Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #90
What is true about VRRP implementations?
- A . VRRP membership is enabled in cpconfig
- B . VRRP can be used together with ClusterXL, but with degraded performance
- C . You cannot have a standalone deployment
- D . You cannot have different VRIDs in the same physical network
Correct Answer: C
Question #92
DLP and Geo Policy are examples of what type of Policy?
- A . Standard Policies
- B . Shared Policies
- C . Inspection Policies
- D . Unified Policies
Correct Answer: B
B
Explanation:
DLP and Geo Policy are examples of Shared Policies. Shared Policies are policies that can be applied to multiple gateways or clusters, regardless of their Access Control policy. Shared Policies allow administrators to manage common security settings across different gateways or clusters, such as Data Loss Prevention, Geo Protection, Threat Prevention, HTTPS Inspection, etc.
Reference: R81 Security Management Administration Guide, page 31.
B
Explanation:
DLP and Geo Policy are examples of Shared Policies. Shared Policies are policies that can be applied to multiple gateways or clusters, regardless of their Access Control policy. Shared Policies allow administrators to manage common security settings across different gateways or clusters, such as Data Loss Prevention, Geo Protection, Threat Prevention, HTTPS Inspection, etc.
Reference: R81 Security Management Administration Guide, page 31.
Question #93
John detected high load on sync interface.
Which is most recommended solution?
- A . For short connections like http service C delay sync for 2 seconds
- B . Add a second interface to handle sync traffic
- C . For short connections like http service C do not sync
- D . For short connections like icmp service C delay sync for 2 seconds
Correct Answer: A
A
Explanation:
When John detects a high load on the sync interface, the recommended solution is to implement a delay in the sync process for short-lived connections like HTTP.
Here’s an explanation of each option:
A) Delaying the sync for 2 seconds for short connections like HTTP services is a common practice to reduce the load on the sync interface. This allows the interface to handle the incoming connections more effectively.
B) Adding a second interface to handle sync traffic might be a viable solution, but it can be more complex and costly compared to implementing a delay for short connections.
C) Not syncing short connections like HTTP services is not a recommended approach because it may lead to synchronization issues and potential data inconsistencies between cluster members.
D) Delaying the sync for ICMP (ping) services is not a common practice and may not effectively address the high load issue on the sync interface.
Therefore, option A is the most recommended solution as it addresses the issue by introducing a delay for short-lived connections, optimizing the sync process without causing synchronization problems.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
A
Explanation:
When John detects a high load on the sync interface, the recommended solution is to implement a delay in the sync process for short-lived connections like HTTP.
Here’s an explanation of each option:
A) Delaying the sync for 2 seconds for short connections like HTTP services is a common practice to reduce the load on the sync interface. This allows the interface to handle the incoming connections more effectively.
B) Adding a second interface to handle sync traffic might be a viable solution, but it can be more complex and costly compared to implementing a delay for short connections.
C) Not syncing short connections like HTTP services is not a recommended approach because it may lead to synchronization issues and potential data inconsistencies between cluster members.
D) Delaying the sync for ICMP (ping) services is not a common practice and may not effectively address the high load issue on the sync interface.
Therefore, option A is the most recommended solution as it addresses the issue by introducing a delay for short-lived connections, optimizing the sync process without causing synchronization problems.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #94
What is the main objective when using Application Control?
- A . To filter out specific content.
- B . To assist the firewall blade with handling traffic.
- C . To see what users are doing.
- D . Ensure security and privacy of information.
Correct Answer: D
D
Explanation:
The main objective when using Application Control is to ensure security and privacy of information. Application Control is a blade that enables administrators to control access to web applications and web sites based on categories, users, groups, machines, and time. Application Control can also block or limit usage of applications that pose security risks or consume excessive bandwidth2.
Reference: Check Point R81 Application Control Administration Guide
D
Explanation:
The main objective when using Application Control is to ensure security and privacy of information. Application Control is a blade that enables administrators to control access to web applications and web sites based on categories, users, groups, machines, and time. Application Control can also block or limit usage of applications that pose security risks or consume excessive bandwidth2.
Reference: Check Point R81 Application Control Administration Guide
Question #95
What could NOT be a reason for synchronization issues in a Management HA environment?
