Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #201
After some changes in the firewall policy you run into some issues. You want to test if the policy from two weeks ago have the same issue. You don’t want to lose the changes from the last weeks.
What is the best way to do it?
- A . Use the Gaia WebUI to take a backup of the Gateway. In SmartConsole under Security Policies go to the Installation History view of the Gateway, select the policy version from two weeks ago and press the ‘Install specific version’ button
- B . Use the Gaia WebUI to take a snapshot of management. In the In SmartConsole under Manage & Settlings go to Sessions -> Revisions and select the revision from two
weeks ago. Run the action ‘Revert to this revision…’ Restore the management snapshot. - C . In SmartConsole under Manage & Settings go to Sessions -> Revisions and select the revision from two weeks ago. Run the action ‘Revert to this revision…’.
- D . In SmartConsole under Security Policies go to the Installation History view of the Gateway, select the policy version from two weeks ago and press the ‘Install specific version’ button
Correct Answer: D
D
Explanation:
The best way to test if the policy from two weeks ago have the same issue is to install the specific version of the policy from the installation history view of the gateway. This way, you can keep the changes from the last weeks in the management server and revert back to them later if needed. You do not need to take a backup or a snapshot of the gateway or the management server for this purpose.
Reference: [Check Point Security Expert R81 Administration Guide], page 34.
D
Explanation:
The best way to test if the policy from two weeks ago have the same issue is to install the specific version of the policy from the installation history view of the gateway. This way, you can keep the changes from the last weeks in the management server and revert back to them later if needed. You do not need to take a backup or a snapshot of the gateway or the management server for this purpose.
Reference: [Check Point Security Expert R81 Administration Guide], page 34.
Question #202
In which scenario will an administrator need to manually define Proxy ARP?
- A . When they configure an "Automatic Static NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.
- B . When they configure an "Automatic Hide NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.
- C . When they configure a "Manual Static NAT" which translates to an IP address that does not belong to one of the firewall’s interfaces.
- D . When they configure a "Manual Hide NAT" which translates to an IP address that belongs to one of the firewall’s interfaces.
Correct Answer: C
C
Explanation:
Proxy ARP is a technique that allows a device to respond to ARP requests on behalf of another IP address. Proxy ARP is required for Manual Static NAT when the translated IP address does not belong to one of the firewall’s interfaces. This is because the firewall needs to intercept the packets destined to the translated IP address and forward them to the original IP address after applying the NAT rule. Without Proxy ARP, the packets would not reach the firewall and the NAT would not work. Proxy ARP is not required for Automatic Static NAT or Automatic Hide NAT, because these types of NAT use IP addresses that belong to the firewall’s interfaces. Proxy ARP is also not required for Manual Hide NAT, because this type of NAT does not change the destination IP address of the packets, only the source IP address.
Reference: Check Point R81 Security Management Administration Guide, page 115
C
Explanation:
Proxy ARP is a technique that allows a device to respond to ARP requests on behalf of another IP address. Proxy ARP is required for Manual Static NAT when the translated IP address does not belong to one of the firewall’s interfaces. This is because the firewall needs to intercept the packets destined to the translated IP address and forward them to the original IP address after applying the NAT rule. Without Proxy ARP, the packets would not reach the firewall and the NAT would not work. Proxy ARP is not required for Automatic Static NAT or Automatic Hide NAT, because these types of NAT use IP addresses that belong to the firewall’s interfaces. Proxy ARP is also not required for Manual Hide NAT, because this type of NAT does not change the destination IP address of the packets, only the source IP address.
Reference: Check Point R81 Security Management Administration Guide, page 115
Question #203
Identify the API that is not supported by Check Point currently.
- A . R81 Management API-
- B . Identity Awareness Web Services API
- C . Open REST API
- D . OPSEC SDK
Correct Answer: C
C
Explanation:
Check Point currently supports four types of APIs: R81 Management API, Identity Awareness Web Services API, OPSEC SDK, and Gaia REST API. The Open REST API is not a valid option.
