Check Point 156-215.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-215.81.20
- Exam Name: Check Point Certified Security Administrator R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #81
What key is used to save the current CPView page in a filename format cpview_“cpview process ID”. cap”number of captures”?
- A . S
- B . W
- C . C
- D . Space bar
Correct Answer: C
C
Explanation:
The key C is used to save the current CPView page in a filename format cpview_“cpview process ID”. cap”number of captures”2.
Reference: Free Check Point CCSA Sample Questions and Study Guide
C
Explanation:
The key C is used to save the current CPView page in a filename format cpview_“cpview process ID”. cap”number of captures”2.
Reference: Free Check Point CCSA Sample Questions and Study Guide
Question #82
A Check Point Software license consists of two components, the Software Blade and the Software Container. There are ______ types of Software Containers: ________.
- A . Two; Security Management and Endpoint Security
- B . Two; Endpoint Security and Security Gateway
- C . Three; Security Management, Security Gateway, and Endpoint Security
- D . Three; Security Gateway, Endpoint Security, and Gateway Management
Correct Answer: C
C
Explanation:
A Check Point Software license consists of two components, the Software Blade and the Software Container. There are three types of Software Containers: Security Management, Security Gateway, and Endpoint Security1. A Software Blade is a specific security function that can be enabled or disabled on a Software Container. A Software Container is a platform that runs one or more Software Blades. Security Management is a container that manages the security policy and configuration of Security Gateways. Security Gateway is a container that enforces the security policy on network traffic. Endpoint Security is a container that protects endpoints from threats and data loss.
Reference: Check Point Licensing and Contract Operations User Guide
C
Explanation:
A Check Point Software license consists of two components, the Software Blade and the Software Container. There are three types of Software Containers: Security Management, Security Gateway, and Endpoint Security1. A Software Blade is a specific security function that can be enabled or disabled on a Software Container. A Software Container is a platform that runs one or more Software Blades. Security Management is a container that manages the security policy and configuration of Security Gateways. Security Gateway is a container that enforces the security policy on network traffic. Endpoint Security is a container that protects endpoints from threats and data loss.
Reference: Check Point Licensing and Contract Operations User Guide
Question #83
What is the order of NAT priorities?
- A . IP pool NAT static NAT. hide NAT
- B . Static NAT hide NAT, IP pool NAT
- C . Static NAT, IP pool NAT hide NAT
- D . Static NAT automatic NAT hide NAT
Correct Answer: C
C
Explanation:
The order of NAT priorities is Static NAT, IP pool NAT, and hide NAT. Static NAT has the highest priority because it is a one-to-one mapping of a private IP address to a public IP address. IP pool NAT has the second highest priority because it is a one-to-many mapping of a private IP address to a pool of public IP addresses. Hide NAT has the lowest priority because it is a many-to-one mapping of multiple private IP addresses to a single public IP address1.
Reference: 1: Check Point R81 Security Gateway Administration Guide, page 23.
C
Explanation:
The order of NAT priorities is Static NAT, IP pool NAT, and hide NAT. Static NAT has the highest priority because it is a one-to-one mapping of a private IP address to a public IP address. IP pool NAT has the second highest priority because it is a one-to-many mapping of a private IP address to a pool of public IP addresses. Hide NAT has the lowest priority because it is a many-to-one mapping of multiple private IP addresses to a single public IP address1.
Reference: 1: Check Point R81 Security Gateway Administration Guide, page 23.
Question #84
Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?
- A . All Connections (Clear or Encrypted)
- B . Accept all encrypted traffic
- C . Specific VPN Communities
- D . All Site-to-Site VPN Communities
Correct Answer: C
C
Explanation:
The option that allows traffic to VPN gateways in specific VPN communities is Specific VPN Communities4. This option enables you to define which VPN communities are allowed in the rule. All Connections (Clear or Encrypted) allows traffic to any destination, regardless of whether it is encrypted or not. Accept all encrypted traffic allows traffic to any encrypted destination, regardless of the VPN community. All Site-to-Site VPN Communities allows traffic to any site-to-site VPN gateway, regardless of the VPN community4. Therefore, the correct answer is C. Specific VPN Communities.
