Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #231
Which is NOT an example of a Check Point API?
- A . Gateway API
- B . Management API
- C . OPSC SDK
- D . Threat Prevention API
Correct Answer: A
A
Explanation:
Gateway API is not an example of a Check Point API. Check Point APIs are interfaces that enable interactions with Check Point products using automation scripts or external applications. The examples of Check Point APIs are Management API, OPSEC SDK, Threat Prevention API, Identity Awareness Web Services API, and others4. Gateway API is not a valid Check Point API name.
Reference: Check Point R81 Security Management Administration Guide, Check Point APIs
A
Explanation:
Gateway API is not an example of a Check Point API. Check Point APIs are interfaces that enable interactions with Check Point products using automation scripts or external applications. The examples of Check Point APIs are Management API, OPSEC SDK, Threat Prevention API, Identity Awareness Web Services API, and others4. Gateway API is not a valid Check Point API name.
Reference: Check Point R81 Security Management Administration Guide, Check Point APIs
Question #232
The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, what would your syntax be?
- A . field_name:string
- B . name field:string
- C . name_field:string
- D . field name:string
Correct Answer: A
A
Explanation:
The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, the syntax is field_name:string. For example, to search for all rules that have a comment containing “VPN”, the syntax is comment:VPN. The other options are not valid syntaxes for searching for a value in a field3.
Reference: 3: Check Point Software, Getting Started, Searching for Text Strings.
A
Explanation:
The Compliance Blade allows you to search for text strings in many windows and panes, to search for a value in a field, the syntax is field_name:string. For example, to search for all rules that have a comment containing “VPN”, the syntax is comment:VPN. The other options are not valid syntaxes for searching for a value in a field3.
Reference: 3: Check Point Software, Getting Started, Searching for Text Strings.
Question #233
What is the purpose of a SmartEvent Correlation Unit?
- A . The SmartEvent Correlation Unit is designed to check the connection reliability from SmartConsole to the SmartEvent Server.
- B . The SmartEvent Correlation Unit’s task it to assign severity levels to the identified events.
- C . The Correlation unit role is to evaluate logs from the log server component to identify patterns/threats and convert them to events.
- D . The SmartEvent Correlation Unit is designed to check the availability of the SmartReporter Server.
Correct Answer: C
C
Explanation:
The purpose of a SmartEvent Correlation Unit is to evaluate logs from the log server component to identify patterns/threats and convert them to events. The SmartEvent Correlation Unit is a software module that runs on the SmartEvent server or on a dedicated server. It applies correlation rules and logic to the logs received from various sources, such as security gateways, endpoints, or third-party devices. It then generates events that represent security incidents or trends that require attention or action.
Reference: Check Point Security Expert R81 Course, SmartEvent Administration Guide
C
Explanation:
The purpose of a SmartEvent Correlation Unit is to evaluate logs from the log server component to identify patterns/threats and convert them to events. The SmartEvent Correlation Unit is a software module that runs on the SmartEvent server or on a dedicated server. It applies correlation rules and logic to the logs received from various sources, such as security gateways, endpoints, or third-party devices. It then generates events that represent security incidents or trends that require attention or action.
Reference: Check Point Security Expert R81 Course, SmartEvent Administration Guide
Question #234
Which is the command to identify the NIC driver before considering about the employment of the Multi-Queue feature?
- A . show interface eth0 mq
- B . ethtool A eth0
- C . ifconfig -i eth0 verbose
- D . ip show Int eth0
Correct Answer: B
B
Explanation:
The command to identify the NIC driver before considering about the employment of the Multi-Queue feature is ethtool -i eth0, where eth0 is the name of the network interface. This command displays the information about the driver and firmware version of the NIC, as well as other details such as bus-info and supported features1. The Multi-Queue feature requires a NIC driver that supports multiple transmit and receive queues2.
