Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #381
What are the three components for Check Point Capsule?
- A . Capsule Docs, Capsule Cloud, Capsule Connect
- B . Capsule Workspace, Capsule Cloud, Capsule Connect
- C . Capsule Workspace, Capsule Docs, Capsule Connect
- D . Capsule Workspace, Capsule Docs, Capsule Cloud
Correct Answer: D
D
Explanation:
The three components for Check Point Capsule are Capsule Workspace, Capsule Docs, and Capsule Cloud. Capsule Workspace is a secure container app that allows users to access corporate data and applications from their mobile devices. Capsule Docs is a solution that protects documents with encryption and granular access control. Capsule Cloud is a cloud-based security service that enforces security policies on devices that are outside the corporate network.
Reference: Check Point Capsule
D
Explanation:
The three components for Check Point Capsule are Capsule Workspace, Capsule Docs, and Capsule Cloud. Capsule Workspace is a secure container app that allows users to access corporate data and applications from their mobile devices. Capsule Docs is a solution that protects documents with encryption and granular access control. Capsule Cloud is a cloud-based security service that enforces security policies on devices that are outside the corporate network.
Reference: Check Point Capsule
Question #382
While enabling the Identity Awareness blade the Identity Awareness wizard does not automatically detect the windows domain.
Why does it not detect the windows domain?
- A . Security Gateway is not part of the Domain
- B . SmartConsole machine is not part of the domain
- C . Identity Awareness is not enabled on Global properties
- D . Security Management Server is not part of the domain
Correct Answer: B
B
Explanation:
The verified answer is B) SmartConsole machine is not part of the domain.
The Identity Awareness wizard uses the SmartConsole machine to detect the windows domain by
querying the Active Directory server using DCOM protocol1. If the SmartConsole machine is not part
of the domain, the query will fail and the wizard will not automatically detect the domain. The user
will have to manually enter the domain name and credentials to proceed with the configuration.
The Security Gateway, the Security Management Server, and the Identity Awareness global
properties do not affect the domain detection by the wizard. However, they are required for other
aspects of the Identity Awareness blade, such as AD Query, Identity Collector, and Browser-Based
Authentication2.
Reference: Identity Awareness Configuration wizard authentication fails3 Identity Awareness – Check Point Software4
B
Explanation:
The verified answer is B) SmartConsole machine is not part of the domain.
The Identity Awareness wizard uses the SmartConsole machine to detect the windows domain by
querying the Active Directory server using DCOM protocol1. If the SmartConsole machine is not part
of the domain, the query will fail and the wizard will not automatically detect the domain. The user
will have to manually enter the domain name and credentials to proceed with the configuration.
The Security Gateway, the Security Management Server, and the Identity Awareness global
properties do not affect the domain detection by the wizard. However, they are required for other
aspects of the Identity Awareness blade, such as AD Query, Identity Collector, and Browser-Based
Authentication2.
Reference: Identity Awareness Configuration wizard authentication fails3 Identity Awareness – Check Point Software4
Question #383
What is true about the IPS-Blade?
- A . In R81, IPS is managed by the Threat Prevention Policy
- B . In R81, in the IPS Layer, the only three possible actions are Basic, Optimized and Strict
- C . In R81, IPS Exceptions cannot be attached to “all rules”
- D . In R81, the GeoPolicy Exceptions and the Threat Prevention Exceptions are the same
Correct Answer: A
A
Explanation:
In R81, IPS is managed by the Threat Prevention Policy. The Threat Prevention Policy is a unified policy that allows you to configure and enforce IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction settings in one place.
Reference: Threat Prevention Administration Guide
A
Explanation:
In R81, IPS is managed by the Threat Prevention Policy. The Threat Prevention Policy is a unified policy that allows you to configure and enforce IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction settings in one place.
Reference: Threat Prevention Administration Guide
Question #384
What is the command used to activated Multi-Version Cluster mode?
- A . set cluster member mvc on in Clish
- B . set mvc on on Clish
- C . set cluster MVC on in Expert Mode
- D . set cluster mvc on in Expert Mode
Correct Answer: A
A
Explanation:
The command used to activate Multi-Version Cluster mode is set cluster member mvc on in Clish. Multi-Version Cluster mode is a feature that allows cluster members to run different versions of Check Point software during a cluster upgrade. This reduces downtime and simplifies the upgrade process. To enable Multi-Version Cluster mode, the command set cluster member mvc on must be executed on each cluster member in Clish3. The other options are not valid commands for activating Multi-Version Cluster mode.
Reference: 3: Check Point Software, Getting Started, Multi-Version Cluster.
A
Explanation:
The command used to activate Multi-Version Cluster mode is set cluster member mvc on in Clish. Multi-Version Cluster mode is a feature that allows cluster members to run different versions of Check Point software during a cluster upgrade. This reduces downtime and simplifies the upgrade process. To enable Multi-Version Cluster mode, the command set cluster member mvc on must be executed on each cluster member in Clish3. The other options are not valid commands for activating Multi-Version Cluster mode.
Reference: 3: Check Point Software, Getting Started, Multi-Version Cluster.
Question #385
You want to store the GAIA configuration in a file for later reference.
What command should you use?
