A . Connection Cache
- B . State Cache
- C . State Table
- D . Network Table
Correct Answer: C
C
Explanation:
Stateful Inspection compiles and registers connections in the State Table. The State Table is a database that stores information about active connections and sessions on the Security Gateway. The other options are not valid names for the database that stores connection information.
Reference: 1: Policy Types 2: CPUSE 3: SIC: [Software Containers]: [Stateful Inspection]
C
Explanation:
Stateful Inspection compiles and registers connections in the State Table. The State Table is a database that stores information about active connections and sessions on the Security Gateway. The other options are not valid names for the database that stores connection information.
Reference: 1: Policy Types 2: CPUSE 3: SIC: [Software Containers]: [Stateful Inspection]
Question #399
Which icon in the WebUI indicates that read/write access is enabled?
- A . Eyeglasses
- B . Pencil
- C . Padlock
- D . Book
Correct Answer: B
B
Explanation:
In Check Point Gaia WebUI, different icons are used to indicate various system states.
Eyeglasses (A) typically represent "view-only" access.
Pencil (B) represents "edit" or read/write access, meaning the user can modify configurations.
Padlock (C) is often used to indicate locked or restricted settings.
Book (D) does not indicate access permissions.
Therefore, the correct answer is "Pencil" (B), which represents that read/write access is enabled in
the WebUI.
Reference: Check Point Gaia WebUI documentation confirms that the Pencil icon is used for read/write mode.
B
Explanation:
In Check Point Gaia WebUI, different icons are used to indicate various system states.
Eyeglasses (A) typically represent "view-only" access.
Pencil (B) represents "edit" or read/write access, meaning the user can modify configurations.
Padlock (C) is often used to indicate locked or restricted settings.
Book (D) does not indicate access permissions.
Therefore, the correct answer is "Pencil" (B), which represents that read/write access is enabled in
the WebUI.
Reference: Check Point Gaia WebUI documentation confirms that the Pencil icon is used for read/write mode.
Question #400
Fill in the blanks: There are ________ types of software containers ________.
- A . Three; security management, Security Gateway, and endpoint security
- B . Three; Security gateway, endpoint security, and gateway management
- C . Two; security management and endpoint security
- D . Two; endpoint security and Security Gateway
Correct Answer: A
A
Explanation:
There are three types of software containers: security management, Security Gateway, and endpoint security. A software container is a set of software blades that provide specific functionality. A security management container manages the security policy and configuration for one or more Security Gateways. A Security Gateway container enforces the security policy on the network traffic. An endpoint security container protects the data and network access of an endpoint device2. The other options are not valid types of software containers.
Reference: Software Containers
A
Explanation:
There are three types of software containers: security management, Security Gateway, and endpoint security. A software container is a set of software blades that provide specific functionality. A security management container manages the security policy and configuration for one or more Security Gateways. A Security Gateway container enforces the security policy on the network traffic. An endpoint security container protects the data and network access of an endpoint device2. The other options are not valid types of software containers.
Reference: Software Containers