Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #241
Bob is going to prepare the import of the exported R81.20 management database. Now he wants to verify that the installed tools on the new target security management machine are able to handle the R81.20 release.
Which of the following Check Point command is true?
- A . $FWDIR/scripts/migrate_server print_installed_tools -v R77.30
- B . $CPDIR/scripts/migrate_server print_installed_tools -v R81.20
- C . $FWDIR/scripts/migrate_server print_installed_tools -v R81.20
- D . $FWDIR/scripts/migrate_server print_uninstalled_tools -v R81.20
Correct Answer: C
C
Explanation:
The correct Check Point command to verify that the installed tools on the new target security management machine are able to handle the R81.20 release is $FWDIR/scripts/migrate_server print_installed_tools -v R81.20. This command will print the list of installed migration tools and their versions, and check if they match the specified version (R81.20 in this case). If the tools are not installed or do not match, the command will print an error message3.
Reference: Check Point R81 Installation and Upgrade Guide
C
Explanation:
The correct Check Point command to verify that the installed tools on the new target security management machine are able to handle the R81.20 release is $FWDIR/scripts/migrate_server print_installed_tools -v R81.20. This command will print the list of installed migration tools and their versions, and check if they match the specified version (R81.20 in this case). If the tools are not installed or do not match, the command will print an error message3.
Reference: Check Point R81 Installation and Upgrade Guide
Question #242
In the R81 SmartConsole, on which tab are Permissions and Administrators defined?
- A . Security Policies
- B . Logs and Monitor
- C . Manage and Settings
- D . Gateways and Servers
Correct Answer: C
C
Explanation:
In the R81 SmartConsole, Permissions and Administrators are defined on the Manage and Settings tab. The Manage and Settings tab allows administrators to configure various settings and options for the SmartConsole, such as global properties, network objects, services, users and user groups,
permissions, licenses, certificates, etc. To define Permissions and Administrators, the administrator can go to the Manage and Settings tab and select Permissions and Administrators from the left pane. This will open a window where the administrator can create, edit, or delete administrators and roles, assign permissions and access profiles, enable multi-domain support, etc. The other options are incorrect because:
The Security Policies tab allows administrators to create, edit, or delete security policies for different blades, such as Access Control, Threat Prevention, Identity Awareness, Mobile Access, etc. It also allows administrators to install policies on selected gateways or servers.
The Logs and Monitor tab allows administrators to view, filter, analyze, or export logs and reports for different blades, such as Access Control, Threat Prevention, Identity Awareness, Mobile Access, etc. It also allows administrators to monitor the status and performance of gateways and servers.
The Gateways and Servers tab allows administrators to add, edit, or delete gateways and servers that are managed by the Security Management Server or the Multi-Domain Security Management Server. It also allows administrators to view the details and configuration of each gateway or server.
C
Explanation:
In the R81 SmartConsole, Permissions and Administrators are defined on the Manage and Settings tab. The Manage and Settings tab allows administrators to configure various settings and options for the SmartConsole, such as global properties, network objects, services, users and user groups,
permissions, licenses, certificates, etc. To define Permissions and Administrators, the administrator can go to the Manage and Settings tab and select Permissions and Administrators from the left pane. This will open a window where the administrator can create, edit, or delete administrators and roles, assign permissions and access profiles, enable multi-domain support, etc. The other options are incorrect because:
The Security Policies tab allows administrators to create, edit, or delete security policies for different blades, such as Access Control, Threat Prevention, Identity Awareness, Mobile Access, etc. It also allows administrators to install policies on selected gateways or servers.
The Logs and Monitor tab allows administrators to view, filter, analyze, or export logs and reports for different blades, such as Access Control, Threat Prevention, Identity Awareness, Mobile Access, etc. It also allows administrators to monitor the status and performance of gateways and servers.
The Gateways and Servers tab allows administrators to add, edit, or delete gateways and servers that are managed by the Security Management Server or the Multi-Domain Security Management Server. It also allows administrators to view the details and configuration of each gateway or server.
Question #243
When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?
