Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #341
SandBlast Mobile identifies threats in mobile devices by using on-device, network, and cloud-based algorithms and has four dedicated components that constantly work together to protect mobile devices and their data.
Which component is NOT part of the SandBlast Mobile solution?
- A . Management Dashboard
- B . Gateway
- C . Personal User Storage
- D . Behavior Risk Engine
Correct Answer: C
C
Explanation:
SandBlast Mobile has four components: Management Dashboard, Gateway, Behavior Risk Engine, and On-Device Network Protection. Personal User Storage is not part of the SandBlast Mobile solution.
Reference: SandBlast Mobile Architecture
C
Explanation:
SandBlast Mobile has four components: Management Dashboard, Gateway, Behavior Risk Engine, and On-Device Network Protection. Personal User Storage is not part of the SandBlast Mobile solution.
Reference: SandBlast Mobile Architecture
Question #342
To add a file to the Threat Prevention Whitelist, what two items are needed?
- A . File name and Gateway
- B . Object Name and MD5 signature
- C . MD5 signature and Gateway
- D . IP address of Management Server and Gateway
Correct Answer: B
B
Explanation:
To add a file to the Threat Prevention Whitelist, you need two items:
B) Object Name and MD5 signature
You need the Object Name to identify the file or object you want to whitelist, and the MD5 signature to specify the unique hash value of that file. The MD5 signature ensures that the specific file you want to whitelist is identified accurately.
Reference: Check Point Certified Security Expert R81 Study Guide, Threat Prevention Administration Guide.
B
Explanation:
To add a file to the Threat Prevention Whitelist, you need two items:
B) Object Name and MD5 signature
You need the Object Name to identify the file or object you want to whitelist, and the MD5 signature to specify the unique hash value of that file. The MD5 signature ensures that the specific file you want to whitelist is identified accurately.
Reference: Check Point Certified Security Expert R81 Study Guide, Threat Prevention Administration Guide.
Question #343
Which of the following is NOT a type of Endpoint Identity Agent?
- A . Terminal
- B . Light
- C . Full
- D . Custom
Correct Answer: A
A
Explanation:
The type of Endpoint Identity Agent that does not exist is Terminal. Endpoint Identity Agent is a software component that runs on Windows or Mac devices and provides identity information to the Check Point Security Gateway. Endpoint Identity Agent allows the Security Gateway to enforce granular access policies based on user identity and device compliance status. There are three types
of Endpoint Identity Agent:
Full Identity Agent – a persistent agent that provides seamless and transparent identity acquisition and SSO (single sign-on) capabilities. It supports various authentication methods, such as Active Directory, LDAP, RADIUS, certificate, etc. It also supports endpoint compliance checks and remediation actions.
Light Identity Agent – a lightweight agent that provides identity acquisition through a web browser. It supports Active Directory authentication only. It does not support SSO or endpoint compliance features.
Custom Identity Agent – a customized agent that provides identity acquisition through an API. It allows third-party applications or systems to integrate with Check Point Identity Awareness and provide user identity information.
Terminal is not a type of Endpoint Identity Agent, but it is a type of Terminal Server Agent. Terminal Server Agent is a software component that runs on Windows Terminal Servers or Citrix Servers and provides identity information for multiple concurrent users who connect to these servers using Remote Desktop Protocol (RDP) or Independent Computing Architecture (ICA) protocol. Terminal Server Agent allows the Security Gateway to enforce granular access policies based on user identity and session information.
A
Explanation:
The type of Endpoint Identity Agent that does not exist is Terminal. Endpoint Identity Agent is a software component that runs on Windows or Mac devices and provides identity information to the Check Point Security Gateway. Endpoint Identity Agent allows the Security Gateway to enforce granular access policies based on user identity and device compliance status. There are three types
of Endpoint Identity Agent:
Full Identity Agent – a persistent agent that provides seamless and transparent identity acquisition and SSO (single sign-on) capabilities. It supports various authentication methods, such as Active Directory, LDAP, RADIUS, certificate, etc. It also supports endpoint compliance checks and remediation actions.
Light Identity Agent – a lightweight agent that provides identity acquisition through a web browser. It supports Active Directory authentication only. It does not support SSO or endpoint compliance features.
Custom Identity Agent – a customized agent that provides identity acquisition through an API. It allows third-party applications or systems to integrate with Check Point Identity Awareness and provide user identity information.