- A . Accidentally, you have configured unique IP addresses per Management Server which invalidates the CA Certificate
- B . There is a network connectivity failure between the servers
- C . Servers are in Collision Mode. Two servers, both in active state cannot be synchronized either automatically or manually.
- D . The products installed on the servers do not match: one device is a Standalone Server while the other is only a Security Management server
Correct Answer: D
D
Explanation:
The statement that could not be a reason for synchronization issues in a Management HA environment is that the products installed on the servers do not match: one device is a Standalone Server while the other is only a Security Management server. This is not a valid reason because Management HA requires that both servers have the same products installed, either both as Standalone Servers or both as Security Management servers. The other statements are possible reasons for synchronization issues in a Management HA environment.
Reference: [Check Point Security Expert R81 High Availability Administration Guide], page 11.
D
Explanation:
The statement that could not be a reason for synchronization issues in a Management HA environment is that the products installed on the servers do not match: one device is a Standalone Server while the other is only a Security Management server. This is not a valid reason because Management HA requires that both servers have the same products installed, either both as Standalone Servers or both as Security Management servers. The other statements are possible reasons for synchronization issues in a Management HA environment.
Reference: [Check Point Security Expert R81 High Availability Administration Guide], page 11.
Question #96
What is Dynamic Balancing?
- A . It is a ClusterXL feature that switches an HA cluster into an LS cluster if required to maximize throughput
- B . It is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load
- C . It is a new feature that is capable of dynamically reserve the amount of Hash kernel memory to reflect the resource usage necessary for maximizing the session rate.
- D . It is a CoreXL feature that assigns the SND to network interfaces to balance the RX Cache of the interfaces
Correct Answer: B
B
Explanation:
Dynamic Balancing is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load. It dynamically changes the split between CoreXL SNDs and CoreXL Firewalls and does not require a reboot or cause an outage. It monitors the system and makes changes as needed to optimize the performance of the Security Gateway. It is supported on Check Point Appliances with R80.40 and higher versions.
Reference: Dynamic Balancing for CoreXL – Check Point Software, Dynamic Balancing available on R80.40 – Check Point CheckMates, CLI R81.20 Reference Guide – Check Point Software, Performance Tuning R81.20 Administration Guide – Check Point Software
B
Explanation:
Dynamic Balancing is a feature that uses a daemon to balance the required number of firewall instances and SNDs based on the current load. It dynamically changes the split between CoreXL SNDs and CoreXL Firewalls and does not require a reboot or cause an outage. It monitors the system and makes changes as needed to optimize the performance of the Security Gateway. It is supported on Check Point Appliances with R80.40 and higher versions.
Reference: Dynamic Balancing for CoreXL – Check Point Software, Dynamic Balancing available on R80.40 – Check Point CheckMates, CLI R81.20 Reference Guide – Check Point Software, Performance Tuning R81.20 Administration Guide – Check Point Software
Question #97
Which encryption algorithm is the least secured?
- A . AES-128
- B . AES-256
- C . DES
- D . 3DES
Correct Answer: C
C
Explanation:
DES (Data Encryption Standard) is a symmetric block cipher that uses a 56-bit key to encrypt and decrypt 64-bit blocks of data. It was developed by IBM in 1975 and adopted by the US government as a standard for encryption. However, DES has been proven to be insecure and vulnerable to various attacks, such as brute force, differential cryptanalysis, and linear cryptanalysis. A brute force attack can break DES in a matter of hours using modern hardware. Differential cryptanalysis can reduce the number of keys to be searched by a factor of four, and linear cryptanalysis can reduce it by a factor of two. Therefore, DES is the least secure encryption algorithm among the options given.
Reference: Types of Encryption, Secure Organization’s Data With These Encryption Algorithms, Comparative study of symmetric cryptographic algorithms
C
Explanation:
DES (Data Encryption Standard) is a symmetric block cipher that uses a 56-bit key to encrypt and decrypt 64-bit blocks of data. It was developed by IBM in 1975 and adopted by the US government as a standard for encryption. However, DES has been proven to be insecure and vulnerable to various attacks, such as brute force, differential cryptanalysis, and linear cryptanalysis. A brute force attack can break DES in a matter of hours using modern hardware. Differential cryptanalysis can reduce the number of keys to be searched by a factor of four, and linear cryptanalysis can reduce it by a factor of two. Therefore, DES is the least secure encryption algorithm among the options given.