- A . RADIUS
- B . Remote Access and RADIUS
- C . AD Query
- D . AD Query and Browser-based Authentication
Correct Answer: D
D
Explanation:
When Identity Awareness is enabled, AD Query and Browser-based Authentication are used as identity sources for Application Control. AD Query allows the Security Gateway to query Active Directory servers for identity information based on IP addresses. Browser-based Authentication allows the Security Gateway to redirect unidentified users to a captive portal where they can authenticate with their credentials. These identity sources provide accurate and up-to-date identity information for Application Control, which can enforce granular policies based on user, group, machine, and domain objects.
Reference: R81 Identity Awareness Administration Guide, page 9.
D
Explanation:
When Identity Awareness is enabled, AD Query and Browser-based Authentication are used as identity sources for Application Control. AD Query allows the Security Gateway to query Active Directory servers for identity information based on IP addresses. Browser-based Authentication allows the Security Gateway to redirect unidentified users to a captive portal where they can authenticate with their credentials. These identity sources provide accurate and up-to-date identity information for Application Control, which can enforce granular policies based on user, group, machine, and domain objects.
Reference: R81 Identity Awareness Administration Guide, page 9.
Question #243
When Identity Awareness is enabled, which identity source(s) is(are) used for Application Control?
- A . RADIUS
- B . Remote Access and RADIUS
- C . AD Query
- D . AD Query and Browser-based Authentication
Correct Answer: D
D
Explanation:
When Identity Awareness is enabled, AD Query and Browser-based Authentication are used as identity sources for Application Control. AD Query allows the Security Gateway to query Active Directory servers for identity information based on IP addresses. Browser-based Authentication allows the Security Gateway to redirect unidentified users to a captive portal where they can authenticate with their credentials. These identity sources provide accurate and up-to-date identity information for Application Control, which can enforce granular policies based on user, group, machine, and domain objects.
Reference: R81 Identity Awareness Administration Guide, page 9.
D
Explanation:
When Identity Awareness is enabled, AD Query and Browser-based Authentication are used as identity sources for Application Control. AD Query allows the Security Gateway to query Active Directory servers for identity information based on IP addresses. Browser-based Authentication allows the Security Gateway to redirect unidentified users to a captive portal where they can authenticate with their credentials. These identity sources provide accurate and up-to-date identity information for Application Control, which can enforce granular policies based on user, group, machine, and domain objects.
Reference: R81 Identity Awareness Administration Guide, page 9.
Question #245
Which statement is true regarding redundancy?
- A . System Administrators know when their cluster has failed over and can also see why it failed over by using the cphaprob Cf if command.
- B . ClusterXL offers three different Load Sharing solutions: Unicast, Broadcast, and Multicast.
- C . Machines in a ClusterXL High Availability configuration must be synchronized.
- D . Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments.
Correct Answer: D
D
Explanation:
The statement that is true regarding redundancy is Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments. ClusterXL and VRRP are two technologies that provide high availability and load sharing for Security Gateways. They are both supported by Gaia OS and can be deployed on various platforms5. The other statements are either false or incomplete regarding redundancy.
Reference: Check Point R81 ClusterXL Administration Guide, Check Point R81 Gaia Administration Guide
D
Explanation:
The statement that is true regarding redundancy is Both ClusterXL and VRRP are fully supported by Gaia and available to all Check Point appliances, open servers, and virtualized environments. ClusterXL and VRRP are two technologies that provide high availability and load sharing for Security Gateways. They are both supported by Gaia OS and can be deployed on various platforms5. The other statements are either false or incomplete regarding redundancy.
Reference: Check Point R81 ClusterXL Administration Guide, Check Point R81 Gaia Administration Guide
Question #246
Which command can you use to verify the number of active concurrent connections?
- A . fw conn all
- B . fw ctl pstat
- C . show all connections
- D . show connections
Correct Answer: B
B
Explanation:
The command fw ctl pstat can be used to verify the number of active concurrent connections on a gateway. This command displays various statistics about the firewall kernel, such as memory usage, CPU utilization, packet rates, and connection table information. The output of this command includes a line that shows the current number of connections and the peak number of connections since the last reboot.
For example:
B
Explanation:
The command fw ctl pstat can be used to verify the number of active concurrent connections on a gateway. This command displays various statistics about the firewall kernel, such as memory usage, CPU utilization, packet rates, and connection table information. The output of this command includes a line that shows the current number of connections and the peak number of connections since the last reboot.
For example:
This means that there are currently 1234 active connections out of a maximum of 8192 connections, which is 15% of the connection table capacity. The peak number of connections since the last reboot was 2345.
