Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #501
In R81.20 a new feature dynamic log distribution was added.
What is this for?
- A . Configure the Security Gateway to distribute logs between multiple active Log Servers to support a better rate of Logs and Log Servers redundancy
- B . In case of a Management High Availability the management server stores the logs dynamically on the member with the most available disk space in /var/log
- C . Synchronize the log between the primary and secondary management server in case of a Management High Availability
- D . To save disk space in case of a firewall cluster local logs are distributed between the cluster members.
Correct Answer: A
A
Explanation:
https://resources.checkpoint.com/datasheet/certified-security-expert-ccse-r8120-course-overview
Dynamic log distribution is a feature that allows you to configure the Security Gateway to distribute logs between multiple active Log Servers to support a better rate of Logs and Log Servers redundancy. This means that each log is sent to only one Log Server and the load is balanced between the primary Log Servers. If all the primary Log Servers are disconnected, the logs are distributed between the backup Log Servers. If no Log Servers are connected, the gateway writes the logs locally. This feature improves the performance and reliability of logging and reduces the network traffic and disk space consumption. You can enable this feature on the SmartConsole -> Gateways & Servers -> Logs -> Dynamic Log Distribution1.
The other options are incorrect because they do not describe the dynamic log distribution feature. Option B is wrong because the Management High Availability does not store the logs
dynamically on the member with the most available disk space, but rather synchronizes the logs between the members using the cpd process2. Option C is wrong because the dynamic log distribution feature does not synchronize the logs between the primary and secondary management server, but rather distributes the logs between the Log Servers. Option D is wrong because the dynamic log distribution feature does not save disk space in case of a firewall cluster, but rather distributes the logs between the Log Servers. The firewall cluster members do not store local logs, but rather send them to the Log Servers3.
A
Explanation:
https://resources.checkpoint.com/datasheet/certified-security-expert-ccse-r8120-course-overview
Dynamic log distribution is a feature that allows you to configure the Security Gateway to distribute logs between multiple active Log Servers to support a better rate of Logs and Log Servers redundancy. This means that each log is sent to only one Log Server and the load is balanced between the primary Log Servers. If all the primary Log Servers are disconnected, the logs are distributed between the backup Log Servers. If no Log Servers are connected, the gateway writes the logs locally. This feature improves the performance and reliability of logging and reduces the network traffic and disk space consumption. You can enable this feature on the SmartConsole -> Gateways & Servers -> Logs -> Dynamic Log Distribution1.
The other options are incorrect because they do not describe the dynamic log distribution feature. Option B is wrong because the Management High Availability does not store the logs
dynamically on the member with the most available disk space, but rather synchronizes the logs between the members using the cpd process2. Option C is wrong because the dynamic log distribution feature does not synchronize the logs between the primary and secondary management server, but rather distributes the logs between the Log Servers. Option D is wrong because the dynamic log distribution feature does not save disk space in case of a firewall cluster, but rather distributes the logs between the Log Servers. The firewall cluster members do not store local logs, but rather send them to the Log Servers3.
Question #502
If the Active Security Management Server fails or if it becomes necessary to change the Active to Standby, the following steps must be taken to prevent data loss. Providing the Active Security Management Server is responsive, which if these steps should NOT be performed:
- A . Rename the hostname of the Standby member to match exactly the hostname of the Active member.
- B . Change the Standby Security Management Server to Active.
- C . Change the Active Security Management Server to Standby.
- D . Manually synchronize the Active and Standby Security Management Servers.
Correct Answer: A
A
Explanation:
The hostname of the Standby member should not be changed to match the hostname of the Active member, as this would cause a conflict in the network. The correct procedure is to change the hostname of the Active member to a different name, and then change the Standby member to the
original hostname of the Active member1.
Reference: 1: Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 9.