C
Explanation:
The option that allows traffic to VPN gateways in specific VPN communities is Specific VPN Communities4. This option enables you to define which VPN communities are allowed in the rule. All Connections (Clear or Encrypted) allows traffic to any destination, regardless of whether it is encrypted or not. Accept all encrypted traffic allows traffic to any encrypted destination, regardless of the VPN community. All Site-to-Site VPN Communities allows traffic to any site-to-site VPN gateway, regardless of the VPN community4. Therefore, the correct answer is C. Specific VPN Communities.
Question #85
Which is a main component of the Check Point security management architecture?
- A . Identity Collector
- B . Endpoint VPN client
- C . SmartConsole
- D . Proxy Server
Correct Answer: C
C
Explanation:
A main component of the Check Point security management architecture is SmartConsole2. SmartConsole is a unified graphical user interface that allows administrators to manage multiple security functions such as firewall, VPN, IPS, application control, URL filtering, identity awareness, and more. SmartConsole connects to the Security Management Server and interacts with other Check Point components such as Security Gateways and Endpoint Security Servers.
Reference: Check Point R81 Security Management Administration Guide
C
Explanation:
A main component of the Check Point security management architecture is SmartConsole2. SmartConsole is a unified graphical user interface that allows administrators to manage multiple security functions such as firewall, VPN, IPS, application control, URL filtering, identity awareness, and more. SmartConsole connects to the Security Management Server and interacts with other Check Point components such as Security Gateways and Endpoint Security Servers.
Reference: Check Point R81 Security Management Administration Guide
Question #86
The competition between stateful inspection and proxies was based on performance, protocol support, and security. Considering stateful Inspections and Proxies, which statement is correct?
- A . Stateful Inspection is limited to Layer 3 visibility, with no Layer 4 to Layer 7 visibility capabilities.
- B . When it comes to performance, proxies were significantly faster than stateful inspection firewalls.
- C . Proxies offer far more security because of being able to give visibility of the payload (the data).
- D . When it comes to performance, stateful inspection was significantly faster than proxies.
Correct Answer: D
D
Explanation:
Stateful Inspection and Proxies are two different technologies for implementing firewall security. Stateful Inspection is a technique that inspects packets at the network layer and maintains a state table that tracks the status of each connection. Proxies are applications that act as intermediaries between clients and servers, and inspect packets at the application layer. The competition between stateful inspection and proxies was based on performance, protocol support, and security. When it comes to performance, stateful inspection was significantly faster than proxies, because it did not have to process the payload of each packet and could handle more concurrent connections1.
Reference: Check Point R81 Security Gateway Technical Administration Guide
D
Explanation:
Stateful Inspection and Proxies are two different technologies for implementing firewall security. Stateful Inspection is a technique that inspects packets at the network layer and maintains a state table that tracks the status of each connection. Proxies are applications that act as intermediaries between clients and servers, and inspect packets at the application layer. The competition between stateful inspection and proxies was based on performance, protocol support, and security. When it comes to performance, stateful inspection was significantly faster than proxies, because it did not have to process the payload of each packet and could handle more concurrent connections1.
Reference: Check Point R81 Security Gateway Technical Administration Guide
Question #87
Which path below is available only when CoreXL is enabled?
- A . Slow path
- B . Firewall path
- C . Medium path
- D . Accelerated path
Correct Answer: C
C
Explanation:
The path that is available only when CoreXL is enabled is the medium path. The medium path is used to handle packets that require deeper inspection by the Firewall and IPS blades, but do not need to go through the slow path. The slow path is used to handle packets that require stateful or out-of-state inspection by other blades, such as Application Control or VPN. The firewall path and the accelerated path are available regardless of CoreXL status.
