Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #531
What component of R81 Management is used for indexing?
- A . DBSync
- B . API Server
- C . fwm
- D . SOLR
Correct Answer: D
D
Explanation:
The component of R81 Management that is used for indexing is SOLR. SOLR is an open-source enterprise search platform that provides fast and scalable indexing and searching capabilities. SOLR is used by SmartConsole to index the objects and rules in the security policy, as well as the logs and events in SmartLog and SmartEvent. SOLR enables quick and easy access to the relevant information in the management database.
Reference: Check Point Security Expert R81 Course, SOLR Troubleshooting
D
Explanation:
The component of R81 Management that is used for indexing is SOLR. SOLR is an open-source enterprise search platform that provides fast and scalable indexing and searching capabilities. SOLR is used by SmartConsole to index the objects and rules in the security policy, as well as the logs and events in SmartLog and SmartEvent. SOLR enables quick and easy access to the relevant information in the management database.
Reference: Check Point Security Expert R81 Course, SOLR Troubleshooting
Question #532
Which blades and or features are not supported in R81?
- A . SmartEvent Maps
- B . SmartEvent
- C . Identity Awareness
- D . SmartConsole Toolbars
Correct Answer: A
A
Explanation:
According to the Check Point website, SmartEvent Maps is a feature that was supported in previous versions of SmartEvent, but is not supported in R81. SmartEvent Maps displayed a graphical representation of security events on a world map. The other options are either supported or not valid features in R81.
Reference: SmartEvent Maps
A
Explanation:
According to the Check Point website, SmartEvent Maps is a feature that was supported in previous versions of SmartEvent, but is not supported in R81. SmartEvent Maps displayed a graphical representation of security events on a world map. The other options are either supported or not valid features in R81.
Reference: SmartEvent Maps
Question #533
Which of the following is NOT an internal/native Check Point command?
- A . fwaccel on
- B . fw ct1 debug
- C . tcpdump
- D . cphaprob
Correct Answer: C
C
Explanation:
The command tcpdump is not an internal/native Check Point command. It is a common command-line tool that captures and analyzes network traffic. The other commands are internal/native Check Point commands that perform various functions. For example: fwaccel on enables SecureXL acceleration on the Security Gateway.
fw ctl debug sets the debug flags for the Firewall kernel module.
cphaprob displays the status and information about ClusterXL or VRRP members.
Reference: Check Point R81 CLI Reference Guide, pages 11, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27; Check Point R81 Gaia Administration Guide, page 9
C
Explanation:
The command tcpdump is not an internal/native Check Point command. It is a common command-line tool that captures and analyzes network traffic. The other commands are internal/native Check Point commands that perform various functions. For example: fwaccel on enables SecureXL acceleration on the Security Gateway.
fw ctl debug sets the debug flags for the Firewall kernel module.
cphaprob displays the status and information about ClusterXL or VRRP members.
Reference: Check Point R81 CLI Reference Guide, pages 11, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27; Check Point R81 Gaia Administration Guide, page 9
Question #534
Which one of the following is NOT a configurable Compliance Regulation?
- A . GLBA
- B . CJIS
- C . SOCI
- D . NCIPA
Correct Answer: C
Question #535
SandBlast agent extends 0 day prevention to what part of the network?
- A . Web Browsers and user devices
- B . DMZ server
- C . Cloud
- D . Email servers
Correct Answer: A
A
Explanation:
SandBlast agent extends zero-day prevention to web browsers and user devices. Zero-day prevention is a capability that protects devices from unknown and emerging threats that exploit vulnerabilities that have not been patched or disclosed. SandBlast Agent provides zero-day prevention by using various technologies such as threat emulation, threat extraction, anti-exploitation, anti-ransomware, and behavioral analysis. SandBlast Agent protects web browsers and user devices from malicious downloads, phishing links, drive-by downloads, browser exploits, malicious scripts, and more.
A
Explanation:
SandBlast agent extends zero-day prevention to web browsers and user devices. Zero-day prevention is a capability that protects devices from unknown and emerging threats that exploit vulnerabilities that have not been patched or disclosed. SandBlast Agent provides zero-day prevention by using various technologies such as threat emulation, threat extraction, anti-exploitation, anti-ransomware, and behavioral analysis. SandBlast Agent protects web browsers and user devices from malicious downloads, phishing links, drive-by downloads, browser exploits, malicious scripts, and more.
Question #536
In what way are SSL VPN and IPSec VPN different?
- A . SSL VPN is using HTTPS in addition to IKE, whereas IPSec VPN is clientless
- B . SSL VPN adds an extra VPN header to the packet, IPSec VPN does not
- C . IPSec VPN does not support two factor authentication, SSL VPN does support this
- D . IPSec VPN uses an additional virtual adapter; SSL VPN uses the client network adapter only.
Correct Answer: D
D
Explanation:
The way SSL VPN and IPSec VPN are different is that IPSec VPN uses an additional virtual adapter; SSL VPN uses the client network adapter only. SSL VPN and IPSec VPN are two types of VPN technologies that provide secure remote access to network resources over the internet. SSL VPN uses SSL/TLS protocol to establish an encrypted tunnel between the client and the server, and does not require any additional software or hardware on the client side. IPSec VPN uses IPSec protocol to establish an encrypted tunnel between the client and the server, and requires a dedicated virtual adapter on the client side to handle the IPSec traffic. The other options are either incorrect or not relevant to SSL VPN and IPSec VPN.
