Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #551
Which of the following statements about Site-to-Site VPN Domain-based is NOT true?
- A . Domain-based- VPN domains are pre-defined for all VPN Gateways.
When the Security Gateway encounters traffic originating from one VPN Domain with the destination to a VPN Domain of another VPN Gateway, that traffic is identified as VPN traffic and is sent through the VPN Tunnel between the two Gateways. - B . Route-based- The Security Gateways will have a Virtual Tunnel Interface (VTI) for each VPN Tunnel with a peer VPN Gateway. The Routing Table can have routes to
forward traffic to these VTIs. Any traffic routed through a VTI is automatically identified as VPN Traffic and is passed through the VPN Tunnel associated with the VTI. - C . Domain-based- VPN domains are pre-defined for all VPN Gateways.
A VPN domain is a service or user that can send or receive VPN traffic through a VPN Gateway. - D . Domain-based- VPN domains are pre-defined for all VPN Gateways. A VPN domain is a host or network that can send or receive VPN traffic through a VPN Gateway.
Correct Answer: C
C
Explanation:
The statement that is not true about site-to-site VPN domain-based is that a VPN domain is a service or user that can send or receive VPN traffic through a VPN gateway. A VPN domain is a host or network that can send or receive VPN traffic through a VPN gateway, not a service or user. A service or user can be part of a VPN community, which defines the encryption and authentication methods for the VPN traffic.
Reference: [Check Point Security Expert R81 Administration Guide], page 146.
C
Explanation:
The statement that is not true about site-to-site VPN domain-based is that a VPN domain is a service or user that can send or receive VPN traffic through a VPN gateway. A VPN domain is a host or network that can send or receive VPN traffic through a VPN gateway, not a service or user. A service or user can be part of a VPN community, which defines the encryption and authentication methods for the VPN traffic.
Reference: [Check Point Security Expert R81 Administration Guide], page 146.
Question #552
If a “ping”-packet is dropped by FW1 Policy Con how many inspection Points do you see this packet in “fw monitor”?
- A . “i", “l” and “o”
- B . I don’t see it in fw monitor
- C . “i" only
- D . “i" and “l”
Correct Answer: C
C
Explanation:
If a “ping”-packet is dropped by FW1 Policy, you will see this packet in “fw monitor” on one inspection point only: “i”. The “i” inspection point represents the inbound traffic before any rule processing. Since the packet is dropped by FW1 Policy, it will not pass through any other inspection points, such as “l” (after rule processing), “o” (outbound before rule processing), or “O” (outbound after rule processing).
Reference: Check Point Software, Getting Started, fw monitor.
C
Explanation:
If a “ping”-packet is dropped by FW1 Policy, you will see this packet in “fw monitor” on one inspection point only: “i”. The “i” inspection point represents the inbound traffic before any rule processing. Since the packet is dropped by FW1 Policy, it will not pass through any other inspection points, such as “l” (after rule processing), “o” (outbound before rule processing), or “O” (outbound after rule processing).
Reference: Check Point Software, Getting Started, fw monitor.
Question #553
What is UserCheck?
- A . Messaging tool used to verify a user’s credentials.
- B . Communication tool used to inform a user about a website or application they are trying to access.
- C . Administrator tool used to monitor users on their network.
- D . Communication tool used to notify an administrator when a new user is created.
Correct Answer: B
B
Explanation:
UserCheck is a communication tool used to inform a user about a website or application they are trying to access. UserCheck allows administrators to interact with users in real time, informing them of the security policy and the actions they need to take. UserCheck can also enable users to self-remediate incidents or request exceptions from the administrator.
Reference: Training & Certification | Check Point Software, Check Point Resource Library
B
Explanation:
UserCheck is a communication tool used to inform a user about a website or application they are trying to access. UserCheck allows administrators to interact with users in real time, informing them of the security policy and the actions they need to take. UserCheck can also enable users to self-remediate incidents or request exceptions from the administrator.
