Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #251
You have successfully backed up Check Point configurations without the OS information.
What command would you use to restore this backup?
- A . restore_backup
- B . import backup
- C . cp_merge
- D . migrate import
Correct Answer: D
D
Explanation:
The command migrate import can be used to restore a backup of Check Point configurations without the OS information. This command imports the configuration from a file that was created using the migrate export command, which backs up only the Check Point configuration and not the OS settings. The other commands are either not valid or not suitable for restoring a backup without the OS information.
Reference: Check Point R81 Installation and Upgrade Guide
D
Explanation:
The command migrate import can be used to restore a backup of Check Point configurations without the OS information. This command imports the configuration from a file that was created using the migrate export command, which backs up only the Check Point configuration and not the OS settings. The other commands are either not valid or not suitable for restoring a backup without the OS information.
Reference: Check Point R81 Installation and Upgrade Guide
Question #252
Which of the following is a new R81 Gateway feature that had not been available in R77.X and older?
- A . The rule base can be built of layers, each containing a set of the security rules. Layers are inspected in the order in which they are defined, allowing control over the rule base flow and which security functionalities take precedence.
- B . Limits the upload and download throughput for streaming media in the company to 1 Gbps.
- C . Time object to a rule to make the rule active only during specified times.
- D . Sub Policies ae sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule.
Correct Answer: D
D
Explanation:
Sub Policies are a new R81 Gateway feature that had not been available in R77.X and older. Sub Policies are sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule. This allows for more granular and modular control over the policy. The other features were already available in previous versions.
Reference: Check Point R81 Security Management Administration Guide, Check Point R77 Security Management Administration Guide, Check Point R77 Gaia Administration Guide, Check Point R77 Security Gateway Technical Administration Guide
D
Explanation:
Sub Policies are a new R81 Gateway feature that had not been available in R77.X and older. Sub Policies are sets of rules that can be created and attached to specific rules. If the rule is matched, inspection will continue in the sub policy attached to it rather than in the next rule. This allows for more granular and modular control over the policy. The other features were already available in previous versions.
Reference: Check Point R81 Security Management Administration Guide, Check Point R77 Security Management Administration Guide, Check Point R77 Gaia Administration Guide, Check Point R77 Security Gateway Technical Administration Guide
Question #253
Which option, when applied to a rule, allows traffic to VPN gateways in specific VPN communities?
- A . All Connections (Clear or Encrypted)
- B . Accept all encrypted traffic
- C . Specific VPN Communities
- D . All Site-to-Site VPN Communities
Correct Answer: C
C
Explanation:
The option that allows traffic to VPN gateways in specific VPN communities is Specific VPN Communities. This option lets you specify which VPN communities are allowed or denied by the rule. A VPN community is a group of VPN gateways or hosts that share the same VPN policy and keys. You can create different types of VPN communities, such as star, meshed, or remote access, depending on your network topology and security requirements. You can also use tags to group VPN gateways or hosts into logical categories.
C
Explanation:
The option that allows traffic to VPN gateways in specific VPN communities is Specific VPN Communities. This option lets you specify which VPN communities are allowed or denied by the rule. A VPN community is a group of VPN gateways or hosts that share the same VPN policy and keys. You can create different types of VPN communities, such as star, meshed, or remote access, depending on your network topology and security requirements. You can also use tags to group VPN gateways or hosts into logical categories.
Question #254
Fill in the blank: An Endpoint identity agent uses a________ for user authentication.
- A . Shared secret
- B . Username/password or Kerberos Ticket
- C . Token
- D . Certificate
Correct Answer: B
B
Explanation:
An Endpoint Identity Agent is a software component that runs on the user’s device and communicates with the Check Point gateway to provide user identity information. An Endpoint Identity Agent can use different methods for user authentication, such as username/password, Kerberos ticket, or certificate. However, the most common and recommended method is username/password or Kerberos ticket, which allows the user to log in to the device with their domain credentials and automatically authenticate with the gateway without entering additional credentials. This method also supports Single Sign-On (SSO) and Multi-Factor Authentication (MFA) features.
The references are:
Check Point R81 Identity Awareness Administration Guide, page 15 Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 14 Endpoint Identity Agent – Check Point CheckMates
B
Explanation:
An Endpoint Identity Agent is a software component that runs on the user’s device and communicates with the Check Point gateway to provide user identity information. An Endpoint Identity Agent can use different methods for user authentication, such as username/password, Kerberos ticket, or certificate. However, the most common and recommended method is username/password or Kerberos ticket, which allows the user to log in to the device with their domain credentials and automatically authenticate with the gateway without entering additional credentials. This method also supports Single Sign-On (SSO) and Multi-Factor Authentication (MFA) features.
The references are:
Check Point R81 Identity Awareness Administration Guide, page 15 Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 14 Endpoint Identity Agent – Check Point CheckMates
Question #255
Alice works for a big security outsourcing provider company and as she receives a lot of change requests per day she wants to use for scripting daily (asks the API services from Check Point fof the Management API. Firstly she needs to be aware if the API services are running for the management.
Which of the following Check Point Command is true:
- A . api mgmt status
- B . api status
- C . status api
- D . status mgmt apt
Correct Answer: B
B
Explanation:
The command ‘api status’ is used to check the status of the Management API server on the Management Server. The command will show if the API server is running, the port number, and the API version. The other commands are not valid or do not check the Management API server status.
Reference: How To’s – Interact with Check Point Management API on Gaia R81, section “Check API Status”.
B
Explanation:
The command ‘api status’ is used to check the status of the Management API server on the Management Server. The command will show if the API server is running, the port number, and the API version. The other commands are not valid or do not check the Management API server status.
