Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #41
To help SmartEvent determine whether events originated internally or externally you must define using the Initial Settings under General Settings in the Policy Tab.
How many options are available to calculate the traffic direction?
- A . 5 Network; Host; Objects; Services; API
- B . 3 Incoming; Outgoing; Network
- C . 2 Internal; External
- D . 4 Incoming; Outgoing; Internal; Other
Correct Answer: D
D
Explanation:
To help SmartEvent determine whether events originated internally or externally, you must define the traffic direction using the Initial Settings under General Settings in the Policy Tab. There are four options available to calculate the traffic direction: Incoming, Outgoing, Internal, and Other. Incoming means the source is external and the destination is internal. Outgoing means the source is internal and the destination is external. Internal means both the source and the destination are internal. Other means both the source and the destination are external.
Reference: SmartEvent R81 Administration Guide
D
Explanation:
To help SmartEvent determine whether events originated internally or externally, you must define the traffic direction using the Initial Settings under General Settings in the Policy Tab. There are four options available to calculate the traffic direction: Incoming, Outgoing, Internal, and Other. Incoming means the source is external and the destination is internal. Outgoing means the source is internal and the destination is external. Internal means both the source and the destination are internal. Other means both the source and the destination are external.
Reference: SmartEvent R81 Administration Guide
Question #42
Which tool is used to enable ClusterXL?
- A . SmartUpdate
- B . cpconfig
- C . SmartConsole
- D . sysconfig
Correct Answer: B
B
Explanation:
The tool that is used to enable ClusterXL is cpconfig. ClusterXL is a software-based Load Sharing and High Availability solution that distributes network traffic between clusters of redundant Security Gateways1. ClusterXL can be enabled on Check Point Security Gateways running on Gaia OS, SecurePlatform OS, IPSO OS, or X-Series XOS2.
To enable ClusterXL, the administrator must run the cpconfig command on each cluster member and select the option to enable ClusterXL. This will prompt the administrator to choose the ClusterXL mode (High Availability or Load Sharing) and the Cluster Control Protocol (CCP) mode (Broadcast or Multicast). After enabling ClusterXL, the administrator must reboot the cluster members for the changes to take effect34.
Therefore, the correct answer is B) The tool that is used to enable ClusterXL is cpconfig.
Reference: 1, Introduction to ClusterXL – Check Point Software
2, ClusterXL Requirements and Compatibility – Check Point Software
3, Configuring ClusterXL – Check Point Software
4, How to configure ClusterXL – Check Point Software Technologies
B
Explanation:
The tool that is used to enable ClusterXL is cpconfig. ClusterXL is a software-based Load Sharing and High Availability solution that distributes network traffic between clusters of redundant Security Gateways1. ClusterXL can be enabled on Check Point Security Gateways running on Gaia OS, SecurePlatform OS, IPSO OS, or X-Series XOS2.
To enable ClusterXL, the administrator must run the cpconfig command on each cluster member and select the option to enable ClusterXL. This will prompt the administrator to choose the ClusterXL mode (High Availability or Load Sharing) and the Cluster Control Protocol (CCP) mode (Broadcast or Multicast). After enabling ClusterXL, the administrator must reboot the cluster members for the changes to take effect34.
Therefore, the correct answer is B) The tool that is used to enable ClusterXL is cpconfig.
Reference: 1, Introduction to ClusterXL – Check Point Software
2, ClusterXL Requirements and Compatibility – Check Point Software
3, Configuring ClusterXL – Check Point Software
4, How to configure ClusterXL – Check Point Software Technologies
Question #43
Firewall polices must be configured to accept VRRP packets on the GAiA platform if it Firewall software.
The Multicast destination assigned by the internet Assigned Number Authority (IANA) for VRRP is:
- A . 224.0.0.18
- B . 224 00 5
- C . 224.0.0.102
- D . 224.0.0.22
Correct Answer: A
A
Explanation:
The multicast destination assigned by the Internet Assigned Numbers Authority (IANA) for VRRP is 224.0.0.18. This is a reserved multicast address that is used by VRRP routers to communicate with each other and announce their priority and state. Firewall policies must be configured to accept VRRP packets on the Gaia platform if it runs Firewall software. Otherwise, VRRP packets will be dropped by default.
