Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #411
Traffic from source 192.168.1.1 is going to www.google.com. The Application Control Blade on the gateway is inspecting the traffic.
Assuming acceleration is enabled which path is handling the traffic?
- A . Slow Path
- B . Medium Path
- C . Fast Path
- D . Accelerated Path
Correct Answer: A
A
Explanation:
When traffic from source 192.168.1.1 is going to www.google.com, and the Application Control Blade on the gateway is inspecting the traffic with acceleration enabled, it is handled by the Slow Path.
A) Slow Path
The Slow Path is responsible for handling traffic that requires full inspection by various security blades, including the Application Control Blade. Acceleration may offload some processing to the Medium Path or Fast Path, but the Slow Path is still involved in deeper inspection.
Reference: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on traffic acceleration and processing paths.
A
Explanation:
When traffic from source 192.168.1.1 is going to www.google.com, and the Application Control Blade on the gateway is inspecting the traffic with acceleration enabled, it is handled by the Slow Path.
A) Slow Path
The Slow Path is responsible for handling traffic that requires full inspection by various security blades, including the Application Control Blade. Acceleration may offload some processing to the Medium Path or Fast Path, but the Slow Path is still involved in deeper inspection.
Reference: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on traffic acceleration and processing paths.
Question #412
If you needed the Multicast MAC address of a cluster, what command would you run?
- A . cphaprob Ca if
- B . cphaconf ccp multicast
- C . cphaconf debug data
- D . cphaprob igmp
Correct Answer: D
D
Explanation:
The command cphaprob igmp can be used to display the Multicast MAC address of a cluster. This command shows the IGMP (Internet Group Management Protocol) information for each cluster interface, including the VRID (Virtual Router ID), the Multicast IP address, and the Multicast MAC address3. The other commands do not show the Multicast MAC address information.
Reference: Check Point R81 ClusterXL Administration Guide
D
Explanation:
The command cphaprob igmp can be used to display the Multicast MAC address of a cluster. This command shows the IGMP (Internet Group Management Protocol) information for each cluster interface, including the VRID (Virtual Router ID), the Multicast IP address, and the Multicast MAC address3. The other commands do not show the Multicast MAC address information.
Reference: Check Point R81 ClusterXL Administration Guide
Question #413
John is using Management HA.
Which Security Management Server should he use for making changes?
- A . secondary Smartcenter
- B . active SmartConsole
- C . connect virtual IP of Smartcenter HA
- D . primary Log Server
Correct Answer: B
B
Explanation:
In Management HA, you should use the active SmartConsole for making changes. The active SmartConsole is connected to the Primary Security Management Server, which is responsible for synchronizing the configuration with the Secondary Security Management Server. If you use the secondary SmartCenter, your changes will not be replicated to the primary SmartCenter and will be lost in case of a failover.
Reference: Check Point Resource Library, page 9
B
Explanation:
In Management HA, you should use the active SmartConsole for making changes. The active SmartConsole is connected to the Primary Security Management Server, which is responsible for synchronizing the configuration with the Secondary Security Management Server. If you use the secondary SmartCenter, your changes will not be replicated to the primary SmartCenter and will be lost in case of a failover.
Reference: Check Point Resource Library, page 9
Question #414
At what point is the Internal Certificate Authority (ICA) created?
- A . Upon creation of a certificate.
- B . During the primary Security Management Server installation process.
- C . When an administrator decides to create one.
- D . When an administrator initially logs into SmartConsole.
Correct Answer: B
B
Explanation:
The Internal Certificate Authority (ICA) is created during the primary Security Management Server installation process. The ICA is responsible for issuing and managing certificates for all Check Point components in the network. The ICA is automatically installed as an integral part of the Security Management Server and can be managed from SmartConsole.
Reference: R81 Security Management Administration Guide, page 113.
B
Explanation:
The Internal Certificate Authority (ICA) is created during the primary Security Management Server installation process. The ICA is responsible for issuing and managing certificates for all Check Point components in the network. The ICA is automatically installed as an integral part of the Security Management Server and can be managed from SmartConsole.
Reference: R81 Security Management Administration Guide, page 113.
Question #415
After upgrading the primary security management server from R80.40 to R81.10 Bob wants to use the central deployment in SmartConsole R81.10 for the first time.
How many installations (e.g. Jumbo Hotfix, Hotfixes or Upgrade Packages) can run of such at the same time:
- A . Up to 5 gateways
- B . only 1 gateway
- C . Up to 10 gateways
- D . Up to 3 gateways
Correct Answer: C
C
Explanation:
According to the Check Point R81.20 documentation, the central deployment feature allows you to install up to 10 packages simultaneously on multiple gateways1. Reference
1: Check Point R81.20 Administration Guide, page 35.
C
Explanation:
According to the Check Point R81.20 documentation, the central deployment feature allows you to install up to 10 packages simultaneously on multiple gateways1. Reference
1: Check Point R81.20 Administration Guide, page 35.
Question #415
After upgrading the primary security management server from R80.40 to R81.10 Bob wants to use the central deployment in SmartConsole R81.10 for the first time.
How many installations (e.g. Jumbo Hotfix, Hotfixes or Upgrade Packages) can run of such at the same time:
- A . Up to 5 gateways
- B . only 1 gateway
- C . Up to 10 gateways
- D . Up to 3 gateways
Correct Answer: C
C
Explanation:
According to the Check Point R81.20 documentation, the central deployment feature allows you to install up to 10 packages simultaneously on multiple gateways1. Reference
1: Check Point R81.20 Administration Guide, page 35.
