Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #51
Which repositories are installed on the Security Management Server by SmartUpdate?
- A . License and Update
- B . Package Repository and Licenses
- C . Update and License & Contract
- D . License & Contract and Package Repository
Correct Answer: D
D
Explanation:
According to the Managing and Installing license via SmartUpdate2, there are two repositories installed on the Security Management Server by SmartUpdate: License & Contract and Package Repository. The License & Contract repository stores all licenses available and all of the assigned licenses. The Package Repository stores all packages downloaded from the Check Point Cloud or uploaded from a local device.
Reference: Managing and Installing license via SmartUpdate
D
Explanation:
According to the Managing and Installing license via SmartUpdate2, there are two repositories installed on the Security Management Server by SmartUpdate: License & Contract and Package Repository. The License & Contract repository stores all licenses available and all of the assigned licenses. The Package Repository stores all packages downloaded from the Check Point Cloud or uploaded from a local device.
Reference: Managing and Installing license via SmartUpdate
Question #52
Fill in the blank: The_____is used to obtain identification and security information about network
users.
- A . User index
- B . UserCheck
- C . User Directory
- D . User server
Correct Answer: C
C
Explanation:
The User Directory is used to obtain identification and security information about network users. It can be integrated with external user databases such as LDAP, RADIUS, or
TACACS+.
Reference: Certified Security Administrator (CCSA) R81.20 Course Overview, page 9.
C
Explanation:
The User Directory is used to obtain identification and security information about network users. It can be integrated with external user databases such as LDAP, RADIUS, or
TACACS+.
Reference: Certified Security Administrator (CCSA) R81.20 Course Overview, page 9.
Question #53
When an Admin logs into SmartConsole and sees a lock icon on a gateway object and cannot edit that object, what does that indicate?
- A . The gateway is not powered on.
- B . Incorrect routing to reach the gateway.
- C . The Admin would need to login to Read-Only mode
- D . Another Admin has made an edit to that object and has yet to publish the change.
Correct Answer: D
D
Explanation:
When an Admin logs into SmartConsole and sees a lock icon on a gateway object and cannot edit that object, it indicates that another Admin has made an edit to that object and has yet to publish the change. SmartConsole supports concurrent administration, which means that multiple Admins can work on the same security policy at the same time. However, when one Admin edits an object, such as a gateway, a rule, or a network, that object is locked for other Admins until the change is published or discarded. The lock icon shows which objects are being edited by other Admins and prevents conflicts or overwrites. The gateway being powered off, incorrect routing to reach the gateway, or logging in to Read-Only mode do not cause the lock icon to appear.
Reference: [Concurrent Administration], [SmartConsole Overview]
D
Explanation:
When an Admin logs into SmartConsole and sees a lock icon on a gateway object and cannot edit that object, it indicates that another Admin has made an edit to that object and has yet to publish the change. SmartConsole supports concurrent administration, which means that multiple Admins can work on the same security policy at the same time. However, when one Admin edits an object, such as a gateway, a rule, or a network, that object is locked for other Admins until the change is published or discarded. The lock icon shows which objects are being edited by other Admins and prevents conflicts or overwrites. The gateway being powered off, incorrect routing to reach the gateway, or logging in to Read-Only mode do not cause the lock icon to appear.
Reference: [Concurrent Administration], [SmartConsole Overview]
Question #54
What is a reason for manual creation of a NAT rule?
- A . In R80 all Network Address Translation is done automatically and there is no need for manually defined NAT-rules.
- B . Network Address Translation of RFC1918-compliant networks is needed to access the Internet.
- C . Network Address Translation is desired for some services, but not for others.
- D . The public IP-address is different from the gateway’s external IP
Correct Answer: D
D
Explanation:
A reason for manual creation of a NAT rule is when the public IP-address is different from the gateway’s external IP. This can happen when the gateway is behind another NAT device or firewall3.
Reference: Check Point R81 Security Gateway Administration Guide, Check Point CCSA – R81: Practice Test & Explanation
D
Explanation:
A reason for manual creation of a NAT rule is when the public IP-address is different from the gateway’s external IP. This can happen when the gateway is behind another NAT device or firewall3.
Reference: Check Point R81 Security Gateway Administration Guide, Check Point CCSA – R81: Practice Test & Explanation
Question #55
Which of the following situations would not require a new license to be generated and installed?
- A . The Security Gateway is upgraded.
- B . The existing license expires.
- C . The license is upgraded.
- D . The IP address of the Security Management or Security Gateway has changed.
Correct Answer: A
A
Explanation:
Upgrading the Security Gateway does not require a new license to be generated and installed. The license is tied to the IP address or hostname of the Security Gateway, not the software version. However, if the IP address or hostname changes, the existing license expires, or the license is upgraded, a new license must be generated and installed12
Reference: Check Point R81, Managing and Installing license via SmartUpdate
A
Explanation:
Upgrading the Security Gateway does not require a new license to be generated and installed. The license is tied to the IP address or hostname of the Security Gateway, not the software version. However, if the IP address or hostname changes, the existing license expires, or the license is upgraded, a new license must be generated and installed12
Reference: Check Point R81, Managing and Installing license via SmartUpdate
Question #56
SmartEvent does NOT use which of the following procedures to identity events:
- A . Matching a log against each event definition
- B . Create an event candidate
- C . Matching a log against local exclusions
- D . Matching a log against global exclusions
Correct Answer: C
C
Explanation:
The procedure that SmartEvent does not use to identify events is matching a log against local exclusions. Local exclusions are used to filter out logs that are not relevant for SmartLog, not SmartEvent12. SmartEvent uses the other procedures to identify events based on event definitions, event candidates, and global exclusions3.
