Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #121
What is the amount of Priority Queues by default?
- A . There are 8 priority queues and this number cannot be changed.
- B . There is no distinct number of queues since it will be changed in a regular basis based on its system requirements.
- C . There are 7 priority queues by default and this number cannot be changed.
- D . There are 8 priority queues by default, and up to 8 additional queues can be manually configured
Correct Answer: D
D
Explanation:
There are 8 priority queues by default, and up to 8 additional queues can be manually configured1. Priority Queues are a feature of SecureXL that accelerates the performance of the Security Gateway by offloading CPU-intensive operations to the SecureXL device2. Priority Queues are used to prioritize traffic when the Security Gateway is stressed and needs to drop packets2. By default, there are 8 priority queues, each with a different priority level and type of connections2. You can manually configure up to 8 additional queues by setting the relevant kernel parameters in $FWDIR/boot/modules/fwkern.conf file1. You can also customize the queue length, the load balancing method, and the services that are considered as control connections1.
Reference: Firewall Priority Queues in R80.x / R81.x – Check Point Software, SecureXL – Check Point Software
D
Explanation:
There are 8 priority queues by default, and up to 8 additional queues can be manually configured1. Priority Queues are a feature of SecureXL that accelerates the performance of the Security Gateway by offloading CPU-intensive operations to the SecureXL device2. Priority Queues are used to prioritize traffic when the Security Gateway is stressed and needs to drop packets2. By default, there are 8 priority queues, each with a different priority level and type of connections2. You can manually configure up to 8 additional queues by setting the relevant kernel parameters in $FWDIR/boot/modules/fwkern.conf file1. You can also customize the queue length, the load balancing method, and the services that are considered as control connections1.
Reference: Firewall Priority Queues in R80.x / R81.x – Check Point Software, SecureXL – Check Point Software
Question #122
Which Check Point process provides logging services, such as forwarding logs from Gateway to Log Server, providing Log Export API (LEA) & Event Logging API (EL-A) services.
- A . DASSERVICE
- B . FWD
- C . CPVIEWD
- D . CPD
Correct Answer: B
B
Explanation:
The FWD process provides logging services, such as forwarding logs from Gateway to Log Server, providing Log Export API (LEA) and Event Logging API (EL-A) services. The FWD process is responsible for sending logs from the Security Gateway to the Security Management Server or Log Server, and for fetching logs from the Security Management Server or Log Server to SmartConsole. The FWD process also handles the communication with external logging applications that use the LEA or EL-A
protocols.
Reference: FWD process does not work after reboot – Check Point CheckMates, section “FWD process does not work after reboot”
Check Point R81, section “Logging and Monitoring”
CoreXL Dynamic Dispatcher – Check Point Software, section “Example of output”
B
Explanation:
The FWD process provides logging services, such as forwarding logs from Gateway to Log Server, providing Log Export API (LEA) and Event Logging API (EL-A) services. The FWD process is responsible for sending logs from the Security Gateway to the Security Management Server or Log Server, and for fetching logs from the Security Management Server or Log Server to SmartConsole. The FWD process also handles the communication with external logging applications that use the LEA or EL-A
protocols.
Reference: FWD process does not work after reboot – Check Point CheckMates, section “FWD process does not work after reboot”
Check Point R81, section “Logging and Monitoring”
CoreXL Dynamic Dispatcher – Check Point Software, section “Example of output”
Question #123
Alice & Bob are going to deploy Management Data Plane Separation (MDPS) for all their Check Point Security Gateway(s)/Cluster(s).
Which of the following statement is true?
- A . Each network environment is dependent and includes interfaces, routes, sockets, and processes
- B . Management Plane C To access, provision and monitor the Security Gateway
- C . Data Plane C To access, provision and monitor the Security Gateway
- D . Management Plane C for all other network traffic and processing
Correct Answer: B
B
Explanation:
Management Data Plane Separation (MDPS) is a feature that allows the separation of the management plane and the data plane on a Security Gateway or a cluster. The management plane is responsible for accessing, provisioning and monitoring the Security Gateway, while the data plane is responsible for all other network traffic and processing. Each network environment is independent and includes interfaces, routes, sockets, and processes1.
Reference: Check Point R81 Administration Guide
B
Explanation:
Management Data Plane Separation (MDPS) is a feature that allows the separation of the management plane and the data plane on a Security Gateway or a cluster. The management plane is responsible for accessing, provisioning and monitoring the Security Gateway, while the data plane is responsible for all other network traffic and processing. Each network environment is independent and includes interfaces, routes, sockets, and processes1.
Reference: Check Point R81 Administration Guide
Question #124
Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to?
- A . 50%
- B . 75%
- C . 80%
- D . 15%
Correct Answer: D
D
Explanation:
Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to a certain threshold. In this case, the correct threshold is specified as option D: 15%.
So, when the available disk space reaches or falls below 15%, old log entries should be deleted to free up space.