C
Explanation:
According to the Check Point R81.20 documentation, the central deployment feature allows you to install up to 10 packages simultaneously on multiple gateways1. Reference
1: Check Point R81.20 Administration Guide, page 35.
Question #417
Bob is asked by Alice to disable the SecureXL mechanism temporary tor further diagnostic by their
Check Point partner.
Which of the following Check Point Command is true:
- A . fwaccel suspend
- B . fwaccel standby
- C . fwaccel off
- D . fwaccel templates
Correct Answer: C
C
Explanation:
You can disable the SecureXL mechanism temporarily for further diagnostic by running fwaccel off on the Security Gateway1. This command disables SecureXL, which is an acceleration solution that maximizes the performance of the Firewall by offloading CPU-intensive operations to the SecureXL device2. Disabling SecureXL can help you troubleshoot connectivity or policy issues, as it forces all traffic to go through the Firewall kernel and bypass the SecureXL device1. To run this command, you need to access the Security Gateway in expert mode and run fwaccel off1. To enable SecureXL again, you can run fwaccel on1. Note that disabling SecureXL may affect the performance of the Security Gateway, so use it with caution and only when necessary1.
Reference: How to enable/disable Check Point SecureXL via CLI – Check Point Software, SecureXL – Check Point Software
C
Explanation:
You can disable the SecureXL mechanism temporarily for further diagnostic by running fwaccel off on the Security Gateway1. This command disables SecureXL, which is an acceleration solution that maximizes the performance of the Firewall by offloading CPU-intensive operations to the SecureXL device2. Disabling SecureXL can help you troubleshoot connectivity or policy issues, as it forces all traffic to go through the Firewall kernel and bypass the SecureXL device1. To run this command, you need to access the Security Gateway in expert mode and run fwaccel off1. To enable SecureXL again, you can run fwaccel on1. Note that disabling SecureXL may affect the performance of the Security Gateway, so use it with caution and only when necessary1.
Reference: How to enable/disable Check Point SecureXL via CLI – Check Point Software, SecureXL – Check Point Software
Question #418
Which member of a high-availability cluster should be upgraded first in a Zero downtime upgrade?
- A . The Standby Member
- B . The Active Member
- C . The Primary Member
- D . The Secondary Member
Correct Answer: A
A
Explanation:
In a Zero downtime upgrade, you should upgrade the Standby Member first. This is because the Standby Member does not process traffic and can be upgraded without affecting the cluster availability. After upgrading the Standby Member, you can perform a failover and make it the Active Member. Then you can upgrade the original Active Member, which becomes the Standby Member after the failover.
Reference: Getting Started – Check Point Software, section “Upgrading Cluster Members with Zero Downtime”
A
Explanation:
In a Zero downtime upgrade, you should upgrade the Standby Member first. This is because the Standby Member does not process traffic and can be upgraded without affecting the cluster availability. After upgrading the Standby Member, you can perform a failover and make it the Active Member. Then you can upgrade the original Active Member, which becomes the Standby Member after the failover.
Reference: Getting Started – Check Point Software, section “Upgrading Cluster Members with Zero Downtime”
Question #419
You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.
What is the first step to run management API commands on GAIA’s shell?
- A . mgmt_admin@teabag > id.txt
- B . mgmt_login
- C . login user admin password teabag
- D . mgmt_cli login user “admin” password “teabag” > id.txt
Correct Answer: B
B
Explanation:
You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.
The first step to run management API commands on GAIA’s shell is mgmt_login. This command allows you to login to the management server and obtain a session ID, which is required for running other management API commands. You can also specify the user name and password as parameters, or enter them interactively. The session ID is stored in the file $CPDIR/tmp/.api_session by default, unless you specify a different file name.
Reference: R81 Management API Reference Guide, page 15.
B
Explanation:
You plan to automate creating new objects using new R81 Management API. You decide to use GAIA CLI for this task.
The first step to run management API commands on GAIA’s shell is mgmt_login. This command allows you to login to the management server and obtain a session ID, which is required for running other management API commands. You can also specify the user name and password as parameters, or enter them interactively. The session ID is stored in the file $CPDIR/tmp/.api_session by default, unless you specify a different file name.
Reference: R81 Management API Reference Guide, page 15.
Question #420
By default, how often does Threat Emulation update the engine on the Security Gateway?
- A . Once per day
- B . Once an hour
- C . Once a week
- D . Twice per day
Correct Answer: A
A
Explanation:
By default, Threat Emulation updates the engine on the Security Gateway once per day. This is the recommended frequency for optimal performance and security. However, the admin can change the update frequency to a different value, such as once an hour, once a week, or twice per day, depending on the network needs and resources. The admin can also manually update the engine at any time using the SmartConsole or the command line interface.
Reference: Threat Emulation Engine Release Updates – Check Point Software, Check Point R81.20 Gaia Fresh Install and upgrade
A
Explanation:
By default, Threat Emulation updates the engine on the Security Gateway once per day. This is the recommended frequency for optimal performance and security. However, the admin can change the update frequency to a different value, such as once an hour, once a week, or twice per day, depending on the network needs and resources. The admin can also manually update the engine at any time using the SmartConsole or the command line interface.
Reference: Threat Emulation Engine Release Updates – Check Point Software, Check Point R81.20 Gaia Fresh Install and upgrade