Check Point 156-315.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #1
The log server sends what to the Correlation Unit?
- A . Authentication requests
- B . CPMI dbsync
- C . Logs
- D . Event Policy
Correct Answer: C
C
Explanation:
The log server sends logs to the Correlation Unit. The Correlation Unit analyzes the logs and generates events based on the event policy. The events are then sent to the SmartEvent Server, which displays them in the SmartEvent GUI.
Reference: [SmartEvent Administration Guide]
C
Explanation:
The log server sends logs to the Correlation Unit. The Correlation Unit analyzes the logs and generates events based on the event policy. The events are then sent to the SmartEvent Server, which displays them in the SmartEvent GUI.
Reference: [SmartEvent Administration Guide]
Question #2
When setting up an externally managed log server, what is one item that will not be configured on the R81 Security Management Server?
- A . IP
- B . SIC
- C . NAT
- D . FQDN
Correct Answer: C
C
Explanation:
NAT (Network Address Translation) is one item that will not be configured on the R81 Security Management Server when setting up an externally managed log server. NAT is a technique that allows devices with private IP addresses to communicate with devices with public IP addresses by translating the private addresses to public ones. NAT is not relevant for configuring an externally managed log server, which requires only the IP address, SIC (Secure Internal Communication), and FQDN (Fully Qualified Domain Name) of the log server.
Reference: Check Point Security Expert R81 Course, Logging and Monitoring Administration Guide
C
Explanation:
NAT (Network Address Translation) is one item that will not be configured on the R81 Security Management Server when setting up an externally managed log server. NAT is a technique that allows devices with private IP addresses to communicate with devices with public IP addresses by translating the private addresses to public ones. NAT is not relevant for configuring an externally managed log server, which requires only the IP address, SIC (Secure Internal Communication), and FQDN (Fully Qualified Domain Name) of the log server.
Reference: Check Point Security Expert R81 Course, Logging and Monitoring Administration Guide
Question #3
Fill in the blank: An identity server uses a __________ for user authentication.
- A . Shared secret
- B . Certificate
- C . One-time password
- D . Token
Correct Answer: D
D
Explanation:
An identity server uses a token for user authentication. A token is a piece of data that contains information about the user’s identity, such as their username, email, roles, and claims. A token is digitally signed by the identity server and can be verified by the relying party (the application or service that needs to authenticate the user). A token can be issued in different formats, such as JSON Web Token (JWT) or Security Assertion Markup Language (SAML). A token can also have different lifetimes, such as short-lived access tokens or long-lived refresh tokens.
D
Explanation:
An identity server uses a token for user authentication. A token is a piece of data that contains information about the user’s identity, such as their username, email, roles, and claims. A token is digitally signed by the identity server and can be verified by the relying party (the application or service that needs to authenticate the user). A token can be issued in different formats, such as JSON Web Token (JWT) or Security Assertion Markup Language (SAML). A token can also have different lifetimes, such as short-lived access tokens or long-lived refresh tokens.
Question #4
Which one is not a valid Package Option In the Web GUI for CPUSE?
- A . Clean Install
- B . Export Package
- C . Upgrade
- D . Database Conversion to R81.20 only
Correct Answer: B
B
Explanation:
CPUSE (Check Point Upgrade Service Engine) is a tool that allows users to download, import, install, and uninstall software packages on Gaia OS. CPUSE has a web-based user interface that can be accessed through Gaia Portal. CPUSE offers four package options in the web GUI for different purposes4:
Clean Install – This option performs a clean installation of a Major Version package, which erases all existing configuration and data on the system.
Export Package – This option exports a package from CPUSE repository to an external location for backup or transfer purposes.
Upgrade – This option performs an upgrade of a Major Version package or a Minor Version package, which preserves the existing configuration and data on the system.
Database Conversion – This option converts the database schema of a Major Version package to match the current version.
Therefore, the correct answer is B)
Reference: 4: CPUSE – Gaia Deployment Agent
B
Explanation:
CPUSE (Check Point Upgrade Service Engine) is a tool that allows users to download, import, install, and uninstall software packages on Gaia OS. CPUSE has a web-based user interface that can be accessed through Gaia Portal. CPUSE offers four package options in the web GUI for different purposes4:
Clean Install – This option performs a clean installation of a Major Version package, which erases all existing configuration and data on the system.
