Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #271
Which packet info is ignored with Session Rate Acceleration?
- A . source port ranges
- B . source ip
- C . source port
- D . same info from Packet Acceleration is used
Correct Answer: C
C
Explanation:
Session Rate Acceleration is a SecureXL feature that accelerates the establishment of new connections by bypassing the inspection of the first packet of each session. Session Rate Acceleration ignores the source port information of the packet, as well as the destination port ranges, protocol type, and VPN information. The other packet info is used by Packet Acceleration, which is another SecureXL feature that accelerates the forwarding of subsequent packets of an established connection.
Reference: SecureXL Mechanism
C
Explanation:
Session Rate Acceleration is a SecureXL feature that accelerates the establishment of new connections by bypassing the inspection of the first packet of each session. Session Rate Acceleration ignores the source port information of the packet, as well as the destination port ranges, protocol type, and VPN information. The other packet info is used by Packet Acceleration, which is another SecureXL feature that accelerates the forwarding of subsequent packets of an established connection.
Reference: SecureXL Mechanism
Question #272
Which Check Point daemon monitors the other daemons?
- A . fwm
- B . cpd
- C . cpwd
- D . fwssd
Correct Answer: C
C
Explanation:
The Check Point daemon that monitors the other daemons is cpwd (Check Point Watchdog). It is responsible for monitoring the health and status of various Check Point daemons and processes running on the Security Gateway. If any daemon or process stops responding or encounters an issue, cpwd can restart it to ensure the continued operation of the Security Gateway.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
C
Explanation:
The Check Point daemon that monitors the other daemons is cpwd (Check Point Watchdog). It is responsible for monitoring the health and status of various Check Point daemons and processes running on the Security Gateway. If any daemon or process stops responding or encounters an issue, cpwd can restart it to ensure the continued operation of the Security Gateway.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #273
What key is used to save the current CPView page in a filename format cpview_”cpview process ID”.cap”number of captures”?
- A . S
- B . W
- C . C
- D . Space bar
Correct Answer: C
C
Explanation:
The key C is used to save the current CPView page in a filename format cpview_“cpview process ID”.cap"number of captures". This is a feature of CPView that allows the user to capture the current page for later analysis or troubleshooting. The file is saved in the /var/log directory on the Security Gateway.
Reference: Check Point Resource Library, page 3. Topic 4, Exam Pool D
C
Explanation:
The key C is used to save the current CPView page in a filename format cpview_“cpview process ID”.cap"number of captures". This is a feature of CPView that allows the user to capture the current page for later analysis or troubleshooting. The file is saved in the /var/log directory on the Security Gateway.
Reference: Check Point Resource Library, page 3. Topic 4, Exam Pool D
Question #274
You work as a security administrator for a large company. CSO of your company has attended a security conference where he has learnt how hackers constantly modify their strategies and techniques to evade detection and reach corporate resources. He wants to make sure that his company has the tight protections in place. Check Point has been selected for the security vendor.
Which Check Point product protects BEST against malware and zero-day attacks while ensuring quick delivery of safe content to your users?
- A . IPS AND Application Control
- B . IPS, anti-virus and anti-bot
- C . IPS, anti-virus and e-mail security
- D . SandBlast
Correct Answer: D
D
Explanation:
SandBlast is the best Check Point product to protect against malware and zero-day attacks while ensuring quick delivery of safe content to your users. SandBlast is an advanced network threat prevention solution that uses a combination of technologies to detect and block known and unknown threats before they reach your network. SandBlast uses Threat Emulation, which is a sandboxing technology that inspects files for malicious behavior in a virtual environment; Threat Extraction, which removes potentially malicious elements from files and delivers clean and safe content to your users; Anti-Bot, which identifies and blocks botnet communications and prevents data exfiltration; Anti-Virus, which scans files for known malware signatures; and IPS, which monitors network traffic for malicious or anomalous patterns. SandBlast also provides comprehensive reports and forensic analysis on the detected threats and their origin and behavior.