Terminal is not a type of Endpoint Identity Agent, but it is a type of Terminal Server Agent. Terminal Server Agent is a software component that runs on Windows Terminal Servers or Citrix Servers and provides identity information for multiple concurrent users who connect to these servers using Remote Desktop Protocol (RDP) or Independent Computing Architecture (ICA) protocol. Terminal Server Agent allows the Security Gateway to enforce granular access policies based on user identity and session information.
Question #344
What traffic does the Anti-bot feature block?
- A . Command and Control traffic from hosts that have been identified as infected
- B . Command and Control traffic to servers with reputation for hosting malware
- C . Network traffic that is directed to unknown or malicious servers
- D . Network traffic to hosts that have been identified as infected
Correct Answer: A
A
Explanation:
The traffic that the Anti-bot feature blocks is command and control traffic from hosts that have been identified as infected. Anti-bot is a blade that detects and prevents botnet attacks by using a cloud-based service that provides up-to-date threat intelligence. When Anti-bot detects a host that is communicating with a malicious command and control server, it blocks the traffic and generates an alert2. The other options are not the types of traffic that Anti-bot blocks.
Reference: 2: Check Point Software, Getting Started, Anti-Bot.
A
Explanation:
The traffic that the Anti-bot feature blocks is command and control traffic from hosts that have been identified as infected. Anti-bot is a blade that detects and prevents botnet attacks by using a cloud-based service that provides up-to-date threat intelligence. When Anti-bot detects a host that is communicating with a malicious command and control server, it blocks the traffic and generates an alert2. The other options are not the types of traffic that Anti-bot blocks.
Reference: 2: Check Point Software, Getting Started, Anti-Bot.
Question #345
What is the correct command to observe the Sync traffic in a VRRP environment?
- A . fw monitor Ce “accept[12:4,b]=224.0.0.18;”
- B . fw monitor Ce “accept port(6118;”
- C . fw monitor Ce “accept proto=mcVRRP;”
- D . fw monitor Ce “accept dst=224.0.0.18;”
Correct Answer: D
D
Explanation:
The correct command to observe the Sync traffic in a VRRP environment is fw monitor Ce “accept dst=224.0.0.18;”. This command captures the packets that have the destination IP address of 224.0.0.18, which is the multicast address used by VRRP for synchronization. The other commands are either not valid or not specific to VRRP Sync traffic.
Reference: [Check Point R81 ClusterXL Administration Guide], Check Point R81 Performance Tuning Administration Guide
D
Explanation:
The correct command to observe the Sync traffic in a VRRP environment is fw monitor Ce “accept dst=224.0.0.18;”. This command captures the packets that have the destination IP address of 224.0.0.18, which is the multicast address used by VRRP for synchronization. The other commands are either not valid or not specific to VRRP Sync traffic.
Reference: [Check Point R81 ClusterXL Administration Guide], Check Point R81 Performance Tuning Administration Guide
Question #346
The system administrator of a company is trying to find out why acceleration is not working for the traffic. The traffic is allowed according to the rule base and checked for viruses. But it is not accelerated.
What is the most likely reason that the traffic is not accelerated?
- A . There is a virus found. Traffic is still allowed but not accelerated.
- B . The connection required a Security server.
- C . Acceleration is not enabled.
- D . The traffic is originating from the gateway itself.
Correct Answer: B
B
Explanation:
According to the Check Point R81 release notes, acceleration is not supported for connections that require a Security server, such as HTTPS Inspection, Content Awareness, or Anti-Virus. The Security server performs deep inspection and modification of the traffic, which prevents acceleration. The other options are either false or not the most likely reason.
Reference: Check Point R81
B
Explanation:
According to the Check Point R81 release notes, acceleration is not supported for connections that require a Security server, such as HTTPS Inspection, Content Awareness, or Anti-Virus. The Security server performs deep inspection and modification of the traffic, which prevents acceleration. The other options are either false or not the most likely reason.
Reference: Check Point R81
Question #347
In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log.
Which of the following options can you add to each Log, Detailed Log and Extended Log?
- A . Accounting
- B . Suppression
- C . Accounting/Suppression
- D . Accounting/Extended
Correct Answer: C
C
Explanation:
In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. The option that can be added to each Log, Detailed Log and Extended Log is Accounting/Suppression. Accounting/Suppression is a feature that allows administrators to control how often logs are generated for certain rules or connections. Accounting means that logs are generated periodically based on a specified interval or volume. Suppression means that logs are generated only for the first and last packet of a connection or session. Accounting/Suppression can be added to any tracking option to reduce the number of logs and save disk space.
