Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #171
You are working with multiple Security Gateways enforcing an extensive number of rules. To simplify security administration, which action would you choose?
- A . Eliminate all possible contradictory rules such as the Stealth or Cleanup rules.
- B . Create a separate Security Policy package for each remote Security Gateway.
- C . Create network objects that restricts all applicable rules to only certain networks.
- D . Run separate SmartConsole instances to login and configure each Security Gateway directly.
Correct Answer: B
B
Explanation:
To simplify security administration when working with multiple Security Gateways enforcing an extensive number of rules, you would choose to create a separate Security Policy package for each remote Security Gateway. A Security Policy package is a set of rules and objects that can be assigned to one or more Security Gateways. This allows you to manage different policies for different gateways from the same Management Server1. The other options are either not effective or not feasible for simplifying security administration.
Reference: Check Point R81 Security Management Administration Guide
B
Explanation:
To simplify security administration when working with multiple Security Gateways enforcing an extensive number of rules, you would choose to create a separate Security Policy package for each remote Security Gateway. A Security Policy package is a set of rules and objects that can be assigned to one or more Security Gateways. This allows you to manage different policies for different gateways from the same Management Server1. The other options are either not effective or not feasible for simplifying security administration.
Reference: Check Point R81 Security Management Administration Guide
Question #172
What API command below creates a new host object with the name "My Host" and IP address of "192 168 0 10"?
- A . set host name "My Host" ip-address "192.168.0.10"
- B . new host name "My Host" ip-address "192 168.0.10"
- C . create host name "My Host" ip-address "192.168 0.10"
- D . mgmt.cli -m <mgmt ip> add host name "My Host" ip-address "192.168.0 10"
Correct Answer: A
A
Explanation:
Check Point API is an interface that allows users to automate tasks and manage Check Point products using RESTful web service calls. Check Point API uses JSON format for requests and responses. To create a new host object with the name “My Host” and IP address of “192.168.0.10”, users need to use the set host command with the name and ip-address parameters6.
The command syntax is:
set host name “My Host” ip-address “192.168.0.10”
Therefore, the correct answer is A.
Reference: 6: Check Point API reference
A
Explanation:
Check Point API is an interface that allows users to automate tasks and manage Check Point products using RESTful web service calls. Check Point API uses JSON format for requests and responses. To create a new host object with the name “My Host” and IP address of “192.168.0.10”, users need to use the set host command with the name and ip-address parameters6.
The command syntax is:
set host name “My Host” ip-address “192.168.0.10”
Therefore, the correct answer is A.
Reference: 6: Check Point API reference
Question #173
fwssd is a child process of which of the following Check Point daemons?
- A . fwd
- B . cpwd
- C . fwm
- D . cpd
Correct Answer: A
A
Explanation:
fwssd is a child process of fwd, which is the firewall daemon that handles policy installation, logging, and state synchronization. cpwd is the watchdog process that monitors and restarts other processes. fwm is the management server process that handles communication with GUI clients. cpd is the infrastructure daemon that handles SIC, licensing, and policy code generation.
Reference: Check Point Processes Cheat Sheet C LazyAdmins, Check Point R81 Gaia Administration Guide, Certified Security Expert (CCSE) R81.20 Course Overview
A
Explanation:
fwssd is a child process of fwd, which is the firewall daemon that handles policy installation, logging, and state synchronization. cpwd is the watchdog process that monitors and restarts other processes. fwm is the management server process that handles communication with GUI clients. cpd is the infrastructure daemon that handles SIC, licensing, and policy code generation.
Reference: Check Point Processes Cheat Sheet C LazyAdmins, Check Point R81 Gaia Administration Guide, Certified Security Expert (CCSE) R81.20 Course Overview
Question #174
Which of the following will NOT affect acceleration?
- A . Connections destined to or originated from the Security gateway
- B . A 5-tuple match
- C . Multicast packets
- D . Connections that have a Handler (ICMP, FTP, H.323, etc.)
Correct Answer: B
B
Explanation:
Check Point’s SecureXL technology, which is responsible for acceleration, has certain limitations and conditions under which acceleration may not occur. In this context, the question is asking about factors that will NOT affect acceleration.
