Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #401
The Security Gateway is installed on GAIA R81. The default port for the Web User Interface is ______.
- A . TCP 18211
- B . TCP 257
- C . TCP 4433
- D . TCP 443
Correct Answer: D
Question #402
What is the correct Syntax for adding an access-rule via R80 API?
- A . add access-rule layer "Network" action "Allow"
- B . add access-rule layer "Network" position 1 name "Rule 1" service. 1 "SMTP" service.2 "hup"
- C . add access-rule <CR> and follow the wizard
- D . add rule position 1 name "Rule 1" policy-package "Standard" add service "http"
Correct Answer: B
B
Explanation:
The correct syntax for adding an access-rule via R80 API is to use the add access-rule command with the layer, position, name, and service parameters. The layer parameter specifies the name of the access control policy layer where the rule will be added. The position parameter specifies the ordinal number in which to place the rule in the rulebase. The name parameter specifies the name of the rule. The service parameter specifies one or more services that match this rule.
Reference: [Check Point Security Expert R81 API Reference Guide], page 18.
B
Explanation:
The correct syntax for adding an access-rule via R80 API is to use the add access-rule command with the layer, position, name, and service parameters. The layer parameter specifies the name of the access control policy layer where the rule will be added. The position parameter specifies the ordinal number in which to place the rule in the rulebase. The name parameter specifies the name of the rule. The service parameter specifies one or more services that match this rule.
Reference: [Check Point Security Expert R81 API Reference Guide], page 18.
Question #403
What is true of the API server on R81.20?
- A . By default the API-server is activated and does not have hardware requirements.
- B . By default the API-server is not active and should be activated from the WebUI.
- C . By default the API server is active on management and stand-alone servers with 16GB of RAM (or more).
- D . By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more).
Correct Answer: D
D
Explanation:
The true statement about the API server on R81.20 is: By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more). The API server is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. The API server is enabled by default on R81.20 management servers that have at least 4 GB of RAM, and on stand-alone servers that have at least 8 GB of RAM. The API server can also be manually enabled or disabled from the WebUI or the CLI.
D
Explanation:
The true statement about the API server on R81.20 is: By default, the API server is active on management servers with 4 GB of RAM (or more) and on stand-alone servers with 8GB of RAM (or more). The API server is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. The API server is enabled by default on R81.20 management servers that have at least 4 GB of RAM, and on stand-alone servers that have at least 8 GB of RAM. The API server can also be manually enabled or disabled from the WebUI or the CLI.
Question #404
Pamela is Cyber Security Engineer working for Global Instance Firm with large scale deployment of Check Point Enterprise Appliances using GAiA/R81.20. Company’s Developer Team is having random access issue to newly deployed Application Server in DMZ’s Application Server Farm Tier and blames DMZ Security Gateway as root cause. The ticket has been created and issue is at Pamela’s desk for an investigation. Pamela decides to use Check Point’s Packet Analyzer Tool-fw monitor to iron out the issue during approved Maintenance window.
What do you recommend as the best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic?
- A . Pamela should check SecureXL status on DMZ Security gateway and if it’s turned ON. She should turn OFF SecureXL before using fw monitor to avoid misleading traffic captures.
- B . Pamela should check SecureXL status on DMZ Security Gateway and if it’s turned OFF. She should turn ON SecureXL before using fw monitor to avoid misleading traffic captures.
- C . Pamela should use tcpdump over fw monitor tool as tcpdump works at OS-level and captures entire traffic.
- D . Pamela should use snoop over fw monitor tool as snoop works at NIC driver level and captures entire traffic.
Correct Answer: A
A
Explanation:
The best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic is: Pamela should check SecureXL status on DMZ Security gateway and if it’s turned ON. She should turn OFF SecureXL before using fw monitor to avoid misleading traffic captures. SecureXL is a technology that accelerates network traffic processing by offloading intensive operations from the Firewall kernel to a dedicated SecureXL device. However, this also means that some traffic might not be seen by fw monitor, which is a tool that captures packets at different inspection points in the Firewall kernel. Therefore, to ensure that fw monitor captures all traffic, SecureXL should be turned OFF before using fw monitor. The other suggestions are either incorrect or less effective in capturing traffic.
