Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #221
Which tool provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed?
- A . ThreatWiki
- B . Whitelist Files
- C . AppWiki
- D . IPS Protections
Correct Answer: B
B
Explanation:
According to the Check Point website, Whitelist Files is the tool that provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed. Whitelist Files can be configured in SmartConsole under Threat Prevention > Policy > Whitelist Files. The other tools are either not related or not valid tools.
Reference: Whitelist Files
B
Explanation:
According to the Check Point website, Whitelist Files is the tool that provides a list of trusted files to the administrator so they can specify to the Threat Prevention blade that these files do not need to be scanned or analyzed. Whitelist Files can be configured in SmartConsole under Threat Prevention > Policy > Whitelist Files. The other tools are either not related or not valid tools.
Reference: Whitelist Files
Question #222
Using Threat Emulation technologies, what is the best way to block .exe and .bat file types?
- A . enable DLP and select.exe and .bat file type
- B . enable .exe & .bat protection in IPS Policy
- C . create FW rule for particular protocol
- D . tecli advanced attributes set prohibited_file_types exe.bat
Correct Answer: A
A
Explanation:
The best way to block .exe and .bat file types using Threat Emulation technologies is to enable DLP and select .exe and .bat file type. DLP stands for Data Loss Prevention, and it is a feature that allows administrators to define rules and actions to protect sensitive data from unauthorized access or transfer. One of the DLP rule conditions is File Type, which can be used to block or alert on specific file types, such as .exe and .bat, that may contain malicious code or scripts. The other options are either not related to Threat Emulation technologies, or not effective in blocking .exe and .bat file types.
A
Explanation:
The best way to block .exe and .bat file types using Threat Emulation technologies is to enable DLP and select .exe and .bat file type. DLP stands for Data Loss Prevention, and it is a feature that allows administrators to define rules and actions to protect sensitive data from unauthorized access or transfer. One of the DLP rule conditions is File Type, which can be used to block or alert on specific file types, such as .exe and .bat, that may contain malicious code or scripts. The other options are either not related to Threat Emulation technologies, or not effective in blocking .exe and .bat file types.
Question #223
Using ClusterXL, what statement is true about the Sticky Decision Function?
- A . Can only be changed for Load Sharing implementations
- B . All connections are processed and synchronized by the pivot
- C . Is configured using cpconfig
- D . Is only relevant when using SecureXL
Correct Answer: A
A
Explanation:
The Sticky Decision Function in ClusterXL is primarily used in Load Sharing implementations. In Load Sharing, the pivot member is responsible for determining the destination of new connections and ensures that traffic from the same source IP address is directed to the same cluster member. This ensures session stickiness for the same source IP, improving load sharing efficiency.
Reference: Check Point Certified Security Expert R81 documentation and learning resources.
A
Explanation:
The Sticky Decision Function in ClusterXL is primarily used in Load Sharing implementations. In Load Sharing, the pivot member is responsible for determining the destination of new connections and ensures that traffic from the same source IP address is directed to the same cluster member. This ensures session stickiness for the same source IP, improving load sharing efficiency.
Reference: Check Point Certified Security Expert R81 documentation and learning resources.
Question #224
Which of the following type of authentication on Mobile Access can NOT be used as the first authentication method?
- A . Dynamic ID
- B . RADIUS
- C . Username and Password
- D . Certificate
Correct Answer: A
Question #225
What is "Accelerated Policy Installation"?
- A . Starting R81, the Desktop Security Policy installation process is accelerated thereby reducing the duration of the process significantly
- B . Starting R81, the QoS Policy installation process is accelerated thereby reducing the duration of the process significantly
- C . Starting R81, the Access Control Policy installation process is accelerated thereby reducing the duration of the process significantly
- D . Starting R81, the Threat Prevention Policy installation process is accelerated thereby reducing the duration of the process significantly
Correct Answer: C
C
Explanation:
Starting R81, the Access Control Policy installation process is accelerated thereby reducing the duration of the process significantly. According to the Check Point R81 Security Management Administration Guide1, Accelerated Install Policy is a new feature in R81 that optimizes common use-cases and drastically speeds up the installation with up to 90% improvement. Policy installation is accelerated depending on the changes that were made to the Access Control policy since the last installation. When the policy installation is accelerated, the icon will appear under the “Install Policy Acceleration” column in the Install Policy window.
