Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #511
The ____ software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.
- A . Next Generation Threat Prevention
- B . Next Generation Threat Emulation
- C . Next Generation Threat Extraction
- D . Next Generation Firewall
Correct Answer: B
B
Explanation:
The software blade package that uses CPU-level and OS-level sandboxing in order to detect and block malware is the Next Generation Threat Emulation. This package is part of the Check Point SandBlast Zero-Day Protection solution, which protects organizations against unknown malware, zero-day threats and targeted attacks, and prevents infections from undiscovered exploits1.
CPU-level and OS-level sandboxing are two techniques that Check Point uses to analyze files and objects for malicious behavior. CPU-level inspection is a unique technology that detects malware at the pre-infection stage by examining the CPU instructions that the file executes. This allows Check Point to identify and block malware that tries to evade detection by using obfuscation, encryption, or polymorphism12.
OS-level sandboxing is a complementary technology that runs files and objects in a virtualized environment and monitors their behavior for malicious indicators. This allows Check Point to detect and block malware that tries to exploit vulnerabilities in the operating system or applications, or that performs malicious actions such as downloading additional payloads, modifying system settings, or communicating with command and control servers12.
Therefore, the correct answer is B) The Next Generation Threat Emulation software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.
Reference: 1, Understanding SandBlast – Check Point Software Technologies
2, HOW TO CHOOSE YOUR NEXT SANDBOXING SOLUTION – Check Point Software
3, CHECK POINT + SERVICENOW
4, Check Point Quantum Edge Datasheet
B
Explanation:
The software blade package that uses CPU-level and OS-level sandboxing in order to detect and block malware is the Next Generation Threat Emulation. This package is part of the Check Point SandBlast Zero-Day Protection solution, which protects organizations against unknown malware, zero-day threats and targeted attacks, and prevents infections from undiscovered exploits1.
CPU-level and OS-level sandboxing are two techniques that Check Point uses to analyze files and objects for malicious behavior. CPU-level inspection is a unique technology that detects malware at the pre-infection stage by examining the CPU instructions that the file executes. This allows Check Point to identify and block malware that tries to evade detection by using obfuscation, encryption, or polymorphism12.
OS-level sandboxing is a complementary technology that runs files and objects in a virtualized environment and monitors their behavior for malicious indicators. This allows Check Point to detect and block malware that tries to exploit vulnerabilities in the operating system or applications, or that performs malicious actions such as downloading additional payloads, modifying system settings, or communicating with command and control servers12.
Therefore, the correct answer is B) The Next Generation Threat Emulation software blade package uses CPU-level and OS-level sandboxing in order to detect and block malware.
Reference: 1, Understanding SandBlast – Check Point Software Technologies
2, HOW TO CHOOSE YOUR NEXT SANDBOXING SOLUTION – Check Point Software
3, CHECK POINT + SERVICENOW
4, Check Point Quantum Edge Datasheet
Question #512
What command would show the API server status?
- A . cpm status
- B . api restart
- C . api status
- D . show api status
Correct Answer: C
C
Explanation:
The command that would show the API server status is api status. API stands for Application Programming Interface, and it is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. API status is a command that shows the current status of the API server, such as whether it is enabled or disabled, running or stopped, listening on which port, using which certificate, etc. The other commands are either invalid or perform different functions.
C
Explanation:
The command that would show the API server status is api status. API stands for Application Programming Interface, and it is a web service that allows external applications to interact with the Check Point management server using standard methods such as HTTP(S) requests and JSON objects. API status is a command that shows the current status of the API server, such as whether it is enabled or disabled, running or stopped, listening on which port, using which certificate, etc. The other commands are either invalid or perform different functions.
Question #513
Which statement is correct about the Sticky Decision Function?
