Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #521
Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process:
- A . Allow GUI Client and management server to communicate via TCP Port 19001
- B . Allow GUI Client and management server to communicate via TCP Port 18191
- C . Performs database tasks such as creating, deleting, and modifying objects and compiling policy.
- D . Performs database tasks such as creating, deleting, and modifying objects and compiling as well as policy code generation.
Correct Answer: C
Question #521
Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidated management console. It empowers the migration from legacy Client-side logic to Server-side logic. The cpm process:
- A . Allow GUI Client and management server to communicate via TCP Port 19001
- B . Allow GUI Client and management server to communicate via TCP Port 18191
- C . Performs database tasks such as creating, deleting, and modifying objects and compiling policy.
- D . Performs database tasks such as creating, deleting, and modifying objects and compiling as well as policy code generation.
Correct Answer: C
Question #523
After trust has been established between the Check Point components, what is TRUE about name and IP-address changes?
- A . Security Gateway IP-address cannot be changed without re-establishing the trust.
- B . The Security Gateway name cannot be changed in command line without re-establishing trust.
- C . The Security Management Server name cannot be changed in SmartConsole without re-establishing trust.
- D . The Security Management Server IP-address cannot be changed without re-establishing the trust.
Correct Answer: A
A
Explanation:
After trust has been established between the Check Point components, the Security Gateway IP address cannot be changed without re-establishing the trust. This is because the trust is based on the Secure Internal Communication (SIC) mechanism, which uses certificates to authenticate and encrypt the communication. The certificates are issued by the Internal Certificate Authority (ICA) of the Security Management Server / Domain Management Server, and contain the name and IP address of the component. Therefore, if the IP address of a component is changed, the certificate will become invalid and the trust will be lost. To restore the trust, the certificate must be renewed or reissued by the ICA12.
However, there are some exceptions to this rule. The Security Gateway name can be changed in command line without re-establishing trust, as long as the IP address remains the same. This is because the SIC mechanism does not rely on the hostname, but on the IP address and the SIC name (which is usually derived from the hostname, but can be manually changed). The Security Management Server name can be changed in SmartConsole without re-establishing trust, as long as the IP address remains the same. This is because SmartConsole uses a different mechanism to connect to the Security Management Server, which does not depend on the SIC certificate. The Security Management Server IP address can be changed without re-establishing trust, as long as some steps are followed to update the Check Point Registry file on the managed Security Gateways / Cluster Members / VSX Virtual Devices. This is because the Registry file contains the IP address of the ICA, which is used for certificate renewal. If the Registry file is not updated, then the certificate renewal will fail and the trust will be lost3.
Reference: 1: Check Point R81 Security Administration Guide – Check Point Software, page 162 2: Check Point R81 Security Engineering Guide – Check Point Software, page 162 3: How to renew SIC after changing IP Address of Security Management Server – Check Point Software, Solution ID: sk103356
A
Explanation:
After trust has been established between the Check Point components, the Security Gateway IP address cannot be changed without re-establishing the trust. This is because the trust is based on the Secure Internal Communication (SIC) mechanism, which uses certificates to authenticate and encrypt the communication. The certificates are issued by the Internal Certificate Authority (ICA) of the Security Management Server / Domain Management Server, and contain the name and IP address of the component. Therefore, if the IP address of a component is changed, the certificate will become invalid and the trust will be lost. To restore the trust, the certificate must be renewed or reissued by the ICA12.
However, there are some exceptions to this rule. The Security Gateway name can be changed in command line without re-establishing trust, as long as the IP address remains the same. This is because the SIC mechanism does not rely on the hostname, but on the IP address and the SIC name (which is usually derived from the hostname, but can be manually changed). The Security Management Server name can be changed in SmartConsole without re-establishing trust, as long as the IP address remains the same. This is because SmartConsole uses a different mechanism to connect to the Security Management Server, which does not depend on the SIC certificate. The Security Management Server IP address can be changed without re-establishing trust, as long as some steps are followed to update the Check Point Registry file on the managed Security Gateways / Cluster Members / VSX Virtual Devices. This is because the Registry file contains the IP address of the ICA, which is used for certificate renewal. If the Registry file is not updated, then the certificate renewal will fail and the trust will be lost3.
