Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #391
To optimize Rule Base efficiency, the most hit rules should be where?
- A . Removed from the Rule Base.
- B . Towards the middle of the Rule Base.
- C . Towards the top of the Rule Base.
- D . Towards the bottom of the Rule Base.
Correct Answer: C
C
Explanation:
To optimize Rule Base efficiency, the most hit rules should be towards the top of the Rule Base. This is because the Rule Base is processed from top to bottom, and the first rule that matches the traffic is applied. Therefore, placing the most hit rules at the top reduces the number of rules that need to be checked and improves the performance of the firewall.
Reference: R81 Security Management Administration Guide, page 97.
C
Explanation:
To optimize Rule Base efficiency, the most hit rules should be towards the top of the Rule Base. This is because the Rule Base is processed from top to bottom, and the first rule that matches the traffic is applied. Therefore, placing the most hit rules at the top reduces the number of rules that need to be checked and improves the performance of the firewall.
Reference: R81 Security Management Administration Guide, page 97.
Question #392
There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B.
The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A’s interface issues were resolved and it became operational.
When it re-joins the cluster, will it become active automatically?
- A . No, since ‘maintain’ current active cluster member’ option on the cluster object properties is enabled by default.
- B . No, since ‘maintain’ current active cluster member’ option is enabled by default on the Global Properties.
- C . Yes, since ‘Switch to higher priority cluster member’ option on the cluster object properties is enabled by default.
- D . Yes, since ‘Switch to higher priority cluster member’ option is enabled by default on the Global Properties.
Correct Answer: A
A
Explanation:
There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A’s interface issues were resolved and it became operational.
When it re-joins the cluster, it will not become active automatically, since ‘maintain current active cluster member’ option on the cluster object properties is enabled by default. This option prevents a failback to the original active member after a failover, unless the current active member fails or is manually switched over. This option provides stability and avoids unnecessary failovers.
Reference: R77 ClusterXL Administration Guide, page 23.
A
Explanation:
There are two R77.30 Security Gateways in the Firewall Cluster. They are named FW_A and FW_B. The cluster is configured to work as HA (High availability) with default cluster configuration. FW_A is configured to have higher priority than FW_B. FW_A was active and processing the traffic in the morning. FW_B was standby. Around 1100 am, its interfaces went down and this caused a failover. FW_B became active. After an hour, FW_A’s interface issues were resolved and it became operational.
When it re-joins the cluster, it will not become active automatically, since ‘maintain current active cluster member’ option on the cluster object properties is enabled by default. This option prevents a failback to the original active member after a failover, unless the current active member fails or is manually switched over. This option provides stability and avoids unnecessary failovers.
Reference: R77 ClusterXL Administration Guide, page 23.
Question #393
What is the command to check the status of the SmartEvent Correlation Unit?
- A . fw ctl get int cpsead_stat
- B . cpstat cpsead
- C . fw ctl stat cpsemd
- D . cp_conf get_stat cpsemd
Correct Answer: B
B
Explanation:
The SmartEvent Correlation Unit is responsible for analyzing the log entries and identifying events from them. It runs on the Log Server machine or on a dedicated machine1. To check the status of the SmartEvent Correlation Unit, you can use the command cpstat cpsead on the machine where it is installed. This command will show you information such as the number of logs processed, the number of events generated, the CPU and memory usage, and the status of the connection to the SmartEvent Server23.
Reference: SmartEvent Administration Guide R76, SmartEvent Administration Guide R75, SmartEvent Performance Tuning Guide
B
Explanation:
The SmartEvent Correlation Unit is responsible for analyzing the log entries and identifying events from them. It runs on the Log Server machine or on a dedicated machine1. To check the status of the SmartEvent Correlation Unit, you can use the command cpstat cpsead on the machine where it is installed. This command will show you information such as the number of logs processed, the number of events generated, the CPU and memory usage, and the status of the connection to the SmartEvent Server23.
Reference: SmartEvent Administration Guide R76, SmartEvent Administration Guide R75, SmartEvent Performance Tuning Guide
Question #394
Connect to the Mobile Access Portal
Correct Answer: D
Explanation:
The verified answer is D) 1. Enable Mobile Access blade on the Security Gateway object and complete the wizard 2. Configure Mobile Access parameters in Security Gateway object 3. Add a rule in the Access Control Policy and install policy 4. Connect to the Mobile Access Portal
The basic configuration steps for the Check Point Mobile Access VPN blade are as follows1:
Enable Mobile Access blade on the Security Gateway object and complete the wizard: This step activates the Mobile Access blade on the selected gateway and guides you through the initial configuration, such as defining the portal name, the certificate, and the authentication methods. Configure Mobile Access parameters in Security Gateway object: This step allows you to customize the Mobile Access settings, such as defining the supported applications, the access roles, the client settings, and the advanced options.