Reference: [CoreXL R81 Administration Guide], [Check Point CCSA – R81: Practice Test & Explanation], [Check Point Security Gateway Architecture and Packet Flow], [Free Check Point CCSA Sample Questions and Study Guide]
C
Explanation:
The path that is available only when CoreXL is enabled is the medium path. The medium path is used to handle packets that require deeper inspection by the Firewall and IPS blades, but do not need to go through the slow path. The slow path is used to handle packets that require stateful or out-of-state inspection by other blades, such as Application Control or VPN. The firewall path and the accelerated path are available regardless of CoreXL status.
Reference: [CoreXL R81 Administration Guide], [Check Point CCSA – R81: Practice Test & Explanation], [Check Point Security Gateway Architecture and Packet Flow], [Free Check Point CCSA Sample Questions and Study Guide]
Question #88
Fill in the blank: SmartConsole, SmartEvent GUI client, and ___________ allow viewing of billions of consolidated logs and shows them as prioritized security events.
- A . SmartView Web Application
- B . SmartTracker
- C . SmartMonitor
- D . SmartReporter
Correct Answer: A
A
Explanation:
SmartConsole, SmartEvent GUI client, and SmartView Web Application allow viewing of billions of consolidated logs and shows them as prioritized security events1. SmartView Web Application is a web-based interface that provides access to SmartEvent reports and dashboards2.
Reference: Check Point R81 Security Management Administration Guide, Check Point R81 SmartEvent Administration Guide
A
Explanation:
SmartConsole, SmartEvent GUI client, and SmartView Web Application allow viewing of billions of consolidated logs and shows them as prioritized security events1. SmartView Web Application is a web-based interface that provides access to SmartEvent reports and dashboards2.
Reference: Check Point R81 Security Management Administration Guide, Check Point R81 SmartEvent Administration Guide
Question #89
Which of the following is true about Stateful Inspection?
- A . Stateful Inspection tracks state using two tables, one for incoming traffic and one for outgoing traffic
- B . Stateful Inspection looks at both the headers of packets, as well as deeply examining their content.
- C . Stateful Inspection requires that a server reply to a request, in order to track a connection’s state
- D . Stateful Inspection requires two rules, one for outgoing traffic and one for incoming traffic.
Correct Answer: B
B
Explanation:
Stateful Inspection is true about looking at both the headers of packets, as well as deeply examining their content. Stateful Inspection inspects packets at all layers of the OSI model and maintains information about the state and context of each connection in a state table.
Reference: Certified Security Administrator (CCSA) R81.20 Course Overview, page 6.
B
Explanation:
Stateful Inspection is true about looking at both the headers of packets, as well as deeply examining their content. Stateful Inspection inspects packets at all layers of the OSI model and maintains information about the state and context of each connection in a state table.
Reference: Certified Security Administrator (CCSA) R81.20 Course Overview, page 6.
Question #90
Which deployment adds a Security Gateway to an existing environment without changing IP routing?
- A . Distributed
- B . Bridge Mode
- C . Remote
- D . Standalone
Correct Answer: B
B
Explanation:
The answer is B because bridge mode deployment adds a Security Gateway to an existing environment without changing IP routing. Bridge mode is a transparent mode that does not require assigning IP addresses to the Security Gateway interfaces. Distributed deployment is a deployment where the Security Management Server and the Security Gateway are installed on separate machines. Remote deployment is a deployment where the Security Gateway is installed on a remote site and connects to the Security Management Server over a VPN tunnel. Standalone deployment is a deployment where the Security Management Server and the Security Gateway are installed on the same machine.
Reference: [Check Point R81 Bridge Mode], [Check Point R81 Deployment Scenarios]
B
Explanation:
The answer is B because bridge mode deployment adds a Security Gateway to an existing environment without changing IP routing. Bridge mode is a transparent mode that does not require assigning IP addresses to the Security Gateway interfaces. Distributed deployment is a deployment where the Security Management Server and the Security Gateway are installed on separate machines. Remote deployment is a deployment where the Security Gateway is installed on a remote site and connects to the Security Management Server over a VPN tunnel. Standalone deployment is a deployment where the Security Management Server and the Security Gateway are installed on the same machine.
Reference: [Check Point R81 Bridge Mode], [Check Point R81 Deployment Scenarios]