- A . It is not supported with either the Performance pack of a hardware based accelerator card
- B . Does not support SPI’s when configured for Load Sharing
- C . It is automatically disabled if the Mobile Access Software Blade is enabled on the cluster
- D . It is not required L2TP traffic
Correct Answer: A
A
Explanation:
The statement that is correct about the Sticky Decision Function is It is not supported with either the Performance pack of a hardware based accelerator card. The Sticky Decision Function (SDF) is a feature that ensures that packets from the same connection are handled by the same cluster member in a Load Sharing configuration. However, SDF is not compatible with SecureXL acceleration, which is enabled by default or by using a Performance pack or a hardware based accelerator card4. The other statements are either incorrect or outdated about SDF.
Reference: Check Point R81 ClusterXL Administration Guide, Sticky Decision Function – Check Point CheckMates
A
Explanation:
The statement that is correct about the Sticky Decision Function is It is not supported with either the Performance pack of a hardware based accelerator card. The Sticky Decision Function (SDF) is a feature that ensures that packets from the same connection are handled by the same cluster member in a Load Sharing configuration. However, SDF is not compatible with SecureXL acceleration, which is enabled by default or by using a Performance pack or a hardware based accelerator card4. The other statements are either incorrect or outdated about SDF.
Reference: Check Point R81 ClusterXL Administration Guide, Sticky Decision Function – Check Point CheckMates
Question #514
Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane.
Which is NOT an option to adjust or configure?
- A . Severity
- B . Automatic reactions
- C . Policy
- D . Threshold
Correct Answer: C
C
Explanation:
An event is a notification that something significant has occurred on a Check Point product or network. Events are generated by various sources, such as blades, gateways, servers, SmartEvent, etc. You can view and manage events in SmartConsole by using the Events tab in the Logs & Monitor view. Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane.
The configurable properties include:
Severity: The level of importance or urgency of the event. You can change the severity of an event by selecting a different value from the drop-down list.
Automatic reactions: The actions that are triggered when an event occurs. You can add, edit, or delete automatic reactions for an event by clicking on the + icon or the pencil icon.
Threshold: The minimum number or frequency of occurrences of an event that triggers an automatic reaction. You can change the threshold of an event by entering a different value in the text box.
The policy is not an option to adjust or configure for an event. The policy is a set of rules that define how to handle events based on their source, type, severity, etc. You can create and manage policies in SmartEvent by using the Policies tab in the Logs & Monitor view.
Reference: R81 Logging and Monitoring Administration Guide
C
Explanation:
An event is a notification that something significant has occurred on a Check Point product or network. Events are generated by various sources, such as blades, gateways, servers, SmartEvent, etc. You can view and manage events in SmartConsole by using the Events tab in the Logs & Monitor view. Selecting an event displays its configurable properties in the Detail pane and a description of the event in the Description pane.
The configurable properties include:
Severity: The level of importance or urgency of the event. You can change the severity of an event by selecting a different value from the drop-down list.
Automatic reactions: The actions that are triggered when an event occurs. You can add, edit, or delete automatic reactions for an event by clicking on the + icon or the pencil icon.
Threshold: The minimum number or frequency of occurrences of an event that triggers an automatic reaction. You can change the threshold of an event by entering a different value in the text box.
The policy is not an option to adjust or configure for an event. The policy is a set of rules that define how to handle events based on their source, type, severity, etc. You can create and manage policies in SmartEvent by using the Policies tab in the Logs & Monitor view.
Reference: R81 Logging and Monitoring Administration Guide
Question #515
What are the steps to configure the HTTPS Inspection Policy?
- A . Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard
- B . Go to Application&url filtering blade > Advanced > Https Inspection > Policy
- C . Go to Manage&Settings > Blades > HTTPS Inspection > Policy
- D . Go to Application&url filtering blade > Https Inspection > Policy
Correct Answer: A
A
Explanation:
The correct steps to configure the HTTPS Inspection Policy in Check Point R81 are as follows1:
Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard.
Enable HTTPS Inspection and select the Policy tab.
Create a new HTTPS Inspection Layer or edit an existing one.
Define the rules for inspecting HTTPS traffic based on the source, destination, service, and action.
