Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #321
Can Check Point and Third-party Gateways establish a certificate-based Site-to-Site VPN tunnel?
- A . Yes, but they need to have a mutually trusted certificate authority
- B . Yes, but they have to have a pre-shared secret key
- C . No, they cannot share certificate authorities
- D . No, Certificate based VPNs are only possible between Check Point devices
Correct Answer: A
A
Explanation:
Check Point and Third-party Gateways can establish a certificate-based Site-to-Site VPN tunnel if they have a mutually trusted certificate authority. This means that both gateways trust the same root CA or intermediate CA that issued their certificates. This way, they can authenticate each other using their certificates and establish a secure VPN tunnel.
Reference: Check Point Resource Library, page 5
A
Explanation:
Check Point and Third-party Gateways can establish a certificate-based Site-to-Site VPN tunnel if they have a mutually trusted certificate authority. This means that both gateways trust the same root CA or intermediate CA that issued their certificates. This way, they can authenticate each other using their certificates and establish a secure VPN tunnel.
Reference: Check Point Resource Library, page 5
Question #322
How long may verification of one file take for Sandblast Threat Emulation?
- A . up to 1 minutes
- B . within seconds cleaned file will be provided
- C . up to 5 minutes
- D . up to 3 minutes
Correct Answer: D
D
Explanation:
How long may verification of one file take for SandBlast Threat Emulation? Verification of one file may take up to 3 minutes for SandBlast Threat Emulation. SandBlast Threat Emulation is a software blade that provides protection against malicious files by emulating them in a virtual sandbox and analyzing their behavior. The emulation time depends on various factors, such as file size, file type, emulation mode, etc. The default emulation time limit is 180 seconds, but it can be changed in the Threat Prevention policy settings.
Reference: [R81 Threat Prevention Administration Guide], page 39.
D
Explanation:
How long may verification of one file take for SandBlast Threat Emulation? Verification of one file may take up to 3 minutes for SandBlast Threat Emulation. SandBlast Threat Emulation is a software blade that provides protection against malicious files by emulating them in a virtual sandbox and analyzing their behavior. The emulation time depends on various factors, such as file size, file type, emulation mode, etc. The default emulation time limit is 180 seconds, but it can be changed in the Threat Prevention policy settings.
Reference: [R81 Threat Prevention Administration Guide], page 39.
Question #323
There are 4 ways to use the Management API for creating host object with R81 Management API.
Which one is NOT correct?
- A . Using Web Services
- B . Using Mgmt_cli tool
- C . Using CLISH
- D . Using SmartConsole GUI console
- E . Events are collected with SmartWorkflow from Trouble Ticket systems
Correct Answer: E
E
Explanation:
There are four ways to use the Management API for creating host object with R81 Management API: Using Web Services, Using mgmt_cli tool, Using CLISH, and Using SmartConsole GUI console. Events are collected with SmartWorkflow from Trouble Ticket systems is not a correct option.
Reference: Check Point Management APIs
E
Explanation:
There are four ways to use the Management API for creating host object with R81 Management API: Using Web Services, Using mgmt_cli tool, Using CLISH, and Using SmartConsole GUI console. Events are collected with SmartWorkflow from Trouble Ticket systems is not a correct option.
Reference: Check Point Management APIs
Question #324
Which components allow you to reset a VPN tunnel?
- A . vpn tu command or SmartView monitor
- B . delete vpn ike sa or vpn she11 command
- C . vpn tunnelutil or delete vpn ike sa command
- D . SmartView monitor only
Correct Answer: A
A
Explanation:
The vpn tu command and the SmartView Monitor are two components that allow you to reset a VPN tunnel. The vpn tu command is a command-line tool that lets you view and manage the status of VPN tunnels on a Security Gateway or cluster member. The SmartView Monitor is a graphical tool that lets you monitor the network and security performance, view VPN tunnel status, and reset VPN tunnels. Both components can be used to reset a VPN tunnel by selecting the option to delete IKE SA or IPsec SA for a specific peer or all peers.