Reference: ethtool(8) – Linux man page: How To Configure Multi-Queue NICs | Linode Docs
B
Explanation:
The command to identify the NIC driver before considering about the employment of the Multi-Queue feature is ethtool -i eth0, where eth0 is the name of the network interface. This command displays the information about the driver and firmware version of the NIC, as well as other details such as bus-info and supported features1. The Multi-Queue feature requires a NIC driver that supports multiple transmit and receive queues2.
Reference: ethtool(8) – Linux man page: How To Configure Multi-Queue NICs | Linode Docs
Question #235
In Threat Prevention, you can create new or clone profiles but you CANNOT change the out-of-the-box profiles of:
- A . Basic, Optimized, Strict
- B . Basic, Optimized, Severe
- C . General, Escalation, Severe
- D . General, purposed, Strict
Correct Answer: A
A
Explanation:
Threat Prevention has three out-of-the-box profiles: Basic, Optimized, and Strict. These profiles define the default actions for different threat prevention blades, such as Anti-Virus, Anti-Bot, IPS, etc. You cannot change the settings of these profiles, but you can clone them and create new profiles with customized settings.
Reference: Training & Certification | Check Point Software, CCSE section
A
Explanation:
Threat Prevention has three out-of-the-box profiles: Basic, Optimized, and Strict. These profiles define the default actions for different threat prevention blades, such as Anti-Virus, Anti-Bot, IPS, etc. You cannot change the settings of these profiles, but you can clone them and create new profiles with customized settings.
Reference: Training & Certification | Check Point Software, CCSE section
Question #236
In SmartEvent, what are the different types of automatic reactions that the administrator can configure?
- A . Mail, Block Source, Block Event Activity, External Script, SNMP Trap
- B . Mail, Block Source, Block Destination, Block Services, SNMP Trap
- C . Mail, Block Source, Block Destination, External Script, SNMP Trap
- D . Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap
Correct Answer: A
A
Explanation:
In SmartEvent, the administrator can configure different types of automatic reactions, which include:
Mail notifications
Blocking the source of the event
Blocking the event activity
Running an external script
Sending an SNMP trap
So, the correct answer is "Mail, Block Source, Block Event Activity, External Script, SNMP Trap."
Reference: Check Point documentation or training materials related to SmartEvent configuration and automatic reactions.
A
Explanation:
In SmartEvent, the administrator can configure different types of automatic reactions, which include:
Mail notifications
Blocking the source of the event
Blocking the event activity
Running an external script
Sending an SNMP trap
So, the correct answer is "Mail, Block Source, Block Event Activity, External Script, SNMP Trap."
Reference: Check Point documentation or training materials related to SmartEvent configuration and automatic reactions.
Question #236
In SmartEvent, what are the different types of automatic reactions that the administrator can configure?
- A . Mail, Block Source, Block Event Activity, External Script, SNMP Trap
- B . Mail, Block Source, Block Destination, Block Services, SNMP Trap
- C . Mail, Block Source, Block Destination, External Script, SNMP Trap
- D . Mail, Block Source, Block Event Activity, Packet Capture, SNMP Trap
Correct Answer: A
A
Explanation:
In SmartEvent, the administrator can configure different types of automatic reactions, which include:
Mail notifications
Blocking the source of the event
Blocking the event activity
Running an external script
Sending an SNMP trap
So, the correct answer is "Mail, Block Source, Block Event Activity, External Script, SNMP Trap."
Reference: Check Point documentation or training materials related to SmartEvent configuration and automatic reactions.
A
Explanation:
In SmartEvent, the administrator can configure different types of automatic reactions, which include:
Mail notifications
Blocking the source of the event
Blocking the event activity
Running an external script
Sending an SNMP trap
So, the correct answer is "Mail, Block Source, Block Event Activity, External Script, SNMP Trap."
Reference: Check Point documentation or training materials related to SmartEvent configuration and automatic reactions.
Question #238
Using Web Services to access the API, which Header Name-Value had to be in the HTTP Post request after the login?