Reference: Training & Certification | Check Point Software, Check Point Resource Library
Question #554
Fill in the blank: The R81 SmartConsole, SmartEvent GUI client, and _______ consolidate billions of
logs and shows then as prioritized security events.
- A . SmartMonitor
- B . SmartView Web Application
- C . SmartReporter
- D . SmartTracker
Correct Answer: B
B
Explanation:
The R81 SmartConsole, SmartEvent GUI client, and SmartView Web Application consolidate billions of logs and show them as prioritized security events. The SmartView Web Application is a web-based interface that allows you to access the SmartEvent Server from any browser. You can use the SmartView Web Application to view and analyze security events, generate reports, and configure SmartEvent settings12.
Reference: 1: Check Point R81 SmartConsole User Guide – Check Point Software, page 10 2: Check Point R81 SmartEvent Administration Guide – Check Point Software, page 9
B
Explanation:
The R81 SmartConsole, SmartEvent GUI client, and SmartView Web Application consolidate billions of logs and show them as prioritized security events. The SmartView Web Application is a web-based interface that allows you to access the SmartEvent Server from any browser. You can use the SmartView Web Application to view and analyze security events, generate reports, and configure SmartEvent settings12.
Reference: 1: Check Point R81 SmartConsole User Guide – Check Point Software, page 10 2: Check Point R81 SmartEvent Administration Guide – Check Point Software, page 9
Question #555
The CPD daemon is a Firewall Kernel Process that does NOT do which of the following?
- A . Secure Internal Communication (SIC)
- B . Restart Daemons if they fail
- C . Transfers messages between Firewall processes
- D . Pulls application monitoring status
Correct Answer: D
D
Explanation:
The CPD daemon is a Firewall Kernel Process that does not pull application monitoring status. The CPD daemon is responsible for Secure Internal Communication (SIC), restarting daemons if they fail, transferring messages between Firewall processes, and managing policy installation.
Reference: CPD process
D
Explanation:
The CPD daemon is a Firewall Kernel Process that does not pull application monitoring status. The CPD daemon is responsible for Secure Internal Communication (SIC), restarting daemons if they fail, transferring messages between Firewall processes, and managing policy installation.
Reference: CPD process
Question #556
Which firewall daemon is responsible for the FW CLI commands?
- A . fwd
- B . fwm
- C . cpm
- D . cpd
Correct Answer: A
A
Explanation:
Which firewall daemon is responsible for the FW CLI commands? The firewall daemon that is responsible for the FW CLI commands is fwd. This daemon handles the communication between the firewall kernel and the user space processes, such as SmartConsole, SmartView Tracker, etc. The FW CLI commands are used to control and monitor various aspects of the firewall, such as connections, policy installation, logs, NAT, etc. The FW CLI commands are executed with the prefix fw, such as fw stat, fw tab, fw monitor, etc.
Reference: R81 Command Line Interface Reference Guide, page 13.
A
Explanation:
Which firewall daemon is responsible for the FW CLI commands? The firewall daemon that is responsible for the FW CLI commands is fwd. This daemon handles the communication between the firewall kernel and the user space processes, such as SmartConsole, SmartView Tracker, etc. The FW CLI commands are used to control and monitor various aspects of the firewall, such as connections, policy installation, logs, NAT, etc. The FW CLI commands are executed with the prefix fw, such as fw stat, fw tab, fw monitor, etc.
Reference: R81 Command Line Interface Reference Guide, page 13.
Question #557
What is the default shell for the command line interface?
- A . Expert
- B . Clish
- C . Admin
- D . Normal
Correct Answer: B
B
Explanation:
What is the default shell for the command line interface? The default shell for the command line interface is Clish. Clish is a shell that provides a menu-based interface for configuring various system settings, such as network interfaces, routing, DNS, NTP, SNMP, SSH, etc. Clish also provides help and completion features for easier navigation. To switch from Clish to Expert mode, which allows running Linux commands, use the command expert.