D
Explanation:
SandBlast is the best Check Point product to protect against malware and zero-day attacks while ensuring quick delivery of safe content to your users. SandBlast is an advanced network threat prevention solution that uses a combination of technologies to detect and block known and unknown threats before they reach your network. SandBlast uses Threat Emulation, which is a sandboxing technology that inspects files for malicious behavior in a virtual environment; Threat Extraction, which removes potentially malicious elements from files and delivers clean and safe content to your users; Anti-Bot, which identifies and blocks botnet communications and prevents data exfiltration; Anti-Virus, which scans files for known malware signatures; and IPS, which monitors network traffic for malicious or anomalous patterns. SandBlast also provides comprehensive reports and forensic analysis on the detected threats and their origin and behavior.
Question #275
The Firewall kernel is replicated multiple times, therefore:
- A . The Firewall kernel only touches the packet if the connection is accelerated
- B . The Firewall can run different policies per core
- C . The Firewall kernel is replicated only with new connections and deletes itself once the connection times out
- D . The Firewall can run the same policy on all cores.
Correct Answer: D
D
Explanation:
On a Security Gateway with CoreXL enabled, the Firewall kernel is replicated multiple times. Each replicated copy, or instance, runs on one processing core. These instances handle traffic concurrently, and each instance is a complete and independent inspection kernel. When CoreXL is enabled, all the kernel instances in the Security Gateway process traffic through the same interfaces and apply the same security policy.
D
Explanation:
On a Security Gateway with CoreXL enabled, the Firewall kernel is replicated multiple times. Each replicated copy, or instance, runs on one processing core. These instances handle traffic concurrently, and each instance is a complete and independent inspection kernel. When CoreXL is enabled, all the kernel instances in the Security Gateway process traffic through the same interfaces and apply the same security policy.
Question #276
The Check Point history feature in R81 provides the following:
- A . View install changes and install specific version
- B . View install changes
- C . Policy Installation Date, view install changes and install specific version
- D . Policy Installation Date only
Correct Answer: A
A
Explanation:
The Check Point history feature in R81 provides the following functions:
View install changes: This function allows you to view the changes that were made in each policy installation, such as added, modified, or deleted rules, objects, settings, etc. You can also compare the changes between different policy installations and filter them by various criteria.
Install specific version: This function allows you to install a specific version of the policy from the history, which can be useful for reverting to a previous policy or testing different policies. You can also view the changes that will be applied by installing a specific version before installing it.
Reference: R81 Security Management Administration Guide, page 85.
A
Explanation:
The Check Point history feature in R81 provides the following functions:
View install changes: This function allows you to view the changes that were made in each policy installation, such as added, modified, or deleted rules, objects, settings, etc. You can also compare the changes between different policy installations and filter them by various criteria.
Install specific version: This function allows you to install a specific version of the policy from the history, which can be useful for reverting to a previous policy or testing different policies. You can also view the changes that will be applied by installing a specific version before installing it.
Reference: R81 Security Management Administration Guide, page 85.
Question #277
Office mode means that:
- A . SecurID client assigns a routable MAC address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.
- B . Users authenticate with an Internet browser and use secure HTTPS connection.
- C . Local ISP (Internet service Provider) assigns a non-routable IP address to the remote user.
- D . Allows a security gateway to assign a remote client an IP address. After the user authenticates for a tunnel, the VPN gateway assigns a routable IP address to the remote client.
Correct Answer: D
D
Explanation:
Office mode is a feature that allows a security gateway to assign a remote client an IP address from a network that is protected by the security gateway. This way, the remote client can access resources on the internal network as if it was physically connected to it. The IP address is assigned to the remote client after the user authenticates for a tunnel, and it is routable, meaning that it can be reached by other hosts on the network. Office mode is useful for scenarios where the remote client needs to use applications that rely on IP addresses, such as VoIP or file sharing12.
Reference: 1: Support, Support Requests, Training … – Check Point Software 2: Gaia R81.20 Administration Guide – Check Point Software
D
Explanation:
Office mode is a feature that allows a security gateway to assign a remote client an IP address from a network that is protected by the security gateway. This way, the remote client can access resources on the internal network as if it was physically connected to it. The IP address is assigned to the remote client after the user authenticates for a tunnel, and it is routable, meaning that it can be reached by other hosts on the network. Office mode is useful for scenarios where the remote client needs to use applications that rely on IP addresses, such as VoIP or file sharing12.
