Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #141
Which of the following is NOT a type of Check Point API available in R81.x?
- A . Identity Awareness Web Services
- B . OPSEC SDK
- C . Mobile Access
- D . Management
Correct Answer: C
C
Explanation:
Check Point API is a set of web services that enable the usage of functions and commands in a dynamic and automated fashion. Check Point API is available in different types, each serving a different purpose and functionality. According to the Check Point Resource Library1, the following are the types of Check Point API available in R81.x:
Identity Awareness Web Services: This type of API allows external applications to send identity and location information to the Security Gateway, which can then use this information for policy enforcement. Identity Awareness Web Services can be used for scenarios such as guest registration, captive portal, identity agents, etc.
OPSEC SDK: This type of API provides a framework for developing applications that interact with Check Point products using the OPSEC (Open Platform for Security) protocol. OPSEC SDK can be used for scenarios such as log export, event management, anti-virus integration, etc.
Management: This type of API allows external applications to perform management operations on the Check Point Management server using RESTful web services. Management API can be used for scenarios such as policy installation, object creation, configuration backup, etc.
Mobile Access is not a type of Check Point API, but rather a feature that provides secure remote access to corporate resources from various devices. Mobile Access uses SSL VPN technology and supports different authentication methods and access scenarios.
Reference: What is an API Gateway?, How to use Check Point API with Postman quick guide, Home – Check Point Developers, Introduction to RESTful APIs and JSON format, Checkpoint API tutorial, part 1 – getting started
C
Explanation:
Check Point API is a set of web services that enable the usage of functions and commands in a dynamic and automated fashion. Check Point API is available in different types, each serving a different purpose and functionality. According to the Check Point Resource Library1, the following are the types of Check Point API available in R81.x:
Identity Awareness Web Services: This type of API allows external applications to send identity and location information to the Security Gateway, which can then use this information for policy enforcement. Identity Awareness Web Services can be used for scenarios such as guest registration, captive portal, identity agents, etc.
OPSEC SDK: This type of API provides a framework for developing applications that interact with Check Point products using the OPSEC (Open Platform for Security) protocol. OPSEC SDK can be used for scenarios such as log export, event management, anti-virus integration, etc.
Management: This type of API allows external applications to perform management operations on the Check Point Management server using RESTful web services. Management API can be used for scenarios such as policy installation, object creation, configuration backup, etc.
Mobile Access is not a type of Check Point API, but rather a feature that provides secure remote access to corporate resources from various devices. Mobile Access uses SSL VPN technology and supports different authentication methods and access scenarios.
Reference: What is an API Gateway?, How to use Check Point API with Postman quick guide, Home – Check Point Developers, Introduction to RESTful APIs and JSON format, Checkpoint API tutorial, part 1 – getting started
Question #142
When synchronizing clusters, which of the following statements is FALSE?
- A . The state of connections using resources is maintained in a Security Server, so their connections cannot be synchronized.
- B . Only cluster members running on the same OS platform can be synchronized.
- C . In the case of a failover, accounting information on the failed member may be lost despite a properly working synchronization.
- D . Client Authentication or Session Authentication connections through a cluster member will be lost if the cluster member fails.
Correct Answer: B
B
Explanation:
The statement that only cluster members running on the same OS platform can be synchronized is false. Cluster members can be synchronized even if they run on different OS platforms, as long as they have the same Check Point version and hotfixes installed. The other statements are true. The state of connections using resources is maintained in a Security Server, so their connections cannot be synchronized. In the case of a failover, accounting information on the failed member may be lost despite a properly working synchronization. Client Authentication or Session Authentication connections through a cluster member will be lost if the cluster member fails.
Reference: R81 ClusterXL Administration Guide, page 9-10; [R81 Security Gateway Architecture], page 23
B
Explanation:
The statement that only cluster members running on the same OS platform can be synchronized is false. Cluster members can be synchronized even if they run on different OS platforms, as long as they have the same Check Point version and hotfixes installed. The other statements are true. The state of connections using resources is maintained in a Security Server, so their connections cannot be synchronized. In the case of a failover, accounting information on the failed member may be lost despite a properly working synchronization. Client Authentication or Session Authentication connections through a cluster member will be lost if the cluster member fails.
Reference: R81 ClusterXL Administration Guide, page 9-10; [R81 Security Gateway Architecture], page 23
Question #143
Native Applications require a thin client under which circumstances?
- A . If you want to use a legacy 32-Bit Windows OS
- B . If you want to use a VPN Client that is not officially supported by the underlying operating system
- C . If you want to have assigned a particular Office Mode IP address.
- D . If you are about to use a client (FTP. RDP, …) that is installed on the endpoint.