C
Explanation:
In Logging and Monitoring, the tracking options are Log, Detailed Log and Extended Log. The option that can be added to each Log, Detailed Log and Extended Log is Accounting/Suppression. Accounting/Suppression is a feature that allows administrators to control how often logs are generated for certain rules or connections. Accounting means that logs are generated periodically based on a specified interval or volume. Suppression means that logs are generated only for the first and last packet of a connection or session. Accounting/Suppression can be added to any tracking option to reduce the number of logs and save disk space.
Question #348
Access roles allow the firewall administrator to configure network access according to:
- A . a combination of computer or computer groups and networks.
- B . All of the above.
- C . remote access clients.
- D . users and user groups.
Correct Answer: B
B
Explanation:
Access roles are objects that define a set of users, machines, or networks that can access a specific network resource. You can create access roles based on any combination of the following criteria: Users and user groups: You can use users and user groups from various sources, such as LDAP, RADIUS, local database, etc.
Computers or computer groups: You can use computers or computer groups that are identified by their IP address, MAC address, or hostname.
Networks: You can use networks that are defined by their IP address range, subnet mask, or gateway. You can use access roles in the Source or Destination column of an Access Control rule to allow or deny network access based on the identity of the users, machines, or networks. The references are:
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 11
Check Point R81 Quantum Security Gateway Guide, page 139
Check Point R81 Identity Awareness Administration Guide, page 9
B
Explanation:
Access roles are objects that define a set of users, machines, or networks that can access a specific network resource. You can create access roles based on any combination of the following criteria: Users and user groups: You can use users and user groups from various sources, such as LDAP, RADIUS, local database, etc.
Computers or computer groups: You can use computers or computer groups that are identified by their IP address, MAC address, or hostname.
Networks: You can use networks that are defined by their IP address range, subnet mask, or gateway. You can use access roles in the Source or Destination column of an Access Control rule to allow or deny network access based on the identity of the users, machines, or networks. The references are:
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 11
Check Point R81 Quantum Security Gateway Guide, page 139
Check Point R81 Identity Awareness Administration Guide, page 9
Question #348
Access roles allow the firewall administrator to configure network access according to:
- A . a combination of computer or computer groups and networks.
- B . All of the above.
- C . remote access clients.
- D . users and user groups.
Correct Answer: B
B
Explanation:
Access roles are objects that define a set of users, machines, or networks that can access a specific network resource. You can create access roles based on any combination of the following criteria: Users and user groups: You can use users and user groups from various sources, such as LDAP, RADIUS, local database, etc.
Computers or computer groups: You can use computers or computer groups that are identified by their IP address, MAC address, or hostname.
Networks: You can use networks that are defined by their IP address range, subnet mask, or gateway. You can use access roles in the Source or Destination column of an Access Control rule to allow or deny network access based on the identity of the users, machines, or networks. The references are:
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 11
Check Point R81 Quantum Security Gateway Guide, page 139
Check Point R81 Identity Awareness Administration Guide, page 9
B
Explanation:
Access roles are objects that define a set of users, machines, or networks that can access a specific network resource. You can create access roles based on any combination of the following criteria: Users and user groups: You can use users and user groups from various sources, such as LDAP, RADIUS, local database, etc.
Computers or computer groups: You can use computers or computer groups that are identified by their IP address, MAC address, or hostname.
Networks: You can use networks that are defined by their IP address range, subnet mask, or gateway. You can use access roles in the Source or Destination column of an Access Control rule to allow or deny network access based on the identity of the users, machines, or networks. The references are:
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 11
Check Point R81 Quantum Security Gateway Guide, page 139
Check Point R81 Identity Awareness Administration Guide, page 9
Question #350
Where do you create and modify the Mobile Access policy in R81?
- A . SmartConsole
- B . SmartMonitor
- C . SmartEndpoint
- D . SmartDashboard
Correct Answer: A
A
Explanation:
In R81, the Mobile Access policy is created and modified in SmartConsole. SmartConsole is the management interface for configuring and managing various security policies, including Mobile Access policies.
Reference: Check Point Certified Security Expert R81 documentation and learning resources.
A
Explanation:
In R81, the Mobile Access policy is created and modified in SmartConsole. SmartConsole is the management interface for configuring and managing various security policies, including Mobile Access policies.
Reference: Check Point Certified Security Expert R81 documentation and learning resources.