Reference: 1: Check Point R81 Security Administration Guide – Check Point Software, page 162 2: Check Point R81 Security Engineering Guide – Check Point Software, page 162 3: How to renew SIC after changing IP Address of Security Management Server – Check Point Software, Solution ID: sk103356
Question #524
Post-Automatic/Manual NAT rules
- A . 1,2,3,4
- B . 1,4,2,3
- C . 3,1,2,4
- D . 4,3,1,2
Correct Answer: A
A
Explanation:
NAT rules are prioritized in the following order:
Automatic Static NAT: This is the highest priority NAT rule and it translates the source or destination IP address to a different IP address without changing the port number. It is configured in the network object properties.
Automatic Hide NAT: This is the second highest priority NAT rule and it translates the source IP address and port number to a different IP address and port number. It is configured in the network object properties.
Manual/Pre-Automatic NAT: This is the third highest priority NAT rule and it allows you to create custom NAT rules that are not possible with automatic NAT. It is configured in the NAT policy rulebase before the automatic NAT rules.
Post-Automatic/Manual NAT rules: This is the lowest priority NAT rule and it allows you to create custom NAT rules that are not possible with automatic NAT. It is configured in the NAT policy rulebase after the automatic NAT rules.
A
Explanation:
NAT rules are prioritized in the following order:
Automatic Static NAT: This is the highest priority NAT rule and it translates the source or destination IP address to a different IP address without changing the port number. It is configured in the network object properties.
Automatic Hide NAT: This is the second highest priority NAT rule and it translates the source IP address and port number to a different IP address and port number. It is configured in the network object properties.
Manual/Pre-Automatic NAT: This is the third highest priority NAT rule and it allows you to create custom NAT rules that are not possible with automatic NAT. It is configured in the NAT policy rulebase before the automatic NAT rules.
Post-Automatic/Manual NAT rules: This is the lowest priority NAT rule and it allows you to create custom NAT rules that are not possible with automatic NAT. It is configured in the NAT policy rulebase after the automatic NAT rules.
Question #525
Which directory below contains log files?
- A . /opt/CPSmartlog-R81/log
- B . /opt/CPshrd-R81/log
- C . /opt/CPsuite-R81/fw1/log
- D . /opt/CPsuite-R81/log
Correct Answer: C
C
Explanation:
The directory /opt/CPsuite-R81/fw1/log contains the log files for the Security Gateway, such as firewall, VPN, IPS, and anti-virus logs1. These log files can be viewed and analyzed using SmartConsole or SmartView2. The other directories are not correct because:
A) The directory /opt/CPSmartlog-R81/log contains the log files for the SmartLog server, which is a separate component that indexes and searches the logs from multiple Security Gateways3.
B) The directory /opt/CPshrd-R81/log contains the log files for the shared components of the Check Point suite, such as cpwd, cpca, cpd, and cpwatchdog4.
D) The directory /opt/CPsuite-R81/log does not exist by default and is not used for logging purposes.
Reference: Logging and Monitoring R81 Administration Guide, SmartConsole R81 Help, SmartLog R81 Help, Check Point Processes and Daemons
C
Explanation:
The directory /opt/CPsuite-R81/fw1/log contains the log files for the Security Gateway, such as firewall, VPN, IPS, and anti-virus logs1. These log files can be viewed and analyzed using SmartConsole or SmartView2. The other directories are not correct because:
A) The directory /opt/CPSmartlog-R81/log contains the log files for the SmartLog server, which is a separate component that indexes and searches the logs from multiple Security Gateways3.
B) The directory /opt/CPshrd-R81/log contains the log files for the shared components of the Check Point suite, such as cpwd, cpca, cpd, and cpwatchdog4.
D) The directory /opt/CPsuite-R81/log does not exist by default and is not used for logging purposes.
Reference: Logging and Monitoring R81 Administration Guide, SmartConsole R81 Help, SmartLog R81 Help, Check Point Processes and Daemons
Question #526
In order to get info about assignment (FW, SND) of all CPUs in your SGW, what is the most accurate CLI command?
- A . fw ctl sdstat
- B . fw ctl affinity Cl Ca Cr Cv
- C . fw ctl multik stat
- D . cpinfo
Correct Answer: B
B
Explanation:
The fw ctl affinity -l -a -r -v command is the most accurate CLI command to get info about assignment (FW, SND) of all CPUs in your SGW. This command displays the affinity settings of all interfaces and processes in a verbose mode, including the Firewall (FW) and Secure Network Distributor (SND) instances.
Reference: CoreXL Administration Guide
B
Explanation:
The fw ctl affinity -l -a -r -v command is the most accurate CLI command to get info about assignment (FW, SND) of all CPUs in your SGW. This command displays the affinity settings of all interfaces and processes in a verbose mode, including the Firewall (FW) and Secure Network Distributor (SND) instances.
