Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #101
Which of the following is NOT a valid type of SecureXL template?
- A . Accept Template
- B . Deny template
- C . Drop Template
- D . NAT Template
Correct Answer: B
B
Explanation:
The type of SecureXL template that is not valid among the options is Deny template. SecureXL templates are pre-allocated data structures that store information about connections that match certain criteria. They are used to accelerate the processing of packets that belong to those connections. The valid types of SecureXL templates are Accept, Drop, NAT, and Crypt. The Accept template is used for connections that are allowed by the Firewall policy. The Drop template is used for connections that are blocked by the Firewall policy. The NAT template is used for connections that require Network Address Translation. The Crypt template is used for connections that require encryption or decryption.
Reference: [SecureXL Templates]
B
Explanation:
The type of SecureXL template that is not valid among the options is Deny template. SecureXL templates are pre-allocated data structures that store information about connections that match certain criteria. They are used to accelerate the processing of packets that belong to those connections. The valid types of SecureXL templates are Accept, Drop, NAT, and Crypt. The Accept template is used for connections that are allowed by the Firewall policy. The Drop template is used for connections that are blocked by the Firewall policy. The NAT template is used for connections that require Network Address Translation. The Crypt template is used for connections that require encryption or decryption.
Reference: [SecureXL Templates]
Question #102
In which VPN community is a satellite VPN gateway not allowed to create a VPN tunnel with another satellite VPN gateway?
- A . Pentagon
- B . Combined
- C . Meshed
- D . Star
Correct Answer: D
D
Explanation:
A star VPN community is a type of VPN community that allows a central gateway to create VPN tunnels with multiple satellite gateways or hosts, but does not allow satellite gateways or hosts to create VPN tunnels with each other. This type of community is suitable for hub-and-spoke topologies, where the central gateway acts as the hub and the satellite gateways or hosts act as the spokes. The central gateway can initiate or terminate VPN traffic to any satellite member, but the satellite members can only initiate or terminate VPN traffic to the central gateway.
D
Explanation:
A star VPN community is a type of VPN community that allows a central gateway to create VPN tunnels with multiple satellite gateways or hosts, but does not allow satellite gateways or hosts to create VPN tunnels with each other. This type of community is suitable for hub-and-spoke topologies, where the central gateway acts as the hub and the satellite gateways or hosts act as the spokes. The central gateway can initiate or terminate VPN traffic to any satellite member, but the satellite members can only initiate or terminate VPN traffic to the central gateway.
Question #103
What command is used to manually failover a Multi-Version Cluster during the upgrade?
- A . clusterXL_admin down in Expert Mode
- B . clusterXL_admin down in Clish
- C . set cluster member state down in Clish
- D . set cluster down in Expert Mode
Correct Answer: B
B
Explanation:
The command used to manually failover a Multi-Version Cluster during the upgrade is clusterXL_admin down in Clish. This command causes the cluster member to stop passing traffic and switch to the Down state. This triggers a failover to another cluster member that is in the Active or Ready state. This command can be used during a Multi-Version Cluster upgrade to manually control which cluster member handles the traffic. The other options are not valid commands for manually failing over a Multi-Version Cluster.
Reference: Check Point Software, Getting Started, Manually Failing Over a Cluster Member.
B
Explanation:
The command used to manually failover a Multi-Version Cluster during the upgrade is clusterXL_admin down in Clish. This command causes the cluster member to stop passing traffic and switch to the Down state. This triggers a failover to another cluster member that is in the Active or Ready state. This command can be used during a Multi-Version Cluster upgrade to manually control which cluster member handles the traffic. The other options are not valid commands for manually failing over a Multi-Version Cluster.
Reference: Check Point Software, Getting Started, Manually Failing Over a Cluster Member.
Question #104
Which command gives us a perspective of the number of kernel tables?
- A . fw tab -t
- B . fw tab -s
- C . fw tab -n
- D . fw tab -k
Correct Answer: B
B
Explanation:
The command "fw tab -s" is used to display information about the state of various kernel tables in a Check Point firewall. It provides a perspective on the number and status of these tables, which can be helpful for troubleshooting and monitoring firewall performance.
