Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #61
What protocol is specifically used for clustered environments?
- A . Clustered Protocol
- B . Synchronized Cluster Protocol
- C . Control Cluster Protocol
- D . Cluster Control Protocol
Correct Answer: D
D
Explanation:
The protocol that is specifically used for clustered environments is Cluster Control Protocol (CCP). CCP is a proprietary Check Point protocol that is used for communication between cluster members and for cluster administration. CCP enables cluster members to exchange state information, synchronize connections, monitor interfaces, and perform failover operations. The other options are incorrect. Clustered Protocol, Synchronized Cluster Protocol, and Control Cluster Protocol are not valid terms in Check Point terminology.
Reference: [Cluster Control Protocol (CCP) – Check Point Software]
D
Explanation:
The protocol that is specifically used for clustered environments is Cluster Control Protocol (CCP). CCP is a proprietary Check Point protocol that is used for communication between cluster members and for cluster administration. CCP enables cluster members to exchange state information, synchronize connections, monitor interfaces, and perform failover operations. The other options are incorrect. Clustered Protocol, Synchronized Cluster Protocol, and Control Cluster Protocol are not valid terms in Check Point terminology.
Reference: [Cluster Control Protocol (CCP) – Check Point Software]
Question #62
What licensing feature is used to verify licenses and activate new licenses added to the License and Contracts repository?
- A . Verification tool
- B . Verification licensing
- C . Automatic licensing
- D . Automatic licensing and Verification tool
Correct Answer: D
D
Explanation:
The licensing feature that is used to verify licenses and activate new licenses added to the License and Contracts repository is Automatic licensing and Verification tool1, p. 8. Automatic licensing is a feature that allows the Security Management Server to automatically attach licenses to Security Gateways. Verification tool is a feature that allows the Security Management Server to verify the validity of licenses and contracts2.
Reference: Check Point CCSA – R81: Practice Test & Explanation, Check Point Licensing and Contract Administration Guide R81
D
Explanation:
The licensing feature that is used to verify licenses and activate new licenses added to the License and Contracts repository is Automatic licensing and Verification tool1, p. 8. Automatic licensing is a feature that allows the Security Management Server to automatically attach licenses to Security Gateways. Verification tool is a feature that allows the Security Management Server to verify the validity of licenses and contracts2.
Reference: Check Point CCSA – R81: Practice Test & Explanation, Check Point Licensing and Contract Administration Guide R81
Question #63
Fill in the blank: An Endpoint identity agent uses a ___________ for user authentication.
- A . Shared secret
- B . Token
- C . Username/password or Kerberos Ticket
- D . Certificate
Correct Answer: C
C
Explanation:
An Endpoint identity agent uses a username/password or Kerberos ticket for user authentication3, p.
C
Explanation:
An Endpoint identity agent uses a username/password or Kerberos ticket for user authentication3, p.
Question #64
You have successfully backed up your Check Point configurations without the OS information.
What command would you use to restore this backup?
- A . restore_backup
- B . import backup
- C . cp_merge
- D . migrate import
Correct Answer: A
A
Explanation:
The command to restore a backup of Check Point configurations without the OS information is restore_backup4. This command restores the Gaia OS configuration and the firewall database from a compressed file. The other commands are not valid for this purpose. import backup is not a valid command. cp_merge is a command to merge policies or objects from different databases. migrate import is a command to import a previously exported database using migrate export.
Reference: System Backup and Restore feature in Gaia, [cp_merge], [migrate import]
A
Explanation:
The command to restore a backup of Check Point configurations without the OS information is restore_backup4. This command restores the Gaia OS configuration and the firewall database from a compressed file. The other commands are not valid for this purpose. import backup is not a valid command. cp_merge is a command to merge policies or objects from different databases. migrate import is a command to import a previously exported database using migrate export.
Reference: System Backup and Restore feature in Gaia, [cp_merge], [migrate import]
Question #65
Core Protections are installed as part of what Policy?
- A . Access Control Policy.
- B . Desktop Firewall Policy
- C . Mobile Access Policy.
- D . Threat Prevention Policy.
Correct Answer: D
D
Explanation:
Core Protections are installed as part of the Threat Prevention Policy. Core Protections are a set of IPS protections that are essential for securing your network against malicious traffic4. The other policies do not include Core Protections.
Reference: 1: Check Point CLI Reference Card 2: Anti-Spoofing 3: SmartView Tracker 4: Core Protections
D
Explanation:
Core Protections are installed as part of the Threat Prevention Policy. Core Protections are a set of IPS protections that are essential for securing your network against malicious traffic4. The other policies do not include Core Protections.
Reference: 1: Check Point CLI Reference Card 2: Anti-Spoofing 3: SmartView Tracker 4: Core Protections
Question #66
Which of the following log queries would show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1?