Option B, "A 5-tuple match," will not affect acceleration. A 5-tuple match refers to the matching of source IP, source port, destination IP, destination port, and protocol. SecureXL can accelerate traffic that matches these criteria, but it’s not a factor that hinders acceleration.
Options A, C, and D can all affect acceleration:
Option A mentions "Connections destined to or originated from the Security gateway," which implies that SecureXL acceleration can apply to these connections.
Option C mentions "Multicast packets," and SecureXL may have limitations in handling multicast traffic efficiently.
Option D mentions "Connections that have a Handler (ICMP, FTP, H.323, etc.)," and certain protocols (such as FTP) may require special handling and might not be fully accelerated by SecureXL.
Reference: Check Point Certified Security Expert R81 Study Guide
B
Explanation:
Check Point’s SecureXL technology, which is responsible for acceleration, has certain limitations and conditions under which acceleration may not occur. In this context, the question is asking about factors that will NOT affect acceleration.
Option B, "A 5-tuple match," will not affect acceleration. A 5-tuple match refers to the matching of source IP, source port, destination IP, destination port, and protocol. SecureXL can accelerate traffic that matches these criteria, but it’s not a factor that hinders acceleration.
Options A, C, and D can all affect acceleration:
Option A mentions "Connections destined to or originated from the Security gateway," which implies that SecureXL acceleration can apply to these connections.
Option C mentions "Multicast packets," and SecureXL may have limitations in handling multicast traffic efficiently.
Option D mentions "Connections that have a Handler (ICMP, FTP, H.323, etc.)," and certain protocols (such as FTP) may require special handling and might not be fully accelerated by SecureXL.
Reference: Check Point Certified Security Expert R81 Study Guide
Question #175
What is required for a site-to-site VPN tunnel that does not use certificates?
- A . Pre-Shared Secret
- B . RSA Token
- C . Unique Passwords
- D . SecurelD
Correct Answer: A
A
Explanation:
A pre-shared secret is a secret key that is shared between the two VPN peers before establishing a secure connection. It is used to authenticate the VPN peers and encrypt the VPN traffic. A pre-shared secret is required for a site-to-site VPN tunnel that does not use certificates, because certificates are another way of authenticating the VPN peers using public key cryptography. Without certificates, the VPN peers need to have a common secret key that only they know.
Reference: Check Point R81 VPN Administration Guide, page 13
A
Explanation:
A pre-shared secret is a secret key that is shared between the two VPN peers before establishing a secure connection. It is used to authenticate the VPN peers and encrypt the VPN traffic. A pre-shared secret is required for a site-to-site VPN tunnel that does not use certificates, because certificates are another way of authenticating the VPN peers using public key cryptography. Without certificates, the VPN peers need to have a common secret key that only they know.
Reference: Check Point R81 VPN Administration Guide, page 13
Question #176
What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?
- A . Use Multi-Domain Management Server.
- B . Choose different setting for log storage and SmartEvent db
- C . Install Management and SmartEvent on different machines.
- D . it is not possible.
Correct Answer: C
C
Explanation:
The recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days is to install Management and SmartEvent on different machines. This is because SmartLog and SmartEvent use different databases and storage methods, and having them on separate machines allows for better performance and scalability.
Reference: [SmartLog Administration Guide]
C
Explanation:
The recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days is to install Management and SmartEvent on different machines. This is because SmartLog and SmartEvent use different databases and storage methods, and having them on separate machines allows for better performance and scalability.
Reference: [SmartLog Administration Guide]
Question #177
You pushed a policy to your gateway and you cannot access the gateway remotely any more.
What command should you use to remove the policy from the gateway by logging in through console access?
- A . "fw cpstop"
- B . "fw unloadlocal"
- C . "fwundo"
- D . "fw unloadpolicy”
Correct Answer: B
B
Explanation:
The command that should be used to remove the policy from the gateway by logging in through console access is “fw unloadlocal”. This command will unload all security policies from a gateway or cluster member and allow all traffic to pass through it. This command can be useful for troubleshooting purposes or for emergency access to a gateway.