Correct Answer: D
D
Explanation:
Native Applications require a thin client under the circumstance that you are about to use a client (FTP, RDP, etc.) that is installed on the endpoint. A thin client is a lightweight software component that enables secure connectivity for native applications without requiring additional configuration or user intervention. A thin client is automatically downloaded and installed on the endpoint when a user initiates a native application session through Mobile Access Portal or SNX Portal.
Reference: [Check Point Security Expert R81 Mobile Access Administration Guide], page 16.
D
Explanation:
Native Applications require a thin client under the circumstance that you are about to use a client (FTP, RDP, etc.) that is installed on the endpoint. A thin client is a lightweight software component that enables secure connectivity for native applications without requiring additional configuration or user intervention. A thin client is automatically downloaded and installed on the endpoint when a user initiates a native application session through Mobile Access Portal or SNX Portal.
Reference: [Check Point Security Expert R81 Mobile Access Administration Guide], page 16.
Question #144
Which method below is NOT one of the ways to communicate using the Management API’s?
- A . Typing API commands using the “mgmt_cli” command
- B . Typing API commands from a dialog box inside the SmartConsole GUI application
- C . Typing API commands using Gaia’s secure shell(clish)19+
- D . Sending API commands over an http connection using web-services
Correct Answer: D
D
Explanation:
The Management API supports three methods of communication: mgmt_cli command, SmartConsole GUI dialog box, and Gaia CLI. Sending API commands over an http connection using web-services is not a supported method.
Reference: Check Point Management APIs
D
Explanation:
The Management API supports three methods of communication: mgmt_cli command, SmartConsole GUI dialog box, and Gaia CLI. Sending API commands over an http connection using web-services is not a supported method.
Reference: Check Point Management APIs
Question #145
Which statement is most correct regarding about “CoreXL Dynamic Dispatcher”?
- A . The CoreXL FW instanxces assignment mechanism is based on Source MAC addresses, Destination MAC addresses
- B . The CoreXL FW instances assignment mechanism is based on the utilization of CPU cores
- C . The CoreXL FW instances assignment mechanism is based on IP Protocol type
- D . The CoreXl FW instances assignment mechanism is based on Source IP addresses, Destination IP addresses, and the IP ‘Protocol’ type
Correct Answer: B
B
Explanation:
The statement that is most correct regarding about “CoreXL Dynamic Dispatcher” is: The CoreXL FW instances assignment mechanism is based on the utilization of CPU cores. CoreXL Dynamic Dispatcher is a feature that allows the Security Gateway to dynamically assign connections to the most available CoreXL FW instance, based on the CPU core utilization. This improves the performance and load balancing of the Security Gateway, especially when handling connections with different processing requirements. The other statements are either incorrect or describe the CoreXL Static Dispatcher mechanism, which assigns connections based on a hash function of the Source IP, Destination IP, and IP Protocol type.
B
Explanation:
The statement that is most correct regarding about “CoreXL Dynamic Dispatcher” is: The CoreXL FW instances assignment mechanism is based on the utilization of CPU cores. CoreXL Dynamic Dispatcher is a feature that allows the Security Gateway to dynamically assign connections to the most available CoreXL FW instance, based on the CPU core utilization. This improves the performance and load balancing of the Security Gateway, especially when handling connections with different processing requirements. The other statements are either incorrect or describe the CoreXL Static Dispatcher mechanism, which assigns connections based on a hash function of the Source IP, Destination IP, and IP Protocol type.
Question #146
What is the best method to upgrade a Security Management Server to R81.x when it is not connected to the Internet?
- A . CPUSE offline upgrade only
- B . Advanced upgrade or CPUSE offline upgrade
- C . Advanced Upgrade only
- D . SmartUpdate offline upgrade
Correct Answer: B
B
Explanation:
The best method to upgrade a Security Management Server to R81.x when it is not connected to the Internet is either Advanced upgrade or CPUSE offline upgrade. Advanced upgrade is a manual procedure that involves backing up the current configuration, installing the new version from an ISO image, and restoring the configuration. CPUSE offline upgrade is an automated procedure that involves downloading the upgrade package from the Check Point User Center, transferring it to the Security Management Server, and installing it using CPUSE. SmartUpdate offline upgrade is not a valid option, as SmartUpdate is a tool for managing licenses and software packages on multiple gateways and servers1.
Reference: 1: Check Point Software, Getting Started, Upgrading Security Management Servers.
B
Explanation:
The best method to upgrade a Security Management Server to R81.x when it is not connected to the Internet is either Advanced upgrade or CPUSE offline upgrade. Advanced upgrade is a manual procedure that involves backing up the current configuration, installing the new version from an ISO image, and restoring the configuration. CPUSE offline upgrade is an automated procedure that involves downloading the upgrade package from the Check Point User Center, transferring it to the Security Management Server, and installing it using CPUSE. SmartUpdate offline upgrade is not a valid option, as SmartUpdate is a tool for managing licenses and software packages on multiple gateways and servers1.