Install the policy on the relevant gateways.
The other options are incorrect because they either use wrong blade names, wrong menu options, or wrong configuration steps.
Reference: 1: LAB:25 How to Configure HTTPS Inspection in Check Point Firewall R81(https://www.youtube.com/watch?v=NCvV7-R9ZgU)
A
Explanation:
The correct steps to configure the HTTPS Inspection Policy in Check Point R81 are as follows1:
Go to Manage&Settings > Blades > HTTPS Inspection > Configure in SmartDashboard.
Enable HTTPS Inspection and select the Policy tab.
Create a new HTTPS Inspection Layer or edit an existing one.
Define the rules for inspecting HTTPS traffic based on the source, destination, service, and action.
Install the policy on the relevant gateways.
The other options are incorrect because they either use wrong blade names, wrong menu options, or wrong configuration steps.
Reference: 1: LAB:25 How to Configure HTTPS Inspection in Check Point Firewall R81(https://www.youtube.com/watch?v=NCvV7-R9ZgU)
Question #516
Using fw monitor you see the following inspection point notion E and i what does that mean?
- A . E shows the packet before the VPN encryption, i after the inbound firewall VM
- B . E shows the packet reaching the external interface, i leaving the internal interface
- C . E shows the packet after the VPN encryption, i before the inbound firewall VM
- D . E shows the packet leaving the external interface, i reaching the internal interface
Correct Answer: C
C
Explanation:
Using fw monitor, the inspection point notation E and i means that E shows the packet after the VPN encryption, and i shows the packet before the inbound firewall VM. E (for example, eth4:E) is the Post-Outbound inspection point, which captures packets after they are encrypted by VPN Outbound. i (for example, eth4:i) is the Pre-Inbound inspection point, which captures packets before they are inspected by the in-bound FireWall VM2.
Reference: Check Point R81 CLI Reference Guide
C
Explanation:
Using fw monitor, the inspection point notation E and i means that E shows the packet after the VPN encryption, and i shows the packet before the inbound firewall VM. E (for example, eth4:E) is the Post-Outbound inspection point, which captures packets after they are encrypted by VPN Outbound. i (for example, eth4:i) is the Pre-Inbound inspection point, which captures packets before they are inspected by the in-bound FireWall VM2.
Reference: Check Point R81 CLI Reference Guide
Question #516
Using fw monitor you see the following inspection point notion E and i what does that mean?
- A . E shows the packet before the VPN encryption, i after the inbound firewall VM
- B . E shows the packet reaching the external interface, i leaving the internal interface
- C . E shows the packet after the VPN encryption, i before the inbound firewall VM
- D . E shows the packet leaving the external interface, i reaching the internal interface
Correct Answer: C
C
Explanation:
Using fw monitor, the inspection point notation E and i means that E shows the packet after the VPN encryption, and i shows the packet before the inbound firewall VM. E (for example, eth4:E) is the Post-Outbound inspection point, which captures packets after they are encrypted by VPN Outbound. i (for example, eth4:i) is the Pre-Inbound inspection point, which captures packets before they are inspected by the in-bound FireWall VM2.
Reference: Check Point R81 CLI Reference Guide
C
Explanation:
Using fw monitor, the inspection point notation E and i means that E shows the packet after the VPN encryption, and i shows the packet before the inbound firewall VM. E (for example, eth4:E) is the Post-Outbound inspection point, which captures packets after they are encrypted by VPN Outbound. i (for example, eth4:i) is the Pre-Inbound inspection point, which captures packets before they are inspected by the in-bound FireWall VM2.
Reference: Check Point R81 CLI Reference Guide
Question #518
What is the valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration?
- A . 1-254
- B . 1-255
- C . 0-254
- D . 0C255
Correct Answer: B
B
Explanation:
The valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration is 1-255. The VRID is a unique number that identifies a virtual router in a VRRP group. It is used to associate routers and their virtual IP addresses. The VRID must be the same for all routers in the same VRRP group.