Reference: Accelerated Install Policy – Check Point Software, section “Accelerated Install Policy”
C
Explanation:
Starting R81, the Access Control Policy installation process is accelerated thereby reducing the duration of the process significantly. According to the Check Point R81 Security Management Administration Guide1, Accelerated Install Policy is a new feature in R81 that optimizes common use-cases and drastically speeds up the installation with up to 90% improvement. Policy installation is accelerated depending on the changes that were made to the Access Control policy since the last installation. When the policy installation is accelerated, the icon will appear under the “Install Policy Acceleration” column in the Install Policy window.
Reference: Accelerated Install Policy – Check Point Software, section “Accelerated Install Policy”
Question #226
During inspection of your Threat Prevention logs you find four different computers having one event each with a Critical Severity.
Which of those hosts should you try to remediate first?
- A . Host having a Critical event found by Threat Emulation
- B . Host having a Critical event found by IPS
- C . Host having a Critical event found by Antivirus
- D . Host having a Critical event found by Anti-Bot
Correct Answer: D
D
Explanation:
The host having a Critical event found by Anti-Bot should be remediated first, as it indicates that the host is infected by a botnet malware that is communicating with a Command and Control server. This poses a serious threat to the network security and data integrity. The other events may indicate potential malware infection or attack attempts, but not necessarily successful ones.
Reference: Threat Prevention Administration Guide
D
Explanation:
The host having a Critical event found by Anti-Bot should be remediated first, as it indicates that the host is infected by a botnet malware that is communicating with a Command and Control server. This poses a serious threat to the network security and data integrity. The other events may indicate potential malware infection or attack attempts, but not necessarily successful ones.
Reference: Threat Prevention Administration Guide
Question #227
Which of the following Check Point commands is true to enable Multi-Version Cluster (MVC)?
- A . Check Point Security Management HA (Secondary): set cluster member mvc on
- B . Check Point Security Gateway Only: set cluster member mvc on
- C . Check Point Security Management HA (Primary): set cluster member mvc on
- D . Check Point Security Gateway Cluster Member: set cluster member mvc on
Correct Answer: D
D
Explanation:
You can enable Multi-Version Cluster (MVC) by running set cluster member mvc on on the Check Point Security Gateway Cluster Member1. MVC is a feature that allows you to upgrade a Security Gateway Cluster to a higher version without downtime2. It works by upgrading one cluster member at a time, while the other cluster members continue to operate with the lower version2. MVC supports upgrading from R80.40 and above to R81 and above2. To use MVC, you need to do the following steps2:
Enable MVC on each cluster member by running set cluster member mvc on in Clish and rebooting the gateway.
Install the higher version on one cluster member using CPUSE or ISO image.
Install policy on the upgraded cluster member and verify that it works properly.
Repeat the previous steps for the remaining cluster members until all of them are upgraded. Disable MVC on each cluster member by running set cluster member mvc off in Clish and rebooting the gateway.
Reference: Multi-Version Cluster (MVC) – Check Point Software, Multi-Version Cluster (MVC) – Check Point CheckMates
D
Explanation:
You can enable Multi-Version Cluster (MVC) by running set cluster member mvc on on the Check Point Security Gateway Cluster Member1. MVC is a feature that allows you to upgrade a Security Gateway Cluster to a higher version without downtime2. It works by upgrading one cluster member at a time, while the other cluster members continue to operate with the lower version2. MVC supports upgrading from R80.40 and above to R81 and above2. To use MVC, you need to do the following steps2:
Enable MVC on each cluster member by running set cluster member mvc on in Clish and rebooting the gateway.
Install the higher version on one cluster member using CPUSE or ISO image.
Install policy on the upgraded cluster member and verify that it works properly.
