Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #561
Which TCP-port does CPM process listen to?
- A . 18191
- B . 18190
- C . 8983
- D . 19009
Correct Answer: D
D
Explanation:
The CPM process is the core process of the Security Management Server that handles all management operations. It listens to TCP-port 19009 by default.
Reference: CPM process
D
Explanation:
The CPM process is the core process of the Security Management Server that handles all management operations. It listens to TCP-port 19009 by default.
Reference: CPM process
Question #562
Which of these is an implicit MEP option?
- A . Primary-backup
- B . Source address based
- C . Round robin
- D . Load Sharing
Correct Answer: A
A
Explanation:
Implicit MEP (Multicast Ethernet Point) options refer to the way multicast traffic is handled within a network. In this case, the question is asking about an implicit MEP option, and the correct answer is:
A) Primary-backup: This is an implicit MEP option where one switch (primary) forwards multicast traffic while the other switch (backup) does not forward the traffic. It is used to ensure redundancy in case the primary switch fails.
B) Source address-based,
C. Round-robin, and
D. Load Sharing are not implicit MEP options; they are different methods of handling multicast traffic and do not describe the concept of primary-backup.
Therefore, option A is the correct answer as it represents an implicit MEP option.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
A
Explanation:
Implicit MEP (Multicast Ethernet Point) options refer to the way multicast traffic is handled within a network. In this case, the question is asking about an implicit MEP option, and the correct answer is:
A) Primary-backup: This is an implicit MEP option where one switch (primary) forwards multicast traffic while the other switch (backup) does not forward the traffic. It is used to ensure redundancy in case the primary switch fails.
B) Source address-based,
C. Round-robin, and
D. Load Sharing are not implicit MEP options; they are different methods of handling multicast traffic and do not describe the concept of primary-backup.
Therefore, option A is the correct answer as it represents an implicit MEP option.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #563
When a packet arrives at the gateway, the gateway checks it against the rules in the hop Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet.
Which of the following statements about the order of rule enforcement is true?
- A . If the Action is Accept, the gateway allows the packet to pass through the gateway.
- B . If the Action is Drop, the gateway continues to check rules in the next Policy Layer down.
- C . If the Action is Accept, the gateway continues to check rules in the next Policy Layer down.
- D . If the Action is Drop, the gateway applies the Implicit Clean-up Rule for that Policy Layer.
Correct Answer: C
C
Explanation:
When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches the packet. The order of rule enforcement depends on the action of the matching rule. If the action is Accept, the gateway allows the packet to pass through the gateway, but also continues to check rules in the next Policy Layer down. If the action is Drop, Reject, or Encrypt, the gateway applies that action to the packet and stops checking rules in that Policy Layer and any subsequent Policy Layers. If there is no matching rule in a Policy Layer, the gateway applies the Implicit Clean-up Rule for that Policy Layer, which is usually Drop.
C
Explanation:
When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches the packet. The order of rule enforcement depends on the action of the matching rule. If the action is Accept, the gateway allows the packet to pass through the gateway, but also continues to check rules in the next Policy Layer down. If the action is Drop, Reject, or Encrypt, the gateway applies that action to the packet and stops checking rules in that Policy Layer and any subsequent Policy Layers. If there is no matching rule in a Policy Layer, the gateway applies the Implicit Clean-up Rule for that Policy Layer, which is usually Drop.
Question #564
You need to see which hotfixes are installed on your gateway, which command would you use?
- A . cpinfo Ch all
- B . cpinfo Co hotfix
- C . cpinfo Cl hotfix
- D . cpinfo Cy all
Correct Answer: D
D
Explanation:
The command cpinfo Cy all displays information about all the hotfixes that are installed on the gateway1. This command also shows the hotfix ID, description, installation date, and status for each hotfix2. The other commands are not valid options for this task. The command cpinfo Ch all shows the hardware information of the gateway3. The commands cpinfo Co hotfix and cpinfo Cl hotfix do not exist and will return an error message.
Reference: Hotfix installer – Configuration Manager, How to keep your Security Gateways up to
date, Solved: Does it always need to have the higher hotfix vers…
D
Explanation:
The command cpinfo Cy all displays information about all the hotfixes that are installed on the gateway1. This command also shows the hotfix ID, description, installation date, and status for each hotfix2. The other commands are not valid options for this task. The command cpinfo Ch all shows the hardware information of the gateway3. The commands cpinfo Co hotfix and cpinfo Cl hotfix do not exist and will return an error message.