Reference: [Configuring VRRP on Gaia]
B
Explanation:
The valid range for Virtual Router Identifier (VRID) value in a Virtual Routing Redundancy Protocol (VRRP) configuration is 1-255. The VRID is a unique number that identifies a virtual router in a VRRP group. It is used to associate routers and their virtual IP addresses. The VRID must be the same for all routers in the same VRRP group.
Reference: [Configuring VRRP on Gaia]
Question #519
What ports are used for SmartConsole to connect to the Security Management Server?
- A . CPMI (18190)
- B . ICA_Pull (18210), CPMI (18190) https (443)
- C . CPM (19009), CPMI (18190) https (443)
- D . CPM (19009), CPMI (18190) CPD (18191)
Correct Answer: C
C
Explanation:
The correct answer is C) CPM (19009), CPMI (18190) https (443).
SmartConsole is a client application that connects to the Security Management Server to manage and configure the security policy and objects. SmartConsole uses three ports to communicate with the Security Management Server1:
CPM (19009): This port is used for the communication between the SmartConsole client and the Check Point Management (CPM) process on the Security Management Server. The CPM process handles the database operations and the policy installation.
CPMI (18190): This port is used for the communication between the SmartConsole client and the Check Point Management Interface (CPMI) process on the Security Management Server. The CPMI process handles the authentication and encryption of the SmartConsole sessions.
https (443): This port is used for the communication between the SmartConsole client and the web server on the Security Management Server. The web server provides the SmartConsole GUI and the SmartConsole extensions.
The other options are incorrect because they either include ports that are not used by SmartConsole
or omit ports that are used by SmartConsole.
Reference: SmartConsole R81.20 – Check Point Software1
C
Explanation:
The correct answer is C) CPM (19009), CPMI (18190) https (443).
SmartConsole is a client application that connects to the Security Management Server to manage and configure the security policy and objects. SmartConsole uses three ports to communicate with the Security Management Server1:
CPM (19009): This port is used for the communication between the SmartConsole client and the Check Point Management (CPM) process on the Security Management Server. The CPM process handles the database operations and the policy installation.
CPMI (18190): This port is used for the communication between the SmartConsole client and the Check Point Management Interface (CPMI) process on the Security Management Server. The CPMI process handles the authentication and encryption of the SmartConsole sessions.
https (443): This port is used for the communication between the SmartConsole client and the web server on the Security Management Server. The web server provides the SmartConsole GUI and the SmartConsole extensions.
The other options are incorrect because they either include ports that are not used by SmartConsole
or omit ports that are used by SmartConsole.
Reference: SmartConsole R81.20 – Check Point Software1
Question #520
What CLI command compiles and installs a Security Policy on the target’s Security Gateways?
- A . fwm compile
- B . fwm load
- C . fwm fetch
- D . fwm install
Correct Answer: B
B
Explanation:
The CLI command that compiles and installs a Security Policy on the target’s Security Gateways is fwm load. Fwm stands for FireWall Management, and it is a command that allows administrators to perform various management tasks on the Security Management Server or Multi-Domain Server. Fwm load takes two arguments: the name of the Security Policy and the name or IP address of the target Security Gateway or Gateway Cluster. For example: [Expert@SMS]# fwm load Standard_Policy fw1
This command will compile and install the Standard_Policy on the Security Gateway named fw1. The other commands are either invalid or perform different functions.
B
Explanation:
The CLI command that compiles and installs a Security Policy on the target’s Security Gateways is fwm load. Fwm stands for FireWall Management, and it is a command that allows administrators to perform various management tasks on the Security Management Server or Multi-Domain Server. Fwm load takes two arguments: the name of the Security Policy and the name or IP address of the target Security Gateway or Gateway Cluster. For example: [Expert@SMS]# fwm load Standard_Policy fw1
This command will compile and install the Standard_Policy on the Security Gateway named fw1. The other commands are either invalid or perform different functions.