Check Point 156-215.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #41
Which message indicates IKE Phase 2 has completed successfully?
- A . Quick Mode Complete
- B . Aggressive Mode Complete
- C . Main Mode Complete
- D . IKE Mode Complete
Correct Answer: A
A
Explanation:
Quick Mode Complete is the message that indicates IKE Phase 2 has completed successfully2. IKE Phase 2 is also known as Quick Mode or Child SA in IKEv1 and IKEv2 respectively. Aggressive Mode and Main Mode are part of IKE Phase 1, which establishes the IKE SA. IKE Mode is not a valid term for IKE negotiation.
Reference: How to Analyze IKE Phase 2 VPN Status Messages, IKEv2 Phase 1 (IKE SA) and Phase 2 (Child SA) Message Exchanges, Understand IPsec IKEv1 Protocol
A
Explanation:
Quick Mode Complete is the message that indicates IKE Phase 2 has completed successfully2. IKE Phase 2 is also known as Quick Mode or Child SA in IKEv1 and IKEv2 respectively. Aggressive Mode and Main Mode are part of IKE Phase 1, which establishes the IKE SA. IKE Mode is not a valid term for IKE negotiation.
Reference: How to Analyze IKE Phase 2 VPN Status Messages, IKEv2 Phase 1 (IKE SA) and Phase 2 (Child SA) Message Exchanges, Understand IPsec IKEv1 Protocol
Question #42
Which of the following is TRUE regarding Gaia command line?
- A . Configuration changes should be done in mgmt_di and use CLISH for monitoring. Expert mode is used only for OS level tasks
- B . Configuration changes should be done in mgmt_cli and use expert-mode for OS-level tasks.
- C . Configuration changes should be done in expert-mode and CLISH is used for monitoring
- D . All configuration changes should be made in CLISH and expert-mode should be used for OS-level tasks.
Correct Answer: D
D
Explanation:
The statement that is true regarding Gaia command line is that all configuration changes should be made in CLISH and expert-mode should be used for OS-level tasks. CLISH is the default shell of Gaia CLI that provides a limited set of commands for basic configuration and troubleshooting. Expert mode is an advanced shell that allows running Linux commands and accessing the file system. Configuration changes should not be done in expert-mode, as they may cause inconsistencies or errors in the system. The other statements are false regarding Gaia command line.
D
Explanation:
The statement that is true regarding Gaia command line is that all configuration changes should be made in CLISH and expert-mode should be used for OS-level tasks. CLISH is the default shell of Gaia CLI that provides a limited set of commands for basic configuration and troubleshooting. Expert mode is an advanced shell that allows running Linux commands and accessing the file system. Configuration changes should not be done in expert-mode, as they may cause inconsistencies or errors in the system. The other statements are false regarding Gaia command line.
Question #43
Both major kinds of NAT support Hide and Static NAT. However, one offers more flexibility.
Which statement is true?
- A . Manual NAT can offer more flexibility than Automatic NAT.
- B . Dynamic Network Address Translation (NAT) Overloading can offer more flexibility than Port Address Translation.
- C . Dynamic NAT with Port Address Translation can offer more flexibility than Network Address Translation (NAT) Overloading.
- D . Automatic NAT can offer more flexibility than Manual NAT.
Correct Answer: A
A
Explanation:
Manual NAT can offer more flexibility than Automatic NAT because it allows the administrator to define the NAT rules in any order and position1. Automatic NAT creates the NAT rules automatically and places them at the top or bottom of the NAT Rule Base2.
Reference: Check Point R81 Firewall Administration Guide, Check Point R81 Security Management Administration Guide
A
Explanation:
Manual NAT can offer more flexibility than Automatic NAT because it allows the administrator to define the NAT rules in any order and position1. Automatic NAT creates the NAT rules automatically and places them at the top or bottom of the NAT Rule Base2.
Reference: Check Point R81 Firewall Administration Guide, Check Point R81 Security Management Administration Guide
Question #44
Please choose correct command syntax to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI?
- A . hostname myHost12 ip-address 10.50.23.90
- B . mgmt add host name ip-address 10.50.23.90
- C . add host name emailserver1 ip-address 10.50.23.90
- D . mgmt add host name emailserver1 ip-address 10.50.23.90
Correct Answer: D
D
Explanation:
The correct syntax for adding a host using GAiA management CLI is mgmt add host name <name> ip-address <ip-address>2.
Reference: Check Point GAiA R81 Command Line Interface Reference Guide
D
Explanation:
The correct syntax for adding a host using GAiA management CLI is mgmt add host name <name> ip-address <ip-address>2.
Reference: Check Point GAiA R81 Command Line Interface Reference Guide
Question #45
What needs to be configured if the NAT property ‘Translate destination on client side’ is not enabled in Global properties?