Add a rule in the Access Control Policy and install policy: This step creates a rule that allows the traffic from the Mobile Access portal to the protected resources and installs the policy on the gateway.
Connect to the Mobile Access Portal: This step verifies that the Mobile Access portal is accessible and functional from a web browser or a mobile device.
The other options are incorrect because they do not follow the correct order or include the necessary
steps.
Reference: Mobile Access Administration Guide R81 – Check Point Software1
Explanation:
The verified answer is D) 1. Enable Mobile Access blade on the Security Gateway object and complete the wizard 2. Configure Mobile Access parameters in Security Gateway object 3. Add a rule in the Access Control Policy and install policy 4. Connect to the Mobile Access Portal
The basic configuration steps for the Check Point Mobile Access VPN blade are as follows1:
Enable Mobile Access blade on the Security Gateway object and complete the wizard: This step activates the Mobile Access blade on the selected gateway and guides you through the initial configuration, such as defining the portal name, the certificate, and the authentication methods. Configure Mobile Access parameters in Security Gateway object: This step allows you to customize the Mobile Access settings, such as defining the supported applications, the access roles, the client settings, and the advanced options.
Add a rule in the Access Control Policy and install policy: This step creates a rule that allows the traffic from the Mobile Access portal to the protected resources and installs the policy on the gateway.
Connect to the Mobile Access Portal: This step verifies that the Mobile Access portal is accessible and functional from a web browser or a mobile device.
The other options are incorrect because they do not follow the correct order or include the necessary
steps.
Reference: Mobile Access Administration Guide R81 – Check Point Software1
Question #395
Which web services protocol is used to communicate to the Check Point R81 Identity Awareness Web API?
- A . SOAP
- B . REST
- C . XLANG
- D . XML-RPC
Correct Answer: B
B
Explanation:
The Check Point R81 Identity Awareness Web API uses the REST web services protocol to communicate with external identity sources. REST stands for Representational State Transfer, and it is an architectural style for designing web services that use HTTP methods to access and manipulate resources. The Identity Awareness Web API allows external identity sources to send identity and session information to the Security Gateway, which can then use this information for policy
enforcement.
B
Explanation:
The Check Point R81 Identity Awareness Web API uses the REST web services protocol to communicate with external identity sources. REST stands for Representational State Transfer, and it is an architectural style for designing web services that use HTTP methods to access and manipulate resources. The Identity Awareness Web API allows external identity sources to send identity and session information to the Security Gateway, which can then use this information for policy
enforcement.
Question #396
Which of the following commands shows the status of processes?
- A . cpwd_admin -l
- B . cpwd -l
- C . cpwd admin_list
- D . cpwd_admin list
Correct Answer: D
D
Explanation:
The command that shows the status of processes is cpwd_admin list. Cpwd_admin is a command that allows administrators to manage processes that are registered with the Check Point WatchDog (CPWD) daemon. CPWD is a daemon that monitors the health of critical processes on the Security Gateway or Management Server, and restarts them if they fail or stop responding. Cpwd_admin list shows the process name, PID, status, start time, monitor status, and number of restarts for each process registered with CPWD.
D
Explanation:
The command that shows the status of processes is cpwd_admin list. Cpwd_admin is a command that allows administrators to manage processes that are registered with the Check Point WatchDog (CPWD) daemon. CPWD is a daemon that monitors the health of critical processes on the Security Gateway or Management Server, and restarts them if they fail or stop responding. Cpwd_admin list shows the process name, PID, status, start time, monitor status, and number of restarts for each process registered with CPWD.
Question #397
What is the purpose of extended master key extension/session hash?
- A . UDP VOIP protocol extension
- B . In case of TLS1.x it is a prevention of a Man-in-the-Middle attack/disclosure of the client-server communication
- C . Special TCP handshaking extension
- D . Supplement DLP data watermark
Correct Answer: B
B
Explanation:
The extended master key extension/session hash is a feature introduced in TLS 1.3 to prevent a Man-in-the-Middle attack/disclosure of the client-server communication. It works by generating a unique session hash for each connection, which is derived from the master key and other parameters. This
session hash is then used to authenticate the application data and the end-of-handshake messages, ensuring that no one can tamper with or eavesdrop on the communication.
