Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #111
The admin lost access to the Gaia Web Management Interface but he was able to connect via ssh.
How can you check if the web service is enabled, running and which port is used?
- A . In expert mode run #netstat -tulnp | grep httpd to see if httpd is up and to get the port number.
In dish run >show web daemon-enable to see if the web daemon is enabled. - B . In dish run >show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode run #netstat -anp | grep httpd to see if the httpd is up
- C . In dish run >show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode run #netstat -anp | grep httpd2 to see if the httpd2 is up
- D . In expert mode run #netstat -tulnp | grep httpd2 to see if httpd2 is up and to get the port number. In dish run >show web daemon-enable to see if the web daemon is enabled.
Correct Answer: C
C
Explanation:
The correct way to check if the web service is enabled, running and which port is used is to use option
C. In dish, run show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode, run netstat -anp | grep httpd2 to see if the httpd2 is up1. The httpd2 service is responsible for the Gaia Web Management Interface2. If the web daemon is disabled, you can enable it by running set web daemon-enable on in dish3. If the httpd2 service is down, you can start it by running service httpd2 start in expert mode4.
Reference: Gaia WebUI and CLI – Check Point CheckMates, Gaia R81.20 Administration Guide – Check Point Software, Gaia R81 Administration Guide – Check Point Software, How to restart Gaia Portal (WebUI) process – Check Point Software
C
Explanation:
The correct way to check if the web service is enabled, running and which port is used is to use option
C. In dish, run show web ssl-port to see if the web daemon is enabled and which port is in use. In expert mode, run netstat -anp | grep httpd2 to see if the httpd2 is up1. The httpd2 service is responsible for the Gaia Web Management Interface2. If the web daemon is disabled, you can enable it by running set web daemon-enable on in dish3. If the httpd2 service is down, you can start it by running service httpd2 start in expert mode4.
Reference: Gaia WebUI and CLI – Check Point CheckMates, Gaia R81.20 Administration Guide – Check Point Software, Gaia R81 Administration Guide – Check Point Software, How to restart Gaia Portal (WebUI) process – Check Point Software
Question #112
Which features are only supported with R81.20 Gateways but not R77.x?
- A . Access Control policy unifies the Firewall, Application Control & URL Filtering, Data Awareness, and Mobile Access Software Blade policies.
- B . Limits the upload and download throughput for streaming media in the company to 1 Gbps.
- C . The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.
- D . Time object to a rule to make the rule active only during specified times.
Correct Answer: C
C
Explanation:
The features that are only supported with R81.20 Gateways and not with R77.x are described in option C:
"C. The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence."
This feature, known as Rule Base Layers, allows for greater flexibility and control in organizing and prioritizing security rules within the rule base.
Options A, B, and D do not specifically pertain to features introduced in R81.20 and are available in earlier versions as well.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
C
Explanation:
The features that are only supported with R81.20 Gateways and not with R77.x are described in option C:
"C. The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence."
This feature, known as Rule Base Layers, allows for greater flexibility and control in organizing and prioritizing security rules within the rule base.
Options A, B, and D do not specifically pertain to features introduced in R81.20 and are available in earlier versions as well.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #113
Which path below is available only when CoreXL is enabled?
- A . Slow path
- B . Firewall path
- C . Medium path
- D . Accelerated path
Correct Answer: C
C
Explanation:
According to the Check Point R81 training course, the medium path is available only when CoreXL is enabled. CoreXL is a performance-enhancing technology that allows multiple CPU cores to process traffic simultaneously. The medium path handles packets that require deeper inspection or content awareness, such as IPS, Anti-Virus, or URL Filtering. The other paths are either available regardless of CoreXL or not valid terms.
Reference: Certified Security Expert (CCSE) R81.20 Course Overview
C
Explanation:
According to the Check Point R81 training course, the medium path is available only when CoreXL is enabled. CoreXL is a performance-enhancing technology that allows multiple CPU cores to process traffic simultaneously. The medium path handles packets that require deeper inspection or content awareness, such as IPS, Anti-Virus, or URL Filtering. The other paths are either available regardless of CoreXL or not valid terms.
Reference: Certified Security Expert (CCSE) R81.20 Course Overview
Question #114
Which of the following is NOT a component of Check Point Capsule?
- A . Capsule Docs
- B . Capsule Cloud
- C . Capsule Enterprise
- D . Capsule Workspace
Correct Answer: C
C
Explanation:
Check Point Capsule is a suite of solutions designed to provide comprehensive mobile security and secure access.
The components of Check Point Capsule include:
Capsule Docs (Option A): A component that secures document sharing and protects sensitive data.
Capsule Cloud (Option B): A component that provides cloud-based security services.
Capsule Workspace (Option D): A component that provides secure workspace on mobile devices.