- A . A host route to route to the destination IP
- B . Use the file local.arp to add the ARP entries for NAT to work
- C . Nothing, the Gateway takes care of all details necessary
- D . Enabling ‘Allow bi-directional NAT’ for NAT to work correctly
Correct Answer: C
C
Explanation:
If the NAT property ‘Translate destination on client side’ is not enabled in Global properties, nothing needs to be configured on the client side, because the Gateway takes care of all details necessary. The Gateway translates the destination IP address before sending the packet to the client, so the client does not need to know about the NAT rule or add any host route or ARP entry.
Reference: Check Point Security Engineering Study Guide, p. 136-137
C
Explanation:
If the NAT property ‘Translate destination on client side’ is not enabled in Global properties, nothing needs to be configured on the client side, because the Gateway takes care of all details necessary. The Gateway translates the destination IP address before sending the packet to the client, so the client does not need to know about the NAT rule or add any host route or ARP entry.
Reference: Check Point Security Engineering Study Guide, p. 136-137
Question #46
In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log.
Which of the following options can you add to each Log, Detailed Log and Extended Log?
- A . Accounting
- B . Suppression
- C . Accounting/Suppression
- D . Accounting/Extended
Correct Answer: C
C
Explanation:
In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. You can add Accounting and/or Suppression to each of these options1. Accounting enables you to track the amount of data that is sent or received by a specific rule. Suppression enables you to reduce the number of logs that are generated by a specific rule. Therefore, the correct answer is C. Accounting/Suppression.
Reference: Logging and Monitoring Administration Guide R80 – Check Point Software
C
Explanation:
In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. You can add Accounting and/or Suppression to each of these options1. Accounting enables you to track the amount of data that is sent or received by a specific rule. Suppression enables you to reduce the number of logs that are generated by a specific rule. Therefore, the correct answer is C. Accounting/Suppression.
Reference: Logging and Monitoring Administration Guide R80 – Check Point Software
Question #47
Which option in tracking allows you to see the amount of data passed in the connection?
- A . Data
- B . Accounting
- C . Logs
- D . Advanced
Correct Answer: B
B
Explanation:
Accounting is the option in tracking that allows you to see the amount of data passed in the connection. Accounting tracks the number of bytes and packets for each connection and generates reports based on the collected data.
Reference: Certified Security Administrator (CCSA) R81.20 Course Overview, page 14.
B
Explanation:
Accounting is the option in tracking that allows you to see the amount of data passed in the connection. Accounting tracks the number of bytes and packets for each connection and generates reports based on the collected data.
Reference: Certified Security Administrator (CCSA) R81.20 Course Overview, page 14.
Question #48
Which option in a firewall rule would only match and allow traffic to VPN gateways for one Community in common?
- A . All Connections (Clear or Encrypted)
- B . Accept all encrypted traffic
- C . Specific VPN Communities
- D . All Site-to-Site VPN Communities
Correct Answer: C
C
Explanation:
Specific VPN Communities is the option that would only match and allow traffic to VPN gateways for one Community in common. This option allows you to define a specific VPN community that includes the VPN gateways that are allowed to communicate with each other. The other options are either too broad or too narrow for this scenario.
Reference: [Site to Site VPN in R80.x – Tutorial for Beginners]
C
Explanation:
Specific VPN Communities is the option that would only match and allow traffic to VPN gateways for one Community in common. This option allows you to define a specific VPN community that includes the VPN gateways that are allowed to communicate with each other. The other options are either too broad or too narrow for this scenario.
Reference: [Site to Site VPN in R80.x – Tutorial for Beginners]
Question #49
In which deployment is the security management server and Security Gateway installed on the same appliance?
- A . Standalone
- B . Remote
- C . Distributed
- D . Bridge Mode
Correct Answer: A
A
Explanation:
A standalone deployment is when the security management server and Security Gateway are installed on the same appliance. This is suitable for small or branch office environments1
A
Explanation:
A standalone deployment is when the security management server and Security Gateway are installed on the same appliance. This is suitable for small or branch office environments1
Question #50
Of all the Check Point components in your network, which one changes most often and should be backed up most frequently?
- A . SmartManager
- B . SmartConsole
- C . Security Gateway
- D . Security Management Server
Correct Answer: D
D
Explanation:
The Security Management Server is the component that changes most often and should be backed up most frequently, because it stores all the security policies and configurations for the Check Point components in your network. The other components are either clients or gateways that do not change as frequently.
Reference: Check Point Security Management Administration Guide R81, p. 9
D
Explanation:
The Security Management Server is the component that changes most often and should be backed up most frequently, because it stores all the security policies and configurations for the Check Point components in your network. The other components are either clients or gateways that do not change as frequently.
Reference: Check Point Security Management Administration Guide R81, p. 9