- A . write mem <filename>
- B . show config Cf <filename>
- C . save config Co <filename>
- D . save configuration <filename>
Correct Answer: D
D
Explanation:
The correct command to store the GAIA configuration in a file is save configuration <filename>1. This will create a file with the current system level configuration in the home directory of the current user1. The other commands are incorrect because they either do not exist or do not save the configuration to a file.
Reference: 1: Backing up Gaia system level configuration (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102234)
D
Explanation:
The correct command to store the GAIA configuration in a file is save configuration <filename>1. This will create a file with the current system level configuration in the home directory of the current user1. The other commands are incorrect because they either do not exist or do not save the configuration to a file.
Reference: 1: Backing up Gaia system level configuration (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102234)
Question #386
Fill in the blank RADIUS protocol uses_____to communicate with the gateway
- A . TDP
- B . CCP
- C . HTTP
- D . UDP
Correct Answer: D
Question #387
What statement best describes the Proxy ARP feature for Manual NAT in R81.20?
- A . Automatic proxy ARP configuration can be enabled
- B . Translate Destination on Client Side should be configured
- C . fw ctl proxy should be configured
- D . local.arp file must always be configured
Correct Answer: D
D
Explanation:
According to the Check Point R81 training course, the Proxy ARP feature for Manual NAT in R81.20 requires the configuration of the local.arp file on the Security Gateway. This file contains the mapping of IP addresses to MAC addresses for NATed hosts. The other options are either incorrect or irrelevant.
Reference: Certified Security Expert (CCSE) R81.20 Course Overview
D
Explanation:
According to the Check Point R81 training course, the Proxy ARP feature for Manual NAT in R81.20 requires the configuration of the local.arp file on the Security Gateway. This file contains the mapping of IP addresses to MAC addresses for NATed hosts. The other options are either incorrect or irrelevant.
Reference: Certified Security Expert (CCSE) R81.20 Course Overview
Question #388
What is the biggest benefit of policy layers?
- A . To break one policy into several virtual policies
- B . Policy Layers and Sub-Policies enable flexible control over the security policy
- C . They improve the performance on OS kernel version 3.0
- D . To include Threat Prevention as a sub policy for the firewall policy
Correct Answer: B
B
Explanation:
The biggest benefit of policy layers is that they enable flexible control over the security policy. Policy layers and sub-policies allow administrators to break one policy into several virtual policies, each with its own set of rules and actions. Policy layers can be ordered, shared, and reused across different policies. Policy layers can also include Threat Prevention as a sub-policy for the firewall policy.
Reference: [Check Point R81 Security Management Guide]
B
Explanation:
The biggest benefit of policy layers is that they enable flexible control over the security policy. Policy layers and sub-policies allow administrators to break one policy into several virtual policies, each with its own set of rules and actions. Policy layers can be ordered, shared, and reused across different policies. Policy layers can also include Threat Prevention as a sub-policy for the firewall policy.
Reference: [Check Point R81 Security Management Guide]
Question #389
What are the two ClusterXL Deployment options?
- A . Distributed and Full High Availability
- B . Broadcast and Multicast Mode
- C . Distributed and Standalone
- D . Unicast and Multicast Mode
Correct Answer: A
A
Explanation:
The two ClusterXL Deployment options are Distributed and Full High Availability. Distributed deployment means that each cluster member has its own Security Management Server and synchronizes with other members. Full High Availability deployment means that one cluster member is active and handles all traffic, while the other members are in standby mode and ready to take over in case of a failure. The other options are not valid ClusterXL Deployment options, but rather ClusterXL Modes or ClusterXL Load Sharing Methods.
Reference: [Check Point Security Expert R81 ClusterXL Administration Guide], page 6.
A
Explanation:
The two ClusterXL Deployment options are Distributed and Full High Availability. Distributed deployment means that each cluster member has its own Security Management Server and synchronizes with other members. Full High Availability deployment means that one cluster member is active and handles all traffic, while the other members are in standby mode and ready to take over in case of a failure. The other options are not valid ClusterXL Deployment options, but rather ClusterXL Modes or ClusterXL Load Sharing Methods.
Reference: [Check Point Security Expert R81 ClusterXL Administration Guide], page 6.
Question #390
Which of the following describes how Threat Extraction functions?
- A . Detect threats and provides a detailed report of discovered threats.
- B . Proactively detects threats.
- C . Delivers file with original content.
- D . Delivers PDF versions of original files with active content removed.
Correct Answer: D
D
Explanation:
Threat Extraction is a software blade that delivers PDF versions of original files with active content removed. Active content, such as macros, scripts, or embedded objects, can be used by attackers to deliver malware or exploit vulnerabilities. Threat Extraction removes or sanitizes the active content from the files and converts them to PDF format, which is safer and more compatible. Threat Extraction can also work together with Threat Emulation to provide both clean and original files to the users.
Reference: Check Point Security Expert R81 Course, Threat Extraction Administration Guide
D
Explanation:
Threat Extraction is a software blade that delivers PDF versions of original files with active content removed. Active content, such as macros, scripts, or embedded objects, can be used by attackers to deliver malware or exploit vulnerabilities. Threat Extraction removes or sanitizes the active content from the files and converts them to PDF format, which is safer and more compatible. Threat Extraction can also work together with Threat Emulation to provide both clean and original files to the users.
Reference: Check Point Security Expert R81 Course, Threat Extraction Administration Guide