Reference: Check Point APIs
C
Explanation:
Check Point currently supports four types of APIs: R81 Management API, Identity Awareness Web Services API, OPSEC SDK, and Gaia REST API. The Open REST API is not a valid option.
Reference: Check Point APIs
Question #204
What is the benefit of “tw monitor” over “tcpdump”?
- A . “fw monitor” reveals Layer 2 information, while “tcpdump” acts at Layer 3.
- B . “fw monitor” is also available for 64-Bit operating systems.
- C . With “fw monitor”, you can see the inspection points, which cannot be seen in “tcpdump”
- D . “fw monitor” can be used from the CLI of the Management Server to collect information from multiple gateways.
Correct Answer: C
C
Explanation:
The benefit of fw monitor over tcpdump is that with fw monitor, you can see the inspection points, which cannot be seen in tcpdump. Inspection points are the locations in the firewall kernel where packets are inspected by the security policy and other software blades. Fw monitor allows you to capture packets at different inspection points and see how they are processed by the firewall. Tcpdump, on the other hand, is a generic packet capture tool that only shows the packets as they enter or leave the network interface.
Reference: Check Point Security Expert R81 Course, fw monitor, tcpdump
C
Explanation:
The benefit of fw monitor over tcpdump is that with fw monitor, you can see the inspection points, which cannot be seen in tcpdump. Inspection points are the locations in the firewall kernel where packets are inspected by the security policy and other software blades. Fw monitor allows you to capture packets at different inspection points and see how they are processed by the firewall. Tcpdump, on the other hand, is a generic packet capture tool that only shows the packets as they enter or leave the network interface.
Reference: Check Point Security Expert R81 Course, fw monitor, tcpdump
Question #205
What are possible Automatic Reactions in SmartEvent?
- A . Mail. SNMP Trap, Block Source. Block Event Activity, External Script
- B . Web Mail. Block Destination, SNMP Trap. SmartTask
- C . Web Mail, Block Service. SNMP Trap. SmartTask, Geo Protection
- D . Web Mail, Forward to SandBlast Appliance, SNMP Trap, External Script
Correct Answer: A
A
Explanation:
The possible Automatic Reactions in SmartEvent are Mail, SNMP Trap, Block Source, Block Event Activity, and External Script1. Automatic Reactions are actions that SmartEvent can perform automatically when a specific event occurs2. They can help you respond quickly and efficiently to security incidents and threats2.
The Automatic Reactions are1:
Mail: This reaction sends an email notification to a specified recipient with the details of the event. You can customize the subject and the body of the email, and use variables to include relevant information.
SNMP Trap: This reaction sends an SNMP trap to a specified SNMP server with the details of the event. You can customize the OID and the community string of the trap, and use variables to include relevant information.
Block Source: This reaction blocks the source IP address of the event from accessing your network for a specified duration. You can choose to block the source on all gateways or on specific gateways. You can also choose to block the source on a specific port or service.
Block Event Activity: This reaction blocks the specific activity that triggered the event from occurring again for a specified duration. You can choose to block the activity on all gateways or on specific gateways. You can also choose to block the activity on a specific port or service.
External Script: This reaction runs an external script on a specified server with the details of the event as arguments. You can use any script that can be executed by the operating system of the server, such as bash, perl, python, etc. You can use variables to include relevant information in the script arguments.
Reference: SmartEvent R81.20 Administration Guide – Check Point Software, SmartEvent – Check Point Software
A
Explanation:
The possible Automatic Reactions in SmartEvent are Mail, SNMP Trap, Block Source, Block Event Activity, and External Script1. Automatic Reactions are actions that SmartEvent can perform automatically when a specific event occurs2. They can help you respond quickly and efficiently to security incidents and threats2.
The Automatic Reactions are1:
Mail: This reaction sends an email notification to a specified recipient with the details of the event. You can customize the subject and the body of the email, and use variables to include relevant information.