A
Explanation:
The hostname of the Standby member should not be changed to match the hostname of the Active member, as this would cause a conflict in the network. The correct procedure is to change the hostname of the Active member to a different name, and then change the Standby member to the
original hostname of the Active member1.
Reference: 1: Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 9.
Question #503
Which of the following is NOT a method used by Identity Awareness for acquiring identity?
- A . Remote Access
- B . Active Directory Query
- C . Cloud IdP (Identity Provider)
- D . RADIUS
Correct Answer: A
A
Explanation:
Identity Awareness uses various methods to acquire identity information. These methods include: Active Directory Query: Identity Awareness queries Active Directory servers to retrieve user and group information.
Cloud IdP (Identity Provider): Identity Awareness integrates with cloud identity providers such as Microsoft Azure AD, Okta, and Google Workspace.
RADIUS: Identity Awareness can use RADIUS servers to authenticate users.
However, Remote Access is not a method used by Identity Awareness for acquiring identity. Remote Access typically refers to VPN connections, and while Identity Awareness can be used in conjunction with VPNs, it does not directly acquire identity information from remote access connections.
Reference: Check Point Troubleshooting Expert – R81 (CCTE) Reference Materials guides and documents. Check Point Certified Troubleshooting Expert R81.20 – CCTE
Check Point CCTE Certification Sample Questions and Practice Exam
A
Explanation:
Identity Awareness uses various methods to acquire identity information. These methods include: Active Directory Query: Identity Awareness queries Active Directory servers to retrieve user and group information.
Cloud IdP (Identity Provider): Identity Awareness integrates with cloud identity providers such as Microsoft Azure AD, Okta, and Google Workspace.
RADIUS: Identity Awareness can use RADIUS servers to authenticate users.
However, Remote Access is not a method used by Identity Awareness for acquiring identity. Remote Access typically refers to VPN connections, and while Identity Awareness can be used in conjunction with VPNs, it does not directly acquire identity information from remote access connections.
Reference: Check Point Troubleshooting Expert – R81 (CCTE) Reference Materials guides and documents. Check Point Certified Troubleshooting Expert R81.20 – CCTE
Check Point CCTE Certification Sample Questions and Practice Exam
Question #504
In the Check Point Firewall Kernel Module, each Kernel is associated with a key, which specifies the type of traffic applicable to the chain module. For Stateful Mode configuration, chain modules marked with __________________ will not apply.
- A . ffff
- B . 1
- C . 3
- D . 2
Correct Answer: D
D
Explanation:
For Stateful Mode configuration, chain modules marked with 2 will not apply. Stateful Mode configuration is a feature that allows administrators to define how packets are processed by different firewall kernel modules in inbound and outbound directions. Chain modules are firewall kernel modules that perform various security functions, such as VPN, IPS, QoS, etc. Each chain module is associated with a key, which specifies the type of traffic applicable to the chain module. The key can be one of the following values: 0 for all packets, 1 for stateful packets, 2 for stateless packets, and 3 for no match packets. For Stateful Mode configuration, only chain modules with key 0 or 1 will apply, as they handle all packets or stateful packets. Chain modules with key 2 will not apply, as they handle stateless packets, which are not relevant for Stateful Mode configuration.
D
Explanation:
For Stateful Mode configuration, chain modules marked with 2 will not apply. Stateful Mode configuration is a feature that allows administrators to define how packets are processed by different firewall kernel modules in inbound and outbound directions. Chain modules are firewall kernel modules that perform various security functions, such as VPN, IPS, QoS, etc. Each chain module is associated with a key, which specifies the type of traffic applicable to the chain module. The key can be one of the following values: 0 for all packets, 1 for stateful packets, 2 for stateless packets, and 3 for no match packets. For Stateful Mode configuration, only chain modules with key 0 or 1 will apply, as they handle all packets or stateful packets. Chain modules with key 2 will not apply, as they handle stateless packets, which are not relevant for Stateful Mode configuration.
