Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #481
How can you see historical data with cpview?
- A . cpview -f <timestamp>
- B . cpview -e <timestamp>
- C . cpview -t <timestamp>
- D . cpview -d <timestamp>
Correct Answer: C
C
Explanation:
To see historical data with cpview, you can use the cpview -t <timestamp> command, where <timestamp> is the date and time you want to view. For example, cpview -t Jan 01 2023 12:00:00 will show you the cpview data for January 1st, 2023 at noon. You can also enter a partial date, such as Jan 02, to see the data for the whole day. This feature is available in R77.10 and higher versions of Check Point software1. You can also access the historical data by pressing the “t” key while running cpview in live mode and entering the desired date and time1. The historical data is stored in the CPViewDB.dat file in the /var/log/CPView_history directory on your gateway2. You can export this file and import it into other tools for visualization, such as Grafana3.
C
Explanation:
To see historical data with cpview, you can use the cpview -t <timestamp> command, where <timestamp> is the date and time you want to view. For example, cpview -t Jan 01 2023 12:00:00 will show you the cpview data for January 1st, 2023 at noon. You can also enter a partial date, such as Jan 02, to see the data for the whole day. This feature is available in R77.10 and higher versions of Check Point software1. You can also access the historical data by pressing the “t” key while running cpview in live mode and entering the desired date and time1. The historical data is stored in the CPViewDB.dat file in the /var/log/CPView_history directory on your gateway2. You can export this file and import it into other tools for visualization, such as Grafana3.
Question #482
When requiring certificates for mobile devices, make sure the authentication method is set to one of the following, Username and Password, RADIUS or ________.
- A . SecureID
- B . SecurID
- C . Complexity
- D . TacAcs
Correct Answer: B
B
Explanation:
When requiring certificates for mobile devices, the authentication method should be set to one of the following:
Username and Password
RADIUS
SecurID (RSA SecurID)
So, the correct answer is option B, "SecurID."
Options A, C, and D are not standard authentication methods for mobile devices in this context.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
B
Explanation:
When requiring certificates for mobile devices, the authentication method should be set to one of the following:
Username and Password
RADIUS
SecurID (RSA SecurID)
So, the correct answer is option B, "SecurID."
Options A, C, and D are not standard authentication methods for mobile devices in this context.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #483
Which VPN routing option uses VPN routing for every connection a satellite gateway handles?
- A . To satellites through center only
- B . To center only
- C . To center and to other satellites through center
- D . To center, or through the center to other satellites, to Internet and other VPN targets
Correct Answer: D
D
Explanation:
This VPN routing option uses VPN routing for every connection a satellite gateway handles, regardless of the destination. This means that all traffic from the satellite gateway will go through the VPN tunnel to the center gateway, and then be routed to the appropriate destination, whether it is another satellite, the Internet, or another VPN target. This option provides the highest level of security and control, but also consumes more bandwidth and processing power.
D
Explanation:
This VPN routing option uses VPN routing for every connection a satellite gateway handles, regardless of the destination. This means that all traffic from the satellite gateway will go through the VPN tunnel to the center gateway, and then be routed to the appropriate destination, whether it is another satellite, the Internet, or another VPN target. This option provides the highest level of security and control, but also consumes more bandwidth and processing power.
Question #484
Which is the least ideal Synchronization Status for Security Management Server High Availability deployment?
- A . Synchronized
- B . Never been synchronized
- C . Lagging
- D . Collision
Correct Answer: D
D
Explanation:
The least ideal Synchronization Status for Security Management Server High Availability deployment is Collision. This status indicates that both members have modified the same object independently, resulting in a conflict that needs to be resolved manually. The other statuses are either normal or indicate a temporary delay in synchronization.
Reference: High Availability Administration Guide
D
Explanation:
The least ideal Synchronization Status for Security Management Server High Availability deployment is Collision. This status indicates that both members have modified the same object independently, resulting in a conflict that needs to be resolved manually. The other statuses are either normal or indicate a temporary delay in synchronization.
Reference: High Availability Administration Guide
Question #485
What are the Threat Prevention software components available on the Check Point Security Gateway?