Reference: Types of Encryption, Secure Organization’s Data With These Encryption Algorithms, Comparative study of symmetric cryptographic algorithms
Question #98
Which one of the following is true about Threat Extraction?
- A . Always delivers a file to user
- B . Works on all MS Office, Executables, and PDF files
- C . Can take up to 3 minutes to complete
- D . Delivers file only if no threats found
Correct Answer: A
A
Explanation:
Threat Extraction is a software blade that always delivers a file to user. Threat Extraction removes or sanitizes the active content from the files and converts them to PDF format, which is safer and more compatible. Threat Extraction can also work together with Threat Emulation to provide both clean and original files to the users. Threat Extraction works on MS Office, PDF, and archive files, but not on executables. Threat Extraction can take up to 3 minutes to complete, depending on the file size and complexity.
Reference: Check Point Security Expert R81 Course, Threat Extraction Administration Guide
A
Explanation:
Threat Extraction is a software blade that always delivers a file to user. Threat Extraction removes or sanitizes the active content from the files and converts them to PDF format, which is safer and more compatible. Threat Extraction can also work together with Threat Emulation to provide both clean and original files to the users. Threat Extraction works on MS Office, PDF, and archive files, but not on executables. Threat Extraction can take up to 3 minutes to complete, depending on the file size and complexity.
Reference: Check Point Security Expert R81 Course, Threat Extraction Administration Guide
Question #99
You want to verify if your management server is ready to upgrade to R81.20.
What tool could you use in this process?
- A . migrate export
- B . upgrade_tools verify
- C . pre_upgrade_verifier
- D . migrate import
Correct Answer: C
C
Explanation:
According to the Check Point website, you can use the pre_upgrade_verifier tool to verify if your management server is ready to upgrade to R81.20. This tool checks the compatibility of your current configuration and database with the target version, and provides a detailed report of any issues or warnings. The other tools are either used for exporting or importing databases, or not valid tools.
Reference: Upgrade Verification Service
C
Explanation:
According to the Check Point website, you can use the pre_upgrade_verifier tool to verify if your management server is ready to upgrade to R81.20. This tool checks the compatibility of your current configuration and database with the target version, and provides a detailed report of any issues or warnings. The other tools are either used for exporting or importing databases, or not valid tools.
Reference: Upgrade Verification Service
Question #100
If an administrator wants to add manual NAT for addresses now owned by the Check Point firewall, what else is necessary to be completed for it to function properly?
- A . Nothing – the proxy ARP is automatically handled in the R81 version
- B . Add the proxy ARP configurations in a file called /etc/conf/local.arp
- C . Add the proxy ARP configurations in a file called $FWDIR/conf/local.arp
- D . Add the proxy ARP configurations in a file called $CPDIR/conf/local.arp
Correct Answer: C
C
Explanation:
If an administrator wants to add manual NAT for addresses not owned by the Check Point firewall, they also need to add the proxy ARP configurations in a file called $FWDIR/conf/local.arp. This file contains the mappings between the IP addresses and the MAC addresses of the NATed hosts. The proxy ARP feature allows the firewall to answer ARP requests on behalf of the NATed hosts and forward the traffic to them. The local.arp file needs to be edited manually and reloaded with the command arp -f $FWDIR/conf/local.arp.
Reference: R81 Security Management Administration Guide, page 1014.
C
Explanation:
If an administrator wants to add manual NAT for addresses not owned by the Check Point firewall, they also need to add the proxy ARP configurations in a file called $FWDIR/conf/local.arp. This file contains the mappings between the IP addresses and the MAC addresses of the NATed hosts. The proxy ARP feature allows the firewall to answer ARP requests on behalf of the NATed hosts and forward the traffic to them. The local.arp file needs to be edited manually and reloaded with the command arp -f $FWDIR/conf/local.arp.
Reference: R81 Security Management Administration Guide, page 1014.