Question #505
You noticed that CPU cores on the Security Gateway are usually 100% utilized and many packets were dropped. You don’t have a budget to perform a hardware upgrade at this time. To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher.
How can you enable them?
- A . fw ctl multik dynamic_dispatching on
- B . fw ctl multik dynamic_dispatching set_mode 9
- C . fw ctl multik set_mode 9
- D . fw ctl multik pq enable
Correct Answer: C
C
Explanation:
To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. You can enable them by using the command fw ctl multik set_mode 9. This command sets the SecureXL mode to 9, which means that Priority Queues are enabled and Dynamic Dispatcher is fully enabled.
Reference: SecureXL Mechanism
C
Explanation:
To optimize drops you decide to use Priority Queues and fully enable Dynamic Dispatcher. You can enable them by using the command fw ctl multik set_mode 9. This command sets the SecureXL mode to 9, which means that Priority Queues are enabled and Dynamic Dispatcher is fully enabled.
Reference: SecureXL Mechanism
Question #506
In which formats can Threat Emulation forensics reports be viewed in?
- A . TXT, XML and CSV
- B . PDF and TXT
- C . PDF, HTML, and XML
- D . PDF and HTML
Correct Answer: C
C
Explanation:
The formats in which Threat Emulation forensics reports can be viewed in are PDF, HTML, and XML. Threat Emulation is a feature that detects and prevents zero-day attacks by emulating files in a sandbox environment and analyzing their behavior. Threat Emulation generates forensics reports that provide detailed information about the emulated files, such as verdict, severity, activity summary, screenshots, network activity, registry activity, file activity, and process activity. These reports can be viewed in PDF, HTML, or XML formats from SmartConsole or SmartView.
C
Explanation:
The formats in which Threat Emulation forensics reports can be viewed in are PDF, HTML, and XML. Threat Emulation is a feature that detects and prevents zero-day attacks by emulating files in a sandbox environment and analyzing their behavior. Threat Emulation generates forensics reports that provide detailed information about the emulated files, such as verdict, severity, activity summary, screenshots, network activity, registry activity, file activity, and process activity. These reports can be viewed in PDF, HTML, or XML formats from SmartConsole or SmartView.
Question #507
What is the recommended number of physical network interfaces in a Mobile Access cluster deployment?
- A . 4 Interfaces C an interface leading to the organization, a second interface leading to the internet, a third interface for synchronization, a fourth interface leading to the Security Management Server.
- B . 3 Interfaces C an interface leading to the organization, a second interface leading to the Internet, a third interface for synchronization.
- C . 1 Interface C an interface leading to the organization and the Internet, and configure for synchronization.
- D . 2 Interfaces C a data interface leading to the organization and the Internet, a second interface for synchronization.
Correct Answer: B
B
Explanation:
According to the Check Point R81 Mobile Access Administration Guide, the recommended number of physical network interfaces in a Mobile Access cluster deployment is three. One interface should be connected to the organization network, one interface should be connected to the Internet, and one interface should be used for synchronization between cluster members. This configuration provides optimal performance and security for Mobile Access traffic.
B
Explanation:
According to the Check Point R81 Mobile Access Administration Guide, the recommended number of physical network interfaces in a Mobile Access cluster deployment is three. One interface should be connected to the organization network, one interface should be connected to the Internet, and one interface should be used for synchronization between cluster members. This configuration provides optimal performance and security for Mobile Access traffic.
Question #508
What solution is multi-queue intended to provide?
- A . Improve the efficiency of traffic handling by SecureXL SNDs
- B . Reduce the confusion for traffic capturing in FW Monitor
- C . Improve the efficiency of CoreXL Kernel Instances
- D . Reduce the performance of network interfaces
Correct Answer: C
C
Explanation:
The solution that multi-queue is intended to provide is to improve the efficiency of CoreXL Kernel Instances. Multi-queue is a feature that allows each CoreXL Kernel Instance to process traffic from multiple interfaces, instead of being bound to a single interface. This improves the load balancing and performance of the Security Gateway, especially when there are high traffic volumes or asymmetric routing1.