- A . IPS, Threat Emulation and Threat Extraction
- B . IPS, Anti-Bot, Anti-Virus, SandBlast and Macro Extraction
- C . IPS, Anti-Bot, Anti-Virus, Threat Emulation and Threat Extraction
- D . IDS, Forensics, Anti-Virus, Sandboxing
Correct Answer: C
C
Explanation:
The Threat Prevention software components available on the Check Point Security Gateway are IPS, Anti-Bot, Anti-Virus, Threat Emulation and Threat Extraction. These components provide comprehensive protection against various types of cyber threats, such as network attacks, malware, ransomware, phishing, zero-day exploits, data leakage, and more. IPS is a network security component that detects and prevents malicious traffic based on signatures, behavioral patterns, and anomaly detection. Anti-Bot is a network security component that detects and blocks botnet communications and command-and-control servers. Anti-Virus is a network security component that scans files for known viruses, worms, and trojans. Threat Emulation is a network security component that emulates files in a sandbox environment to detect unknown malware and prevent zero-day attacks. Threat Extraction is a network security component that removes malicious content from files and delivers clean files to users.
Reference: [Check Point R81 Threat Prevention Administration Guide], page 9-10
C
Explanation:
The Threat Prevention software components available on the Check Point Security Gateway are IPS, Anti-Bot, Anti-Virus, Threat Emulation and Threat Extraction. These components provide comprehensive protection against various types of cyber threats, such as network attacks, malware, ransomware, phishing, zero-day exploits, data leakage, and more. IPS is a network security component that detects and prevents malicious traffic based on signatures, behavioral patterns, and anomaly detection. Anti-Bot is a network security component that detects and blocks botnet communications and command-and-control servers. Anti-Virus is a network security component that scans files for known viruses, worms, and trojans. Threat Emulation is a network security component that emulates files in a sandbox environment to detect unknown malware and prevent zero-day attacks. Threat Extraction is a network security component that removes malicious content from files and delivers clean files to users.
Reference: [Check Point R81 Threat Prevention Administration Guide], page 9-10
Question #486
Matt wants to upgrade his old Security Management server to R81.x using the Advanced Upgrade with Database Migration.
What is one of the requirements for a successful upgrade?
- A . Size of the /var/log folder of the source machine must be at least 25% of the size of the /var/log directory on the target machine
- B . Size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine
- C . Size of the $FWDIR/log folder of the target machine must be at least 30% of the size of the $FWDIR/log directory on the source machine
- D . Size of the /var/log folder of the target machine must be at least 25GB or more
Correct Answer: B
B
Explanation:
One of the requirements for a successful upgrade using the Advanced Upgrade with Database Migration is that the size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine. This is to ensure that there is enough space to copy the log files from the source machine to the target machine during the upgrade process.
Reference: Advanced Upgrade with Database Migration
B
Explanation:
One of the requirements for a successful upgrade using the Advanced Upgrade with Database Migration is that the size of the /var/log folder of the target machine must be at least 25% of the size of the /var/log directory on the source machine. This is to ensure that there is enough space to copy the log files from the source machine to the target machine during the upgrade process.
Reference: Advanced Upgrade with Database Migration
Question #487
Which SmartEvent component is responsible to collect the logs from different Log Servers?
- A . SmartEvent Server
- B . SmartEvent Database
- C . SmartEvent Collector
- D . SmartEvent Correlation Unit
Correct Answer: D
D
Explanation:
The SmartEvent component that is responsible to collect the logs from different Log Servers is the SmartEvent Correlation Unit. The SmartEvent Correlation Unit is a daemon that runs on the SmartEvent Server and receives logs from one or more Log Servers. The SmartEvent Correlation Unit analyzes the logs and generates correlated events according to the SmartEvent policy2.
Reference: Check Point R81 SmartEvent Administration Guide
D
Explanation:
The SmartEvent component that is responsible to collect the logs from different Log Servers is the SmartEvent Correlation Unit. The SmartEvent Correlation Unit is a daemon that runs on the SmartEvent Server and receives logs from one or more Log Servers. The SmartEvent Correlation Unit analyzes the logs and generates correlated events according to the SmartEvent policy2.
Reference: Check Point R81 SmartEvent Administration Guide
Question #488
How many versions, besides the destination version, are supported in a Multi-Version Cluster Upgrade?
- A . 1
- B . 3
- C . 2
- D . 4
Correct Answer: B
B
Explanation:
Multi-Version Cluster Upgrade (MVCLU) is a feature that allows you to upgrade a cluster of Security Gateways from one major version to another, without downtime1. MVCLU supports upgrading a cluster that runs on different versions, as long as the versions are compatible with the destination version1. The number of versions, besides the destination version, that are supported in a MVCLU depends on the destination version. For example, if the destination version is R81, then MVCLU supports up to three versions besides R81, which are R80.40, R80.30, and R80.202. Therefore, the correct answer is B, as three versions are supported in a MVCLU besides the destination version.
