Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #211
VPN Link Selection will perform the following when the primary VPN link goes down?
- A . The Firewall will drop the packets.
- B . The Firewall can update the Link Selection entries to start using a different link for the same tunnel.
- C . The Firewall will send out the packet on all interfaces.
- D . The Firewall will inform the client that the tunnel is down.
Correct Answer: B
B
Explanation:
VPN Link Selection is a feature that allows the Security Gateway to select the best link for each VPN tunnel based on the network topology and the Link Selection configuration1. When the primary VPN link goes down, the Firewall can update the Link Selection entries to start using a different link for the same tunnel, as long as the remote peer supports this feature and has multiple IP addresses configured2. This way, the VPN tunnel can be maintained without interruption or renegotiation. The other options are not correct because:
B
Explanation:
VPN Link Selection is a feature that allows the Security Gateway to select the best link for each VPN tunnel based on the network topology and the Link Selection configuration1. When the primary VPN link goes down, the Firewall can update the Link Selection entries to start using a different link for the same tunnel, as long as the remote peer supports this feature and has multiple IP addresses configured2. This way, the VPN tunnel can be maintained without interruption or renegotiation. The other options are not correct because:
A) The Firewall will not drop the packets, but will try to send them over another link if possible.
C) The Firewall will not send out the packet on all interfaces, but will use the routing table to determine the best interface for each destination.
D) The Firewall will not inform the client that the tunnel is down, but will try to keep the tunnel up by switching to another link.
Reference: IPSec VPN – Link Selection, Outgoing VPN Link Selection on a gateway with multiple external interfaces
Question #212
What is a possible command to delete all of the SSH connections of a gateway?
- A . fw sam -I dport 22
- B . fw ctl conntab -x -dpott=22
- C . fw tab -t connections -x -e 00000016
- D . fwaccel dos config set dport ssh
Correct Answer: A
A
Explanation:
The command ‘fw sam -I dport 22’ will delete all of the SSH connections of a gateway by adding a temporary rule to the Security Policy that blocks traffic with destination port 22. The other commands are not valid or do not have the same effect.
Reference: Check Point R81 Command Line Interface Reference Guide, page 101.
A
Explanation:
The command ‘fw sam -I dport 22’ will delete all of the SSH connections of a gateway by adding a temporary rule to the Security Policy that blocks traffic with destination port 22. The other commands are not valid or do not have the same effect.
Reference: Check Point R81 Command Line Interface Reference Guide, page 101.
Question #213
Which is not a blade option when configuring SmartEvent?
- A . Correlation Unit
- B . SmartEvent Unit
- C . SmartEvent Server
- D . Log Server
Correct Answer: B
B
Explanation:
SmartEvent Unit is not a blade option when configuring SmartEvent. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules. SmartEvent Unit is not a valid component or blade of SmartEvent.
B
Explanation:
SmartEvent Unit is not a blade option when configuring SmartEvent. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules. SmartEvent Unit is not a valid component or blade of SmartEvent.
Question #214
What is the correct description for the Dynamic Balancing / Split feature?
- A . Dynamic Balancing / Split dynamically change the number of SND’s and firewall instances based on the current load. It is only available on Quantum Appliances and Open Server (not on Quantum Spark)
- B . Dynamic Balancing / Split dynamically distribute the traffic from one network interface to multiple SND’s. The interface must support Multi-Queue. It is only available on Quantum Appliances and Open Server (not on Quantum Spark)
- C . Dynamic Balancing / Split dynamically distribute the traffic from one network interface to multiple SND’s. The interface must support Multi-Queue. It is only available on Quantum Appliances (not on Quantum Spark or Open Server)
- D . Dynamic Balancing / Split dynamically change the number of SND’s and firewall instances based on the current load. It is only available on Quantum Appliances (not on Quantum Spark or Open Server)
Correct Answer: D
D
Explanation:
The correct description for the Dynamic Balancing / Split feature is:
Dynamic Balancing / Split dynamically change the number of SND’s and firewall instances based on the current load.
It is only available on Quantum Appliances (not on Quantum Spark or Open Server)
The Dynamic Balancing / Split feature is a performance-enhancing daemon that balances the load between CoreXL SNDs and CoreXL Firewalls. It monitors the average CPU utilization of CoreXL Firewall and SND instances and automatically increases or decreases the number of CoreXL Firewall instances. The Dynamic Balancing Daemon (dsd) has three stages in each iteration: Examine the current CPU utilization, Calculate the optimal split, and Apply the new split1.