Export Package – This option exports a package from CPUSE repository to an external location for backup or transfer purposes.
Upgrade – This option performs an upgrade of a Major Version package or a Minor Version package, which preserves the existing configuration and data on the system.
Database Conversion – This option converts the database schema of a Major Version package to match the current version.
Therefore, the correct answer is B)
Reference: 4: CPUSE – Gaia Deployment Agent
Question #5
Vanessa is a Firewall administrator. She wants to test a backup of her company’s production Firewall cluster Dallas_GW. She has a lab environment that is identical to her production environment. She decided to restore production backup via SmartConsole in lab environment.
Which details she need to fill in System Restore window before she can click OK button and test the backup?
- A . Server, SCP, Username, Password, Path, Comment, Member
- B . Server, TFTP, Username, Password, Path, Comment, All Members
- C . Server, Protocol, Username, Password, Path, Comment, All Members
- D . Server, Protocol, username Password, Path, Comment, Member
Correct Answer: C
C
Explanation:
According to the Check Point website, Vanessa needs to fill in the following details in the System Restore window before she can click OK button and test the backup: Server, Protocol, Username, Password, Path, Comment, All Members. These details specify the source and destination of the backup file, as well as the scope of the restore operation. The other options are either missing or incorrect details.
Reference: System Restore
C
Explanation:
According to the Check Point website, Vanessa needs to fill in the following details in the System Restore window before she can click OK button and test the backup: Server, Protocol, Username, Password, Path, Comment, All Members. These details specify the source and destination of the backup file, as well as the scope of the restore operation. The other options are either missing or incorrect details.
Reference: System Restore
Question #6
Which of the following is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers?
- A . UserCheck
- B . Active Directory Query
- C . Account Unit Query
- D . User Directory Query
Correct Answer: B
B
Explanation:
Active Directory Query is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers by querying domain controllers for security event logs. The Security Gateway sends a WMI query to each domain controller and receives a WMI event when a user logs in, logs out, or unlocks their computer. The Security Gateway then maps IP addresses to user names based on these events. Active Directory Query does not require any software installation on domain controllers or clients, but it requires certain permissions and configurations on the domain controllers
Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_IdentityAwareness_AdminGuide/62402.htm
B
Explanation:
Active Directory Query is an identity acquisition method that allows a Security Gateway to identify Active Directory users and computers by querying domain controllers for security event logs. The Security Gateway sends a WMI query to each domain controller and receives a WMI event when a user logs in, logs out, or unlocks their computer. The Security Gateway then maps IP addresses to user names based on these events. Active Directory Query does not require any software installation on domain controllers or clients, but it requires certain permissions and configurations on the domain controllers
Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_IdentityAwareness_AdminGuide/62402.htm
Question #7
Which CLI command will reset the IPS pattern matcher statistics?
- A . ips reset pmstat
- B . ips pstats reset
- C . ips pmstats refresh
- D . ips pmstats reset
Correct Answer: D
D
Explanation:
The CLI command to reset the IPS (Intrusion Prevention System) pattern matcher statistics is option
D: ips pmstats reset. This command will reset the statistics related to the IPS pattern matcher. Options A, B, and C are not the correct syntax for resetting the IPS pattern matcher statistics.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
D
Explanation:
The CLI command to reset the IPS (Intrusion Prevention System) pattern matcher statistics is option
D: ips pmstats reset. This command will reset the statistics related to the IPS pattern matcher. Options A, B, and C are not the correct syntax for resetting the IPS pattern matcher statistics.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #8
You have a Gateway is running with 2 cores. You plan to add a second gateway to build a cluster and used a device with 4 cores.
How many cores can be used in a Cluster for Firewall-kernel on the new device?