Reference: [Configuring VRRP on Gaia]
A
Explanation:
The multicast destination assigned by the Internet Assigned Numbers Authority (IANA) for VRRP is 224.0.0.18. This is a reserved multicast address that is used by VRRP routers to communicate with each other and announce their priority and state. Firewall policies must be configured to accept VRRP packets on the Gaia platform if it runs Firewall software. Otherwise, VRRP packets will be dropped by default.
Reference: [Configuring VRRP on Gaia]
Question #44
Which of the following Windows Security Events will not map a username to an IP address in Identity Awareness?
- A . Kerberos Ticket Renewed
- B . Kerberos Ticket Requested
- C . Account Logon
- D . Kerberos Ticket Timed Out
Correct Answer: D
D
Explanation:
Identity Awareness maps usernames to IP addresses by collecting Windows Security Events from Active Directory Domain Controllers. These events include Account Logon, Kerberos Ticket Requested, and Kerberos Ticket Renewed. These events indicate that a user has successfully authenticated to the domain and obtained a Kerberos ticket for accessing network resources. Identity Awareness can use these events to associate the username with the source IP address of the authentication request.
However, Kerberos Ticket Timed Out is not a Windows Security Event that Identity Awareness can use to map usernames to IP addresses. This event indicates that a user’s Kerberos ticket has expired and needs to be renewed. This event does not contain the source IP address of the user, only the username and the ticket information. Therefore, Identity Awareness cannot use this event to map a username to an IP address.
Reference: 1, Training & Certification | Check Point Software, section “Security Expert R81.20 (CCSE) Core Training”
2, Certified Security Expert (CCSE) R81.20 Course Overview, page 1
3, Check Point Certified Security Expert R81, page 5
5, Identity Awareness Administration Guide R81, section “How Identity Awareness Collects Identities”
D
Explanation:
Identity Awareness maps usernames to IP addresses by collecting Windows Security Events from Active Directory Domain Controllers. These events include Account Logon, Kerberos Ticket Requested, and Kerberos Ticket Renewed. These events indicate that a user has successfully authenticated to the domain and obtained a Kerberos ticket for accessing network resources. Identity Awareness can use these events to associate the username with the source IP address of the authentication request.
However, Kerberos Ticket Timed Out is not a Windows Security Event that Identity Awareness can use to map usernames to IP addresses. This event indicates that a user’s Kerberos ticket has expired and needs to be renewed. This event does not contain the source IP address of the user, only the username and the ticket information. Therefore, Identity Awareness cannot use this event to map a username to an IP address.
Reference: 1, Training & Certification | Check Point Software, section “Security Expert R81.20 (CCSE) Core Training”
2, Certified Security Expert (CCSE) R81.20 Course Overview, page 1
3, Check Point Certified Security Expert R81, page 5
5, Identity Awareness Administration Guide R81, section “How Identity Awareness Collects Identities”
Question #45
With SecureXL enabled, accelerated packets will pass through the following:
- A . Network Interface Card, OSI Network Layer, OS IP Stack, and the Acceleration Device
- B . Network Interface Card, Check Point Firewall Kernal, and the Acceleration Device
- C . Network Interface Card and the Acceleration Device
- D . Network Interface Card, OSI Network Layer, and the Acceleration Device
Correct Answer: C
C
Explanation:
With SecureXL enabled, accelerated packets will pass through the following: Network Interface Card and the Acceleration Device. SecureXL is a technology that accelerates network traffic processing by offloading intensive operations from the Firewall kernel to a dedicated SecureXL device. Accelerated packets are packets that match certain criteria and can be handled by SecureXL without involving the Firewall kernel. These packets bypass the OSI Network Layer, OS IP Stack, and Check Point Firewall Kernel, and are processed directly by the Network Interface Card and the Acceleration Device. The other options are either incorrect or describe non-accelerated packets.
C
Explanation:
With SecureXL enabled, accelerated packets will pass through the following: Network Interface Card and the Acceleration Device. SecureXL is a technology that accelerates network traffic processing by offloading intensive operations from the Firewall kernel to a dedicated SecureXL device. Accelerated packets are packets that match certain criteria and can be handled by SecureXL without involving the Firewall kernel. These packets bypass the OSI Network Layer, OS IP Stack, and Check Point Firewall Kernel, and are processed directly by the Network Interface Card and the Acceleration Device. The other options are either incorrect or describe non-accelerated packets.
Question #46
What is the protocol and port used for Health Check and State Synchronization in ClusterXL?