A
Explanation:
The best suggestion for Pamela to make sure she successfully captures entire traffic in context of Firewall and problematic traffic is: Pamela should check SecureXL status on DMZ Security gateway and if it’s turned ON. She should turn OFF SecureXL before using fw monitor to avoid misleading traffic captures. SecureXL is a technology that accelerates network traffic processing by offloading intensive operations from the Firewall kernel to a dedicated SecureXL device. However, this also means that some traffic might not be seen by fw monitor, which is a tool that captures packets at different inspection points in the Firewall kernel. Therefore, to ensure that fw monitor captures all traffic, SecureXL should be turned OFF before using fw monitor. The other suggestions are either incorrect or less effective in capturing traffic.
Question #405
Which command is used to add users to or from existing roles?
- A . Add rba user <User Name> roles <List>
- B . Add rba user <User Name>
- C . Add user <User Name> roles <List>
- D . Add user <User Name>
Correct Answer: A
A
Explanation:
The command to add users to or from existing roles is add rba user <User Name> roles <List>. This command allows you to assign one or more roles to a user in the Gaia database. Roles are collections of permissions that define what actions a user can perform on the system. You can use predefined roles or create your own custom roles. To remove a role from a user, you can use the command delete rba user <User Name> roles <List>.
A
Explanation:
The command to add users to or from existing roles is add rba user <User Name> roles <List>. This command allows you to assign one or more roles to a user in the Gaia database. Roles are collections of permissions that define what actions a user can perform on the system. You can use predefined roles or create your own custom roles. To remove a role from a user, you can use the command delete rba user <User Name> roles <List>.
Question #406
How can SmartView application accessed?
- A . http://<Security Management IP Address>/smartview
- B . http://<Security Management IP Address>:4434/smartview/
- C . https://<Security Management IP Address>/smartview/
- D . https://<Security Management host name>:4434/smartview/
Correct Answer: C
C
Explanation:
SmartView is a web-based application that allows you to view and analyze logs, reports, and events from multiple Check Point products.
You can access SmartView by using the following URL:
C
Explanation:
SmartView is a web-based application that allows you to view and analyze logs, reports, and events from multiple Check Point products.
You can access SmartView by using the following URL:
You need to use HTTPS protocol and the default port 443. You also need to enter the IP address of the Security Management Server that hosts the SmartView application. You cannot use the host name of the Security Management Server or a different port number.
Reference: SmartView R81 Administration Guide
Question #407
Hit Count is a feature to track the number of connections that each rule matches, which one is not benefit of Hit Count.
- A . Better understand the behavior of the Access Control Policy
- B . Improve Firewall performance – You can move a rule that has hot count to a higher position in the Rule Base
- C . Automatically rearrange Access Control Policy based on Hit Count Analysis
- D . Analyze a Rule Base – You can delete rules that have no matching connections
Correct Answer: C
C
Explanation:
Hit Count is a feature to track the number of connections that each rule matches, which can help to optimize the Rule Base efficiency and analyze the network traffic behavior. The benefit that is not provided by Hit Count is automatically rearrange Access Control Policy based on Hit Count Analysis. Hit Count does not change the order of the rules automatically, but it allows the administrator to manually move the rules up or down based on the hit count statistics. The administrator can also use the SmartOptimize feature to get suggestions for improving the Rule Base order and performance.
Reference: R81 Security Management Administration Guide, page 97.
C
Explanation:
Hit Count is a feature to track the number of connections that each rule matches, which can help to optimize the Rule Base efficiency and analyze the network traffic behavior. The benefit that is not provided by Hit Count is automatically rearrange Access Control Policy based on Hit Count Analysis. Hit Count does not change the order of the rules automatically, but it allows the administrator to manually move the rules up or down based on the hit count statistics. The administrator can also use the SmartOptimize feature to get suggestions for improving the Rule Base order and performance.
Reference: R81 Security Management Administration Guide, page 97.
Question #408
Alice knows about the Check Point Management HA installation from Bob and needs to know which Check Point Security Management Server is currently capable of issuing and managing certificate. Alice uses the Check Point command "cpconfig” to run the Check Point Security Management Server configuration tool on both Check Point Management HA instances "Primary & Secondary"
Which configuration option does she need to look for:
- A . Certificate’s Fingerprint
- B . Random Pool
- C . CA Authority
- D . Certificate Authority
Correct Answer: D
D
Explanation:
Certificate Authority (CA) is a service that issues and manages digital certificates for secure communication between Check Point components. CA can be installed on a Security Management Server or on a dedicated server. CA can be configured as primary or secondary in a High Availability cluster. The cpconfig command is used to run the Check Point Configuration Tool on Gaia OS, which allows users to configure various settings for Check Point products. One of the configuration options is Certificate Authority, which shows if CA is installed on the server and if it is primary or secondary5. Therefore, Alice needs to look for this option to check the CA status.