The Dynamic Balancing / Split feature is supported on Check Point Appliances, such as Quantum Appliances, Quantum Maestro, Quantum Security Gateways, and Quantum LightSpeed Appliances in KPPAK mode2. It is not supported on Quantum Spark appliances, which are designed for small and medium businesses. It is also not supported on Open Server platforms, which are general-purpose servers that run Check Point software on top of third-party operating systems.
Reference: Dynamic Balancing for CoreXL; Maestro and Dynamic Balancing (Dynamic Split); Dynamic Balancing available on R80.40; [Quantum Spark Appliances]; [Open Server]
D
Explanation:
The correct description for the Dynamic Balancing / Split feature is:
Dynamic Balancing / Split dynamically change the number of SND’s and firewall instances based on the current load.
It is only available on Quantum Appliances (not on Quantum Spark or Open Server)
The Dynamic Balancing / Split feature is a performance-enhancing daemon that balances the load between CoreXL SNDs and CoreXL Firewalls. It monitors the average CPU utilization of CoreXL Firewall and SND instances and automatically increases or decreases the number of CoreXL Firewall instances. The Dynamic Balancing Daemon (dsd) has three stages in each iteration: Examine the current CPU utilization, Calculate the optimal split, and Apply the new split1.
The Dynamic Balancing / Split feature is supported on Check Point Appliances, such as Quantum Appliances, Quantum Maestro, Quantum Security Gateways, and Quantum LightSpeed Appliances in KPPAK mode2. It is not supported on Quantum Spark appliances, which are designed for small and medium businesses. It is also not supported on Open Server platforms, which are general-purpose servers that run Check Point software on top of third-party operating systems.
Reference: Dynamic Balancing for CoreXL; Maestro and Dynamic Balancing (Dynamic Split); Dynamic Balancing available on R80.40; [Quantum Spark Appliances]; [Open Server]
Question #215
What kind of information would you expect to see using the sim affinity command?
- A . The VMACs used in a Security Gateway cluster
- B . The involved firewall kernel modules in inbound and outbound packet chain
- C . Overview over SecureXL templated connections
- D . Network interfaces and core distribution used for CoreXL
Correct Answer: D
D
Explanation:
The kind of information that you would expect to see using the sim affinity command is network interfaces and core distribution used for CoreXL. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. CoreXL is a technology that improves the performance of the Security Gateway by using multiple cores to handle concurrent connections. The sim affinity command can show which network interfaces and SecureXL instances are bound to which CPU cores, and allow administrators to change the affinity settings.
D
Explanation:
The kind of information that you would expect to see using the sim affinity command is network interfaces and core distribution used for CoreXL. Sim affinity is a command that allows administrators to view and modify the CPU core affinity of network interfaces and SecureXL instances. CoreXL is a technology that improves the performance of the Security Gateway by using multiple cores to handle concurrent connections. The sim affinity command can show which network interfaces and SecureXL instances are bound to which CPU cores, and allow administrators to change the affinity settings.
Question #216
Which utility allows you to configure the DHCP service on Gaia from the command line?
- A . ifconfig
- B . dhcp_ofg
- C . sysconfig
- D . cpconfig
Correct Answer: C
C
Explanation:
The utility that allows you to configure the DHCP service on Gaia from the command line is sysconfig. This utility provides a menu-based interface for configuring various system settings, including network interfaces, routing, DNS, NTP, SNMP, SSH, etc. One of the options in sysconfig is DHCP Server Configuration, which allows you to enable or disable the DHCP service, define DHCP scopes, set lease time, etc.
Reference: Gaia Administration Guide R81, page 29.
C
Explanation:
The utility that allows you to configure the DHCP service on Gaia from the command line is sysconfig. This utility provides a menu-based interface for configuring various system settings, including network interfaces, routing, DNS, NTP, SNMP, SSH, etc. One of the options in sysconfig is DHCP Server Configuration, which allows you to enable or disable the DHCP service, define DHCP scopes, set lease time, etc.
Reference: Gaia Administration Guide R81, page 29.
Question #217
Which Check Point daemon invokes and monitors critical processes and attempts to restart them if they fail?
- A . fwm
- B . cpd
- C . cpwd
- D . cpm
Correct Answer: C
C
Explanation:
The Check Point WatchDog daemon (cpwd) invokes and monitors critical processes and attempts to restart them if they fail. The cpwd daemon is responsible for starting processes such as cpd, cpm, fwm, fwd, and others. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The cpm daemon is the Check Point Management Server daemon that handles database operations and policy installation. The fwm daemon is the Firewall Management daemon that handles communication between Security Gateways and Security Management Servers.