- A . CCP and 18190
- B . CCP and 257
- C . CCP and 8116
- D . CPC and 8116
Correct Answer: C
C
Explanation:
ClusterXL is a clustering technology that provides high availability and load sharing for Security Gateways. ClusterXL uses a proprietary protocol called Check Point Cluster Protocol (CCP) to communicate between cluster members. CCP has two main functions: Health Check and State Synchronization. Health Check is the mechanism that monitors the status and availability of each cluster member and determines which member is the active one. State Synchronization is the mechanism that synchronizes the connection and NAT tables between cluster members to ensure a smooth failover in case of a member failure. CCP uses UDP port 8116 for both Health Check and State Synchronization messages. The other options are not correct because:
A) CCP and 18190: This option is incorrect because CCP does not use port 18190. Port 18190 is used by Secure Internal Communication (SIC) between Security Gateways and Management Servers.
B) CCP and 257: This option is incorrect because CCP does not use port 257. Port 257 is used by Check Point Security Management Protocol (CPM) for communication between SmartConsole and Management Servers.
D) CPC and 8116: This option is incorrect because there is no such protocol as CPC in ClusterXL.
Reference: ClusterXL R81.20 Administration Guide, ClusterXL Administration Guide R80.40, sk25977 – Ports used by Check Point software
C
Explanation:
ClusterXL is a clustering technology that provides high availability and load sharing for Security Gateways. ClusterXL uses a proprietary protocol called Check Point Cluster Protocol (CCP) to communicate between cluster members. CCP has two main functions: Health Check and State Synchronization. Health Check is the mechanism that monitors the status and availability of each cluster member and determines which member is the active one. State Synchronization is the mechanism that synchronizes the connection and NAT tables between cluster members to ensure a smooth failover in case of a member failure. CCP uses UDP port 8116 for both Health Check and State Synchronization messages. The other options are not correct because:
A) CCP and 18190: This option is incorrect because CCP does not use port 18190. Port 18190 is used by Secure Internal Communication (SIC) between Security Gateways and Management Servers.
B) CCP and 257: This option is incorrect because CCP does not use port 257. Port 257 is used by Check Point Security Management Protocol (CPM) for communication between SmartConsole and Management Servers.
D) CPC and 8116: This option is incorrect because there is no such protocol as CPC in ClusterXL.
Reference: ClusterXL R81.20 Administration Guide, ClusterXL Administration Guide R80.40, sk25977 – Ports used by Check Point software
Question #47
What are the minimum open server hardware requirements for a Security Management Server/Standalone in R81?
- A . 2 CPU cores, 4GB of RAM and 15GB of disk space
- B . 8 CPU cores, 16GB of RAM and 500 GB of disk space
- C . 4 CPU cores, 8GB of RAM and 500GB of disk space
- D . 8 CPU cores, 32GB of RAM and 1 TB of disk space
Correct Answer: C
C
Explanation:
The minimum open server hardware requirements for a Security Management Server/Standalone in R81 are:
CPU: Intel Core i5-4590 or equivalent (4 cores)
Memory: 8 GB RAM
Disk space: 500 GB
The other options do not match the minimum requirements. Option A has insufficient CPU cores, memory and disk space. Option B has excessive CPU cores and disk space. Option D has excessive CPU cores, memory and disk space.
Reference: Check Point R81 Release Notes, page 6
C
Explanation:
The minimum open server hardware requirements for a Security Management Server/Standalone in R81 are:
CPU: Intel Core i5-4590 or equivalent (4 cores)
Memory: 8 GB RAM
Disk space: 500 GB
The other options do not match the minimum requirements. Option A has insufficient CPU cores, memory and disk space. Option B has excessive CPU cores and disk space. Option D has excessive CPU cores, memory and disk space.
Reference: Check Point R81 Release Notes, page 6
Question #48
Which Correction mechanisms are available with ClusterXL under R81.20?
- A . Correction Mechanisms are only available of Maestro Hyperscale Orchestrators
- B . Pre-Correction and SDF (Sticky Decision Function)
- C . SDF (Sticky Decision Function) and Flush and ACK
- D . Dispatcher (Early Correction) and Firewall (Late Correction)
Correct Answer: C
C
Explanation:
SDF (Sticky Decision Function) and Flush and ACK are the two correction mechanisms that are available with ClusterXL under R81.20. According to the ClusterXL R81.20 Administration Guide1, correction mechanisms are methods that ClusterXL uses to prevent or recover from out-of-state situations, which occur when different Cluster Members have different information about the connections that they handle1. ClusterXL supports two types of correction mechanisms: SDF and Flush and ACK1.