Options A, B, and C do not represent the recommended threshold for deleting old log entries according to Check Point’s best practices.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources. Topic 2, Exam Pool B
D
Explanation:
Check Point recommends configuring Disk Space Management parameters to delete old log entries when available disk space is less than or equal to a certain threshold. In this case, the correct threshold is specified as option D: 15%.
So, when the available disk space reaches or falls below 15%, old log entries should be deleted to free up space.
Options A, B, and C do not represent the recommended threshold for deleting old log entries according to Check Point’s best practices.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources. Topic 2, Exam Pool B
Question #125
What is the main difference between Threat Extraction and Threat Emulation?
- A . Threat Emulation never delivers a file and takes more than 3 minutes to complete.
- B . Threat Extraction always delivers a file and takes less than a second to complete.
- C . Threat Emulation never delivers a file that takes less than a second to complete.
- D . Threat Extraction never delivers a file and takes more than 3 minutes to complete.
Correct Answer: B
B
Explanation:
Threat Extraction (Answer B): Threat Extraction always delivers a file, but it removes potentially malicious content from the file before delivering it to the user. It is designed to provide a safe version of the file quickly, taking less than a second to complete.
Threat Emulation (Option A): Threat Emulation does not deliver the original file to the user until it has been thoroughly analyzed for threats. It may take more than 3 minutes to complete the analysis. The emphasis here is on safety and thorough inspection, which may result in a longer processing time.
Therefore, Option B correctly describes the main difference between Threat Extraction and Threat Emulation.
Reference: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.
B
Explanation:
Threat Extraction (Answer B): Threat Extraction always delivers a file, but it removes potentially malicious content from the file before delivering it to the user. It is designed to provide a safe version of the file quickly, taking less than a second to complete.
Threat Emulation (Option A): Threat Emulation does not deliver the original file to the user until it has been thoroughly analyzed for threats. It may take more than 3 minutes to complete the analysis. The emphasis here is on safety and thorough inspection, which may result in a longer processing time.
Therefore, Option B correctly describes the main difference between Threat Extraction and Threat Emulation.
Reference: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.
Question #126
What is the valid range for VRID value in VRRP configuration?
- A . 1-254
- B . 1-255
- C . 0-254
- D . 0-255
Correct Answer: B
B
Explanation:
The valid range for VRID value in VRRP configuration is 1 – 255. VRID stands for Virtual Router ID, and it is a number that identifies a virtual router in a VRRP cluster. A VRRP cluster consists of one or more routers that share a virtual IP address and provide redundancy and load balancing for network traffic. Each router in the cluster must have a unique VRID value, and the VRID value must match the VRID value configured on the interface that connects to the VRRP cluster. The VRID value can be any number from 1 to 255, inclusive.
B
Explanation:
The valid range for VRID value in VRRP configuration is 1 – 255. VRID stands for Virtual Router ID, and it is a number that identifies a virtual router in a VRRP cluster. A VRRP cluster consists of one or more routers that share a virtual IP address and provide redundancy and load balancing for network traffic. Each router in the cluster must have a unique VRID value, and the VRID value must match the VRID value configured on the interface that connects to the VRRP cluster. The VRID value can be any number from 1 to 255, inclusive.
Question #127
With MTA (Mail Transfer Agent) enabled the gateways manages SMTP traffic and holds external email with potentially malicious attachments.
What is required in order to enable MTA (Mail Transfer Agent) functionality in the Security Gateway?
- A . Threat Cloud Intelligence
- B . Threat Prevention Software Blade Package
- C . Endpoint Total Protection
- D . Traffic on port 25
Correct Answer: B
B
Explanation:
To enable MTA (Mail Transfer Agent) functionality in the Security Gateway, the Threat Prevention Software Blade Package is required. The Threat Prevention Software Blade Package includes the Anti-Virus, Anti-Bot, and Threat Emulation blades, which can scan and hold external email with potentially malicious attachments. The MTA functionality allows the Security Gateway to act as an SMTP relay between the mail server and the Internet, and apply Threat Prevention policies to the email traffic. The other options are either not related or not sufficient to enable MTA functionality. R
B
Explanation:
To enable MTA (Mail Transfer Agent) functionality in the Security Gateway, the Threat Prevention Software Blade Package is required. The Threat Prevention Software Blade Package includes the Anti-Virus, Anti-Bot, and Threat Emulation blades, which can scan and hold external email with potentially malicious attachments. The MTA functionality allows the Security Gateway to act as an SMTP relay between the mail server and the Internet, and apply Threat Prevention policies to the email traffic. The other options are either not related or not sufficient to enable MTA functionality. R
Question #128
Choose the correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI?
- A . mgmt_cli add host name “myHost12 ip” address 10.50.23.90
- B . mgmt_cli add host name ip-address 10.50.23.90
- C . mgmt_cli add host “emailserver1” address 10.50.23.90
- D . mgmt_cli add host name “emailserver1” ip-address 10.50.23.90
Correct Answer: D
D
Explanation:
The correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI is mgmt_cli add host name "emailserver1" ip-address 10.50.23.90. The name and ip-address parameters are required and must be enclosed in double quotes. The other options are missing the double quotes or have incorrect parameter names1.