Reference: 1: Check Point Software, Getting Started, Multi-Queue.
C
Explanation:
The solution that multi-queue is intended to provide is to improve the efficiency of CoreXL Kernel Instances. Multi-queue is a feature that allows each CoreXL Kernel Instance to process traffic from multiple interfaces, instead of being bound to a single interface. This improves the load balancing and performance of the Security Gateway, especially when there are high traffic volumes or asymmetric routing1.
Reference: 1: Check Point Software, Getting Started, Multi-Queue.
Question #509
How does the Anti-Virus feature of the Threat Prevention policy block traffic from infected websites?
- A . By dropping traffic from websites identified through ThreatCloud Verification and URL Caching
- B . By dropping traffic that is not proven to be from clean websites in the URL Filtering blade
- C . By allowing traffic from websites that are known to run Antivirus Software on servers regularly
- D . By matching logs against ThreatCloud information about the reputation of the website
Correct Answer: D
D
Explanation:
The Anti-Virus feature of the Threat Prevention policy blocks traffic from infected websites by matching logs against ThreatCloud information about the reputation of the website. ThreatCloud is a collaborative network that collects and analyzes threat data from millions of sources worldwide. It assigns a reputation score to each website based on its malicious activity and behavior. If a website has a low reputation score, it is considered infected and blocked by the Anti-Virus blade.
Reference: Training & Certification | Check Point Software, CCSE section
D
Explanation:
The Anti-Virus feature of the Threat Prevention policy blocks traffic from infected websites by matching logs against ThreatCloud information about the reputation of the website. ThreatCloud is a collaborative network that collects and analyzes threat data from millions of sources worldwide. It assigns a reputation score to each website based on its malicious activity and behavior. If a website has a low reputation score, it is considered infected and blocked by the Anti-Virus blade.
Reference: Training & Certification | Check Point Software, CCSE section
Question #510
What Is the difference between Updatable Objects and Dynamic Objects
- A . Dynamic Objects ate maintained automatically by the Threat Cloud. Updatable Objects are created and maintained locally. In both cases there is no need to install policy for the changes to take effect.
- B . Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically.
Dynamic Objects are created and maintained locally For Dynamic Objects there is no need to install policy for the changes to take effect. - C . Updatable Objects is a Threat Cloud Service. The provided Objects are updated automatically. Dynamic Objects are created and maintained locally In both cases there is no need to install policy for the changes to take effect.
- D . Dynamic Objects are maintained automatically by the Threat Cloud. For Dynamic Objects there rs no need to install policy for the changes to take effect. Updatable Objects are created and maintained locally.
Correct Answer: B
B
Explanation:
Updatable Objects are a Threat Cloud Service that provides network objects that represent external services, such as Office 365, AWS, GEO locations, and more. These objects are updated automatically by Check Point and do not require policy installation for the changes to take effect. Dynamic Objects are created and maintained locally by the administrator and can be used to define temporary or changing network objects, such as IP addresses, ports, or ranges. Dynamic Objects also do not require policy installation for the changes to take effect.
Reference: Updatable Objects, Updateable Objects and NAT, R80.20 Updatable Domain Objects and CLI Commands.
B
Explanation:
Updatable Objects are a Threat Cloud Service that provides network objects that represent external services, such as Office 365, AWS, GEO locations, and more. These objects are updated automatically by Check Point and do not require policy installation for the changes to take effect. Dynamic Objects are created and maintained locally by the administrator and can be used to define temporary or changing network objects, such as IP addresses, ports, or ranges. Dynamic Objects also do not require policy installation for the changes to take effect.
Reference: Updatable Objects, Updateable Objects and NAT, R80.20 Updatable Domain Objects and CLI Commands.