Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #471
What is the purpose of the command "ps aux | grep twd"?
- A . You can check the Process ID and the processing time of the twd process.
- B . You can convert the log file into Post Script format.
- C . You can list all Process IDs for all running services.
- D . You can check whether the IPS default setting is set to Detect or Prevent mode
Correct Answer: A
A
Explanation:
The command “ps aux | grep twd” is used to check the process ID and the processing time of the twd process on the Security Gateway. The ps command displays information about the active processes on the system. The aux option shows all processes for all users, including those without a controlling terminal. The grep command filters the output of the ps command by searching for the pattern “twd”, which is the name of the process that handles VPN traffic encryption and decryption1. The output of the command shows the process ID, CPU usage, memory usage, start time, and other details of the twd process2. Therefore, the correct answer is A.
Reference: 1: [Check Point Processes and Daemons] 2: [How to troubleshoot VPN issues with cpview utility]
A
Explanation:
The command “ps aux | grep twd” is used to check the process ID and the processing time of the twd process on the Security Gateway. The ps command displays information about the active processes on the system. The aux option shows all processes for all users, including those without a controlling terminal. The grep command filters the output of the ps command by searching for the pattern “twd”, which is the name of the process that handles VPN traffic encryption and decryption1. The output of the command shows the process ID, CPU usage, memory usage, start time, and other details of the twd process2. Therefore, the correct answer is A.
Reference: 1: [Check Point Processes and Daemons] 2: [How to troubleshoot VPN issues with cpview utility]
Question #472
What Factor preclude Secure XL Templating?
- A . Source Port Ranges/Encrypted Connections
- B . IPS
- C . ClusterXL in load sharing Mode
- D . CoreXL
Correct Answer: A
A
Explanation:
SecureXL Templating is a feature that accelerates the processing of packets that belong to the same connection or session by creating a template for the first packet and applying it to the subsequent packets. SecureXL Templating is precluded by factors that prevent the creation of a template, such as source port ranges, encrypted connections, NAT, QoS, etc.
Reference: SecureXL Mechanism
A
Explanation:
SecureXL Templating is a feature that accelerates the processing of packets that belong to the same connection or session by creating a template for the first packet and applying it to the subsequent packets. SecureXL Templating is precluded by factors that prevent the creation of a template, such as source port ranges, encrypted connections, NAT, QoS, etc.
Reference: SecureXL Mechanism
Question #473
A user complains that some Internet resources are not available. The Administrator is having issues seeing it packets are being dropped at the firewall (not seeing drops in logs).
What is the solution to troubleshoot the issue?
- A . run fw unloadlocal" on the relevant gateway and check the ping again
- B . run "cpstop" on the relevant gateway and check the ping again
- C . run ‘’fw log" on the relevant gateway
- D . run ‘’fw ctl zdebug drop" on the relevant gateway
Correct Answer: D
D
Explanation:
The solution to troubleshoot the issue of some Internet resources being unavailable is to run fw ctl zdebug drop on the relevant gateway1. This command lists all dropped packets in real time and explains the reasons for the drop2. It is a powerful tool that can help diagnose connectivity problems and firewall policy issues3. To use this command, you need to access the gateway in expert mode and run fw ctl zdebug + drop2. You can also filter the output by using grep with an IP address or a keyword, for example: fw ctl zdebug + drop | grep 10.10.10.10 or fw ctl zdebug + drop | grep SYN3. This command is a wrapper for the full debugs, and it will run the debug commands for you and will allow you to run debug from one debug module only4. By default, it will use a small debug buffer but if you wish, you can provide the -buf option to use your own size4. To stop the command, press Ctrl+C and then run fw ctl debug 0 to reset the debug state3.
Note: Running this command may affect the performance of the firewall, so use it with caution and only when necessary3.
Reference: Solved: is it possible /supported to run fw ctl zdebug on … – Check …, How to use the fw ctl zdebug command to view drops on the Security Gateway, Troubleshooting dropped packets in Checkpoint using zdebug, “fw ctl zdebug” – Helpful Command Combinations – Check Point CheckMates
D
Explanation:
The solution to troubleshoot the issue of some Internet resources being unavailable is to run fw ctl zdebug drop on the relevant gateway1. This command lists all dropped packets in real time and explains the reasons for the drop2. It is a powerful tool that can help diagnose connectivity problems and firewall policy issues3. To use this command, you need to access the gateway in expert mode and run fw ctl zdebug + drop2. You can also filter the output by using grep with an IP address or a keyword, for example: fw ctl zdebug + drop | grep 10.10.10.10 or fw ctl zdebug + drop | grep SYN3. This command is a wrapper for the full debugs, and it will run the debug commands for you and will allow you to run debug from one debug module only4. By default, it will use a small debug buffer but if you wish, you can provide the -buf option to use your own size4. To stop the command, press Ctrl+C and then run fw ctl debug 0 to reset the debug state3.