Reference: CoreXL Administration Guide
Question #527
During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:
- A . Dropped without sending a negative acknowledgment
- B . Dropped without logs and without sending a negative acknowledgment
- C . Dropped with negative acknowledgment
- D . Dropped with logs and without sending a negative acknowledgment
Correct Answer: D
D
Explanation:
For packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are dropped with logs and without sending a negative acknowledgment. Firewall Kernel Inspection is the process of applying security policies and rules to network traffic by the Firewall kernel module. If a packet does not match any rule or matches a rule with an action of Drop or Reject, the packet is dropped by the Firewall kernel module. The difference between Drop and Reject is that Drop silently discards the packet without informing the sender, while Reject discards the packet and sends a negative acknowledgment (such as an ICMP message) to the sender. However, both Drop and Reject actions generate logs that record the details of the dropped packets, such as source, destination, protocol, port, rule number, etc. The other options are either incorrect or describe different scenarios.
D
Explanation:
For packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are dropped with logs and without sending a negative acknowledgment. Firewall Kernel Inspection is the process of applying security policies and rules to network traffic by the Firewall kernel module. If a packet does not match any rule or matches a rule with an action of Drop or Reject, the packet is dropped by the Firewall kernel module. The difference between Drop and Reject is that Drop silently discards the packet without informing the sender, while Reject discards the packet and sends a negative acknowledgment (such as an ICMP message) to the sender. However, both Drop and Reject actions generate logs that record the details of the dropped packets, such as source, destination, protocol, port, rule number, etc. The other options are either incorrect or describe different scenarios.
Question #528
What information is NOT collected from a Security Gateway in a Cpinfo?
- A . Firewall logs
- B . Configuration and database files
- C . System message logs
- D . OS and network statistics
Correct Answer: A
A
Explanation:
In a Cpinfo (Checkpoint information) command, various information is collected from a Security Gateway. However, firewall logs are NOT collected from a Security Gateway in a Cpinfo.
A) Firewall logs
The Cpinfo command typically collects information such as configuration and database files, system message logs, OS and network statistics, but it does not include firewall logs. Firewall logs are usually obtained separately using other methods or tools.
Reference: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on Cpinfo.
A
Explanation:
In a Cpinfo (Checkpoint information) command, various information is collected from a Security Gateway. However, firewall logs are NOT collected from a Security Gateway in a Cpinfo.
A) Firewall logs
The Cpinfo command typically collects information such as configuration and database files, system message logs, OS and network statistics, but it does not include firewall logs. Firewall logs are usually obtained separately using other methods or tools.
Reference: Check Point Certified Security Expert R81 Study Guide, Check Point documentation on Cpinfo.
Question #529
Fill in the blank: The R81 utility fw monitor is used to troubleshoot ______________________.
- A . User data base corruption
- B . LDAP conflicts
- C . Traffic issues
- D . Phase two key negotiations
Correct Answer: C
C
Explanation:
Check Point’s FW Monitor is a powerful built-in tool for capturing network traffic at the packet level. The FW Monitor utility captures network packets at multiple capture points along the FireWall inspection chains. These captured packets can be inspected later using the WireShark.
C
Explanation:
Check Point’s FW Monitor is a powerful built-in tool for capturing network traffic at the packet level. The FW Monitor utility captures network packets at multiple capture points along the FireWall inspection chains. These captured packets can be inspected later using the WireShark.
Question #530
What level of CPU load on a Secure Network Distributor would indicate that another may be necessary?
- A . Idle <20%
- B . USR <20%
- C . SYS <20%
- D . Wait <20%
Correct Answer: A
A
Explanation:
The CPU load on a Secure Network Distributor (SND) indicates how much processing power is available for distributing traffic among cluster members. If the CPU load is high, it means that the SND is overloaded and cannot handle more traffic efficiently. A good indicator of SND overload is when the Idle CPU percentage is less than 20%. In this case, you may need to add another SND to balance the load or optimize your cluster configuration.
Reference: Getting Started – Check Point Software, section “Monitoring ClusterXL Status”
A
Explanation:
The CPU load on a Secure Network Distributor (SND) indicates how much processing power is available for distributing traffic among cluster members. If the CPU load is high, it means that the SND is overloaded and cannot handle more traffic efficiently. A good indicator of SND overload is when the Idle CPU percentage is less than 20%. In this case, you may need to add another SND to balance the load or optimize your cluster configuration.
Reference: Getting Started – Check Point Software, section “Monitoring ClusterXL Status”