Option C, "Capsule Enterprise," is not a recognized component of Check Point Capsule based on the available information. Therefore, it is the correct answer as the component that is NOT part of Check Point Capsule.
Reference: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.
C
Explanation:
Check Point Capsule is a suite of solutions designed to provide comprehensive mobile security and secure access.
The components of Check Point Capsule include:
Capsule Docs (Option A): A component that secures document sharing and protects sensitive data.
Capsule Cloud (Option B): A component that provides cloud-based security services.
Capsule Workspace (Option D): A component that provides secure workspace on mobile devices.
Option C, "Capsule Enterprise," is not a recognized component of Check Point Capsule based on the available information. Therefore, it is the correct answer as the component that is NOT part of Check Point Capsule.
Reference: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.
Question #115
Fill in the blank: The IPS policy for pre-R81 gateways is installed during the _______ .
- A . Firewall policy install
- B . Threat Prevention policy install
- C . Anti-bot policy install
- D . Access Control policy install
Correct Answer: C
C
Explanation:
The IPS policy for pre-R81 gateways is installed during the Anti-bot policy install. The Anti-bot policy install includes both Anti-bot and IPS protections for pre-R81 gateways, since they share the same inspection engine. For R81 and above gateways, the IPS policy is installed separately as part of the Threat Prevention policy install, which also includes Anti-virus and Threat Emulation protections.
Reference: R81 Threat Prevention Administration Guide, page 15.
C
Explanation:
The IPS policy for pre-R81 gateways is installed during the Anti-bot policy install. The Anti-bot policy install includes both Anti-bot and IPS protections for pre-R81 gateways, since they share the same inspection engine. For R81 and above gateways, the IPS policy is installed separately as part of the Threat Prevention policy install, which also includes Anti-virus and Threat Emulation protections.
Reference: R81 Threat Prevention Administration Guide, page 15.
Question #116
What are the modes of SandBlast Threat Emulation deployment?
- A . Cloud, Smart-1 and Hybrid
- B . Cloud. OpenServer and Vmware
- C . Cloud, Appliance and Private
- D . Cloud, Appliance and Hybrid
Correct Answer: D
D
Explanation:
SandBlast Threat Emulation is a technology that protects against zero-day and unknown malware by inspecting files in a secure sandbox environment and emulating their behavior. SandBlast Threat Emulation can be deployed in three modes: Cloud, Appliance and Hybrid1.
Cloud mode: The files are sent to the Check Point cloud service for emulation. This mode does not require any additional hardware or software installation. It is the easiest and most cost-effective way to deploy SandBlast Threat Emulation.
Appliance mode: The files are sent to a dedicated appliance (TE1000X, TE2500X, or TE100X) for emulation. This mode provides the highest level of performance and scalability, as well as data privacy and compliance. It is suitable for large organizations with high security and throughput requirements.
Hybrid mode: The files are first sent to the Check Point cloud service for emulation, and if the cloud service cannot determine the verdict, they are then sent to a dedicated appliance for further analysis. This mode combines the benefits of both cloud and appliance modes, offering fast response time and high accuracy.
Reference: 1: SandBlast Threat Emulation Deployment Modes
D
Explanation:
SandBlast Threat Emulation is a technology that protects against zero-day and unknown malware by inspecting files in a secure sandbox environment and emulating their behavior. SandBlast Threat Emulation can be deployed in three modes: Cloud, Appliance and Hybrid1.
Cloud mode: The files are sent to the Check Point cloud service for emulation. This mode does not require any additional hardware or software installation. It is the easiest and most cost-effective way to deploy SandBlast Threat Emulation.
Appliance mode: The files are sent to a dedicated appliance (TE1000X, TE2500X, or TE100X) for emulation. This mode provides the highest level of performance and scalability, as well as data privacy and compliance. It is suitable for large organizations with high security and throughput requirements.
Hybrid mode: The files are first sent to the Check Point cloud service for emulation, and if the cloud service cannot determine the verdict, they are then sent to a dedicated appliance for further analysis. This mode combines the benefits of both cloud and appliance modes, offering fast response time and high accuracy.
Reference: 1: SandBlast Threat Emulation Deployment Modes
Question #117
SecureXL improves non-encrypted firewall traffic throughput and encrypted VPN traffic throughput.
- A . This statement is true because SecureXL does improve all traffic.
- B . This statement is false because SecureXL does not improve this traffic but CoreXL does.
- C . This statement is true because SecureXL does improve this traffic.
- D . This statement is false because encrypted traffic cannot be inspected.
Correct Answer: C
C
Explanation:
SecureXL is a performance-enhancing technology used in Check Point firewalls. It improves the throughput of both non-encrypted firewall traffic and encrypted VPN traffic. The statement in option C is true because SecureXL does improve both types of traffic by offloading processing to dedicated hardware acceleration, optimizing firewall and VPN operations.