Reference: Check Point Security Expert R81 Course, TLS 1.3 RFC
B
Explanation:
The extended master key extension/session hash is a feature introduced in TLS 1.3 to prevent a Man-in-the-Middle attack/disclosure of the client-server communication. It works by generating a unique session hash for each connection, which is derived from the master key and other parameters. This
session hash is then used to authenticate the application data and the end-of-handshake messages, ensuring that no one can tamper with or eavesdrop on the communication.
Reference: Check Point Security Expert R81 Course, TLS 1.3 RFC
Question #398
What are the different command sources that allow you to communicate with the API server?
- A . SmartView Monitor, API_cli Tool, Gaia CLI, Web Services
- B . SmartConsole GUI Console, mgmt_cli Tool, Gaia CLI, Web Services
- C . SmartConsole GUI Console, API_cli Tool, Gaia CLI, Web Services
- D . API_cli Tool, Gaia CLI, Web Services
Correct Answer: B
B
Explanation:
You can communicate with the API server using three command sources: SmartConsole GUI Console, mgmt_cli Tool, and Gaia CLI. Web Services are not a command source, but a way to access the API server using HTTP requests.
Reference: Check Point Management APIs
B
Explanation:
You can communicate with the API server using three command sources: SmartConsole GUI Console, mgmt_cli Tool, and Gaia CLI. Web Services are not a command source, but a way to access the API server using HTTP requests.
Reference: Check Point Management APIs
Question #399
In terms of Order Rule Enforcement, when a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom.
Which of the following statements is correct?
- A . If the Action of the matching rule is Accept the gateway will drop the packet
- B . If the Action of the matching rule is Drop, the gateway continues to check rules in the next Policy Layer down
- C . If the Action of the matching rule is Drop the gateway stops matching against later rules in the Policy Rule Base and drops the packet
- D . If the rule does not match in the Network policy it will continue to other enabled polices
Correct Answer: C
C
Explanation:
If the action of the matching rule is Drop, the gateway stops matching against later rules in the Policy Rule Base and drops the packet. This is because the Drop action is a final action that terminates the rule matching process and discards the packet. The gateway does not continue to check rules in the next Policy Layer down or in other enabled policies.
Reference: [Policy Layers and Sub-Policies]
https://sc1.checkpoint.com/documents/R81/CP_R81_SecMGMT/html_frameset.htm?topic=docume nts/R81/CP_R81_SecMGMT/126197
C
Explanation:
If the action of the matching rule is Drop, the gateway stops matching against later rules in the Policy Rule Base and drops the packet. This is because the Drop action is a final action that terminates the rule matching process and discards the packet. The gateway does not continue to check rules in the next Policy Layer down or in other enabled policies.
Reference: [Policy Layers and Sub-Policies]
https://sc1.checkpoint.com/documents/R81/CP_R81_SecMGMT/html_frameset.htm?topic=docume nts/R81/CP_R81_SecMGMT/126197
Question #400
Fill in the blank. Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is ________ .
- A . Sent to the Internal Certificate Authority.
- B . Sent to the Security Administrator.
- C . Stored on the Security Management Server.
- D . Stored on the Certificate Revocation List.
Correct Answer: D
D
Explanation:
Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is stored on the Certificate Revocation List (CRL). The CRL is a list of certificates that have been revoked by the Internal Certificate Authority (ICA) and are no longer valid for Secure Internal Communication (SIC). The CRL is signed by the ICA and issued to all the managed Security Gateways the next time a SIC connection is made12. The CRL helps to prevent unauthorized access to the Security Management Server by revoked Security Gateways.
Reference: 1: How to renew SIC after changing IP Address of Security Management Server – Check Point Software, Solution ID: sk43784 2: Check Point R81 Security Engineering Guide – Check Point Software, page 162
D
Explanation:
Once a certificate is revoked from the Security Gateway by the Security Management Server, the certificate information is stored on the Certificate Revocation List (CRL). The CRL is a list of certificates that have been revoked by the Internal Certificate Authority (ICA) and are no longer valid for Secure Internal Communication (SIC). The CRL is signed by the ICA and issued to all the managed Security Gateways the next time a SIC connection is made12. The CRL helps to prevent unauthorized access to the Security Management Server by revoked Security Gateways.
Reference: 1: How to renew SIC after changing IP Address of Security Management Server – Check Point Software, Solution ID: sk43784 2: Check Point R81 Security Engineering Guide – Check Point Software, page 162