SNMP Trap: This reaction sends an SNMP trap to a specified SNMP server with the details of the event. You can customize the OID and the community string of the trap, and use variables to include relevant information.
Block Source: This reaction blocks the source IP address of the event from accessing your network for a specified duration. You can choose to block the source on all gateways or on specific gateways. You can also choose to block the source on a specific port or service.
Block Event Activity: This reaction blocks the specific activity that triggered the event from occurring again for a specified duration. You can choose to block the activity on all gateways or on specific gateways. You can also choose to block the activity on a specific port or service.
External Script: This reaction runs an external script on a specified server with the details of the event as arguments. You can use any script that can be executed by the operating system of the server, such as bash, perl, python, etc. You can use variables to include relevant information in the script arguments.
Reference: SmartEvent R81.20 Administration Guide – Check Point Software, SmartEvent – Check Point Software
Question #206
When doing a Stand-Alone Installation, you would install the Security Management Server with which other Check Point architecture component?
- A . None, Security Management Server would be installed by itself.
- B . SmartConsole
- C . SecureClient
- D . Security Gateway
- E . SmartEvent
Correct Answer: D
D
Explanation:
When doing a Stand-Alone Installation, you would install the Security Management Server with the Security Gateway as the other Check Point architecture component. A Stand-Alone Installation is where the Security Management Server and the Security Gateway are installed on the same machine2. The other options are either not Check Point architecture components, or not suitable for a Stand-Alone Installation.
Reference: Check Point R81 Installation and Upgrade Guide
D
Explanation:
When doing a Stand-Alone Installation, you would install the Security Management Server with the Security Gateway as the other Check Point architecture component. A Stand-Alone Installation is where the Security Management Server and the Security Gateway are installed on the same machine2. The other options are either not Check Point architecture components, or not suitable for a Stand-Alone Installation.
Reference: Check Point R81 Installation and Upgrade Guide
Question #207
For best practices, what is the recommended time for automatic unlocking of locked admin accounts?
- A . 20 minutes
- B . 15 minutes
- C . Admin account cannot be unlocked automatically
- D . 30 minutes at least
Correct Answer: D
D
Explanation:
For best practices, the recommended time for automatic unlocking of locked admin accounts is 30 minutes at least. Admin accounts can be locked due to failed login attempts, password expiration, or manual locking by another admin. To prevent unauthorized access or brute force attacks, locked admin accounts should not be unlocked automatically too soon. The recommended minimum time for automatic unlocking is 30 minutes, which can be configured from the SmartConsole under Manage > Permissions and Administrators > Advanced > Unlock locked administrators after.
D
Explanation:
For best practices, the recommended time for automatic unlocking of locked admin accounts is 30 minutes at least. Admin accounts can be locked due to failed login attempts, password expiration, or manual locking by another admin. To prevent unauthorized access or brute force attacks, locked admin accounts should not be unlocked automatically too soon. The recommended minimum time for automatic unlocking is 30 minutes, which can be configured from the SmartConsole under Manage > Permissions and Administrators > Advanced > Unlock locked administrators after.
Question #208
Which of the following is NOT supported by CPUSE?
- A . Automatic download of full installation and upgrade packages
- B . Automatic download of hotfixes
- C . Installation of private hotfixes
- D . Offline installations
Correct Answer: D
D
Explanation:
The option that is not supported by CPUSE is offline installations. CPUSE (Check Point Update Service Engine) is a Gaia software update agent that manages software updates on Gaia OS and Check Point products. It requires an internet connection to download and install updates from the Check Point Cloud or a local Deployment Agent. The other options are supported by CPUSE. It can automatically download full installation and upgrade packages, hotfixes, and private hotfixes. It can also install them manually or automatically according to a schedule.