- A . 3
- B . 2
- C . 1
- D . 4
Correct Answer: D
D
Explanation:
The number of cores that can be used in a Cluster for Firewall-kernel on the new device with 4 cores is 4. Cluster is a feature that allows two or more Security Gateways to provide high availability and load balancing for network traffic. Firewall-kernel is a component of the Security Gateway that performs packet inspection according to security policies. The number of cores that can be used for Firewall-kernel in a Cluster depends on the number of cores available on each device in the Cluster. The Cluster will use the lowest common denominator of cores among all devices in the Cluster for Firewall-kernel. Therefore, if one device has 2 cores and another device has 4 cores, the Cluster will use 2 cores for Firewall-kernel on each device. However, if both devices have 4 cores, the Cluster will use 4 cores for Firewall-kernel on each device.
D
Explanation:
The number of cores that can be used in a Cluster for Firewall-kernel on the new device with 4 cores is 4. Cluster is a feature that allows two or more Security Gateways to provide high availability and load balancing for network traffic. Firewall-kernel is a component of the Security Gateway that performs packet inspection according to security policies. The number of cores that can be used for Firewall-kernel in a Cluster depends on the number of cores available on each device in the Cluster. The Cluster will use the lowest common denominator of cores among all devices in the Cluster for Firewall-kernel. Therefore, if one device has 2 cores and another device has 4 cores, the Cluster will use 2 cores for Firewall-kernel on each device. However, if both devices have 4 cores, the Cluster will use 4 cores for Firewall-kernel on each device.
Question #9
The customer has about 150 remote access user with a Windows laptops. Not more than 50 Clients will be connected at the same time. The customer want to use multiple VPN Gateways as entry point and a personal firewall.
What will be the best license for him?
- A . He will need Capsule Connect using MEP (multiple entry points).
- B . Because the customer uses only Windows clients SecuRemote will be sufficient and no additional license is needed
- C . He will need Harmony Endpoint because of the personal firewall.
- D . Mobile Access license because he needs only a 50 user license, license count is per concurrent user.
Correct Answer: C
C
Explanation:
Harmony Endpoint is a solution that provides comprehensive protection for endpoint devices against cyber threats. Harmony Endpoint includes a personal firewall that controls the network traffic to and from the endpoint device, based on predefined rules and policies. Harmony Endpoint also integrates with Check Point’s VPN solutions to provide secure remote access to corporate resources1. Therefore, the customer will need Harmony Endpoint because of the personal firewall requirement.
Reference: 1: Harmony Endpoint Administration Guide
C
Explanation:
Harmony Endpoint is a solution that provides comprehensive protection for endpoint devices against cyber threats. Harmony Endpoint includes a personal firewall that controls the network traffic to and from the endpoint device, based on predefined rules and policies. Harmony Endpoint also integrates with Check Point’s VPN solutions to provide secure remote access to corporate resources1. Therefore, the customer will need Harmony Endpoint because of the personal firewall requirement.
Reference: 1: Harmony Endpoint Administration Guide
Question #10
Which command lists firewall chain?
- A . fwctl chain
- B . fw list chain
- C . fw chain module
- D . fw tab -t chainmod
Correct Answer: A
A
Explanation:
The command that lists firewall chain is fw ctl chain1. This command displays the list of chain modules that are registered on the Security Gateway2. Chain modules are components of the Firewall kernel that inspect and process packets according to the security policy and other features3. The order of the chain modules determines the order of the packet inspection and processing3. The fw ctl chain command can help you troubleshoot connectivity or performance issues, or to verify that a feature is enabled or disabled on the Security Gateway2. To run this command, you need to access the Security Gateway in expert mode and run fw ctl chain1.
Reference: How to use fw ctl chain – Check Point Software, fw ctl chain – Check Point Software, R81.x Security Gateway Architecture (Logical Packet Flow) – Check Point CheckMates
A
Explanation:
The command that lists firewall chain is fw ctl chain1. This command displays the list of chain modules that are registered on the Security Gateway2. Chain modules are components of the Firewall kernel that inspect and process packets according to the security policy and other features3. The order of the chain modules determines the order of the packet inspection and processing3. The fw ctl chain command can help you troubleshoot connectivity or performance issues, or to verify that a feature is enabled or disabled on the Security Gateway2. To run this command, you need to access the Security Gateway in expert mode and run fw ctl chain1.
Reference: How to use fw ctl chain – Check Point Software, fw ctl chain – Check Point Software, R81.x Security Gateway Architecture (Logical Packet Flow) – Check Point CheckMates