Check Point 156-315.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #11
In what way is Secure Network Distributor (SND) a relevant feature of the Security Gateway?
- A . SND is a feature to accelerate multiple SSL VPN connections
- B . SND is an alternative to IPSec Main Mode, using only 3 packets
- C . SND is used to distribute packets among Firewall instances
- D . SND is a feature of fw monitor to capture accelerated packets
Correct Answer: C
C
Explanation:
Secure Network Distributor (SND) is a relevant feature of the Security Gateway because it is used to distribute packets among Firewall instances. SND is a technology that improves the performance and scalability of the Security Gateway by using multiple cores to handle concurrent connections. SND consists of two components: SND driver and Firewall instances. SND driver is responsible for receiving packets from network interfaces and distributing them to Firewall instances based on a load balancing algorithm. Firewall instances are responsible for inspecting packets according to security policies and forwarding them to their destinations. The other options are either incorrect or not related to SND.
C
Explanation:
Secure Network Distributor (SND) is a relevant feature of the Security Gateway because it is used to distribute packets among Firewall instances. SND is a technology that improves the performance and scalability of the Security Gateway by using multiple cores to handle concurrent connections. SND consists of two components: SND driver and Firewall instances. SND driver is responsible for receiving packets from network interfaces and distributing them to Firewall instances based on a load balancing algorithm. Firewall instances are responsible for inspecting packets according to security policies and forwarding them to their destinations. The other options are either incorrect or not related to SND.
Question #12
Fill in the blanks: In the Network policy layer, the default action for the Implied last rule is ____ all traffic. However, in the Application Control policy layer, the default action is ______ all traffic.
- A . Accept; redirect
- B . Accept; drop
- C . Redirect; drop
- D . Drop; accept
Correct Answer: D
D
Explanation:
In the Network policy layer, the default action for the Implied last rule is drop all traffic. However, in the Application Control policy layer, the default action is accept all traffic. The Implied last rule is a rule that is automatically added at the end of each policy layer and defines what to do with traffic that does not match any of the user-defined rules. The default actions for each policy layer can be changed in the Global Properties or in the layer properties.
Reference: R81 Security Management Administration Guide, page 30.
D
Explanation:
In the Network policy layer, the default action for the Implied last rule is drop all traffic. However, in the Application Control policy layer, the default action is accept all traffic. The Implied last rule is a rule that is automatically added at the end of each policy layer and defines what to do with traffic that does not match any of the user-defined rules. The default actions for each policy layer can be changed in the Global Properties or in the layer properties.
Reference: R81 Security Management Administration Guide, page 30.
Question #13
Fill in the blank: __________ information is included in “Full Log” tracking option, but is not included
in “Log” tracking option?
- A . Destination port
- B . Data type
- C . File attributes
- D . Application
Correct Answer: B
B
Explanation:
The Full Log tracking option includes more information than the Log tracking option, such as the data type of the traffic. The data type indicates the type of content that was transferred, such as text, image, video, or audio. The data type can be used for filtering and reporting purposes. The Log tracking option only includes basic information, such as source, destination, service, action, and time.
B
Explanation:
The Full Log tracking option includes more information than the Log tracking option, such as the data type of the traffic. The data type indicates the type of content that was transferred, such as text, image, video, or audio. The data type can be used for filtering and reporting purposes. The Log tracking option only includes basic information, such as source, destination, service, action, and time.
Question #14
Fill in the blank: A new license should be generated and installed in all of the following situations EXCEPT when ________ .
- A . The license is attached to the wrong Security Gateway.
- B . The existing license expires.
- C . The license is upgraded.
- D . The IP address of the Security Management or Security Gateway has changed.
Correct Answer: D
D
Explanation:
A new license should be generated and installed in all of the following situations except when the IP address of the Security Management or Security Gateway has changed. This is because Check Point licenses are not bound to IP addresses, but to other parameters such as MAC addresses, CPU IDs, or hostnames. Therefore, changing the IP address of a licensed machine does not affect the validity of the license. However, changing other parameters, such as replacing a network card or renaming a machine, may require a new license. Additionally, when the existing license expires or the license is upgraded to a higher level or a different package, a new license is needed.