Reference: 1: Support, Support Requests, Training … – Check Point Software 2: Gaia R81.20 Administration Guide – Check Point Software
Question #278
How do you enable virtual mac (VMAC) on-the-fly on a cluster member?
- A . cphaprob set int fwha_vmac_global_param_enabled 1
- B . clusterXL set int fwha_vmac_global_param_enabled 1
- C . fw ctl set int fwha_vmac_global_param_enabled 1
- D . cphaconf set int fwha_vmac_global_param_enabled 1
Correct Answer: C
C
Explanation:
To enable VMAC mode on a cluster member, you need to set the value of the global kernel parameter fwha_vmac_global_param_enabled to 1. This can be done on-the-fly using the command fw ctl set int fwha_vmac_global_param_enabled 1 on all cluster members. This command does not require a reboot or a policy installation. VMAC mode allows the cluster to use a virtual MAC address for its virtual IP addresses, which reduces the number of gratuitous ARP packets sent upon failover and avoids ARP cache issues on some routers and switches.
Reference: How to enable ClusterXL Virtual MAC (VMAC) mode
C
Explanation:
To enable VMAC mode on a cluster member, you need to set the value of the global kernel parameter fwha_vmac_global_param_enabled to 1. This can be done on-the-fly using the command fw ctl set int fwha_vmac_global_param_enabled 1 on all cluster members. This command does not require a reboot or a policy installation. VMAC mode allows the cluster to use a virtual MAC address for its virtual IP addresses, which reduces the number of gratuitous ARP packets sent upon failover and avoids ARP cache issues on some routers and switches.
Reference: How to enable ClusterXL Virtual MAC (VMAC) mode
Question #279
What are the two types of tests when using the Compliance blade?
- A . Policy-based tests and Global properties
- B . Global tests and Object-based tests
- C . Access Control policy analysis and Threat Prevention policy analysis
- D . Tests conducted based on the loC XMfcfile and analysis of SOLR documents
Correct Answer: B
B
Explanation:
The Check Point Compliance Blade has a library of Check Point-defined tests to use as a baseline for good gateway and policy configuration. A Best Practice test is related to specified regulations in different regulatory standards. It describes compliance status and recommends corrective steps. Global Tests – Examine all applicable configuration settings in the organization. Object-based Tests – Examine the configuration settings for specified objects (gateways, profiles and other objects) https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails =&solutionid=sk120256
B
Explanation:
The Check Point Compliance Blade has a library of Check Point-defined tests to use as a baseline for good gateway and policy configuration. A Best Practice test is related to specified regulations in different regulatory standards. It describes compliance status and recommends corrective steps. Global Tests – Examine all applicable configuration settings in the organization. Object-based Tests – Examine the configuration settings for specified objects (gateways, profiles and other objects) https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails =&solutionid=sk120256
Question #280
Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.
Which component of SandBlast protection is her company using on a Gateway?
- A . SandBlast Threat Emulation
- B . SandBlast Agent
- C . Check Point Protect
- D . SandBlast Threat Extraction
Correct Answer: D
D
Explanation:
Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.
The component of SandBlast protection that her company is using on a Gateway is SandBlast Threat Extraction. SandBlast Threat Extraction is a software blade that provides protection against malicious files by removing potentially risky elements, such as macros, embedded objects, scripts, etc. The sanitized files are delivered to the users with a notification about the removed elements. SandBlast Threat Extraction can also reconstruct the original files after they are scanned by SandBlast Threat Emulation, which is another software blade that provides protection against malicious files by emulating them in a virtual sandbox and analyzing their behavior.
Reference: R81 Threat Prevention Administration Guide, page 37.
D
Explanation:
Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she opened the PDF file, she noticed that the file is basically empty and only few lines of text are in it. The report is missing some graphs, tables and links.
The component of SandBlast protection that her company is using on a Gateway is SandBlast Threat Extraction. SandBlast Threat Extraction is a software blade that provides protection against malicious files by removing potentially risky elements, such as macros, embedded objects, scripts, etc. The sanitized files are delivered to the users with a notification about the removed elements. SandBlast Threat Extraction can also reconstruct the original files after they are scanned by SandBlast Threat Emulation, which is another software blade that provides protection against malicious files by emulating them in a virtual sandbox and analyzing their behavior.
Reference: R81 Threat Prevention Administration Guide, page 37.