Reference: 1: ClusterXL upgrade methods and paths – Check Point Software 2: Check Point R81 – Check Point Software
B
Explanation:
Multi-Version Cluster Upgrade (MVCLU) is a feature that allows you to upgrade a cluster of Security Gateways from one major version to another, without downtime1. MVCLU supports upgrading a cluster that runs on different versions, as long as the versions are compatible with the destination version1. The number of versions, besides the destination version, that are supported in a MVCLU depends on the destination version. For example, if the destination version is R81, then MVCLU supports up to three versions besides R81, which are R80.40, R80.30, and R80.202. Therefore, the correct answer is B, as three versions are supported in a MVCLU besides the destination version.
Reference: 1: ClusterXL upgrade methods and paths – Check Point Software 2: Check Point R81 – Check Point Software
Question #489
Please choose correct command to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI?
- A . host name myHost12 ip-address 10.50.23.90
- B . mgmt: add host name ip-address 10.50.23.90
- C . add host name emailserver1 ip-address 10.50.23.90
- D . mgmt: add host name emailserver1 ip-address 10.50.23.90
Correct Answer: D
D
Explanation:
The correct command to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI is mgmt: add host name emailserver1 ip-address 10.50.23.90. This command will create a new host object in the Security Management Server database, with the specified name and IP address. The mgmt: prefix indicates that the command is executed on the Security Management Server, and not on the local GAiA machine. The other commands are either missing the mgmt: prefix, or have incorrect syntax or parameters.
D
Explanation:
The correct command to add an “emailserver1” host with IP address 10.50.23.90 using GAiA management CLI is mgmt: add host name emailserver1 ip-address 10.50.23.90. This command will create a new host object in the Security Management Server database, with the specified name and IP address. The mgmt: prefix indicates that the command is executed on the Security Management Server, and not on the local GAiA machine. The other commands are either missing the mgmt: prefix, or have incorrect syntax or parameters.
Question #490
To accelerate the rate of connection establishment, SecureXL groups all connection that match a particular service and whose sole differentiating element is the source port. The type of grouping enables even the very first packets of a TCP handshake to be accelerated. The first packets of the first connection on the same service will be forwarded to the Firewall kernel which will then create a template of the connection.
Which of the these is NOT a SecureXL template?
- A . Accept Template
- B . Deny Template
- C . Drop Template
- D . NAT Template
Correct Answer: B
B
Explanation:
SecureXL templates are a mechanism to accelerate the rate of connection establishment by grouping connections that match a particular service and whose sole differentiating element is the source port. SecureXL templates enable even the very first packets of a TCP handshake to be accelerated, without waiting for the Firewall kernel to create a connection entry. The first packets of the first connection on the same service will be forwarded to the Firewall kernel, which will then create a template of the connection. The template will contain all the relevant information for the connection, such as source and destination IP addresses, destination port, NAT information, policy decision, etc. The template will be used by SecureXL to handle subsequent connections on the same service, without involving the Firewall kernel. This reduces the CPU load and increases the throughput.
There are three types of SecureXL templates: Accept, Drop, and NAT. Accept templates are used for connections that are allowed by the Firewall policy. Drop templates are used for connections that are blocked by the Firewall policy. NAT templates are used for connections that require NAT translation. Deny templates are not a valid type of SecureXL template.
Reference: SecureXL NAT Templates in R80.20 and lower, Part 3 – SecureXL, Security Gateway Performance Optimization – Part 5 – SecureXL
B
Explanation:
SecureXL templates are a mechanism to accelerate the rate of connection establishment by grouping connections that match a particular service and whose sole differentiating element is the source port. SecureXL templates enable even the very first packets of a TCP handshake to be accelerated, without waiting for the Firewall kernel to create a connection entry. The first packets of the first connection on the same service will be forwarded to the Firewall kernel, which will then create a template of the connection. The template will contain all the relevant information for the connection, such as source and destination IP addresses, destination port, NAT information, policy decision, etc. The template will be used by SecureXL to handle subsequent connections on the same service, without involving the Firewall kernel. This reduces the CPU load and increases the throughput.
There are three types of SecureXL templates: Accept, Drop, and NAT. Accept templates are used for connections that are allowed by the Firewall policy. Drop templates are used for connections that are blocked by the Firewall policy. NAT templates are used for connections that require NAT translation. Deny templates are not a valid type of SecureXL template.
Reference: SecureXL NAT Templates in R80.20 and lower, Part 3 – SecureXL, Security Gateway Performance Optimization – Part 5 – SecureXL