D
Explanation:
A new license should be generated and installed in all of the following situations except when the IP address of the Security Management or Security Gateway has changed. This is because Check Point licenses are not bound to IP addresses, but to other parameters such as MAC addresses, CPU IDs, or hostnames. Therefore, changing the IP address of a licensed machine does not affect the validity of the license. However, changing other parameters, such as replacing a network card or renaming a machine, may require a new license. Additionally, when the existing license expires or the license is upgraded to a higher level or a different package, a new license is needed.
Question #15
Check Point security components are divided into the following components:
- A . GUI Client, Security Gateway, WebUI Interface
- B . GUI Client, Security Management, Security Gateway
- C . Security Gateway, WebUI Interface, Consolidated Security Logs
- D . Security Management, Security Gateway, Consolidate Security Logs
Correct Answer: B
B
Explanation:
Check Point security components are divided into the following components: GUI Client, Security Management, Security Gateway. GUI Client is the graphical user interface that allows administrators to configure, manage, and monitor Check Point products and security policies. Security Management is the server that stores and enforces the security policies and provides logging and reporting functions. Security Gateway is the device that inspects and filters network traffic according to the security policies.
B
Explanation:
Check Point security components are divided into the following components: GUI Client, Security Management, Security Gateway. GUI Client is the graphical user interface that allows administrators to configure, manage, and monitor Check Point products and security policies. Security Management is the server that stores and enforces the security policies and provides logging and reporting functions. Security Gateway is the device that inspects and filters network traffic according to the security policies.
Question #16
Identity Awareness lets an administrator easily configure network access and auditing based on three items. Choose the correct statement.
- A . Network location, the identity of a user and the identity of a machine.
- B . Geographical location, the identity of a user and the identity of a machine.
- C . Network location, the identity of a user and the active directory membership.
- D . Network location, the telephone number of a user and the UID of a machine.
Correct Answer: A
A
Explanation:
The correct answer is A. Network location, the identity of a user and the identity of a machine. Identity Awareness allows you to easily configure network access and auditing based on three items: network location, the identity of a user and the identity of a machine1. This enables you to create granular and accurate identity-based policies that control who can access what, when and how. You can also monitor and log user and machine activities for compliance and auditing purposes. Geographical location, the telephone number of a user and the UID of a machine are not the items that Identity Awareness uses to identify and authorize users and machines.
Reference: Identity Awareness – Check Point Software1
A
Explanation:
The correct answer is A. Network location, the identity of a user and the identity of a machine. Identity Awareness allows you to easily configure network access and auditing based on three items: network location, the identity of a user and the identity of a machine1. This enables you to create granular and accurate identity-based policies that control who can access what, when and how. You can also monitor and log user and machine activities for compliance and auditing purposes. Geographical location, the telephone number of a user and the UID of a machine are not the items that Identity Awareness uses to identify and authorize users and machines.
Reference: Identity Awareness – Check Point Software1
Question #17
How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?
- A . Install appliance TE250X on SpanPort on LAN switch in MTA mode.
- B . Install appliance TE250X in standalone mode and setup MTA.
- C . You can utilize only Check Point Cloud Services for this scenario.
- D . It is not possible, always Check Point SGW is needed to forward emails to SandBlast appliance.
Correct Answer: C
C
Explanation:
To deploy a TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway, you can utilize Check Point Cloud Services. In this scenario, you can leverage cloud-based email security services provided by Check Point without the need for an on-premises Security Gateway.
Option C correctly states that you can use only Check Point Cloud Services for this scenario, making it the verified answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
C
Explanation:
To deploy a TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway, you can utilize Check Point Cloud Services. In this scenario, you can leverage cloud-based email security services provided by Check Point without the need for an on-premises Security Gateway.
Option C correctly states that you can use only Check Point Cloud Services for this scenario, making it the verified answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #18
What object type would you use to grant network access to an LDAP user group?