- A . src:192.168.1.1 OR dst:172.26.1.1 AND action:Drop
- B . src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop
- C . 192.168.1.1 AND 172.26.1.1 AND drop
- D . 192.168.1.1 OR 172.26.1.1 AND action:Drop
Correct Answer: B
B
Explanation:
src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop is the correct log query to show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1. The AND operator means that all conditions must be true for the query to match. The OR operator means that any condition can be true for the query to match3. The other queries will either show packets that are not dropped or packets that have different source or destination addresses.
B
Explanation:
src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop is the correct log query to show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1. The AND operator means that all conditions must be true for the query to match. The OR operator means that any condition can be true for the query to match3. The other queries will either show packets that are not dropped or packets that have different source or destination addresses.
Question #66
Which of the following log queries would show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1?
- A . src:192.168.1.1 OR dst:172.26.1.1 AND action:Drop
- B . src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop
- C . 192.168.1.1 AND 172.26.1.1 AND drop
- D . 192.168.1.1 OR 172.26.1.1 AND action:Drop
Correct Answer: B
B
Explanation:
src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop is the correct log query to show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1. The AND operator means that all conditions must be true for the query to match. The OR operator means that any condition can be true for the query to match3. The other queries will either show packets that are not dropped or packets that have different source or destination addresses.
B
Explanation:
src:192.168.1.1 AND dst:172.26.1.1 AND action:Drop is the correct log query to show only dropped packets with source address of 192.168.1.1 and destination address of 172.26.1.1. The AND operator means that all conditions must be true for the query to match. The OR operator means that any condition can be true for the query to match3. The other queries will either show packets that are not dropped or packets that have different source or destination addresses.
Question #68
Which one of the following is the preferred licensing model? Select the BEST answer
- A . Local licensing because it ties the package license to the IP-address of the gateway and has no dependency of the Security Management Server.
- B . Central licensing because it ties the package license to the IP-address of the Security Management Server and has no dependency on the gateway.
- C . Central licensing because it ties the package license to the MAC-address of the Security Management Server’s Mgmt-interface and has no dependency on the gateway.
- D . Local licensing because it ties the package license to the MAC-address of the gateway management interface and has no Security Management Server dependency.
Correct Answer: B
B
Explanation:
Central licensing is the preferred licensing model because it ties the package license to the IP-address of the Security Management Server and has no dependency on the gateway. This allows for easier management and distribution of licenses across multiple gateways1.
Reference: 1: Check Point R81 Security Management Administration Guide, page 14.
B
Explanation:
Central licensing is the preferred licensing model because it ties the package license to the IP-address of the Security Management Server and has no dependency on the gateway. This allows for easier management and distribution of licenses across multiple gateways1.
Reference: 1: Check Point R81 Security Management Administration Guide, page 14.
Question #69
Which one of these features is NOT associated with the Check Point URL Filtering and Application Control Blade?
- A . Detects and blocks malware by correlating multiple detection engines before users are affected.
- B . Configure rules to limit the available network bandwidth for specified users or groups.
- C . Use UserCheck to help users understand that certain websites are against the company’s security policy.
- D . Make rules to allow or block applications and Internet sites for individual applications, categories, and risk levels.
Correct Answer: A
A
Explanation:
The correct answer is A because detecting and blocking malware by correlating multiple detection engines before users are affected is not a feature of the Check Point URL Filtering and Application Control Blade3. This feature is part of the Check Point Anti-Virus and Anti-Bot Blades3. The other options are features of the Check Point URL Filtering and Application Control Blade3.
Reference: Check Point R81 URL Filtering and Application Control Administration Guide
A
Explanation:
The correct answer is A because detecting and blocking malware by correlating multiple detection engines before users are affected is not a feature of the Check Point URL Filtering and Application Control Blade3. This feature is part of the Check Point Anti-Virus and Anti-Bot Blades3. The other options are features of the Check Point URL Filtering and Application Control Blade3.
Reference: Check Point R81 URL Filtering and Application Control Administration Guide
Question #70
A stateful inspection firewall works by registering connection data and compiling this information. Where is the information stored?
- A . In the system SMEM memory pool.
- B . In State tables.
- C . In the Sessions table.
- D . In a CSV file on the firewall hard drive located in $FWDIR/conf/.
Correct Answer: B
B
Explanation:
A stateful inspection firewall works by registering connection data and compiling this information in state tables. State tables are data structures that store information about the state and context of each connection, such as source, destination, service, protocol, sequence number, flags, etc. State tables enable the firewall to inspect both the header and the payload of each packet and apply
security policies accordingly.
Reference: [Stateful Inspection], [State Tables]
B
Explanation:
A stateful inspection firewall works by registering connection data and compiling this information in state tables. State tables are data structures that store information about the state and context of each connection, such as source, destination, service, protocol, sequence number, flags, etc. State tables enable the firewall to inspect both the header and the payload of each packet and apply
security policies accordingly.
Reference: [Stateful Inspection], [State Tables]