- A . X-chkp-sid Session Unique Identifier
- B . API-Key
- C . user-uid
- D . uuid Universally Unique Identifier
Correct Answer: A
A
Explanation:
The header name-value that has to be in the HTTP Post request after the login when using Web Services to access the API is X-chkp-sid Session Unique Identifier. This header contains the session ID that is returned by the login command and identifies the session for subsequent API commands. The
session ID is valid for a limited time and can be extended by using keepalive or logout commands.
Reference: [Check Point R81 Management API Reference Guide]
A
Explanation:
The header name-value that has to be in the HTTP Post request after the login when using Web Services to access the API is X-chkp-sid Session Unique Identifier. This header contains the session ID that is returned by the login command and identifies the session for subsequent API commands. The
session ID is valid for a limited time and can be extended by using keepalive or logout commands.
Reference: [Check Point R81 Management API Reference Guide]
Question #239
How many interfaces can you configure to use the Multi-Queue feature?
- A . 10 interfaces
- B . 3 interfaces
- C . 4 interfaces
- D . 5 interfaces
Correct Answer: D
D
Explanation:
How many interfaces can you configure to use the Multi-Queue feature? You can configure up to 5 interfaces to use the Multi-Queue feature. Multi-Queue is a performance enhancement feature that allows distributing the network traffic among multiple CPU cores, instead of using a single core for all traffic. Multi-Queue can be enabled on interfaces that have high traffic load and support multiple receive/transmit queues. Multi-Queue can be configured via SmartConsole or via CLI with the command sim affinity -m.
Reference: R81 Performance Tuning Administration Guide, page 18.
D
Explanation:
How many interfaces can you configure to use the Multi-Queue feature? You can configure up to 5 interfaces to use the Multi-Queue feature. Multi-Queue is a performance enhancement feature that allows distributing the network traffic among multiple CPU cores, instead of using a single core for all traffic. Multi-Queue can be enabled on interfaces that have high traffic load and support multiple receive/transmit queues. Multi-Queue can be configured via SmartConsole or via CLI with the command sim affinity -m.
Reference: R81 Performance Tuning Administration Guide, page 18.
Question #240
What are the two modes for SNX (SSL Network Extender)?
- A . Network Mode and Application Mode
- B . Visitor Mode and Office Mode
- C . Network Mode and Hub Mode
- D . Office Mode and Hub Mode
Correct Answer: A
A
Explanation:
SNX (SSL Network Extender) is a thin VPN client installed on an endpoint user computer that provides secure remote access to a corporate network. It can be used with Mobile Access blade or the IPsec VPN blade via the Mobile Access or SNX portals1. SNX has two modes: Network Mode and Application Mode2.
Network Mode: In this mode, SNX creates a virtual network adapter on the endpoint computer and assigns it an IP address from the internal network. This allows the endpoint computer to access all the resources on the internal network as if it was physically connected to it. Network Mode supports all IP-based applications, including TCP and UDP applications2.
Application Mode: In this mode, SNX does not create a virtual network adapter on the endpoint computer, but instead intercepts the traffic of specific applications and forwards it to the Security Gateway. Application Mode supports only TCP-based applications that are defined in the Mobile Access policy. Application Mode is useful when Network Mode is not supported or when granular control over the applications is required2.
Reference: SSL Network Extender: SNX Modes
A
Explanation:
SNX (SSL Network Extender) is a thin VPN client installed on an endpoint user computer that provides secure remote access to a corporate network. It can be used with Mobile Access blade or the IPsec VPN blade via the Mobile Access or SNX portals1. SNX has two modes: Network Mode and Application Mode2.
Network Mode: In this mode, SNX creates a virtual network adapter on the endpoint computer and assigns it an IP address from the internal network. This allows the endpoint computer to access all the resources on the internal network as if it was physically connected to it. Network Mode supports all IP-based applications, including TCP and UDP applications2.
Application Mode: In this mode, SNX does not create a virtual network adapter on the endpoint computer, but instead intercepts the traffic of specific applications and forwards it to the Security Gateway. Application Mode supports only TCP-based applications that are defined in the Mobile Access policy. Application Mode is useful when Network Mode is not supported or when granular control over the applications is required2.
Reference: SSL Network Extender: SNX Modes