Note: Running this command may affect the performance of the firewall, so use it with caution and only when necessary3.
Reference: Solved: is it possible /supported to run fw ctl zdebug on … – Check …, How to use the fw ctl zdebug command to view drops on the Security Gateway, Troubleshooting dropped packets in Checkpoint using zdebug, “fw ctl zdebug” – Helpful Command Combinations – Check Point CheckMates
Question #474
Which Check Point software blade provides visibility of users, groups and machines while also providing access control through identity-based policies?
- A . Application Control
- B . Firewall
- C . Identity Awareness
- D . URL Filtering
Correct Answer: C
C
Explanation:
The verified answer is
C. Identity Awareness.
Identity Awareness is the Check Point software blade that provides detailed visibility of users, groups, and machines, while also providing application and access control through the creation of accurate, identity-based policies1. Identity Awareness allows you to easily configure network access and auditing based on three items: network location, the identity of a user and the identity of a machine1. Identity Awareness integrates with multiple identity sources, such as Microsoft Active Directory, Cisco Identity Services Engine, and RADIUS Accounting23.
Application Control is the Check Point software blade that enables network administrators to identify and control thousands of applications and widgets, and millions of websites, based on categories, risk, and characteristics.
Firewall is the Check Point software blade that provides stateful inspection and enforcement of network traffic, and protects against network and application-level attacks.
URL Filtering is the Check Point software blade that enables secure web access by blocking access to malicious and inappropriate websites, and enforcing compliance with corporate policies.
Reference: Identity Awareness – Check Point Software1
Check Point Integrated Security Architecture – Check Point Software2 Cisco Identity Services Engine and Check Point Integration3 Application Control – Check Point Software Firewall – Check Point Software
URL Filtering – Check Point Software
C
Explanation:
The verified answer is
C. Identity Awareness.
Identity Awareness is the Check Point software blade that provides detailed visibility of users, groups, and machines, while also providing application and access control through the creation of accurate, identity-based policies1. Identity Awareness allows you to easily configure network access and auditing based on three items: network location, the identity of a user and the identity of a machine1. Identity Awareness integrates with multiple identity sources, such as Microsoft Active Directory, Cisco Identity Services Engine, and RADIUS Accounting23.
Application Control is the Check Point software blade that enables network administrators to identify and control thousands of applications and widgets, and millions of websites, based on categories, risk, and characteristics.
Firewall is the Check Point software blade that provides stateful inspection and enforcement of network traffic, and protects against network and application-level attacks.
URL Filtering is the Check Point software blade that enables secure web access by blocking access to malicious and inappropriate websites, and enforcing compliance with corporate policies.
Reference: Identity Awareness – Check Point Software1
Check Point Integrated Security Architecture – Check Point Software2 Cisco Identity Services Engine and Check Point Integration3 Application Control – Check Point Software Firewall – Check Point Software
URL Filtering – Check Point Software
Question #475
In SmartConsole, objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories.
Which of the following is NOT an objects category?
- A . Limit
- B . Resource
- C . Custom Application / Site
- D . Network Object
Correct Answer: B
B
Explanation:
Resource is not an objects category in SmartConsole. Objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories, such as Network Object, Host, Gateway, Service, Time Object, Custom Application / Site, Limit, and Group. A resource is a type of object that represents an application or content that is accessible through HTTP or HTTPS protocols. A resource can be used to define access rules for users who connect through Identity Awareness or Mobile Access blades.
B
Explanation:
Resource is not an objects category in SmartConsole. Objects are used to represent physical and virtual network components and also some logical components. These objects are divided into several categories, such as Network Object, Host, Gateway, Service, Time Object, Custom Application / Site, Limit, and Group. A resource is a type of object that represents an application or content that is accessible through HTTP or HTTPS protocols. A resource can be used to define access rules for users who connect through Identity Awareness or Mobile Access blades.
Question #476
SandBlast appliances can be deployed in the following modes:
- A . using a SPAN port to receive a copy of the traffic only
- B . detect only
- C . inline/prevent or detect
- D . as a Mail Transfer Agent and as part of the traffic flow only
Correct Answer: C
C
Explanation:
SandBlast appliances can be deployed in the following modes:
C) Inline/prevent or detect
SandBlast appliances can be deployed in an inline mode where they actively inspect and prevent or detect malicious traffic. In this mode, the appliance sits in the network traffic path and can take actions to block or detect threats in real-time.
Reference: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on SandBlast.
C
Explanation:
SandBlast appliances can be deployed in the following modes:
C) Inline/prevent or detect
SandBlast appliances can be deployed in an inline mode where they actively inspect and prevent or detect malicious traffic. In this mode, the appliance sits in the network traffic path and can take actions to block or detect threats in real-time.
Reference: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on SandBlast.
Question #477
In R81 spoofing is defined as a method of:
- A . Disguising an illegal IP address behind an authorized IP address through Port Address Translation.
- B . Hiding your firewall from unauthorized users.