Reference: 5: cpconfig
D
Explanation:
Certificate Authority (CA) is a service that issues and manages digital certificates for secure communication between Check Point components. CA can be installed on a Security Management Server or on a dedicated server. CA can be configured as primary or secondary in a High Availability cluster. The cpconfig command is used to run the Check Point Configuration Tool on Gaia OS, which allows users to configure various settings for Check Point products. One of the configuration options is Certificate Authority, which shows if CA is installed on the server and if it is primary or secondary5. Therefore, Alice needs to look for this option to check the CA status.
Reference: 5: cpconfig
Question #409
Which TCP port does the CPM process listen on?
- A . 18191
- B . 18190
- C . 8983
- D . 19009
Correct Answer: D
D
Explanation:
The TCP port that the CPM process listens on is 19009. The CPM process is the Check Point Management process that handles all management operations on the Security Management Server, such as policy installation, database synchronization, logging, etc. It communicates with other processes and clients using TCP port 19009. The other ports are used by different processes or services. TCP port 18191 is used by the FWM process for management communication. TCP port 18190 is used by the CPD process for inter-process communication. TCP port 8983 is used by the Solr process for SmartLog indexing.
Reference: [Check Point Ports]
D
Explanation:
The TCP port that the CPM process listens on is 19009. The CPM process is the Check Point Management process that handles all management operations on the Security Management Server, such as policy installation, database synchronization, logging, etc. It communicates with other processes and clients using TCP port 19009. The other ports are used by different processes or services. TCP port 18191 is used by the FWM process for management communication. TCP port 18190 is used by the CPD process for inter-process communication. TCP port 8983 is used by the Solr process for SmartLog indexing.
Reference: [Check Point Ports]
Question #410
The “MAC magic” value must be modified under the following condition:
- A . There is more than one cluster connected to the same VLAN
- B . A firewall cluster is configured to use Multicast for CCP traffic
- C . There are more than two members in a firewall cluster
- D . A firewall cluster is configured to use Broadcast for CCP traffic
Correct Answer: A
A
Explanation:
The “MAC magic” value, also known as the “Cluster Global ID”, is a mechanism that identifies different clusters on the same network segment. It is used to prevent MAC address conflicts and ensure proper load balancing among cluster members. The “MAC magic” value is a hexadecimal number that is appended to the virtual MAC address of the cluster interface. By default, the “MAC magic” value is set to 1 for all clusters, but it must be changed manually if there is more than one cluster connected to the same VLAN. Otherwise, the clusters will not be able to communicate with each other or with external hosts.
The “MAC magic” value does not need to be modified under the other conditions listed in the question. The firewall cluster can use either Broadcast or Multicast for CCP traffic without affecting the “MAC magic” value. The number of members in a firewall cluster also does not affect the “MAC magic” value, as long as they belong to the same cluster and have the same Cluster Global ID.
Reference: Verifying Magic Mac – R81.20 – Check Point CheckMates; What is Magic MAC? – Check Point CheckMates; Check Point R81 CLI Reference Guide, page 17; R81 ClusterXL Administration Guide, page 9-10
A
Explanation:
The “MAC magic” value, also known as the “Cluster Global ID”, is a mechanism that identifies different clusters on the same network segment. It is used to prevent MAC address conflicts and ensure proper load balancing among cluster members. The “MAC magic” value is a hexadecimal number that is appended to the virtual MAC address of the cluster interface. By default, the “MAC magic” value is set to 1 for all clusters, but it must be changed manually if there is more than one cluster connected to the same VLAN. Otherwise, the clusters will not be able to communicate with each other or with external hosts.
The “MAC magic” value does not need to be modified under the other conditions listed in the question. The firewall cluster can use either Broadcast or Multicast for CCP traffic without affecting the “MAC magic” value. The number of members in a firewall cluster also does not affect the “MAC magic” value, as long as they belong to the same cluster and have the same Cluster Global ID.
Reference: Verifying Magic Mac – R81.20 – Check Point CheckMates; What is Magic MAC? – Check Point CheckMates; Check Point R81 CLI Reference Guide, page 17; R81 ClusterXL Administration Guide, page 9-10