Reference: 1: Check Point Software, Getting Started, Adding a Host.
D
Explanation:
The correct syntax to add a new host named “emailserver1” with IP address 10.50.23.90 using GAiA Management CLI is mgmt_cli add host name "emailserver1" ip-address 10.50.23.90. The name and ip-address parameters are required and must be enclosed in double quotes. The other options are missing the double quotes or have incorrect parameter names1.
Reference: 1: Check Point Software, Getting Started, Adding a Host.
Question #129
Fill in the blank: Browser-based Authentication sends users to a web page to acquire identities using
________ .
- A . User Directory
- B . Captive Portal and Transparent Kerberos Authentication
- C . Captive Portal
- D . UserCheck
Correct Answer: B
B
Explanation:
Browser-based Authentication is a method of acquiring identities from unidentified users by sending them to a web page where they can log in and authenticate. Browser-based Authentication uses two techniques to acquire identities: Captive Portal and Transparent Kerberos Authentication1.
Captive Portal is a simple method that attempts authentication through a web interface before granting a user access to Intranet resources. When a user tries to access a protected resource, they are redirected to a web page where they have to enter their credentials. The credentials are verified by the Identity Awareness Security Gateway or an external authentication server. If the authentication is successful, the user’s identity is associated with their IP address and they are allowed to access the resource12.
Transparent Kerberos Authentication is a more seamless method that leverages the existing Kerberos infrastructure in the network. When a user tries to access a protected resource, the Identity Awareness Security Gateway intercepts the Kerberos ticket request and extracts the user’s identity from it. The user’s identity is then associated with their IP address and they are allowed to access the resource without any additional prompts. This method requires that the Identity Awareness Security Gateway is configured as a trusted proxy in the Active Directory domain12.
Therefore, the correct answer is B) Browser-based Authentication sends users to a web page to acquire identities using Captive Portal and Transparent Kerberos Authentication.
Reference: 1, THE IMPORTANCE OF ACCESS ROLES – Check Point Software, page 2
2, Browser-based Authentication Check Point – Bing
3, How to Configure Client Authentication – Check Point Software, page 1
4, Identity Sources – Check Point Software
5, Configuring Browser-Based Authentication – Check Point Software
6, Two Factor Authentication – Check Point Software
B
Explanation:
Browser-based Authentication is a method of acquiring identities from unidentified users by sending them to a web page where they can log in and authenticate. Browser-based Authentication uses two techniques to acquire identities: Captive Portal and Transparent Kerberos Authentication1.
Captive Portal is a simple method that attempts authentication through a web interface before granting a user access to Intranet resources. When a user tries to access a protected resource, they are redirected to a web page where they have to enter their credentials. The credentials are verified by the Identity Awareness Security Gateway or an external authentication server. If the authentication is successful, the user’s identity is associated with their IP address and they are allowed to access the resource12.
Transparent Kerberos Authentication is a more seamless method that leverages the existing Kerberos infrastructure in the network. When a user tries to access a protected resource, the Identity Awareness Security Gateway intercepts the Kerberos ticket request and extracts the user’s identity from it. The user’s identity is then associated with their IP address and they are allowed to access the resource without any additional prompts. This method requires that the Identity Awareness Security Gateway is configured as a trusted proxy in the Active Directory domain12.
Therefore, the correct answer is B) Browser-based Authentication sends users to a web page to acquire identities using Captive Portal and Transparent Kerberos Authentication.
Reference: 1, THE IMPORTANCE OF ACCESS ROLES – Check Point Software, page 2
2, Browser-based Authentication Check Point – Bing
3, How to Configure Client Authentication – Check Point Software, page 1
4, Identity Sources – Check Point Software
5, Configuring Browser-Based Authentication – Check Point Software
6, Two Factor Authentication – Check Point Software
Question #130
SmartConsole R81 requires the following ports to be open for SmartEvent R81 management:
- A . 19090,22
- B . 19190,22
- C . 18190,80
- D . 19009,443
Correct Answer: D
D
Explanation:
To use SmartConsole R81 for managing SmartEvent R81, you need to have the following ports open:
Port 19009 for communication over HTTPS (443)
Port 19009 for communication over HTTP (80)
These ports are necessary for the SmartConsole to communicate with SmartEvent for management and monitoring purposes.
Reference: Check Point Certified Security Expert R81 documentation and learning resources.
D
Explanation:
To use SmartConsole R81 for managing SmartEvent R81, you need to have the following ports open:
Port 19009 for communication over HTTPS (443)
Port 19009 for communication over HTTP (80)
These ports are necessary for the SmartConsole to communicate with SmartEvent for management and monitoring purposes.
Reference: Check Point Certified Security Expert R81 documentation and learning resources.