Check Point 156-315.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #21
Which is the correct order of a log flow processed by SmartEvent components?
- A . Firewall > Correlation Unit > Log Server > SmartEvent Server Database > SmartEvent Client
- B . Firewall > SmartEvent Server Database > Correlation Unit > Log Server > SmartEvent Client
- C . Firewall > Log Server > SmartEvent Server Database > Correlation Unit > SmartEvent Client
- D . Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client
Correct Answer: D
D
Explanation:
The correct order of a log flow processed by SmartEvent components is: Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client. The Firewall generates logs for traffic and security events. The Log Server receives and stores the logs from the Firewall. The Correlation Unit analyzes the logs and generates SmartEvent events based on predefined or custom rules. The SmartEvent Server Database stores the events generated by the Correlation Unit. The SmartEvent Client displays the events and reports from the SmartEvent Server Database.
Reference: Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 12;: Check Point Software, Training & Certification, SmartEvent Introduction.
D
Explanation:
The correct order of a log flow processed by SmartEvent components is: Firewall > Log Server > Correlation Unit > SmartEvent Server Database > SmartEvent Client. The Firewall generates logs for traffic and security events. The Log Server receives and stores the logs from the Firewall. The Correlation Unit analyzes the logs and generates SmartEvent events based on predefined or custom rules. The SmartEvent Server Database stores the events generated by the Correlation Unit. The SmartEvent Client displays the events and reports from the SmartEvent Server Database.
Reference: Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 12;: Check Point Software, Training & Certification, SmartEvent Introduction.
Question #22
What is NOT a Cluster Mode?
- A . Load Sharing Unicast
- B . Load Sharing Multicast
- C . Active-Active
- D . High Availability Multicast
Correct Answer: C
C
Explanation:
Active-Active is not a cluster mode. Active-Active is a cluster configuration where both members are active and handle traffic simultaneously. However, this configuration is only supported for VSX clusters, not for regular clusters. The cluster modes for regular clusters are High Availability (HA), Load Sharing Unicast, and Load Sharing Multicast.
Reference: [Check Point Security Expert R81 ClusterXL Administration Guide], page 7.
C
Explanation:
Active-Active is not a cluster mode. Active-Active is a cluster configuration where both members are active and handle traffic simultaneously. However, this configuration is only supported for VSX clusters, not for regular clusters. The cluster modes for regular clusters are High Availability (HA), Load Sharing Unicast, and Load Sharing Multicast.
Reference: [Check Point Security Expert R81 ClusterXL Administration Guide], page 7.
Question #23
Which Operating Systems are supported for the Endpoint Security VPN?
- A . Windows and x86 Solaris
- B . Windows and macOS computers
- C . Windows and SPARC Solaris
- D . Windows and Red Hat Linux
Correct Answer: B
B
Explanation:
Endpoint Security VPN is a lightweight remote access client that supports Windows and macOS computers. It provides secure connectivity to corporate resources using L2TP/IPSec, SSL, or Check Point’s proprietary VPN protocol. Endpoint Security VPN also integrates with other Endpoint Security products such as SandBlast Agent, Full Disk Encryption, Media Encryption, and Firewall.
Reference: Check Point R81 Endpoint Security VPN Administration Guide, page 5
B
Explanation:
Endpoint Security VPN is a lightweight remote access client that supports Windows and macOS computers. It provides secure connectivity to corporate resources using L2TP/IPSec, SSL, or Check Point’s proprietary VPN protocol. Endpoint Security VPN also integrates with other Endpoint Security products such as SandBlast Agent, Full Disk Encryption, Media Encryption, and Firewall.
Reference: Check Point R81 Endpoint Security VPN Administration Guide, page 5
Question #24
The essential means by which state synchronization works to provide failover in the event an active member goes down, ____________ is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster.
- A . ccp
- B . cphaconf
- C . cphad
- D . cphastart
Correct Answer: A
A
Explanation:
The essential means by which state synchronization works to provide failover in the event an active member goes down, ccp is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster. Ccp stands for Cluster Control Protocol, and it is a proprietary protocol that runs on UDP port 8116. Ccp is responsible for exchanging state information, health checks, load balancing decisions, and synchronization network configuration between cluster members. The other options are either commands or daemons that are related to cluster operations, but not the protocol itself.
A
Explanation:
The essential means by which state synchronization works to provide failover in the event an active member goes down, ccp is used specifically for clustered environments to allow gateways to report their own state and learn about the states of other members in the cluster. Ccp stands for Cluster Control Protocol, and it is a proprietary protocol that runs on UDP port 8116. Ccp is responsible for exchanging state information, health checks, load balancing decisions, and synchronization network configuration between cluster members. The other options are either commands or daemons that are related to cluster operations, but not the protocol itself.
Question #25
identity Awareness allows easy configuration for network access, and auditing based on what three
items?
- A . Client machine IP address
- B . Network location the identity of a user and the identity of a machine
- C . Log server IP address
- D . Gateway proxy IP address
Correct Answer: B
Question #26
What feature allows Remote-access VPN users to access resources across a site-to-site VPN tunnel?
- A . Specific VPN Communities
- B . Remote Access VPN Switch
- C . Mobile Access VPN Domain
- D . Network Access VPN Domain
Correct Answer: D
D
Explanation:
The "Network Access VPN Domain" feature allows remote-access VPN users to access resources across a site-to-site VPN tunnel. This feature allows remote users to securely access internal network resources as if they were physically connected to the network. This is achieved by adding the remote-access VPN users to a "VPN Domain" that has access to the internal network resources via a site-to-site VPN tunnel. This VPN Domain is also referred to as a "Network Access VPN Domain".