Reference: R81 VPN Administration Guide, page 29-30; R81 SmartConsole R81 Resolved Issues, sk170114
A
Explanation:
The vpn tu command and the SmartView Monitor are two components that allow you to reset a VPN tunnel. The vpn tu command is a command-line tool that lets you view and manage the status of VPN tunnels on a Security Gateway or cluster member. The SmartView Monitor is a graphical tool that lets you monitor the network and security performance, view VPN tunnel status, and reset VPN tunnels. Both components can be used to reset a VPN tunnel by selecting the option to delete IKE SA or IPsec SA for a specific peer or all peers.
Reference: R81 VPN Administration Guide, page 29-30; R81 SmartConsole R81 Resolved Issues, sk170114
Question #325
Alice wants to upgrade the current security management machine from R80.40 to R81.20 and she wants to check the Deployment Agent status over the GAIA CLISH.
Which of the following GAIACLISH command is true?
- A . show agent status
- B . show uninstaller status
- C . show installer packages
- D . show installer status
Correct Answer: D
D
Explanation:
The correct command for checking the Deployment Agent status over the GAIA CLISH is “show installer status”. This command displays information about the Deployment Agent such as its version, status, last update time, and last operation result. The other commands are either invalid or irrelevant for this purpose.
Reference: [Check Point Security Expert R81 Installation and Upgrade Guide], page 23.
D
Explanation:
The correct command for checking the Deployment Agent status over the GAIA CLISH is “show installer status”. This command displays information about the Deployment Agent such as its version, status, last update time, and last operation result. The other commands are either invalid or irrelevant for this purpose.
Reference: [Check Point Security Expert R81 Installation and Upgrade Guide], page 23.
Question #326
Which one of the following is true about Threat Emulation?
- A . Takes less than a second to complete
- B . Works on MS Office and PDF files only
- C . Always delivers a file
- D . Takes minutes to complete (less than 3 minutes)
Correct Answer: D
D
Explanation:
Threat Emulation is a software blade that takes minutes to complete (less than 3 minutes). Threat Emulation analyzes files for malicious behavior by running them in a virtual sandbox. Threat Emulation works on MS Office, PDF, executables, and archive files. Threat Emulation does not always deliver a file, but only if no threats are found or if the user chooses to download the original file after seeing a warning message.
Reference: Check Point Security Expert R81 Course, Threat Emulation Administration Guide
D
Explanation:
Threat Emulation is a software blade that takes minutes to complete (less than 3 minutes). Threat Emulation analyzes files for malicious behavior by running them in a virtual sandbox. Threat Emulation works on MS Office, PDF, executables, and archive files. Threat Emulation does not always deliver a file, but only if no threats are found or if the user chooses to download the original file after seeing a warning message.
Reference: Check Point Security Expert R81 Course, Threat Emulation Administration Guide
Question #327
Which of the following cannot be configured in an Access Role Object?
- A . Networks
- B . Machines
- C . Users
- D . Time
Correct Answer: D
D
Explanation:
The verified answer is D) Time.
An Access Role object is a logical representation of a set of users, machines, or networks that can be used in the security policy1. An Access Role object can include the following components1: Networks: IP addresses or network objects that define the source or destination of the traffic. Machines: Specific hosts or machine groups that are identified by their MAC addresses or certificates. Users: Specific users or user groups that are authenticated by one or more identity sources, such as Active Directory, LDAP, or Identity Awareness.
Time is not a component of an Access Role object, and it cannot be configured in it. Time is a separate object type that can be used to define the validity period of a rule or a policy2.
Reference: LDAP group vs Access role objects – Check Point CheckMates3 THE IMPORTANCE OF ACCESS ROLES – Check Point Software1 Time Objects – Check Point Software2
D
Explanation:
The verified answer is D) Time.