Reference: [CPUSE Overview]
https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_AdminWebAdminGuide/html_frameset.htm?topic=documents/R77/CP_R77_Gaia_AdminWebAdminGuide/112109
D
Explanation:
The option that is not supported by CPUSE is offline installations. CPUSE (Check Point Update Service Engine) is a Gaia software update agent that manages software updates on Gaia OS and Check Point products. It requires an internet connection to download and install updates from the Check Point Cloud or a local Deployment Agent. The other options are supported by CPUSE. It can automatically download full installation and upgrade packages, hotfixes, and private hotfixes. It can also install them manually or automatically according to a schedule.
Reference: [CPUSE Overview]
https://sc1.checkpoint.com/documents/R77/CP_R77_Gaia_AdminWebAdminGuide/html_frameset.htm?topic=documents/R77/CP_R77_Gaia_AdminWebAdminGuide/112109
Question #209
What is the difference between SSL VPN and IPSec VPN?
- A . IPSec VPN does not require installation of a resilient VPN client.
- B . SSL VPN requires installation of a resident VPN client.
- C . SSL VPN and IPSec VPN are the same.
- D . IPSec VPN requires installation of a resident VPN client and SSL VPN requires only an installed Browser.
Correct Answer: D
D
Explanation:
The main difference between SSL VPN (Secure Sockets Layer Virtual Private Network) and IPSec VPN (Internet Protocol Security Virtual Private Network) is in the way they operate:
SSL VPN typically does not require the installation of a resident VPN client. It often relies on a web browser to establish the VPN connection, making it more convenient for remote users who may not want to install dedicated VPN software.
IPSec VPN, on the other hand, often requires the installation of a resident VPN client on the user’s device to establish the VPN connection. This client software is necessary for configuring and managing the VPN connection.
Option C, stating that SSL VPN and IPSec VPN are the same, is incorrect because they have distinct characteristics as described above.
Option A is incorrect because it inaccurately suggests that IPSec VPN does not require a resident VPN client, which is not true in most cases.
Option B is incorrect because it wrongly claims that SSL VPN requires the installation of a resident VPN client.
Reference: Check Point Certified Security Expert R81 Study Guide
D
Explanation:
The main difference between SSL VPN (Secure Sockets Layer Virtual Private Network) and IPSec VPN (Internet Protocol Security Virtual Private Network) is in the way they operate:
SSL VPN typically does not require the installation of a resident VPN client. It often relies on a web browser to establish the VPN connection, making it more convenient for remote users who may not want to install dedicated VPN software.
IPSec VPN, on the other hand, often requires the installation of a resident VPN client on the user’s device to establish the VPN connection. This client software is necessary for configuring and managing the VPN connection.
Option C, stating that SSL VPN and IPSec VPN are the same, is incorrect because they have distinct characteristics as described above.
Option A is incorrect because it inaccurately suggests that IPSec VPN does not require a resident VPN client, which is not true in most cases.
Option B is incorrect because it wrongly claims that SSL VPN requires the installation of a resident VPN client.
Reference: Check Point Certified Security Expert R81 Study Guide
Question #210
What is the difference between an event and a log?
- A . Events are generated at gateway according to Event Policy
- B . A log entry becomes an event when it matches any rule defined in Event Policy
- C . Events are collected with SmartWorkflow form Trouble Ticket systems
- D . Log and Events are synonyms
Correct Answer: B
B
Explanation:
The difference between an event and a log is that a log entry becomes an event when it matches any rule defined in Event Policy. A log entry is a record of a network activity that is generated by a Security Gateway or a Management Server. An event is a log entry that meets certain criteria and triggers an action or a notification. The other options are either not true or not accurate definitions of events and logs.
Reference: Check Point R81 Logging and Monitoring Administration Guide
B
Explanation:
The difference between an event and a log is that a log entry becomes an event when it matches any rule defined in Event Policy. A log entry is a record of a network activity that is generated by a Security Gateway or a Management Server. An event is a log entry that meets certain criteria and triggers an action or a notification. The other options are either not true or not accurate definitions of events and logs.
Reference: Check Point R81 Logging and Monitoring Administration Guide