Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #191
If SecureXL is disabled which path is used to process traffic?
- A . Passive path
- B . Medium path
- C . Firewall path
- D . Accelerated path
Correct Answer: C
C
Explanation:
If SecureXL is disabled, which means that packet acceleration is not available, the traffic is processed by the Firewall path. The Firewall path is the slowest path in the Check Point architecture, as it involves a full inspection of each packet by the Firewall kernel and all the enabled Software Blades. The Firewall path is also known as the F2F (Firewall to Firewall) path or the INSPECT path.
Reference: Check Point Architecture
C
Explanation:
If SecureXL is disabled, which means that packet acceleration is not available, the traffic is processed by the Firewall path. The Firewall path is the slowest path in the Check Point architecture, as it involves a full inspection of each packet by the Firewall kernel and all the enabled Software Blades. The Firewall path is also known as the F2F (Firewall to Firewall) path or the INSPECT path.
Reference: Check Point Architecture
Question #192
To find records in the logs that shows log records from the Application & URL Filtering Software Blade where traffic was dropped, what would be the query syntax?
- A . blada: application control AND action:drop
- B . blade."application control AND action;drop
- C . (blade: application control AND action;drop)
- D . blade;"application control AND action:drop
Correct Answer: D
D
Explanation:
The correct query syntax to find records in the logs that show log records from the Application & URL Filtering Software Blade where traffic was dropped is blade;“application control AND action:drop”.
This query uses quotation marks to enclose the values of the blade and action fields, and uses a colon to separate the field name from the value. The query also uses AND to combine two conditions that must be met for a log record to match.
Reference: [Searching Logs]
D
Explanation:
The correct query syntax to find records in the logs that show log records from the Application & URL Filtering Software Blade where traffic was dropped is blade;“application control AND action:drop”.
This query uses quotation marks to enclose the values of the blade and action fields, and uses a colon to separate the field name from the value. The query also uses AND to combine two conditions that must be met for a log record to match.
Reference: [Searching Logs]
Question #193
Which of the following is NOT an option to calculate the traffic direction?
- A . Incoming
- B . Internal
- C . External
- D . Outgoing
Correct Answer: D
D
Explanation:
The option that is NOT an option to calculate the traffic direction is Outgoing. Traffic direction is a parameter that determines how traffic is classified as internal or external based on its source and destination. Traffic direction can be calculated using three options: Incoming, Internal, or External. Incoming means that traffic is classified as internal if its destination is one of the Security Gateway’s interfaces, and external otherwise. Internal means that traffic is classified as internal if its source or destination belongs to one of the internal networks defined in the topology, and external otherwise. External means that traffic is classified as internal if both its source and destination belong to one of the internal networks defined in the topology, and external otherwise. Outgoing is not a valid option
to calculate traffic direction.
D
Explanation:
The option that is NOT an option to calculate the traffic direction is Outgoing. Traffic direction is a parameter that determines how traffic is classified as internal or external based on its source and destination. Traffic direction can be calculated using three options: Incoming, Internal, or External. Incoming means that traffic is classified as internal if its destination is one of the Security Gateway’s interfaces, and external otherwise. Internal means that traffic is classified as internal if its source or destination belongs to one of the internal networks defined in the topology, and external otherwise. External means that traffic is classified as internal if both its source and destination belong to one of the internal networks defined in the topology, and external otherwise. Outgoing is not a valid option
to calculate traffic direction.
Question #194
Which one is not a valid upgrade method to R81.20?
- A . RPM Upgrade
- B . Upgrade with Migration
- C . Advanced Upgrade
- D . CPUSE Upgrade
Correct Answer: A
A
Explanation:
RPM upgrade is not a valid upgrade method to R81.20. RPM upgrade is a method of upgrading from R80.20.M1 to R80.20.M2 or later, but it is not supported for upgrading to R81.20. The valid upgrade methods to R81.20 are CPUSE upgrade, advanced upgrade, and upgrade with migration.
Reference: [Check Point Security Expert R81 Installation and Upgrade Guide], page 12.
A
Explanation:
RPM upgrade is not a valid upgrade method to R81.20. RPM upgrade is a method of upgrading from R80.20.M1 to R80.20.M2 or later, but it is not supported for upgrading to R81.20. The valid upgrade methods to R81.20 are CPUSE upgrade, advanced upgrade, and upgrade with migration.
Reference: [Check Point Security Expert R81 Installation and Upgrade Guide], page 12.
Question #195
Which command is used to obtain the configuration lock in Gaia?
- A . Lock database override
- B . Unlock database override
- C . Unlock database lock
- D . Lock database user
Correct Answer: A
A
Explanation:
Which command is used to obtain the configuration lock in Gaia? The command that is used to obtain the configuration lock in Gaia is lock database override. This command allows a user to take over the configuration lock from another user who is currently logged in with read/write access. The other user will be forced to logout and will lose any unsaved changes. This command should be used with caution and only when necessary.
Reference: Gaia Administration Guide R81, page 15.
A
Explanation:
Which command is used to obtain the configuration lock in Gaia? The command that is used to obtain the configuration lock in Gaia is lock database override. This command allows a user to take over the configuration lock from another user who is currently logged in with read/write access. The other user will be forced to logout and will lose any unsaved changes. This command should be used with caution and only when necessary.
Reference: Gaia Administration Guide R81, page 15.
