Check Point 156-315.81.20 Practice Exams
Last updated on Oct 21,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 21,2026
Question #31
John detected high load on sync interface.
Which is most recommended solution?
- A . For FTP connections C do not sync
- B . Add a second interface to handle sync traffic
- C . For short connections like http service C do not sync
- D . For short connections like icmp service C delay sync for 2 seconds
Correct Answer: A
A
Explanation:
The most recommended solution for high load on sync interface is to exclude FTP connections from synchronization. This is because FTP connections are usually long-lived and consume a lot of bandwidth and resources on the sync interface. By excluding FTP connections from synchronization, the load on the sync interface can be reduced and the performance of the cluster can be improved.
Reference: Synchronization Optimization
A
Explanation:
The most recommended solution for high load on sync interface is to exclude FTP connections from synchronization. This is because FTP connections are usually long-lived and consume a lot of bandwidth and resources on the sync interface. By excluding FTP connections from synchronization, the load on the sync interface can be reduced and the performance of the cluster can be improved.
Reference: Synchronization Optimization
Question #32
What is the SandBlast Agent designed to do?
- A . Performs OS-level sandboxing for SandBlast Cloud architecture
- B . Ensure the Check Point SandBlast services is running on the end user’s system
- C . If malware enters an end user’s system, the SandBlast Agent prevents the malware from spreading with the network
- D . Clean up email sent with malicious attachments
Correct Answer: C
C
Explanation:
The SandBlast Agent is designed to prevent malware from spreading within the network if it enters an end user’s system. SandBlast Agent is a lightweight endpoint security solution that protects devices from advanced threats such as ransomware, phishing, zero-day attacks, and data exfiltration. SandBlast Agent uses various technologies such as behavioral analysis, anti-exploitation, anti-ransomware, threat emulation, threat extraction, and forensics to detect and block malware before it can harm the device or the network. The other options are either not the main purpose or not the functionality of SandBlast Agent.
C
Explanation:
The SandBlast Agent is designed to prevent malware from spreading within the network if it enters an end user’s system. SandBlast Agent is a lightweight endpoint security solution that protects devices from advanced threats such as ransomware, phishing, zero-day attacks, and data exfiltration. SandBlast Agent uses various technologies such as behavioral analysis, anti-exploitation, anti-ransomware, threat emulation, threat extraction, and forensics to detect and block malware before it can harm the device or the network. The other options are either not the main purpose or not the functionality of SandBlast Agent.
Question #33
You have pushed policy to GW-3 and now cannot pass traffic through the gateway.
As a last resort, to restore traffic flow, what command would you run to remove the latest policy from GW-3?
- A . fw unloadlocal
- B . fw unloadpolicy
- C . fwm unload local
- D . fwm unload policy
Correct Answer: A
A
Explanation:
The command fw unloadlocal removes the current security policy from the local gateway and returns it to its initial state2. This command can be used as a last resort to restore traffic flow through the gateway if the policy is causing problems. The command fw unloadpolicy is not valid, and the commands fwm unload local and fwm unload policy are used to remove policies from remote gateways3.
Reference: 2: Check Point Software, Getting Started, Unloading Security Policies; 3: Check Point Software, Getting Started, Unloading Security Policies from Remote Gateways.
A
Explanation:
The command fw unloadlocal removes the current security policy from the local gateway and returns it to its initial state2. This command can be used as a last resort to restore traffic flow through the gateway if the policy is causing problems. The command fw unloadpolicy is not valid, and the commands fwm unload local and fwm unload policy are used to remove policies from remote gateways3.
Reference: 2: Check Point Software, Getting Started, Unloading Security Policies; 3: Check Point Software, Getting Started, Unloading Security Policies from Remote Gateways.
Question #34
You notice that your firewall is under a DDoS attack and would like to enable the Penalty Box feature, which command you use?
- A . sim erdos Ce 1
- B . sim erdos C m 1
- C . sim erdos Cv 1
- D . sim erdos Cx 1
Correct Answer: A
A
Explanation:
The command that would be used to enable the Penalty Box feature is sim erdos -e 1. Penalty Box is a feature that protects the Security Gateway from DDoS attacks by dropping packets from sources that send excessive traffic. Sim erdos is a command that allows administrators to configure and manage the Penalty Box feature. Sim erdos -e 1 enables the Penalty Box feature on the Security Gateway. The other options are either invalid or perform different functions.
A
Explanation:
The command that would be used to enable the Penalty Box feature is sim erdos -e 1. Penalty Box is a feature that protects the Security Gateway from DDoS attacks by dropping packets from sources that send excessive traffic. Sim erdos is a command that allows administrators to configure and manage the Penalty Box feature. Sim erdos -e 1 enables the Penalty Box feature on the Security Gateway. The other options are either invalid or perform different functions.
Question #35
Tom has been tasked to install Check Point R81 in a distributed deployment. Before Tom installs the systems this way, how many machines will he need if he does NOT include a SmartConsole machine in his calculations?
- A . One machine, but it needs to be installed using SecurePlatform for compatibility purposes.
- B . One machine
- C . Two machines
- D . Three machines
Correct Answer: C
C
Explanation:
Tom will need two machines to install Check Point R81 in a distributed deployment, if he does not include a SmartConsole machine in his calculations. A distributed deployment consists of a Security Management Server that manages one or more Security Gateways. Therefore, Tom will need one machine for the Security Management Server and another machine for the Security Gateway. The other options are either too few or too many machines for a distributed deployment.
