Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #461
Using mgmt_cli, what is the correct syntax to import a host object called Server_1 from the CLI?
- A . mgmt_cli add-host “Server_1” ip_address “10.15.123.10” –format txt
- B . mgmt_cli add host name “Server_1” ip-address “10.15.123.10” –format json
- C . mgmt_cli add object-host “Server_1” ip-address “10.15.123.10” –format json
- D . mgmt._cli add object “Server-1” ip-address “10.15.123.10” –format json
Correct Answer: B
B
Explanation:
The correct syntax to import a host object using mgmt_cli is mgmt_cli add host name <name> ip-address <ip-address> –format <format>1. The name and ip-address parameters are mandatory, while the format parameter is optional and can be either json or txt. The other options are incorrect because they either use wrong parameters, wrong hyphens, or wrong object types.
Reference: 1: Check Point Resource Library2
B
Explanation:
The correct syntax to import a host object using mgmt_cli is mgmt_cli add host name <name> ip-address <ip-address> –format <format>1. The name and ip-address parameters are mandatory, while the format parameter is optional and can be either json or txt. The other options are incorrect because they either use wrong parameters, wrong hyphens, or wrong object types.
Reference: 1: Check Point Resource Library2
Question #462
By default how often updates are checked when the CPUSE Software Updates Policy is set to Automatic?
- A . Six times per day
- B . Seven times per day
- C . Every two hours
- D . Every three hours
Correct Answer: D
D
Explanation:
By default, when the CPUSE Software Updates Policy is set to Automatic, updates are checked every three hours3. This means that the CPUSE agent will automatically download and install updates that match the policy settings every three hours. The other options are not the default values for the CPUSE Software Updates Policy.
Reference: 3: Check Point Software, Getting Started, CPUSE Software Updates Policy.
D
Explanation:
By default, when the CPUSE Software Updates Policy is set to Automatic, updates are checked every three hours3. This means that the CPUSE agent will automatically download and install updates that match the policy settings every three hours. The other options are not the default values for the CPUSE Software Updates Policy.
Reference: 3: Check Point Software, Getting Started, CPUSE Software Updates Policy.
Question #463
What are valid Policy Types in R81.X?
- A . Access Control, Threat Prevention, QoS, Desktop Security
- B . Access Control, IPS, Threat Emulation, NAT
- C . Access Control, IPS, QoS, DLP
- D . Access Control, RemoteAccess VPN, NAT, IPS
Correct Answer: C
C
Explanation:
Policy Types are the different types of security policies that can be configured and enforced on a
Check Point gateway. The valid Policy Types in R81.X are:
Access Control: Defines the rules for allowing or blocking traffic based on source, destination, service, user, and other criteria.
IPS: Protects the network from known and unknown attacks by inspecting the traffic and applying signatures, protections, and actions.
QoS: Controls the bandwidth allocation and prioritization for different types of traffic and
applications.
DLP: Prevents the leakage of sensitive data from the network by detecting and blocking data
transfers that violate predefined rules.
The references are:
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 11
Check Point Certified Security Administrator R81 – ExperTeach, page 5
Check Point Cybersecurity BootCamp R81.20 C CCSA & CCSE Training, page 2
C
Explanation:
Policy Types are the different types of security policies that can be configured and enforced on a
Check Point gateway. The valid Policy Types in R81.X are:
Access Control: Defines the rules for allowing or blocking traffic based on source, destination, service, user, and other criteria.
IPS: Protects the network from known and unknown attacks by inspecting the traffic and applying signatures, protections, and actions.
QoS: Controls the bandwidth allocation and prioritization for different types of traffic and
applications.
DLP: Prevents the leakage of sensitive data from the network by detecting and blocking data
transfers that violate predefined rules.
The references are:
Check Point Certified Security Expert R81.20 (CCSE) Core Training, slide 11
Check Point Certified Security Administrator R81 – ExperTeach, page 5
Check Point Cybersecurity BootCamp R81.20 C CCSA & CCSE Training, page 2
Question #464
There are 4 ways to use the Management API for creating host object with the Management API.
Which one is NOT correct?
- A . Using cpconfig
- B . Using CLISH
- C . Using SmartConsole GUI console
- D . Using Web Services
Correct Answer: A
Question #465
From SecureXL perspective, what are the three paths of traffic flow:
- A . Initial Path; Medium Path; Accelerated Path
- B . Layer Path; Blade Path; Rule Path
- C . Firewall Path; Accelerated Path; Medium Path
- D . Firewall Path; Accept Path; Drop Path
Correct Answer: C
C
Explanation:
From SecureXL perspective, the three paths of traffic flow are Firewall Path, Accelerated Path, and Medium Path. Firewall Path is the path that handles packets that are not processed by SecureXL and are sent to the Firewall kernel for inspection. Accelerated Path is the path that handles packets that are processed by SecureXL and bypass the Firewall kernel. Medium Path is the path that handles packets that are partially processed by SecureXL and partially by the Firewall kernel1.
Reference: Check Point R81 Performance Tuning Administration Guide
C
Explanation:
From SecureXL perspective, the three paths of traffic flow are Firewall Path, Accelerated Path, and Medium Path. Firewall Path is the path that handles packets that are not processed by SecureXL and are sent to the Firewall kernel for inspection. Accelerated Path is the path that handles packets that are processed by SecureXL and bypass the Firewall kernel. Medium Path is the path that handles packets that are partially processed by SecureXL and partially by the Firewall kernel1.