Option C correctly states that SecureXL improves this traffic, making it the verified answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
C
Explanation:
SecureXL is a performance-enhancing technology used in Check Point firewalls. It improves the throughput of both non-encrypted firewall traffic and encrypted VPN traffic. The statement in option C is true because SecureXL does improve both types of traffic by offloading processing to dedicated hardware acceleration, optimizing firewall and VPN operations.
Option C correctly states that SecureXL improves this traffic, making it the verified answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #118
When users connect to the Mobile Access portal they are unable to open File Shares.
Which log file would you want to examine?
- A . cvpnd.elg
- B . httpd.elg
- C . vpnd.elg
- D . fw.elg
Correct Answer: A
A
Explanation:
When users connect to the Mobile Access portal they are unable to open File Shares.
The log file that you would want to examine is cvpnd.elg. This log file contains information about the Mobile Access VPN daemon, which handles the connections from the Mobile Access portal to the internal resources, such as File Shares, Web Applications, etc. The log file is located in the directory $FWDIR/log/ on the Security Gateway. You can use the command fw log -f cvpnd.elg to view the log file in real time.
Reference: R81 Mobile Access Administration Guide, page 255.
A
Explanation:
When users connect to the Mobile Access portal they are unable to open File Shares.
The log file that you would want to examine is cvpnd.elg. This log file contains information about the Mobile Access VPN daemon, which handles the connections from the Mobile Access portal to the internal resources, such as File Shares, Web Applications, etc. The log file is located in the directory $FWDIR/log/ on the Security Gateway. You can use the command fw log -f cvpnd.elg to view the log file in real time.
Reference: R81 Mobile Access Administration Guide, page 255.
Question #119
The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule based and checked for viruses. But it is not accelerated.
What is the most likely reason that the traffic is not accelerated?
- A . The connection is destined for a server within the network
- B . The connection required a Security server
- C . The packet is the second in an established TCP connection
- D . The packets are not multicast
Correct Answer: B
B
Explanation:
The most likely reason that the traffic is not accelerated is that the connection required a Security server. A Security server is a Check Point mechanism that inspects traffic that cannot be directly handled by the kernel. For example, traffic that requires content inspection, such as HTTP, FTP, SMTP, or VPN-1 SecuRemote/SecureClient. When a connection requires a Security server, it cannot be accelerated by SecureXL, which is a technology that offloads the processing of security operations from the CPU to improve performance. The other options are not relevant for acceleration.
Reference: Check Point Software, Getting Started, SecureXL;: Check Point Software, Getting Started, Security Servers.
B
Explanation:
The most likely reason that the traffic is not accelerated is that the connection required a Security server. A Security server is a Check Point mechanism that inspects traffic that cannot be directly handled by the kernel. For example, traffic that requires content inspection, such as HTTP, FTP, SMTP, or VPN-1 SecuRemote/SecureClient. When a connection requires a Security server, it cannot be accelerated by SecureXL, which is a technology that offloads the processing of security operations from the CPU to improve performance. The other options are not relevant for acceleration.
Reference: Check Point Software, Getting Started, SecureXL;: Check Point Software, Getting Started, Security Servers.
Question #120
You have used the "set inactivity-timeout 120" command to prevent the session to be disconnected after 10 minutes of inactivity. However, the Web session is being disconnected after 10 minutes.
Why?
- A . The idle timeout for the web session is specified with the "set web session-timeout" command.
- B . The number specified is the amount of the idle timeout in seconds rather than in minutes. So you have to use the command "set inactivity-timeout 600" instead.
- C . Probably, you have forgotten to make sure that nobody is accessing the management server via the SmartConsole which locks the management database.
- D . The number of minutes is correct. Probably, you have forgotten to save this setting with the "save config" command.
Correct Answer: A
A
Explanation:
The reason why the web session is being disconnected after 10 minutes is that the idle timeout for the web session is specified with the “set web session-timeout” command, not the “set inactivity-timeout” command. The “set inactivity-timeout” command only affects the CLI session, not the web session. To prevent the web session from being disconnected after 10 minutes of inactivity, you need to use the “set web session-timeout” command with a higher value than 10 minutes.
Reference: [Check Point Security Expert R81 Administration Guide], page 77.
A
Explanation:
The reason why the web session is being disconnected after 10 minutes is that the idle timeout for the web session is specified with the “set web session-timeout” command, not the “set inactivity-timeout” command. The “set inactivity-timeout” command only affects the CLI session, not the web session. To prevent the web session from being disconnected after 10 minutes of inactivity, you need to use the “set web session-timeout” command with a higher value than 10 minutes.
Reference: [Check Point Security Expert R81 Administration Guide], page 77.