- C . Detecting people using false or wrong authentication logins
- D . Making packets appear as if they come from an authorized IP address.
Correct Answer: D
D
Explanation:
In R81, spoofing is defined as a method of making packets appear as if they come from an authorized IP address. Spoofing can be used by attackers to bypass security policies or hide their identity. Check Point firewalls use anti-spoofing mechanisms to prevent spoofed packets from entering or leaving the network.
Reference: Security Gateway R81 Administration Guide:
D
Explanation:
In R81, spoofing is defined as a method of making packets appear as if they come from an authorized IP address. Spoofing can be used by attackers to bypass security policies or hide their identity. Check Point firewalls use anti-spoofing mechanisms to prevent spoofed packets from entering or leaving the network.
Reference: Security Gateway R81 Administration Guide:
Question #478
Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.
After installation, is the administrator required to perform any additional tasks?
- A . Run cprestart from clish
- B . After upgrading the hardware, increase the number of kernel instances using cpconfig
- C . Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores
- D . Hyperthreading must be enabled in the bios to use CoreXL
Correct Answer: B
B
Explanation:
: After installing a new multicore CPU to replace the existing single core CPU, the administrator is required to perform one additional task, which is to increase the number of kernel instances using cpconfig. This is because by default, only one kernel instance is enabled on a Security Gateway. To take advantage of multiple cores, the administrator needs to configure more kernel instances according to the number of cores available on the CPU.
Reference: Configuring CoreXL
B
Explanation:
: After installing a new multicore CPU to replace the existing single core CPU, the administrator is required to perform one additional task, which is to increase the number of kernel instances using cpconfig. This is because by default, only one kernel instance is enabled on a Security Gateway. To take advantage of multiple cores, the administrator needs to configure more kernel instances according to the number of cores available on the CPU.
Reference: Configuring CoreXL
Question #479
What happen when IPS profile is set in Detect Only Mode for troubleshooting?
- A . It will generate Geo-Protection traffic
- B . Automatically uploads debugging logs to Check Point Support Center
- C . It will not block malicious traffic
- D . Bypass licenses requirement for Geo-Protection control
Correct Answer: C
C
Explanation:
It is recommended to enable Detect-Only for Troubleshooting on the profile during the initial installation of IPS. This option overrides any protections that are set to Prevent so that they will not block any traffic.
During this time you can analyze the alerts that IPS generates to see how IPS will handle network traffic, while avoiding any impact on the flow of traffic.
C
Explanation:
It is recommended to enable Detect-Only for Troubleshooting on the profile during the initial installation of IPS. This option overrides any protections that are set to Prevent so that they will not block any traffic.
During this time you can analyze the alerts that IPS generates to see how IPS will handle network traffic, while avoiding any impact on the flow of traffic.
Question #480
You are asked to check the status of several user-mode processes on the management server and gateway.
Which of the following processes can only be seen on a Management Server?
- A . fwd
- B . fwm
- C . cpd
- D . cpwd
Correct Answer: B
B
Explanation:
User-mode processes are processes that run in the user space of the operating system, as opposed to kernel-mode processes that run in the kernel space. User-mode processes are usually less privileged and have less access to system resources than kernel-mode processes. Check Point products use both user-mode and kernel-mode processes to provide various functionalities and services.
The following are some of the user-mode processes that can be seen on the management server and gateway:
fwd: This process is responsible for policy installation, logging, and communication with other Check Point components. It runs on both the management server and gateway.
cpd: This process is responsible for licensing, certificate management, and communication with SmartConsole. It runs on both the management server and gateway.
cpwd: This process is responsible for monitoring and restarting other processes. It runs on both the management server and gateway.
The following is a user-mode process that can only be seen on the management server:
fwm: This process is responsible for managing the security policy database, compiling the security policy, and generating reports. It runs only on the management server. Therefore, the correct answer is B)
Reference: Check Point Processes and Daemons, Check Point Processes Cheat Sheet, Check Point Firewall Security Solution
B
Explanation:
User-mode processes are processes that run in the user space of the operating system, as opposed to kernel-mode processes that run in the kernel space. User-mode processes are usually less privileged and have less access to system resources than kernel-mode processes. Check Point products use both user-mode and kernel-mode processes to provide various functionalities and services.
The following are some of the user-mode processes that can be seen on the management server and gateway:
fwd: This process is responsible for policy installation, logging, and communication with other Check Point components. It runs on both the management server and gateway.
cpd: This process is responsible for licensing, certificate management, and communication with SmartConsole. It runs on both the management server and gateway.
cpwd: This process is responsible for monitoring and restarting other processes. It runs on both the management server and gateway.
The following is a user-mode process that can only be seen on the management server:
fwm: This process is responsible for managing the security policy database, compiling the security policy, and generating reports. It runs only on the management server. Therefore, the correct answer is B)
Reference: Check Point Processes and Daemons, Check Point Processes Cheat Sheet, Check Point Firewall Security Solution