Reference: [Check Point R81 CLI Reference Guide]
B
Explanation:
The command that should be used to remove the policy from the gateway by logging in through console access is “fw unloadlocal”. This command will unload all security policies from a gateway or cluster member and allow all traffic to pass through it. This command can be useful for troubleshooting purposes or for emergency access to a gateway.
Reference: [Check Point R81 CLI Reference Guide]
Question #178
The Event List within the Event tab contains:
- A . a list of options available for running a query.
- B . the top events, destinations, sources, and users of the query results, either as a chart or in a tallied list.
- C . events generated by a query.
- D . the details of a selected event.
Correct Answer: C
C
Explanation:
The Event List within the Event tab contains events generated by a query. The Event List shows the events that match the query criteria, such as time range, filter, and aggregation. The events can be sorted by different columns, such as severity, time, action, and source3. The other options are either not part of the Event tab or not related to the Event List.
Reference: Check Point R81 Logging and Monitoring Administration Guide
C
Explanation:
The Event List within the Event tab contains events generated by a query. The Event List shows the events that match the query criteria, such as time range, filter, and aggregation. The events can be sorted by different columns, such as severity, time, action, and source3. The other options are either not part of the Event tab or not related to the Event List.
Reference: Check Point R81 Logging and Monitoring Administration Guide
Question #179
The Correlation Unit performs all but the following actions:
- A . Marks logs that individually are not events, but may be part of a larger pattern to be identified later.
- B . Generates an event based on the Event policy.
- C . Assigns a severity level to the event.
- D . Takes a new log entry that is part of a group of items that together make up an event, and adds it to an ongoing event.
Correct Answer: C
C
Explanation:
The Correlation Unit in Check Point Security Management performs several actions, but it does not assign a severity level to the event. The Correlation Unit is responsible for identifying patterns in logs, marking logs that are part of larger patterns, generating events based on the Event policy, and adding new log entries to ongoing events. However, assigning a severity level to an event is typically done through the Event policy configuration, not by the Correlation Unit.
Reference: Check Point Certified Security Expert R81 Study Guide
C
Explanation:
The Correlation Unit in Check Point Security Management performs several actions, but it does not assign a severity level to the event. The Correlation Unit is responsible for identifying patterns in logs, marking logs that are part of larger patterns, generating events based on the Event policy, and adding new log entries to ongoing events. However, assigning a severity level to an event is typically done through the Event policy configuration, not by the Correlation Unit.
Reference: Check Point Certified Security Expert R81 Study Guide
Question #180
What technologies are used to deny or permit network traffic?
- A . Stateful Inspection, Firewall Blade, and URL/Application Blade
- B . Packet Filtering, Stateful Inspection, and Application Layer Firewall
- C . Firewall Blade, URL/Application Blade, and IPS
- D . Stateful Inspection, URL/Application Blade, and Threat Prevention
Correct Answer: B
B
Explanation:
Packet filtering, stateful inspection, and application layer firewall are technologies used to deny or permit network traffic based on different criteria. Packet filtering is a basic firewall technology that examines the header of each packet and compares it to a set of rules to decide whether to allow or drop it. Stateful inspection is an advanced firewall technology that tracks the state and context of each connection and applies security rules based on the connection information. Application layer firewall is a firewall technology that inspects the content and behavior of applications and protocols at the application layer of the OSI model and enforces granular policies based on the application identity, user identity, and content type.
Reference: Check Point R81 Firewall Administration Guide, page 9-10
B
Explanation:
Packet filtering, stateful inspection, and application layer firewall are technologies used to deny or permit network traffic based on different criteria. Packet filtering is a basic firewall technology that examines the header of each packet and compares it to a set of rules to decide whether to allow or drop it. Stateful inspection is an advanced firewall technology that tracks the state and context of each connection and applies security rules based on the connection information. Application layer firewall is a firewall technology that inspects the content and behavior of applications and protocols at the application layer of the OSI model and enforces granular policies based on the application identity, user identity, and content type.
Reference: Check Point R81 Firewall Administration Guide, page 9-10