Question #247
Bob works for a big security outsourcing provider company and as he receives a lot of change requests per day he wants to use for scripting daily tasks the API services (torn Check Point for the GAIA API. Firstly he needs to be aware if the API services are running for the GAIA operating system.
Which of the following Check Point Command is true:
- A . gala_dlish status
- B . status gaiaapi
- C . api_gala status
- D . gala_api status
Correct Answer: D
D
Explanation:
https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#api_access~v1.7%20
The correct Check Point command to check if the API services are running for the GAIA operating system is gala_api status. The gala_api command is used to manage the API services in the GAIA operating system, and the status option is used to check the status of the API services.
D
Explanation:
https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#api_access~v1.7%20
The correct Check Point command to check if the API services are running for the GAIA operating system is gala_api status. The gala_api command is used to manage the API services in the GAIA operating system, and the status option is used to check the status of the API services.
Question #248
What order should be used when upgrading a Management High Availability Cluster?
- A . Secondary Management, then Primary Management
- B . Active Management, then Standby Management
- C . Standby Management, then Active Management
- D . Primary Management, then Secondary Management
Correct Answer: C
C
Explanation:
The upgrade process for a Management High Availability Cluster is to first upgrade the Standby Management Server, then perform a failover and upgrade the Active Management Server. This way, the cluster can maintain its functionality and synchronization during the upgrade. The references are:
Check Point R81 Upgrade Guide, page 17
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 10
C
Explanation:
The upgrade process for a Management High Availability Cluster is to first upgrade the Standby Management Server, then perform a failover and upgrade the Active Management Server. This way, the cluster can maintain its functionality and synchronization during the upgrade. The references are:
Check Point R81 Upgrade Guide, page 17
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 10
Question #249
Joey wants to upgrade from R75.40 to R81 version of Security management. He will use Advanced
Upgrade with Database Migration method to achieve this.
What is one of the requirements for his success?
- A . Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine
- B . Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine
- C . Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR/log directory on the source machine
- D . Size of the /var/log folder of the target machine must be at least 25GB or more
Correct Answer: B
B
Explanation:
One of the requirements for Joey’s success in upgrading from R75.40 to R81 version of Security management using Advanced Upgrade with Database Migration method is that the size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine. Advanced Upgrade with Database Migration method is a procedure that allows administrators to upgrade their Security Management Server to a newer version by migrating their database from an older version to a new machine with a fresh installation of the newer version. One of the steps in this procedure is to copy the /var/log folder from the source machine to the target machine, which contains important log files and configuration files. To ensure that there is enough disk space on the target machine for this operation, it is required that the size of the /var/log folder on the target machine must be at least 25% of the size of the /var/log folder on the source machine.
B
Explanation:
One of the requirements for Joey’s success in upgrading from R75.40 to R81 version of Security management using Advanced Upgrade with Database Migration method is that the size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine. Advanced Upgrade with Database Migration method is a procedure that allows administrators to upgrade their Security Management Server to a newer version by migrating their database from an older version to a new machine with a fresh installation of the newer version. One of the steps in this procedure is to copy the /var/log folder from the source machine to the target machine, which contains important log files and configuration files. To ensure that there is enough disk space on the target machine for this operation, it is required that the size of the /var/log folder on the target machine must be at least 25% of the size of the /var/log folder on the source machine.
Question #250
Security Checkup Summary can be easily conducted within:
- A . Summary
- B . Views
- C . Reports
- D . Checkups
Correct Answer: B
B
Explanation:
Security Checkup Summary can be easily conducted within Views. Views is a feature in SmartConsole that allows you to create customized dashboards and reports based on various security data sources, such as logs, events, audit trails, and more. You can use Views to perform a Security Checkup Summary, which is a comprehensive analysis of your network security posture and potential risks. You can use predefined templates or create your own views to generate the summary.
Reference: Check Point Security Expert R81 Course, Views Administration Guide
B
Explanation:
Security Checkup Summary can be easily conducted within Views. Views is a feature in SmartConsole that allows you to create customized dashboards and reports based on various security data sources, such as logs, events, audit trails, and more. You can use Views to perform a Security Checkup Summary, which is a comprehensive analysis of your network security posture and potential risks. You can use predefined templates or create your own views to generate the summary.
Reference: Check Point Security Expert R81 Course, Views Administration Guide