Reference: SmartLog R81 Administration Guide, Check Point CCSA – R81: Practice Test & Explanation, SmartEvent R81 Administration Guide, [Free Check Point CCSA Sample Questions and Study Guide]
C
Explanation:
The procedure that SmartEvent does not use to identify events is matching a log against local exclusions. Local exclusions are used to filter out logs that are not relevant for SmartLog, not SmartEvent12. SmartEvent uses the other procedures to identify events based on event definitions, event candidates, and global exclusions3.
Reference: SmartLog R81 Administration Guide, Check Point CCSA – R81: Practice Test & Explanation, SmartEvent R81 Administration Guide, [Free Check Point CCSA Sample Questions and Study Guide]
Question #57
Which software blade does NOT accompany the Threat Prevention policy?
- A . IPS
- B . Application Control and URL Filtering
- C . Threat Emulation
- D . Anti-virus
Correct Answer: B
B
Explanation:
The Threat Prevention policy is a unified policy that manages three software blades: IPS, Anti-Virus, and Threat Emulation7. The Threat Prevention policy enables you to configure settings and actions for detecting and preventing various types of threats, such as malware, exploits, botnets, etc. Application Control and URL Filtering are not part of the Threat Prevention policy, but they are part of a separate policy that controls access to applications and websites based on categories, users, groups, and machines
B
Explanation:
The Threat Prevention policy is a unified policy that manages three software blades: IPS, Anti-Virus, and Threat Emulation7. The Threat Prevention policy enables you to configure settings and actions for detecting and preventing various types of threats, such as malware, exploits, botnets, etc. Application Control and URL Filtering are not part of the Threat Prevention policy, but they are part of a separate policy that controls access to applications and websites based on categories, users, groups, and machines
Question #58
What two ordered layers make up the Access Control Policy Layer?
- A . URL Filtering and Network
- B . Network and Threat Prevention
- C . Application Control and URL Filtering
- D . Network and Application Control
Correct Answer: B
B
Explanation:
The two ordered layers that make up the Access Control Policy Layer are Network and Threat Prevention. Network layer contains rules that define how traffic is inspected and handled by the Security Gateway. Threat Prevention layer contains rules that define how traffic is inspected by the Threat Prevention Software Blades2.
Reference: Check Point R81 Security Management Administration Guide
B
Explanation:
The two ordered layers that make up the Access Control Policy Layer are Network and Threat Prevention. Network layer contains rules that define how traffic is inspected and handled by the Security Gateway. Threat Prevention layer contains rules that define how traffic is inspected by the Threat Prevention Software Blades2.
Reference: Check Point R81 Security Management Administration Guide
Question #59
Which Check Point software blade monitors Check Point devices and provides a picture of network and security performance?
- A . Application Control
- B . Threat Emulation
- C . Logging and Status
- D . Monitoring
Correct Answer: D
D
Explanation:
The Check Point software blade that monitors Check Point devices and provides a picture of network and security performance is Monitoring. The Monitoring Software Blade presents a complete picture of network and security performance, enabling fast responses to changes in traffic patterns or security events. It centrally monitors Check Point devices and alerts security administrators to changes to gateways, endpoints, tunnels, remote users and security activities234.
Reference: Monitoring Software Blade, Check Point Integrated Security Architecture, Support, Support Requests, Training, Documentation, and Knowledge base for Check Point products and services
D
Explanation:
The Check Point software blade that monitors Check Point devices and provides a picture of network and security performance is Monitoring. The Monitoring Software Blade presents a complete picture of network and security performance, enabling fast responses to changes in traffic patterns or security events. It centrally monitors Check Point devices and alerts security administrators to changes to gateways, endpoints, tunnels, remote users and security activities234.
Reference: Monitoring Software Blade, Check Point Integrated Security Architecture, Support, Support Requests, Training, Documentation, and Knowledge base for Check Point products and services
Question #60
Which of the following is considered to be the more secure and preferred VPN authentication method?
- A . Password
- B . Certificate
- C . MD5
- D . Pre-shared secret
Correct Answer: B
B
Explanation:
Reference: Certificate-based authentication is considered to be the more secure and preferred VPN authentication method. It uses digital certificates to verify the identity of the VPN client and server, and provides stronger encryption and mutual authentication. Password-based authentication methods are less secure and more vulnerable to brute-force attacks, phishing, and keylogging. MD5 is a hashing algorithm, not an authentication method. Pre-shared secret is a symmetric key that is shared between the VPN peers, but it can be compromised if it is not changed frequently or stored securely12
Reference: VPN authentication options, Windows VPN technical guide
B
Explanation:
Reference: Certificate-based authentication is considered to be the more secure and preferred VPN authentication method. It uses digital certificates to verify the identity of the VPN client and server, and provides stronger encryption and mutual authentication. Password-based authentication methods are less secure and more vulnerable to brute-force attacks, phishing, and keylogging. MD5 is a hashing algorithm, not an authentication method. Pre-shared secret is a symmetric key that is shared between the VPN peers, but it can be compromised if it is not changed frequently or stored securely12
Reference: VPN authentication options, Windows VPN technical guide