Reference: Check Point Software, Getting Started, WatchDog Daemon;: Check Point Software, Getting Started, Processes.
C
Explanation:
The Check Point WatchDog daemon (cpwd) invokes and monitors critical processes and attempts to restart them if they fail. The cpwd daemon is responsible for starting processes such as cpd, cpm, fwm, fwd, and others. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The cpm daemon is the Check Point Management Server daemon that handles database operations and policy installation. The fwm daemon is the Firewall Management daemon that handles communication between Security Gateways and Security Management Servers.
Reference: Check Point Software, Getting Started, WatchDog Daemon;: Check Point Software, Getting Started, Processes.
Question #218
What are the attributes that SecureXL will check after the connection is allowed by Security Policy?
- A . Source address, Destination address, Source port, Destination port, Protocol
- B . Source MAC address, Destination MAC address, Source port, Destination port, Protocol
- C . Source address, Destination address, Source port, Destination port
- D . Source address, Destination address, Destination port, Protocol
Correct Answer: A
A
Explanation:
The attributes that SecureXL will check after the connection is allowed by Security Policy are Source address, Destination address, Source port, Destination port, Protocol. These are the five tuple parameters that define a connection and are used by SecureXL to accelerate the traffic. The other options are either missing some of the parameters or include irrelevant ones, such as MAC addresses1.
Reference: Check Point R81 SecureXL Administration Guide
A
Explanation:
The attributes that SecureXL will check after the connection is allowed by Security Policy are Source address, Destination address, Source port, Destination port, Protocol. These are the five tuple parameters that define a connection and are used by SecureXL to accelerate the traffic. The other options are either missing some of the parameters or include irrelevant ones, such as MAC addresses1.
Reference: Check Point R81 SecureXL Administration Guide
Question #219
Which Mobile Access Solution is clientless?
- A . Mobile Access Portal
- B . Checkpoint Mobile
- C . Endpoint Security Suite
- D . SecuRemote
Correct Answer: A
A
Explanation:
Mobile Access Portal is a clientless solution that provides secure web access to corporate resources from any device and any browser. Mobile Access Portal uses SSL encryption and authentication to protect the data and the identity of the users. Mobile Access Portal supports various types of web applications, such as webmail, file shares, intranet sites, and web-based applications.
The references are:
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 15 Check Point R81 Mobile Access Blade Administration Guide, page 7 [Check Point Mobile Access Software Blade]
A
Explanation:
Mobile Access Portal is a clientless solution that provides secure web access to corporate resources from any device and any browser. Mobile Access Portal uses SSL encryption and authentication to protect the data and the identity of the users. Mobile Access Portal supports various types of web applications, such as webmail, file shares, intranet sites, and web-based applications.
The references are:
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 15 Check Point R81 Mobile Access Blade Administration Guide, page 7 [Check Point Mobile Access Software Blade]
Question #220
Which of the following statements is TRUE about R81 management plug-ins?
- A . The plug-in is a package installed on the Security Gateway.
- B . Installing a management plug-in requires a Snapshot, just like any upgrade process.
- C . A management plug-in interacts with a Security Management Server to provide new features and support for new products.
- D . Using a plug-in offers full central management only if special licensing is applied to specific features of the plug-in.
Correct Answer: C
C
Explanation:
A management plug-in is a software component that interacts with a Security Management Server to provide new features and support for new products. A management plug-in can extend the functionality of SmartConsole, SmartDashboard, SmartView Monitor, SmartView Tracker, SmartEvent, SmartReporter, SmartProvisioning, SmartUpdate, and other management tools. A management plug-in can also add new objects, policies, rules, actions, reports, views, and wizards to the management system. Some examples of management plug-ins are CloudGuard Controller, SandBlast Agent, Endpoint Security Server, Threat Extraction for Web, etc.
C
Explanation:
A management plug-in is a software component that interacts with a Security Management Server to provide new features and support for new products. A management plug-in can extend the functionality of SmartConsole, SmartDashboard, SmartView Monitor, SmartView Tracker, SmartEvent, SmartReporter, SmartProvisioning, SmartUpdate, and other management tools. A management plug-in can also add new objects, policies, rules, actions, reports, views, and wizards to the management system. Some examples of management plug-ins are CloudGuard Controller, SandBlast Agent, Endpoint Security Server, Threat Extraction for Web, etc.