Reference: How To’s – Interact with Check Point Management API on Gaia R81, section “Check API Status”.
Question #256
The fwd process on the Security Gateway sends logs to the fwd process on the Management Server, where it is forwarded to___________via____________
- A . cpd, fwm
- B . cpm, cpd
- C . fwm, cpd
- D . cpwd, fwssd
Correct Answer: C
C
Explanation:
The fwd process on the Security Gateway sends logs to the fwd process on the Management Server, where it is forwarded to fwm via cpd. The fwm process is responsible for managing the log files and the cpd process is responsible for communication between processes. The other options are incorrect because they involve processes that are not related to logging or communication.
Reference: Check Point Certified Security Expert R81.20 Course Overview, sk163413: Support, Support Requests, Training … – Check Point Software, Check Point Certified Security Expert R81.20
C
Explanation:
The fwd process on the Security Gateway sends logs to the fwd process on the Management Server, where it is forwarded to fwm via cpd. The fwm process is responsible for managing the log files and the cpd process is responsible for communication between processes. The other options are incorrect because they involve processes that are not related to logging or communication.
Reference: Check Point Certified Security Expert R81.20 Course Overview, sk163413: Support, Support Requests, Training … – Check Point Software, Check Point Certified Security Expert R81.20
Question #257
Which of the following technologies extracts detailed information from packets and stores that information in state tables?
- A . INSPECT Engine
- B . Stateful Inspection
- C . Packet Filtering
- D . Application Layer Firewall
Correct Answer: A
A
Explanation:
According to the Check Point website, INSPECT Engine is the technology that extracts detailed information from packets and stores that information in state tables. INSPECT Engine is the core of Check Point’s Stateful Inspection technology, which enables Security Gateways to inspect traffic at multiple layers and enforce security policies. The other technologies are either not related or not specific enough.
Reference: INSPECT Engine
A
Explanation:
According to the Check Point website, INSPECT Engine is the technology that extracts detailed information from packets and stores that information in state tables. INSPECT Engine is the core of Check Point’s Stateful Inspection technology, which enables Security Gateways to inspect traffic at multiple layers and enforce security policies. The other technologies are either not related or not specific enough.
Reference: INSPECT Engine
Question #258
What command can you use to have cpinfo display all installed hotfixes?
- A . cpinfo -hf
- B . cpinfo Cy all
- C . cpinfo Cget hf
- D . cpinfo installed_jumbo
Correct Answer: B
B
Explanation:
The command cpinfo -y all can be used to have cpinfo display all installed hotfixes. Cpinfo is a tool that collects diagnostic data from a Check Point gateway or management server. The data includes configuration files, logs, status reports, and more. The -y parameter is used to specify which sections of data to include in the cpinfo output. The value all means to include all sections, including the hotfixes section, which shows the list of hotfixes installed on the system.
Reference: Check Point Security Expert R81 Course, cpinfo Utility
B
Explanation:
The command cpinfo -y all can be used to have cpinfo display all installed hotfixes. Cpinfo is a tool that collects diagnostic data from a Check Point gateway or management server. The data includes configuration files, logs, status reports, and more. The -y parameter is used to specify which sections of data to include in the cpinfo output. The value all means to include all sections, including the hotfixes section, which shows the list of hotfixes installed on the system.
Reference: Check Point Security Expert R81 Course, cpinfo Utility
Question #259
Which is the command to identify the NIC driver before considering about the employment of the
Multi-Queue feature?
- A . ip show int eth0
- B . show interface eth0 mq
- C . ifconfig -i eth0 verbose
- D . ethtool -i eth0
Correct Answer: D
Question #260
When defining QoS global properties, which option below is not valid?
- A . Weight
- B . Authenticated timeout
- C . Schedule
- D . Rate
Correct Answer: D
D
Explanation:
QoS global properties are the settings that apply to all QoS rules and QoS interfaces on the Security Gateway. They include the following options12:
Weight: This is the relative importance of a QoS rule compared to other QoS rules. A higher weight means a higher priority. The default weight is 1, and the maximum weight is 1000.
Authenticated timeout: This is the time period in seconds that a connection remains in the QoS rule after the last packet is sent or received. The default timeout is 600 seconds, and the minimum timeout is 60 seconds.
Schedule: This is the time period in which a QoS rule is active. You can define a schedule for each day of the week, or use the default schedule of always active.
Rate: This is not a valid option for QoS global properties. Rate is an option for QoS rule action, which defines the maximum bandwidth allocated for a QoS rule. The rate can be specified in Kbps, Mbps, or percentage of interface speed.
Reference: 1: QoS R81.20 Administration Guide – Check Point Software 2: QoS R81 Administration
Guide – Check Point Software
D
Explanation:
QoS global properties are the settings that apply to all QoS rules and QoS interfaces on the Security Gateway. They include the following options12:
Weight: This is the relative importance of a QoS rule compared to other QoS rules. A higher weight means a higher priority. The default weight is 1, and the maximum weight is 1000.
Authenticated timeout: This is the time period in seconds that a connection remains in the QoS rule after the last packet is sent or received. The default timeout is 600 seconds, and the minimum timeout is 60 seconds.
Schedule: This is the time period in which a QoS rule is active. You can define a schedule for each day of the week, or use the default schedule of always active.
Rate: This is not a valid option for QoS global properties. Rate is an option for QoS rule action, which defines the maximum bandwidth allocated for a QoS rule. The rate can be specified in Kbps, Mbps, or percentage of interface speed.
Reference: 1: QoS R81.20 Administration Guide – Check Point Software 2: QoS R81 Administration
Guide – Check Point Software