Reference: 1: Check Point Software, Getting Started, Upgrading Security Management Servers.
Question #147
What is the base level encryption key used by Capsule Docs?
- A . RSA 2048
- B . RSA 1024
- C . SHA-256
- D . AES
Correct Answer: A
A
Explanation:
The base level encryption key used by Capsule Docs is RSA 2048. This means that Capsule Docs uses a 2048-bit RSA public key encryption algorithm to encrypt and decrypt documents. RSA is an asymmetric encryption algorithm that uses two keys: a public key that can be shared with anyone, and a private key that must be kept secret. AES, SHA-256, and RSA 1024 are not the base level encryption keys used by Capsule Docs.
Reference: Check Point Software, Getting Started, Capsule Docs Encryption.
A
Explanation:
The base level encryption key used by Capsule Docs is RSA 2048. This means that Capsule Docs uses a 2048-bit RSA public key encryption algorithm to encrypt and decrypt documents. RSA is an asymmetric encryption algorithm that uses two keys: a public key that can be shared with anyone, and a private key that must be kept secret. AES, SHA-256, and RSA 1024 are not the base level encryption keys used by Capsule Docs.
Reference: Check Point Software, Getting Started, Capsule Docs Encryption.
Question #148
According to out of the box SmartEvent policy, which blade will automatically be correlated into events?
- A . Firewall
- B . VPN
- C . IPS
- D . HTTPS
Correct Answer: C
C
Explanation:
According to out of the box SmartEvent policy, the blade that will automatically be correlated into events is IPS. IPS (Intrusion Prevention System) is a blade that detects and prevents network attacks by inspecting traffic and applying signatures and protections. SmartEvent correlates IPS logs into events based on predefined event definitions, such as IPS Attack, IPS Attack High Confidence, IPS Attack Critical Confidence, etc. The other blades are not automatically correlated into events by default, but they can be added to the SmartEvent policy manually.
Reference: [SmartEvent Policy]
C
Explanation:
According to out of the box SmartEvent policy, the blade that will automatically be correlated into events is IPS. IPS (Intrusion Prevention System) is a blade that detects and prevents network attacks by inspecting traffic and applying signatures and protections. SmartEvent correlates IPS logs into events based on predefined event definitions, such as IPS Attack, IPS Attack High Confidence, IPS Attack Critical Confidence, etc. The other blades are not automatically correlated into events by default, but they can be added to the SmartEvent policy manually.
Reference: [SmartEvent Policy]
Question #149
Sticky Decision Function (SDF) is required to prevent which of the following? Assume you set up an Active-Active cluster.
- A . Symmetric routing
- B . Failovers
- C . Asymmetric routing
- D . Anti-Spoofing
Correct Answer: C
C
Explanation:
Sticky Decision Function (SDF) is required to prevent asymmetric routing in an Active-Active cluster. Asymmetric routing occurs when packets from a source to a destination follow a different path than packets from the destination to the source. This can cause problems with stateful inspection and NAT. SDF ensures that packets from the same connection are handled by the same cluster member1.
Reference: Check Point R81 ClusterXL Administration Guide
C
Explanation:
Sticky Decision Function (SDF) is required to prevent asymmetric routing in an Active-Active cluster. Asymmetric routing occurs when packets from a source to a destination follow a different path than packets from the destination to the source. This can cause problems with stateful inspection and NAT. SDF ensures that packets from the same connection are handled by the same cluster member1.
Reference: Check Point R81 ClusterXL Administration Guide
Question #150
SandBlast has several functional components that work together to ensure that attacks are prevented in real-time.
Which the following is NOT part of the SandBlast component?
- A . Threat Emulation
- B . Mobile Access
- C . Mail Transfer Agent
- D . Threat Cloud
Correct Answer: B
B
Explanation:
Mobile Access is not part of the SandBlast component. Mobile Access is a software blade that provides secure remote access to corporate resources from various devices, such as smartphones, tablets, and laptops. Mobile Access supports different connectivity methods, such as SSL VPN, IPsec VPN, and Mobile Enterprise Application Store (MEAS). Mobile Access also integrates with Mobile Threat Prevention (MTP) to protect mobile devices from malware and network attacks.
Reference: Check Point Security Expert R81 Course, Mobile Access Administration Guide, SandBlast Mobile Datasheet
B
Explanation:
Mobile Access is not part of the SandBlast component. Mobile Access is a software blade that provides secure remote access to corporate resources from various devices, such as smartphones, tablets, and laptops. Mobile Access supports different connectivity methods, such as SSL VPN, IPsec VPN, and Mobile Enterprise Application Store (MEAS). Mobile Access also integrates with Mobile Threat Prevention (MTP) to protect mobile devices from malware and network attacks.
Reference: Check Point Security Expert R81 Course, Mobile Access Administration Guide, SandBlast Mobile Datasheet