Reference: Check Point R81 Performance Tuning Administration Guide
Question #466
Which file gives you a list of all security servers in use, including port number?
- A . $FWDIR/conf/conf.conf
- B . $FWDIR/conf/servers.conf
- C . $FWDIR/conf/fwauthd.conf
- D . $FWDIR/conf/serversd.conf
Correct Answer: C
C
Explanation:
The file that gives you a list of all security servers in use, including port number,
is $FWDIR/conf/fwauthd.conf. Security servers are processes that handle application-level protocols such as HTTP, FTP, SMTP, etc., and perform security checks on them. Fwauthd.conf is a configuration file that defines which security servers are enabled, which ports they listen on, and which inspection points they are attached to.
C
Explanation:
The file that gives you a list of all security servers in use, including port number,
is $FWDIR/conf/fwauthd.conf. Security servers are processes that handle application-level protocols such as HTTP, FTP, SMTP, etc., and perform security checks on them. Fwauthd.conf is a configuration file that defines which security servers are enabled, which ports they listen on, and which inspection points they are attached to.
Question #467
Which process handles connection from SmartConsole R81?
- A . fwm
- B . cpmd
- C . cpm
- D . cpd
Correct Answer: C
C
Explanation:
The process that handles connection from SmartConsole R81 is cpm. Cpm stands for Check Point Management, and it is the main process that runs on the Security Management Server and interacts with SmartConsole clients. Cpm is responsible for managing policies, objects, logs, tasks, and other management functions. The other processes are either obsolete or irrelevant for SmartConsole connection.
C
Explanation:
The process that handles connection from SmartConsole R81 is cpm. Cpm stands for Check Point Management, and it is the main process that runs on the Security Management Server and interacts with SmartConsole clients. Cpm is responsible for managing policies, objects, logs, tasks, and other management functions. The other processes are either obsolete or irrelevant for SmartConsole connection.
Question #468
Which of the following process pulls application monitoring status?
- A . fwd
- B . fwm
- C . cpwd
- D . cpd
Correct Answer: D
D
Explanation:
The process that pulls application monitoring status is cpd. cpd is a daemon that runs on Check Point products and performs various tasks related to management communication, policy installation, license verification, logging, etc. cpd also monitors the status of other processes and applications on the system and reports it to the management server. cpd uses SNMP to collect information from various sources, such as blades, gateways, servers, etc. You can view the application monitoring status in SmartConsole by using the Gateways & Servers tab in the Logs & Monitor view.
Reference: Check Point Processes and Daemons
D
Explanation:
The process that pulls application monitoring status is cpd. cpd is a daemon that runs on Check Point products and performs various tasks related to management communication, policy installation, license verification, logging, etc. cpd also monitors the status of other processes and applications on the system and reports it to the management server. cpd uses SNMP to collect information from various sources, such as blades, gateways, servers, etc. You can view the application monitoring status in SmartConsole by using the Gateways & Servers tab in the Logs & Monitor view.
Reference: Check Point Processes and Daemons
Question #469
How to can you make sure that the old logs will be available after updating the Management to version R81.20 using the Advanced Upgrade Method?
- A . Use the WebUI -> Maintenance > System Backup and store the backup on a remote FTP server
- B . The logs will be included running SFWDIR/scripts/migrate_server export -v R81.20 <path/filename>
- C . Use the WebUI to save a snapshot before updating the Management -> Maintenance > Snapshot Management
- D . Use the migrate_server tool with the option ‘-I’ for the logs and ‘-x’ for the index
Correct Answer: B
B
Explanation:
The best way to make sure that the old logs will be available after updating the Management to version R81.20 using the Advanced Upgrade Method is to use the migrate_server tool with the option ‘-l’ for the logs and ‘-x’ for the index. This option will export both logs and index files from an existing Security Management Server or Multi-Domain Server to a specified directory or file. The exported data can then be imported to a new server using a similar command with ‘-i’ option.
Reference: [Check Point R81 Installation and Upgrade Guide]
B
Explanation:
The best way to make sure that the old logs will be available after updating the Management to version R81.20 using the Advanced Upgrade Method is to use the migrate_server tool with the option ‘-l’ for the logs and ‘-x’ for the index. This option will export both logs and index files from an existing Security Management Server or Multi-Domain Server to a specified directory or file. The exported data can then be imported to a new server using a similar command with ‘-i’ option.
Reference: [Check Point R81 Installation and Upgrade Guide]
Question #470
GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the:
- A . Check Point Update Service Engine
- B . Check Point Software Update Agent
- C . Check Point Remote Installation Daemon (CPRID)
- D . Check Point Software Update Daemon
Correct Answer: A
A
Explanation:
GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the Check Point Update Service Engine. This agent allows you to download and install software updates, hotfixes, upgrade packages, etc., from Check Point servers or from a local repository. The Check Point Update Service Engine can be accessed via SmartConsole or via WebUI or CLI on GAIA.
Reference: [Gaia Administration Guide R81], page 77.
A
Explanation:
GAIA greatly increases operational efficiency by offering an advanced and intuitive software update agent, commonly referred to as the Check Point Update Service Engine. This agent allows you to download and install software updates, hotfixes, upgrade packages, etc., from Check Point servers or from a local repository. The Check Point Update Service Engine can be accessed via SmartConsole or via WebUI or CLI on GAIA.
Reference: [Gaia Administration Guide R81], page 77.