D
Explanation:
The way SSL VPN and IPSec VPN are different is that IPSec VPN uses an additional virtual adapter; SSL VPN uses the client network adapter only. SSL VPN and IPSec VPN are two types of VPN technologies that provide secure remote access to network resources over the internet. SSL VPN uses SSL/TLS protocol to establish an encrypted tunnel between the client and the server, and does not require any additional software or hardware on the client side. IPSec VPN uses IPSec protocol to establish an encrypted tunnel between the client and the server, and requires a dedicated virtual adapter on the client side to handle the IPSec traffic. The other options are either incorrect or not relevant to SSL VPN and IPSec VPN.
Question #537
Which is NOT a SmartEvent component?
- A . SmartEvent Server
- B . Correlation Unit
- C . Log Consolidator
- D . Log Server
Correct Answer: C
C
Explanation:
Log Consolidator is NOT a SmartEvent component. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules. Log Consolidator is not a valid component or blade of SmartEvent.
C
Explanation:
Log Consolidator is NOT a SmartEvent component. SmartEvent is a unified security event management solution that provides visibility, analysis, and reporting of security events across multiple Check Point products. SmartEvent consists of three main components: SmartEvent Server, Correlation Unit, and Log Server. SmartEvent Server is responsible for storing and displaying security events in SmartConsole and SmartEventWeb. Correlation Unit is responsible for collecting and correlating logs from various sources and generating security events based on predefined or custom scenarios. Log Server is responsible for receiving and indexing logs from Security Gateways and other Check Point modules. Log Consolidator is not a valid component or blade of SmartEvent.
Question #538
According to the policy installation flow the transfer state (CPTA) is responsible for the code generated by the FWM. On the Security Gateway side a process receives them and first stores them Into a temporary directory.
Which process is true for receiving these Tiles;
- A . FWD
- B . CPD
- C . FWM
- D . RAD
Correct Answer: A
A
Explanation:
FWD is a process that runs on both Security Management Server and Security Gateway. On Security Management Server, FWD handles logging and communication with SmartConsole. On Security Gateway, FWD receives policy files from FWM (the policy compiler process on Security Management Server) and stores them in a temporary directory before installing them on the firewall kernel7. Therefore, FWD is responsible for receiving policy files from FWM on Security Gateway side. The correct answer is A.
Reference: 7: Check Point Processes and Daemons
A
Explanation:
FWD is a process that runs on both Security Management Server and Security Gateway. On Security Management Server, FWD handles logging and communication with SmartConsole. On Security Gateway, FWD receives policy files from FWM (the policy compiler process on Security Management Server) and stores them in a temporary directory before installing them on the firewall kernel7. Therefore, FWD is responsible for receiving policy files from FWM on Security Gateway side. The correct answer is A.
Reference: 7: Check Point Processes and Daemons
Question #539
Why is a Central License the preferred and recommended method of licensing?
- A . Central Licensing actually not supported with Gaia.
- B . Central Licensing is the only option when deploying Gala.
- C . Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed.
- D . Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.
Correct Answer: D
D
Explanation:
Central Licensing is the preferred and recommended method of licensing because it simplifies the license management process and reduces the risk of license issues. Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. This means that you can easily add, remove, or replace gateways without affecting your license status. Central Licensing also allows you to view and manage all your licenses from one central location using SmartConsole or SmartUpdate. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and cannot be changed to any gateway if needed.
Reference: Check Point R81 Licensing and Contract Administration Guide, page 7
D
Explanation:
Central Licensing is the preferred and recommended method of licensing because it simplifies the license management process and reduces the risk of license issues. Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. This means that you can easily add, remove, or replace gateways without affecting your license status. Central Licensing also allows you to view and manage all your licenses from one central location using SmartConsole or SmartUpdate. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and cannot be changed to any gateway if needed.
Reference: Check Point R81 Licensing and Contract Administration Guide, page 7
Question #539
Why is a Central License the preferred and recommended method of licensing?
- A . Central Licensing actually not supported with Gaia.
- B . Central Licensing is the only option when deploying Gala.
- C . Central Licensing ties to the IP address of a gateway and can be changed to any gateway if needed.
- D . Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes.
Correct Answer: D
D
Explanation:
Central Licensing is the preferred and recommended method of licensing because it simplifies the license management process and reduces the risk of license issues. Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. This means that you can easily add, remove, or replace gateways without affecting your license status. Central Licensing also allows you to view and manage all your licenses from one central location using SmartConsole or SmartUpdate. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and cannot be changed to any gateway if needed.
Reference: Check Point R81 Licensing and Contract Administration Guide, page 7
D
Explanation:
Central Licensing is the preferred and recommended method of licensing because it simplifies the license management process and reduces the risk of license issues. Central Licensing ties to the IP address of the management server and is not dependent on the IP of any gateway in the event it changes. This means that you can easily add, remove, or replace gateways without affecting your license status. Central Licensing also allows you to view and manage all your licenses from one central location using SmartConsole or SmartUpdate. Central Licensing is supported with Gaia and is not the only option when deploying Gaia. Central Licensing does not tie to the IP address of a gateway and cannot be changed to any gateway if needed.
Reference: Check Point R81 Licensing and Contract Administration Guide, page 7