Repeat the previous steps for the remaining cluster members until all of them are upgraded. Disable MVC on each cluster member by running set cluster member mvc off in Clish and rebooting the gateway.
Reference: Multi-Version Cluster (MVC) – Check Point Software, Multi-Version Cluster (MVC) – Check Point CheckMates
Question #228
You need to change the MAC-address on eth2 interface of the gateway.
What command and what mode will you use to achieve this goal?
- A . set interface eth2 mac-addr 11:11:11:11:11:11; CLISH
- B . ifconfig eth1 hw 11:11:11:11:11:11; expert
- C . set interface eth2 hw-addr 11:11:11:11:11:11; CLISH
- D . ethtool -i eth2 mac 11:11:11:11:11:11; expert
Correct Answer: A
A
Explanation:
You need to change the MAC-address on eth2 interface of the gateway. The command and the mode that you will use to achieve this goal are set interface eth2 mac-addr 11:11:11:11:11:11; CLISH. This command allows you to change the MAC address of an interface in GAIA, which can be useful for replacing a faulty network card or cloning another device. The command is executed in CLISH mode, which is a shell that provides a menu-based interface for configuring various system settings. To apply the changes, you need to save the configuration and restart the interface.
Reference: Gaia Administration Guide R81, page 31.
A
Explanation:
You need to change the MAC-address on eth2 interface of the gateway. The command and the mode that you will use to achieve this goal are set interface eth2 mac-addr 11:11:11:11:11:11; CLISH. This command allows you to change the MAC address of an interface in GAIA, which can be useful for replacing a faulty network card or cloning another device. The command is executed in CLISH mode, which is a shell that provides a menu-based interface for configuring various system settings. To apply the changes, you need to save the configuration and restart the interface.
Reference: Gaia Administration Guide R81, page 31.
Question #229
What has to be taken into consideration when configuring Management HA?
- A . The Database revisions will not be synchronized between the management servers
- B . SmartConsole must be closed prior to synchronized changes in the objects database
- C . If you wanted to use Full Connectivity Upgrade, you must change the Implied Rules to allow FW1_cpredundant to pass before the Firewall Control Connections.
- D . For Management Server synchronization, only External Virtual Switches are supported. So, if you wanted to employ Virtual Routers instead, you have to reconsider your design.
Correct Answer: A
A
Explanation:
When configuring Management HA, you have to take into consideration that the Database revisions will not be synchronized between the management servers. Database revisions are snapshots of the database that are created manually or automatically when installing a policy or saving changes. They are stored locally on each management server and are not replicated by Management HA. The other options are either not true or not relevant to Management HA.
Reference: Check Point R81 Installation and Upgrade Guide
A
Explanation:
When configuring Management HA, you have to take into consideration that the Database revisions will not be synchronized between the management servers. Database revisions are snapshots of the database that are created manually or automatically when installing a policy or saving changes. They are stored locally on each management server and are not replicated by Management HA. The other options are either not true or not relevant to Management HA.
Reference: Check Point R81 Installation and Upgrade Guide
Question #230
You are investigating issues with to gateway cluster members are not able to establish the first initial cluster synchronization.
What service is used by the FWD daemon to do a Full Synchronization?
- A . TCP port 443
- B . TCP port 257
- C . TCP port 256
- D . UDP port 8116
Correct Answer: C
C
Explanation:
The FWD daemon uses TCP port 256 to do a Full Synchronization between gateway cluster members. This port is also used for other synchronization types, such as Delta Synchronization and Accelerated Synchronization. The FWD daemon is responsible for synchronizing the connections table, NAT table, and VPN keys between cluster members.
Reference: ClusterXL Administration Guide, SK25977 – Ports Used by Check Point Software
C
Explanation:
The FWD daemon uses TCP port 256 to do a Full Synchronization between gateway cluster members. This port is also used for other synchronization types, such as Delta Synchronization and Accelerated Synchronization. The FWD daemon is responsible for synchronizing the connections table, NAT table, and VPN keys between cluster members.
Reference: ClusterXL Administration Guide, SK25977 – Ports Used by Check Point Software