Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #351
On R81.20 when configuring Third-Party devices to read the logs using the LEA (Log Export API) the default Log Server uses port:
- A . 18210
- B . 18184
- C . 257
- D . 18191
Correct Answer: B
B
Explanation:
On R81.20, when configuring Third-Party devices to read the logs using the LEA (Log Export API), the default Log Server uses port 18184. This port can be changed using the lea_server command in expert mode. The other ports are either not related to LEA, or used for different purposes, such as 18210 for CPMI, 257 for FW1_log, and 18191 for SIC.
Reference: [Check Point R81 Logging and Monitoring Administration Guide], [Check Point Ports Used for Communication by Various Check Point Modules]
B
Explanation:
On R81.20, when configuring Third-Party devices to read the logs using the LEA (Log Export API), the default Log Server uses port 18184. This port can be changed using the lea_server command in expert mode. The other ports are either not related to LEA, or used for different purposes, such as 18210 for CPMI, 257 for FW1_log, and 18191 for SIC.
Reference: [Check Point R81 Logging and Monitoring Administration Guide], [Check Point Ports Used for Communication by Various Check Point Modules]
Question #352
How many layers make up the TCP/IP model?
- A . 2
- B . 7
- C . 6
- D . 4
Correct Answer: D
D
Explanation:
The TCP/IP model is a four-layer model that describes how data is transmitted over a network. The four layers are: Application, Transport, Internet, and Network Access. The Application layer provides services and protocols for applications to communicate with each other. The Transport layer provides reliable or unreliable data delivery between hosts. The Internet layer provides routing and addressing of packets across networks. The Network Access layer provides physical and logical access to the network media.
Reference: Training & Certification | Check Point Software, Check Point Resource Library
D
Explanation:
The TCP/IP model is a four-layer model that describes how data is transmitted over a network. The four layers are: Application, Transport, Internet, and Network Access. The Application layer provides services and protocols for applications to communicate with each other. The Transport layer provides reliable or unreliable data delivery between hosts. The Internet layer provides routing and addressing of packets across networks. The Network Access layer provides physical and logical access to the network media.
Reference: Training & Certification | Check Point Software, Check Point Resource Library
Question #353
What needs to be configured if the NAT property ‘Translate destination or client side’ is not enabled in Global Properties?
- A . A host route to route to the destination IP.
- B . Use the file local.arp to add the ARP entries for NAT to work.
- C . Nothing, the Gateway takes care of all details necessary.
- D . Enabling ‘Allow bi-directional NAT’ for NAT to work correctly.
Correct Answer: C
C
Explanation:
The NAT property ‘Translate destination or client side’ is used to determine whether the destination IP address of a packet should be translated on the client side or the server side of a connection. If this property is not enabled, then the destination IP address is translated on the server side, which means that the gateway takes care of all details necessary for NAT to work. The gateway will send an ARP request for the translated IP address and will reply to any ARP requests for that address. Therefore, there is no need to configure a host route, use the local.arp file, or enable bi-directional NAT for NAT to work correctly.
Reference: R81 Security Management Administration Guide, page 1010.
C
Explanation:
The NAT property ‘Translate destination or client side’ is used to determine whether the destination IP address of a packet should be translated on the client side or the server side of a connection. If this property is not enabled, then the destination IP address is translated on the server side, which means that the gateway takes care of all details necessary for NAT to work. The gateway will send an ARP request for the translated IP address and will reply to any ARP requests for that address. Therefore, there is no need to configure a host route, use the local.arp file, or enable bi-directional NAT for NAT to work correctly.
Reference: R81 Security Management Administration Guide, page 1010.
Question #354
What SmartEvent component creates events?
- A . Consolidation Policy
- B . Correlation Unit
- C . SmartEvent Policy
- D . SmartEvent GUI
Correct Answer: B
B
Explanation:
The SmartEvent component that creates events is the Correlation Unit, which is responsible for correlating and analyzing security events to identify patterns and potential threats.
Option A, "Consolidation Policy," does not create events but is used to configure policies for event consolidation.
Option C, "SmartEvent Policy," is not responsible for creating events but is used to configure policies related to SmartEvent.
Option D, "SmartEvent GUI," is the graphical user interface for managing SmartEvent but does not create events itself.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
B
Explanation:
The SmartEvent component that creates events is the Correlation Unit, which is responsible for correlating and analyzing security events to identify patterns and potential threats.
Option A, "Consolidation Policy," does not create events but is used to configure policies for event consolidation.
Option C, "SmartEvent Policy," is not responsible for creating events but is used to configure policies related to SmartEvent.