D
Explanation:
The "Network Access VPN Domain" feature allows remote-access VPN users to access resources across a site-to-site VPN tunnel. This feature allows remote users to securely access internal network resources as if they were physically connected to the network. This is achieved by adding the remote-access VPN users to a "VPN Domain" that has access to the internal network resources via a site-to-site VPN tunnel. This VPN Domain is also referred to as a "Network Access VPN Domain".
Question #27
What command lists all interfaces using Multi-Queue?
- A . cpmq get
- B . show interface all
- C . cpmq set
- D . show multiqueue all
Correct Answer: A
A
Explanation:
The command that lists all interfaces using Multi-Queue is cpmq get. Multi-Queue is a feature that allows network interfaces to use multiple transmit and receive queues, which improves the performance and scalability of the Security Gateway by distributing the network load among several CPU cores. Cpmq is a command that allows administrators to configure and manage Multi-Queue settings on network interfaces. Cpmq get lists all interfaces using Multi-Queue and shows their queue count and core distribution.
A
Explanation:
The command that lists all interfaces using Multi-Queue is cpmq get. Multi-Queue is a feature that allows network interfaces to use multiple transmit and receive queues, which improves the performance and scalability of the Security Gateway by distributing the network load among several CPU cores. Cpmq is a command that allows administrators to configure and manage Multi-Queue settings on network interfaces. Cpmq get lists all interfaces using Multi-Queue and shows their queue count and core distribution.
Question #28
How many policy layers do Access Control policy support?
- A . 2
- B . 4
- C . 1
- D . 3
Correct Answer: A
A
Explanation:
The Access Control policy supports two policy layers. These are the Network layer and the Application & URL Filtering layer. The Network layer contains rules that control the network traffic based on the source, destination, service, and action. The Application & URL Filtering layer contains rules that control the application and web access based on the application, site category, and user identity12.
The Access Control policy can also use inline layers, which are sub-policies that are embedded within a rule. Inline layers allow more granular control over specific traffic or scenarios, such as VPN, Mobile Access, or different user groups13. However, inline layers are not considered as separate policy layers, but rather as extensions of the parent rule4.
Therefore, the correct answer is A. The Access Control policy supports two policy layers.
Reference: 1, Policy Layers in R80.x – Check Point CheckMates
2, Access Control policies, layers, and rules | Check Point Firewall …
3, Chapter 8: Introduction to Policies, Layers, and Rules – Check Point …
4, Creating an Access Control Policy – Check Point Software
A
Explanation:
The Access Control policy supports two policy layers. These are the Network layer and the Application & URL Filtering layer. The Network layer contains rules that control the network traffic based on the source, destination, service, and action. The Application & URL Filtering layer contains rules that control the application and web access based on the application, site category, and user identity12.
The Access Control policy can also use inline layers, which are sub-policies that are embedded within a rule. Inline layers allow more granular control over specific traffic or scenarios, such as VPN, Mobile Access, or different user groups13. However, inline layers are not considered as separate policy layers, but rather as extensions of the parent rule4.
Therefore, the correct answer is A. The Access Control policy supports two policy layers.
Reference: 1, Policy Layers in R80.x – Check Point CheckMates
2, Access Control policies, layers, and rules | Check Point Firewall …
3, Chapter 8: Introduction to Policies, Layers, and Rules – Check Point …
4, Creating an Access Control Policy – Check Point Software
Question #29
How is communication between different Check Point components secured in R81? As with all questions, select the BEST answer.
- A . By using IPSEC
- B . By using SIC
- C . By using ICA
- D . By using 3DES
Correct Answer: B
B
Explanation:
Communication between different Check Point components is secured by using SIC, which stands for secure internal communication. SIC is a certificate-based channel that uses standards-based TLS 1.2 for creating secure connections and AES128 for encryption. SIC ensures that only authorized components can communicate with each other and that the communication is protected from eavesdropping and tampering. SIC is established by using a one-time password (OTP) that is generated when a Check Point component is created or installed. The OTP is used to initialize the trust relationship between the component and the Security Management Server, which acts as an internal certificate authority (ICA) that issues and revokes certificates for the components.
B
Explanation:
Communication between different Check Point components is secured by using SIC, which stands for secure internal communication. SIC is a certificate-based channel that uses standards-based TLS 1.2 for creating secure connections and AES128 for encryption. SIC ensures that only authorized components can communicate with each other and that the communication is protected from eavesdropping and tampering. SIC is established by using a one-time password (OTP) that is generated when a Check Point component is created or installed. The OTP is used to initialize the trust relationship between the component and the Security Management Server, which acts as an internal certificate authority (ICA) that issues and revokes certificates for the components.
Question #30
Which of the following Check Point processes within the Security Management Server is responsible for the receiving of log records from Security Gateway?
- A . logd
- B . fwd
- C . fwm
- D . cpd
Correct Answer: B
B
Explanation:
The fwd process within the Security Management Server is responsible for the receiving of log records from Security Gateway. The fwd process handles the communication with the Security Gateways and log servers via TCP port 2571. The other processes have different roles, such as logd for writing logs to the database, fwm for handling GUI clients, and cpd for infrastructure tasks2.
Reference: Check Point Ports Used for Communication by Various Check Point Modules, Check Point Processes Cheat Sheet C LazyAdmins
B
Explanation:
The fwd process within the Security Management Server is responsible for the receiving of log records from Security Gateway. The fwd process handles the communication with the Security Gateways and log servers via TCP port 2571. The other processes have different roles, such as logd for writing logs to the database, fwm for handling GUI clients, and cpd for infrastructure tasks2.
Reference: Check Point Ports Used for Communication by Various Check Point Modules, Check Point Processes Cheat Sheet C LazyAdmins