An Access Role object is a logical representation of a set of users, machines, or networks that can be used in the security policy1. An Access Role object can include the following components1: Networks: IP addresses or network objects that define the source or destination of the traffic. Machines: Specific hosts or machine groups that are identified by their MAC addresses or certificates. Users: Specific users or user groups that are authenticated by one or more identity sources, such as Active Directory, LDAP, or Identity Awareness.
Time is not a component of an Access Role object, and it cannot be configured in it. Time is a separate object type that can be used to define the validity period of a rule or a policy2.
Reference: LDAP group vs Access role objects – Check Point CheckMates3 THE IMPORTANCE OF ACCESS ROLES – Check Point Software1 Time Objects – Check Point Software2
Question #328
You can access the ThreatCloud Repository from:
- A . R81.20 SmartConsole and Application Wiki
- B . Threat Prevention and Threat Tools
- C . Threat Wiki and Check Point Website
- D . R81.20 SmartConsole and Threat Prevention
Correct Answer: D
D
Explanation:
According to the Check Point R81 release notes, you can access the ThreatCloud Repository from R81.20 SmartConsole and Threat Prevention. The ThreatCloud Repository is a cloud-based service that provides real-time threat intelligence and updates to Check Point products. The other options are either outdated or nonexistent.
Reference: Check Point R81
D
Explanation:
According to the Check Point R81 release notes, you can access the ThreatCloud Repository from R81.20 SmartConsole and Threat Prevention. The ThreatCloud Repository is a cloud-based service that provides real-time threat intelligence and updates to Check Point products. The other options are either outdated or nonexistent.
Reference: Check Point R81
Question #329
Which statement is NOT TRUE about Delta synchronization?
- A . Using UDP Multicast or Broadcast on port 8161
- B . Using UDP Multicast or Broadcast on port 8116
- C . Quicker than Full sync
- D . Transfers changes in the Kernel tables between cluster members.
Correct Answer: A
A
Explanation:
The statement that is not true about Delta synchronization is Using UDP Multicast or Broadcast on port 8161. Delta synchronization is a mechanism that transfers only the changes in the kernel tables between cluster members, instead of sending the entire tables. It uses UDP Multicast or Broadcast on port 8116, not 81612. The other statements are true about Delta synchronization.
Reference: Check Point R81 ClusterXL Administration Guide
A
Explanation:
The statement that is not true about Delta synchronization is Using UDP Multicast or Broadcast on port 8161. Delta synchronization is a mechanism that transfers only the changes in the kernel tables between cluster members, instead of sending the entire tables. It uses UDP Multicast or Broadcast on port 8116, not 81612. The other statements are true about Delta synchronization.
Reference: Check Point R81 ClusterXL Administration Guide
Question #330
When gathering information about a gateway using CPINFO, what information is included or excluded when using the “-x” parameter?
- A . Includes the registry
- B . Gets information about the specified Virtual System
- C . Does not resolve network addresses
- D . Output excludes connection table
Correct Answer: B
B
Explanation:
The cpinfo command is a tool that collects diagnostic data from a Check Point gateway or management server. The data includes configuration files, logs, status reports, and more. The cpinfo output can be used for troubleshooting or sent to Check Point support for analysis. The -x parameter is used to get information about the specified Virtual System on a VSX gateway. A Virtual System is a virtualized firewall instance that runs on a VSX gateway and has its own security policy and objects.
Reference: Check Point Security Expert R81 Course, cpinfo Utility, VSX Administration Guide
B
Explanation:
The cpinfo command is a tool that collects diagnostic data from a Check Point gateway or management server. The data includes configuration files, logs, status reports, and more. The cpinfo output can be used for troubleshooting or sent to Check Point support for analysis. The -x parameter is used to get information about the specified Virtual System on a VSX gateway. A Virtual System is a virtualized firewall instance that runs on a VSX gateway and has its own security policy and objects.
Reference: Check Point Security Expert R81 Course, cpinfo Utility, VSX Administration Guide