Question #196
When performing a minimal effort upgrade, what will happen to the network traffic?
- A . All connections that were initiated before the upgrade will be dropped, causing network downtime
- B . All connections that were initiated before the upgrade will be handled normally
- C . All connections that were initiated before the upgrade will be handled by the standby gateway
- D . All connections that were initiated before the upgrade will be handled by the active gateway
Correct Answer: B
B
Explanation:
A minimal effort upgrade is a process of upgrading the Security Gateway software without changing the configuration or policy. It is done by using the CPUSE (Check Point Update Service Engine) tool, which is available in the Gaia Portal or CLI. The CPUSE tool performs a pre-upgrade verification to check the compatibility and readiness of the system for the upgrade. If the verification passes, the CPUSE tool installs the new software package and reboots the system. During the reboot, there is a short network downtime, but it does not affect the existing connections. All connections that were initiated before the upgrade will be handled normally by the upgraded gateway. The minimal effort upgrade preserves the existing configuration and policy, so there is no need to reinstall the policy or reconfigure the gateway after the upgrade.
Reference: Check Point Upgrade Path and Management Servers and Security Gateways Compatibility Maps, section “Minimal Effort Upgrade”
INSTALLATION AND UPGRADE GUIDE R81, page 21-22
B
Explanation:
A minimal effort upgrade is a process of upgrading the Security Gateway software without changing the configuration or policy. It is done by using the CPUSE (Check Point Update Service Engine) tool, which is available in the Gaia Portal or CLI. The CPUSE tool performs a pre-upgrade verification to check the compatibility and readiness of the system for the upgrade. If the verification passes, the CPUSE tool installs the new software package and reboots the system. During the reboot, there is a short network downtime, but it does not affect the existing connections. All connections that were initiated before the upgrade will be handled normally by the upgraded gateway. The minimal effort upgrade preserves the existing configuration and policy, so there is no need to reinstall the policy or reconfigure the gateway after the upgrade.
Reference: Check Point Upgrade Path and Management Servers and Security Gateways Compatibility Maps, section “Minimal Effort Upgrade”
INSTALLATION AND UPGRADE GUIDE R81, page 21-22
Question #197
How often does Threat Emulation download packages by default?
- A . Once a week
- B . Once an hour
- C . Twice per day
- D . Once per day
Correct Answer: D
D
Explanation:
Threat Emulation downloads packages by default once per day. The packages contain updates for the Threat Emulation engine, signatures, and images. The download frequency can be changed in the Threat Prevention policy settings.
Reference: Threat Emulation Administration Guide, Threat Prevention R81 Release Notes
D
Explanation:
Threat Emulation downloads packages by default once per day. The packages contain updates for the Threat Emulation engine, signatures, and images. The download frequency can be changed in the Threat Prevention policy settings.
Reference: Threat Emulation Administration Guide, Threat Prevention R81 Release Notes
Question #198
Gaia has two default user accounts that cannot be deleted.
What are those user accounts?
- A . Admin and Default
- B . Expert and Clish
- C . Control and Monitor
- D . Admin and Monitor
Correct Answer: D
D
Explanation:
Gaia has two default user accounts that cannot be deleted: Admin and Monitor. Admin is a superuser account that has full access to all Gaia features and commands. Monitor is a read-only account that can view Gaia configuration and status but cannot make any changes. Both accounts have predefined passwords that can be changed by the Admin user.
Reference: [Check Point R81 Gaia Administration Guide], page 29
SRC: GAIA R81.20 Administration Guide User Management -> Users These users are created by default and cannot be deleted: admin and monitor
D
Explanation:
Gaia has two default user accounts that cannot be deleted: Admin and Monitor. Admin is a superuser account that has full access to all Gaia features and commands. Monitor is a read-only account that can view Gaia configuration and status but cannot make any changes. Both accounts have predefined passwords that can be changed by the Admin user.
Reference: [Check Point R81 Gaia Administration Guide], page 29
SRC: GAIA R81.20 Administration Guide User Management -> Users These users are created by default and cannot be deleted: admin and monitor
Question #199
Fill in the blank: The command ___________________ provides the most complete restoration of a R81 configuration.
- A . upgrade_import
- B . cpconfig
- C . fwm dbimport -p <export file>
- D . cpinfo Crecover
Correct Answer: A
Question #200
Which software blade does NOT accompany the Threat Prevention policy?
- A . Anti-virus
- B . IPS
- C . Threat Emulation
- D . Application Control and URL Filtering
Correct Answer: D
D
Explanation:
Which software blade does NOT accompany the Threat Prevention policy? Application Control and URL Filtering software blade does not accompany the Threat Prevention policy. The Threat Prevention policy is a unified policy that includes Anti-virus, IPS, Anti-bot, and Threat Emulation software blades. Application Control and URL Filtering software blade is part of the Access Control policy, which is a separate policy that controls network access based on users, applications, content, and other criteria.
Reference: R81 Security Management Administration Guide, page 29.
D
Explanation:
Which software blade does NOT accompany the Threat Prevention policy? Application Control and URL Filtering software blade does not accompany the Threat Prevention policy. The Threat Prevention policy is a unified policy that includes Anti-virus, IPS, Anti-bot, and Threat Emulation software blades. Application Control and URL Filtering software blade is part of the Access Control policy, which is a separate policy that controls network access based on users, applications, content, and other criteria.
Reference: R81 Security Management Administration Guide, page 29.