Option B correctly identifies the command that gives a perspective of the number of kernel tables, making it the verified answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
B
Explanation:
The command "fw tab -s" is used to display information about the state of various kernel tables in a Check Point firewall. It provides a perspective on the number and status of these tables, which can be helpful for troubleshooting and monitoring firewall performance.
Option B correctly identifies the command that gives a perspective of the number of kernel tables, making it the verified answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #105
After finishing installation admin John likes to use top command in expert mode. John has to set the expert-password and was able to use top command. A week later John has to use the top command again, He detected that the expert password is no longer valid.
What is the most probable reason for this behavior?
- A . “write memory” was not issued on clish
- B . changes are only possible via SmartConsole
- C . “save config” was not issued in expert mode
- D . “save config” was not issued on clish
Correct Answer: D
D
Explanation:
The most probable reason for the expert password to be no longer valid after a week is that save config was not issued on clish. The clish command set expert-password sets the expert password for the current session only. To make the password persistent, the clish command save config must be issued after setting the expert password2. The other options are not relevant for setting the expert password.
Reference: 2: Check Point Software, Getting Started, Setting Expert Password.
D
Explanation:
The most probable reason for the expert password to be no longer valid after a week is that save config was not issued on clish. The clish command set expert-password sets the expert password for the current session only. To make the password persistent, the clish command save config must be issued after setting the expert password2. The other options are not relevant for setting the expert password.
Reference: 2: Check Point Software, Getting Started, Setting Expert Password.
Question #106
There are multiple types of licenses for the various VPN components and types. License type related to management and functioning of Remote Access VPNs are – which of the following license requirement statement is NOT true:
- A . MobileAccessLicense ° This license is required on the Security Gateway for the following Remote Access solutions
- B . EndpointPolicyManagementLicense ° The Endpoint Security Suite includes blades other than the Remote Access VPN, hence this license is required to manage the suite
- C . EndpointContainerLicense ° The Endpoint Software Blade Licenses does not require an Endpoint Container License as the base
- D . IPSecVPNLicense • This license is installed on the VPN Gateway and is a basic requirement for a Remote Access VPN solution
Correct Answer: C
C
Explanation:
The Endpoint Policy Management License is required for managing the Endpoint Security Suite, which includes blades such as the Remote Access VPN. The IPSec VPN License is installed on the VPN Gateway and is a basic requirement for a Remote Access VPN solution. The MobileAccessLicense is required on the Security Gateway for the following Remote Access solutions.
C
Explanation:
The Endpoint Policy Management License is required for managing the Endpoint Security Suite, which includes blades such as the Remote Access VPN. The IPSec VPN License is installed on the VPN Gateway and is a basic requirement for a Remote Access VPN solution. The MobileAccessLicense is required on the Security Gateway for the following Remote Access solutions.
Question #107
While using the Gaia CLI. what is the correct command to publish changes to the management server?
- A . json publish
- B . mgmt publish
- C . mgmt_cli commit
- D . commit
Correct Answer: B
B
Explanation:
While using the Gaia CLI, the correct command to publish changes to the management server is mgmt publish. This command publishes all changes made by all administrators since the last publish operation. The json publish command is not valid in Gaia CLI. The mgmt_cli commit command is used to publish changes made by a specific administrator session. The commit command is used to save configuration changes in Gaia CLI.
Reference: Publishing Changes
B
Explanation:
While using the Gaia CLI, the correct command to publish changes to the management server is mgmt publish. This command publishes all changes made by all administrators since the last publish operation. The json publish command is not valid in Gaia CLI. The mgmt_cli commit command is used to publish changes made by a specific administrator session. The commit command is used to save configuration changes in Gaia CLI.
Reference: Publishing Changes
Question #108
Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU.
After installation, is the administrator required to perform any additional tasks?
- A . Go to clash-Run cpstop | Run cpstart
- B . Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway
- C . Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores
- D . Go to clash-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway | Install Security Policy
Correct Answer: B
B
Explanation:
Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU. After installation, the administrator needs to perform some additional tasks for it to function properly. The tasks that the administrator needs to perform are:
Go to Clish-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway
Go to SmartConsole | Install Security Policy
The first task is to enable and configure CoreXL, which is a performance enhancement feature that allows running multiple instances of the firewall kernel on multiple CPU cores. CoreXL can be enabled and configured via cpconfig, which is a utility that provides a menu-based interface for various system settings. After enabling CoreXL, the administrator needs to reboot the Security Gateway for the changes to take effect.