SDF (Sticky Decision Function) is a mechanism that ensures that packets of the same connection are always handled by the same Cluster Member, regardless of the load balancing algorithm. SDF uses a hash table that maps each connection to a specific Cluster Member, based on the 5-tuple of source IP, destination IP, source port, destination port, and protocol. SDF prevents out-of-state situations by avoiding the switch of Cluster Members for existing connections1.
Flush and ACK is a mechanism that synchronizes the connection tables of different Cluster Members when an out-of-state situation is detected.
Flush and ACK works as follows:
When a Cluster Member receives a packet that belongs to an unknown connection, it sends a Flush message to all other Cluster Members, asking them to delete the connection from their tables. When a Cluster Member receives a Flush message, it checks if it has the connection in its table. If it does, it deletes the connection and sends an ACK message to the sender of the Flush message, indicating that it has performed the deletion.
When a Cluster Member receives an ACK message, it creates a new connection entry in its table for the packet that triggered the Flush message, and processes the packet normally.
If a Cluster Member does not receive any ACK message within a timeout period, it assumes that no other Cluster Member has the connection, and creates a new connection entry in its table for the packet that triggered the Flush message1.
Reference: ClusterXL R81.20 Administration Guide
C
Explanation:
SDF (Sticky Decision Function) and Flush and ACK are the two correction mechanisms that are available with ClusterXL under R81.20. According to the ClusterXL R81.20 Administration Guide1, correction mechanisms are methods that ClusterXL uses to prevent or recover from out-of-state situations, which occur when different Cluster Members have different information about the connections that they handle1. ClusterXL supports two types of correction mechanisms: SDF and Flush and ACK1.
SDF (Sticky Decision Function) is a mechanism that ensures that packets of the same connection are always handled by the same Cluster Member, regardless of the load balancing algorithm. SDF uses a hash table that maps each connection to a specific Cluster Member, based on the 5-tuple of source IP, destination IP, source port, destination port, and protocol. SDF prevents out-of-state situations by avoiding the switch of Cluster Members for existing connections1.
Flush and ACK is a mechanism that synchronizes the connection tables of different Cluster Members when an out-of-state situation is detected.
Flush and ACK works as follows:
When a Cluster Member receives a packet that belongs to an unknown connection, it sends a Flush message to all other Cluster Members, asking them to delete the connection from their tables. When a Cluster Member receives a Flush message, it checks if it has the connection in its table. If it does, it deletes the connection and sends an ACK message to the sender of the Flush message, indicating that it has performed the deletion.
When a Cluster Member receives an ACK message, it creates a new connection entry in its table for the packet that triggered the Flush message, and processes the packet normally.
If a Cluster Member does not receive any ACK message within a timeout period, it assumes that no other Cluster Member has the connection, and creates a new connection entry in its table for the packet that triggered the Flush message1.
Reference: ClusterXL R81.20 Administration Guide
Question #49
Which pre-defined Permission Profile should be assigned to an administrator that requires full access to audit all configurations without modifying them?
- A . Auditor
- B . Read Only All
- C . Super User
- D . Full Access
Correct Answer: B
B
Explanation:
The pre-defined Permission Profile that should be assigned to an administrator that requires full access to audit all configurations without modifying them is Read Only All. This profile grants read-only access to all features and blades in SmartConsole, including logs and reports. This profile is suitable for auditors who need to review the security policy and settings, but not change them.
Reference: R81 Security Management Administration Guide, page 57.
B
Explanation:
The pre-defined Permission Profile that should be assigned to an administrator that requires full access to audit all configurations without modifying them is Read Only All. This profile grants read-only access to all features and blades in SmartConsole, including logs and reports. This profile is suitable for auditors who need to review the security policy and settings, but not change them.
Reference: R81 Security Management Administration Guide, page 57.
Question #50
When detected, an event can activate an Automatic Reaction. The SmartEvent administrator can create and configure one Automatic Reaction, or many, according to the needs of the system.
Which of the following statement is false and NOT part of possible automatic reactions:
- A . Syslog
- B . SNMPTrap
- C . Block Source
- D . Mail
Correct Answer: B