- A . Access Role
- B . Group Template
- C . SmartDirectory Group
- D . User Group
Correct Answer: A
Question #19
What is a feature that enables VPN connections to successfully maintain a private and secure VPN session without employing Stateful Inspection?
- A . Stateful Mode
- B . VPN Routing Mode
- C . Wire Mode
- D . Stateless Mode
Correct Answer: C
C
Explanation:
Wire Mode is a VPN-1 NGX feature that enables VPN connections to successfully fail over, bypassing Security Gateway enforcement. This improves performance and reduces downtime. Based on a trusted source and destination, Wire Mode uses internal interfaces and VPN Communities to maintain a private and secure VPN session, without employing Stateful Inspection. Since Stateful Inspection no longer takes place, dynamic-routing protocols that do not survive state verification in non-Wire Mode configurations can now be deployed. The VPN connection is no different from any other connections along a dedicated wire, thus the meaning of "Wire Mode".
Reference: VPN Administration Guide
C
Explanation:
Wire Mode is a VPN-1 NGX feature that enables VPN connections to successfully fail over, bypassing Security Gateway enforcement. This improves performance and reduces downtime. Based on a trusted source and destination, Wire Mode uses internal interfaces and VPN Communities to maintain a private and secure VPN session, without employing Stateful Inspection. Since Stateful Inspection no longer takes place, dynamic-routing protocols that do not survive state verification in non-Wire Mode configurations can now be deployed. The VPN connection is no different from any other connections along a dedicated wire, thus the meaning of "Wire Mode".
Reference: VPN Administration Guide
Question #20
To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:
- A . fw ctl Dyn_Dispatch on
- B . fw ctl Dyn_Dispatch enable
- C . fw ctl multik set_mode 4
- D . fw ctl multik set_mode 1
Correct Answer: C
C
Explanation:
Dynamic Dispatch is a feature that enhances CoreXL performance by dynamically assigning new connections to CoreXL FW instances based on their CPU utilization1. To enable Dynamic Dispatch on Security Gateway without enabling Firewall Priority Queues (FPQ), you need to run the command fw ctl multik set_mode 4 in Expert mode and reboot2. This command will set the CoreXL mode to Dynamic Dispatcher without FPQ. The other options are not correct because:
A) fw ctl Dyn_Dispatch on: This command does not exist and will return an error message.
B) fw ctl Dyn_Dispatch enable: This command does not exist and will return an error message.
D) fw ctl multik set_mode 1: This command will set the CoreXL mode to Static Dispatcher without FPQ, which is the default mode2. This mode will use a static hash function to assign new connections to CoreXL FW instances based on their IP addresses and protocol.
Reference: CoreXL Dynamic Dispatcher, To fully enable Dynamic Dispatcher on a Security Gateway, Running Dynamic Dispatch / Dynamic Split / Dynamic Balancing on VSEC/IaaS in Vmware, Dynamic Balancing for CoreXL
C
Explanation:
Dynamic Dispatch is a feature that enhances CoreXL performance by dynamically assigning new connections to CoreXL FW instances based on their CPU utilization1. To enable Dynamic Dispatch on Security Gateway without enabling Firewall Priority Queues (FPQ), you need to run the command fw ctl multik set_mode 4 in Expert mode and reboot2. This command will set the CoreXL mode to Dynamic Dispatcher without FPQ. The other options are not correct because:
A) fw ctl Dyn_Dispatch on: This command does not exist and will return an error message.
B) fw ctl Dyn_Dispatch enable: This command does not exist and will return an error message.
D) fw ctl multik set_mode 1: This command will set the CoreXL mode to Static Dispatcher without FPQ, which is the default mode2. This mode will use a static hash function to assign new connections to CoreXL FW instances based on their IP addresses and protocol.
Reference: CoreXL Dynamic Dispatcher, To fully enable Dynamic Dispatcher on a Security Gateway, Running Dynamic Dispatch / Dynamic Split / Dynamic Balancing on VSEC/IaaS in Vmware, Dynamic Balancing for CoreXL