The second task is to install the security policy on the Security Gateway via SmartConsole, which is a unified graphical user interface for managing Check Point products. Installing the security policy will activate the CoreXL instances and distribute the traffic among them.
Reference: R81 Performance Tuning Administration Guide, page 15; R81 Security Management Administration Guide, page 83.
B
Explanation:
Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new CPU to replace the existing single core CPU. After installation, the administrator needs to perform some additional tasks for it to function properly. The tasks that the administrator needs to perform are:
Go to Clish-Run cpconfig | Configure CoreXL to make use of the additional Cores | Exit cpconfig | Reboot Security Gateway
Go to SmartConsole | Install Security Policy
The first task is to enable and configure CoreXL, which is a performance enhancement feature that allows running multiple instances of the firewall kernel on multiple CPU cores. CoreXL can be enabled and configured via cpconfig, which is a utility that provides a menu-based interface for various system settings. After enabling CoreXL, the administrator needs to reboot the Security Gateway for the changes to take effect.
The second task is to install the security policy on the Security Gateway via SmartConsole, which is a unified graphical user interface for managing Check Point products. Installing the security policy will activate the CoreXL instances and distribute the traffic among them.
Reference: R81 Performance Tuning Administration Guide, page 15; R81 Security Management Administration Guide, page 83.
Question #109
For Management High Availability, which of the following is NOT a valid synchronization status?
- A . Collision
- B . Down
- C . Lagging
- D . Never been synchronized
Correct Answer: B
B
Explanation:
For Management High Availability, the valid synchronization status options are:
A) Collision
B) Down
C) Lagging
D) Never been synchronized
In this context, "Down" indicates that the synchronization is not functioning correctly or that the standby management server is not reachable. This is a valid synchronization status, so the answer is not B.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
B
Explanation:
For Management High Availability, the valid synchronization status options are:
A) Collision
B) Down
C) Lagging
D) Never been synchronized
In this context, "Down" indicates that the synchronization is not functioning correctly or that the standby management server is not reachable. This is a valid synchronization status, so the answer is not B.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #110
Vanessa is firewall administrator in her company. Her company is using Check Point firewall on a central and several remote locations which are managed centrally by R77.30 Security Management Server. On central location is installed R77.30 Gateway on Open server. Remote locations are using Check Point UTM-1570 series appliances with R75.30 and some of them are using a UTM-1-Edge-X or Edge-W with latest available firmware. She is in process of migrating to R81.
What can cause Vanessa unnecessary problems, if she didn’t check all requirements for migration to R81?
- A . Missing an installed R77.20 Add-on on Security Management Server
- B . Unsupported firmware on UTM-1 Edge-W appliance
- C . Unsupported version on UTM-1 570 series appliance
- D . Unsupported appliances on remote locations
Correct Answer: A
A
Explanation:
What can cause Vanessa unnecessary problems, if she didn’t check all requirements for migration to R81, is missing an installed R77.20 Add-on on Security Management Server. R77.20 Add-on is a package that adds new features and enhancements to R77 Security Management Server, such as support for new appliances, Gaia OS features, VPN features, etc. One of the requirements for migrating to R81 from R77 Security Management Server is to have R77.20 Add-on installed on the server. If Vanessa did not check this requirement and tried to migrate without R77.20 Add-on, she would encounter errors and failures during the migration process. The other options are either not relevant or not problematic for migration to R81.
A
Explanation:
What can cause Vanessa unnecessary problems, if she didn’t check all requirements for migration to R81, is missing an installed R77.20 Add-on on Security Management Server. R77.20 Add-on is a package that adds new features and enhancements to R77 Security Management Server, such as support for new appliances, Gaia OS features, VPN features, etc. One of the requirements for migrating to R81 from R77 Security Management Server is to have R77.20 Add-on installed on the server. If Vanessa did not check this requirement and tried to migrate without R77.20 Add-on, she would encounter errors and failures during the migration process. The other options are either not relevant or not problematic for migration to R81.