Option D, "SmartEvent GUI," is the graphical user interface for managing SmartEvent but does not create events itself.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #355
An administrator wishes to enable Identity Awareness on the Check Point firewalls. However, they allow users to use company issued or personal laptops. Since the administrator cannot manage the personal laptops, which of the following methods would BEST suit this company?
- A . AD Query
- B . Terminal Servers Agent
- C . Identity Agents
- D . Browser-Based Authentication
Correct Answer: D
D
Explanation:
Browser-Based Authentication is an identity awareness method that enables you to identify users who are not authenticated by other methods, such as Active Directory or VPN. Browser-Based Authentication redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity.
Browser-Based Authentication is suitable for scenarios where users can use company issued or
personal laptops, since it does not require any installation or configuration on the user’s device. It
also supports various operating systems and browsers, and can be customized to match the
company’s branding.
The references are:
Check Point R81 Identity Awareness Administration Guide, page 9 Configuring Browser-Based Authentication in SmartConsole
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 13
D
Explanation:
Browser-Based Authentication is an identity awareness method that enables you to identify users who are not authenticated by other methods, such as Active Directory or VPN. Browser-Based Authentication redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity.
Browser-Based Authentication is suitable for scenarios where users can use company issued or
personal laptops, since it does not require any installation or configuration on the user’s device. It
also supports various operating systems and browsers, and can be customized to match the
company’s branding.
The references are:
Check Point R81 Identity Awareness Administration Guide, page 9 Configuring Browser-Based Authentication in SmartConsole
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 13
Question #356
Which Check Point software blade provides protection from zero-day and undiscovered threats?
- A . Firewall
- B . Threat Emulation
- C . Application Control
- D . Threat Extraction
Correct Answer: B
B
Explanation:
The Check Point software blade that provides protection from zero-day and undiscovered threats is Threat Emulation. Threat Emulation is a sandboxing technology that inspects files for malicious behavior in a virtual environment before they reach the end user. Threat Emulation can detect and block malware that tries to evade traditional signature-based solutions by using unknown or obfuscated techniques. Threat Emulation can also generate forensic reports and provide actionable intelligence on the malware origin and behavior.
B
Explanation:
The Check Point software blade that provides protection from zero-day and undiscovered threats is Threat Emulation. Threat Emulation is a sandboxing technology that inspects files for malicious behavior in a virtual environment before they reach the end user. Threat Emulation can detect and block malware that tries to evade traditional signature-based solutions by using unknown or obfuscated techniques. Threat Emulation can also generate forensic reports and provide actionable intelligence on the malware origin and behavior.
Question #357
Which of the following is an authentication method used for Identity Awareness?
- A . RSA
- B . SSL
- C . Captive Portal
- D . PKI
Correct Answer: C
C
Explanation:
Captive Portal is one of the authentication methods used for Identity Awareness, which is a feature of Check Point that enables you to identify users and apply security policy rules based on their identity. Captive Portal redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity.
The references are:
Machine Authentication & Identity Awareness – Check Point CheckMates Check Point Certified Security Expert R81.20, slide 13
Check Point R81 Identity Awareness Administration Guide, page 9
C
Explanation:
Captive Portal is one of the authentication methods used for Identity Awareness, which is a feature of Check Point that enables you to identify users and apply security policy rules based on their identity. Captive Portal redirects users to a web page where they can enter their credentials and be authenticated by an external server, such as LDAP or RADIUS. After authentication, users can access the Internet and corporate resources according to the security policy rules that apply to their identity.
The references are:
Machine Authentication & Identity Awareness – Check Point CheckMates Check Point Certified Security Expert R81.20, slide 13
Check Point R81 Identity Awareness Administration Guide, page 9
Question #358
What is correct statement about Security Gateway and Security Management Server failover in Check Point R81.X in terms of Check Point Redundancy driven solution?
- A . Security Gateway failover is an automatic procedure but Security Management Server failover is a manual procedure.
- B . Security Gateway failover as well as Security Management Server failover is a manual procedure.
- C . Security Gateway failover is a manual procedure but Security Management Server failover is an automatic procedure.
- D . Security Gateway failover as well as Security Management Server failover is an automatic procedure.
Correct Answer: A
A
Explanation:
The correct statement about Security Gateway and Security Management Server failover in Check Point R81.X in terms of Check Point Redundancy driven solution is: Security Gateway failover is an automatic procedure but Security Management Server failover is a manual procedure. Security Gateway failover is a feature that allows a cluster of Security Gateways to provide high availability and load balancing for network traffic. If one Security Gateway fails or becomes unreachable, another Security Gateway in the cluster automatically takes over its role and handles the traffic without interrupting the service. Security Management Server failover is a feature that allows a backup Security Management Server to take over the role of the primary Security Management Server in case of failure or disaster. However, this feature requires manual intervention to activate the backup server and restore the database from a backup file.