Reference: Gaia Administration Guide R81, page 29.
B
Explanation:
What is the default shell for the command line interface? The default shell for the command line interface is Clish. Clish is a shell that provides a menu-based interface for configuring various system settings, such as network interfaces, routing, DNS, NTP, SNMP, SSH, etc. Clish also provides help and completion features for easier navigation. To switch from Clish to Expert mode, which allows running Linux commands, use the command expert.
Reference: Gaia Administration Guide R81, page 29.
Question #558
Which command shows actual allowed connections in state table?
- A . fw tab Ct StateTable
- B . fw tab Ct connections
- C . fw tab Ct connection
- D . fw tab connections
Correct Answer: B
B
Explanation:
The correct command to show actual allowed connections in the state table is option B: fw tab Ct connections. This command displays the contents of the "connections" table, which contains information about the active connections being tracked by the firewall.
Option A (fw tab Ct StateTable) is incorrect as there is no "StateTable" table; it should be "connections."
Option C (fw tab Ct connection) is also incorrect, as it should be "connections."
Option D (fw tab connections) is not the correct syntax for the command.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
B
Explanation:
The correct command to show actual allowed connections in the state table is option B: fw tab Ct connections. This command displays the contents of the "connections" table, which contains information about the active connections being tracked by the firewall.
Option A (fw tab Ct StateTable) is incorrect as there is no "StateTable" table; it should be "connections."
Option C (fw tab Ct connection) is also incorrect, as it should be "connections."
Option D (fw tab connections) is not the correct syntax for the command.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #559
Which of the following authentication methods ARE NOT used for Mobile Access?
- A . RADIUS server
- B . Username and password (internal, LDAP)
- C . SecurID
- D . TACACS+
Correct Answer: D
D
Explanation:
TACACS+ is not an authentication method that is used for Mobile Access. Mobile Access supports the following authentication methods: username and password (internal, LDAP, or RADIUS), certificate, SecurID, DynamicID, and SMS2. TACACS+ is a protocol that provides access control for routers, network access servers, and other network devices, but it is not supported by Mobile Access3.
Reference: Check Point R81 Mobile Access Administration Guide, TACACS+ – Wikipedia
D
Explanation:
TACACS+ is not an authentication method that is used for Mobile Access. Mobile Access supports the following authentication methods: username and password (internal, LDAP, or RADIUS), certificate, SecurID, DynamicID, and SMS2. TACACS+ is a protocol that provides access control for routers, network access servers, and other network devices, but it is not supported by Mobile Access3.
Reference: Check Point R81 Mobile Access Administration Guide, TACACS+ – Wikipedia
Question #560
Mobile Access Gateway can be configured as a reverse proxy for Internal Web Applications Reverse proxy users browse to a URL that is resolved to the Security Gateway IP address.
Which of the following Check Point command is true for enabling the Reverse Proxy:
- A . ReverseCLIProxy
- B . ReverseProxyCLI
- C . ReverseProxy
- D . ProxyReverseCLI
Correct Answer: C
C
Explanation:
Mobile Access Gateway can be configured as a reverse proxy for internal web applications. Reverse proxy users browse to a URL that is resolved to the Security Gateway IP address. The Security Gateway then forwards the requests to the internal web servers and returns the responses to the users. To enable reverse proxy mode on the Mobile Access Gateway, the administrator needs to run the ReverseProxy command on the command line interface of the Security Gateway5. Therefore, the correct answer is C.
Reference: 5: Reverse Proxy Mode
C
Explanation:
Mobile Access Gateway can be configured as a reverse proxy for internal web applications. Reverse proxy users browse to a URL that is resolved to the Security Gateway IP address. The Security Gateway then forwards the requests to the internal web servers and returns the responses to the users. To enable reverse proxy mode on the Mobile Access Gateway, the administrator needs to run the ReverseProxy command on the command line interface of the Security Gateway5. Therefore, the correct answer is C.
Reference: 5: Reverse Proxy Mode