Reference: Check Point R81 Installation and Upgrade Guide
C
Explanation:
Tom will need two machines to install Check Point R81 in a distributed deployment, if he does not include a SmartConsole machine in his calculations. A distributed deployment consists of a Security Management Server that manages one or more Security Gateways. Therefore, Tom will need one machine for the Security Management Server and another machine for the Security Gateway. The other options are either too few or too many machines for a distributed deployment.
Reference: Check Point R81 Installation and Upgrade Guide
Question #36
When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events.
What is this setting called and what are you defining?
- A . Network, and defining your Class A space
- B . Topology, and you are defining the Internal network
- C . Internal addresses you are defining the gateways
- D . Internal network(s) you are defining your networks
Correct Answer: D
D
Explanation:
When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events. This setting is called Internal network(s) and you are defining your networks. You can specify one or more networks or IP addresses that are considered internal for SmartEvent. This helps SmartEvent to determine the direction of the traffic (inbound, outbound, or internal) and generate events accordingly.
Reference: [SmartEvent Administration Guide]
D
Explanation:
When configuring SmartEvent Initial settings, you must specify a basic topology for SmartEvent to help it calculate traffic direction for events. This setting is called Internal network(s) and you are defining your networks. You can specify one or more networks or IP addresses that are considered internal for SmartEvent. This helps SmartEvent to determine the direction of the traffic (inbound, outbound, or internal) and generate events accordingly.
Reference: [SmartEvent Administration Guide]
Question #37
What is the recommended way to have a redundant Sync connection between the cluster nodes?
- A . In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define two Sync interfaces per node. Connect both Sync interfaces without using a switch.
- B . Use a group of bonded interfaces. In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define a Virtual IP for the Sync interface.
- C . In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management and define two Sync interfaces per node. Use two different Switches to connect both Sync interfaces.
- D . Use a group of bonded interfaces connected to different switches. Define a dedicated sync interface, only one interface per node using the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management.
Correct Answer: D
D
Explanation:
The recommended way to have a redundant Sync connection between the cluster nodes is to use a group of bonded interfaces connected to different switches. In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management, you should define a dedicated sync interface, only one interface per node.
D
Explanation:
The recommended way to have a redundant Sync connection between the cluster nodes is to use a group of bonded interfaces connected to different switches. In the SmartConsole / Gateways & Servers -> select Cluster Properties / Network Management, you should define a dedicated sync interface, only one interface per node.
Question #38
IF the first packet of an UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), what message is sent back through the kernel?
- A . Nothing
- B . TCP FIN
- C . TCP RST
- D . ICMP unreachable
Correct Answer: A
A
Explanation:
If the first packet of a UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), nothing is sent back through the kernel. This is because UDP is a connectionless protocol that does not require an acknowledgement from the receiver. Therefore, if a UDP packet is dropped by the Firewall, the sender will not receive any feedback or notification.
Reference: UDP Protocol
A
Explanation:
If the first packet of a UDP session is rejected by a rule definition from within a security policy (not including the clean up rule), nothing is sent back through the kernel. This is because UDP is a connectionless protocol that does not require an acknowledgement from the receiver. Therefore, if a UDP packet is dropped by the Firewall, the sender will not receive any feedback or notification.
Reference: UDP Protocol
Question #39
What is the SOLR database for?
- A . Used for full text search and enables powerful matching capabilities
- B . Writes data to the database and full text search
- C . Serves GUI responsible to transfer request to the DLE server
- D . Enables powerful matching capabilities and writes data to the database
Correct Answer: A
A
Explanation:
The SOLR database is used for full text search and enables powerful matching capabilities. The SOLR database is part of the Log Server component, which is responsible for indexing and storing logs received from Security Gateways and other sources. The SOLR database allows users to perform complex queries on the logs using keywords, filters, operators, and expressions.
Reference: Log Server
A
Explanation:
The SOLR database is used for full text search and enables powerful matching capabilities. The SOLR database is part of the Log Server component, which is responsible for indexing and storing logs received from Security Gateways and other sources. The SOLR database allows users to perform complex queries on the logs using keywords, filters, operators, and expressions.
Reference: Log Server
Question #40
What is not a purpose of the deployment of Check Point API?
- A . Execute an automated script to perform common tasks
- B . Create a customized GUI Client for manipulating the objects database
- C . Create products that use and enhance the Check Point solution
- D . Integrate Check Point products with 3rd party solution
Correct Answer: B
B
Explanation:
The deployment of Check Point API does not have the purpose of creating a customized GUI Client for manipulating the objects database. The Check Point API is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. The Check Point API can be used to execute an automated script to perform common tasks, create products that use and enhance the Check Point solution, and integrate Check Point products with 3rd party solutions. However, creating a customized GUI Client for manipulating the objects database is not a supported or intended use case of the Check Point API.
B
Explanation:
The deployment of Check Point API does not have the purpose of creating a customized GUI Client for manipulating the objects database. The Check Point API is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. The Check Point API can be used to execute an automated script to perform common tasks, create products that use and enhance the Check Point solution, and integrate Check Point products with 3rd party solutions. However, creating a customized GUI Client for manipulating the objects database is not a supported or intended use case of the Check Point API.