A
Explanation:
The correct statement about Security Gateway and Security Management Server failover in Check Point R81.X in terms of Check Point Redundancy driven solution is: Security Gateway failover is an automatic procedure but Security Management Server failover is a manual procedure. Security Gateway failover is a feature that allows a cluster of Security Gateways to provide high availability and load balancing for network traffic. If one Security Gateway fails or becomes unreachable, another Security Gateway in the cluster automatically takes over its role and handles the traffic without interrupting the service. Security Management Server failover is a feature that allows a backup Security Management Server to take over the role of the primary Security Management Server in case of failure or disaster. However, this feature requires manual intervention to activate the backup server and restore the database from a backup file.
Question #359
Which upgrade method you should use upgrading from R80.40 to R81.20 to avoid any downtime?
- A . Zero Downtime Upgrade (ZDU)
- B . Connectivity Upgrade (CU)
- C . Minimal Effort Upgrade (ME)
- D . Multi-Version Cluster Upgrade (MVC)
Correct Answer: D
D
Explanation:
The correct upgrade method for upgrading from R80.40 to R81.20 without any downtime is the Multi-Version Cluster Upgrade (MVC). MVC is a new feature in R80.40 that replaces the deprecated Connectivity Upgrade (CU). MVC allows you to upgrade cluster members to a newer version without losing connectivity and test the new version on some of the cluster members before you decide to upgrade the rest of the cluster members. MVC synchronizes connections between cluster members that run different versions and ensures that the cluster remains operational during the upgrade process. MVC is intended only to test the current configuration in the newer version and not to change the security policy and install it on cluster members with different software versions. MVC is disabled by default and can be enabled on each cluster member individually. MVC has some limitations, such as not supporting VSX clusters, IPS blade, or SecureXL acceleration.
Reference: Multi-Version Cluster (MVC) replaces Connectivity Upgrade (CU) in R80.40 Multi-Version Cluster (MVC) Upgrade Configuring the Multi-Version Cluster Mechanism
D
Explanation:
The correct upgrade method for upgrading from R80.40 to R81.20 without any downtime is the Multi-Version Cluster Upgrade (MVC). MVC is a new feature in R80.40 that replaces the deprecated Connectivity Upgrade (CU). MVC allows you to upgrade cluster members to a newer version without losing connectivity and test the new version on some of the cluster members before you decide to upgrade the rest of the cluster members. MVC synchronizes connections between cluster members that run different versions and ensures that the cluster remains operational during the upgrade process. MVC is intended only to test the current configuration in the newer version and not to change the security policy and install it on cluster members with different software versions. MVC is disabled by default and can be enabled on each cluster member individually. MVC has some limitations, such as not supporting VSX clusters, IPS blade, or SecureXL acceleration.
Reference: Multi-Version Cluster (MVC) replaces Connectivity Upgrade (CU) in R80.40 Multi-Version Cluster (MVC) Upgrade Configuring the Multi-Version Cluster Mechanism
Question #360
Customer’s R81 management server needs to be upgraded to R81.20.
What is the best upgrade method when the management server is not connected to the Internet?
- A . Export R81 configuration, clean install R81.20 and import the configuration
- B . CPUSE offline upgrade
- C . CPUSE online upgrade
- D . SmartUpdate upgrade
Correct Answer: C
C
Explanation:
CPUSE offline upgrade is the best upgrade method when the management server is not connected to the Internet. CPUSE (Check Point Upgrade Service Engine) is a tool that automates the process of upgrading and installing software packages on Check Point devices. CPUSE can work in online mode or offline mode. Online mode requires an Internet connection to download the packages from Check Point servers. Offline mode allows you to download the packages manually from another device and transfer them to the management server using a USB drive or SCP.
Reference: Check Point Security Expert R81 Course, CPUSE Administration Guide
C
Explanation:
CPUSE offline upgrade is the best upgrade method when the management server is not connected to the Internet. CPUSE (Check Point Upgrade Service Engine) is a tool that automates the process of upgrading and installing software packages on Check Point devices. CPUSE can work in online mode or offline mode. Online mode requires an Internet connection to download the packages from Check Point servers. Offline mode allows you to download the packages manually from another device and transfer them to the management server using a USB drive or SCP.
Reference: Check Point Security Expert R81 Course, CPUSE Administration Guide