Reference: Hotfix installer – Configuration Manager, How to keep your Security Gateways up to
date, Solved: Does it always need to have the higher hotfix vers…
Question #565
Which Check Point software blade provides Application Security and identity control?
- A . Identity Awareness
- B . Data Loss Prevention
- C . URL Filtering
- D . Application Control
Correct Answer: D
D
Explanation:
Application Control is the software blade that provides Application Security and identity control. It allows administrators to define granular policies based on users or groups to identify, block or limit the usage of web applications and widgets. Application Control also integrates with Identity Awareness to provide user-level visibility and control.
Reference: Training & Certification | Check Point Software, Check Point Resource Library
D
Explanation:
Application Control is the software blade that provides Application Security and identity control. It allows administrators to define granular policies based on users or groups to identify, block or limit the usage of web applications and widgets. Application Control also integrates with Identity Awareness to provide user-level visibility and control.
Reference: Training & Certification | Check Point Software, Check Point Resource Library
Question #566
What is false regarding prerequisites for the Central Deployment usage?
- A . The administrator must have write permission on SmartUpdate
- B . Security Gateway must have the latest CPUSE Deployment Agent
- C . No need to establish SIC between gateways and the management server, since the CDT tool will take care about SIC automatically.
- D . The Security Gateway must have a policy installed
Correct Answer: C
C
Explanation:
Establishing SIC between gateways and the management server is a prerequisite for Central Deployment usage, as the CDT tool will not take care of this automatically1. The administrator must have write permission on SmartUpdate, the Security Gateway must have the latest CPUSE Deployment Agent, and the Security Gateway must have a policy installed2. These are the basic requirements for using the Central Deployment Tool (CDT), which is a utility that lets you manage a deployment of software packages from your Management Server to the multiple managed Security gateways and cluster members at the same time2. The CDT can perform various actions, such as installation of software packages, taking snapshots, running shell scripts, pushing/pulling files, and automating the RMA backup and restore process2. The CDT is supported on Check Point Appliances with R80.40 and higher versions2.
Reference: How to keep your Security Gateways up to date – Check Point Software, Central Deployment Tool (CDT) – Check Point CheckMates.
C
Explanation:
Establishing SIC between gateways and the management server is a prerequisite for Central Deployment usage, as the CDT tool will not take care of this automatically1. The administrator must have write permission on SmartUpdate, the Security Gateway must have the latest CPUSE Deployment Agent, and the Security Gateway must have a policy installed2. These are the basic requirements for using the Central Deployment Tool (CDT), which is a utility that lets you manage a deployment of software packages from your Management Server to the multiple managed Security gateways and cluster members at the same time2. The CDT can perform various actions, such as installation of software packages, taking snapshots, running shell scripts, pushing/pulling files, and automating the RMA backup and restore process2. The CDT is supported on Check Point Appliances with R80.40 and higher versions2.
Reference: How to keep your Security Gateways up to date – Check Point Software, Central Deployment Tool (CDT) – Check Point CheckMates.
Question #567
In R81, where do you manage your Mobile Access Policy?
- A . Access Control Policy
- B . Through the Mobile Console
- C . Shared Gateways Policy
- D . From the Dedicated Mobility Tab
Correct Answer: B
B
Explanation:
In R81, you manage your Mobile Access Policy from the Mobile Console. The Mobile Console is a separate web-based interface that allows you to configure and monitor Mobile Access features, such as VPN, portal, applications, users, devices, and certificates. The Mobile Console can be accessed from any browser by entering https://<Management_Server_IP>/mobileconsole.
Reference: [Mobile Console]
B
Explanation:
In R81, you manage your Mobile Access Policy from the Mobile Console. The Mobile Console is a separate web-based interface that allows you to configure and monitor Mobile Access features, such as VPN, portal, applications, users, devices, and certificates. The Mobile Console can be accessed from any browser by entering https://<Management_Server_IP>/mobileconsole.
Reference: [Mobile Console]
Question #568
When Dynamic Dispatcher is enabled, connections are assigned dynamically with the exception of:
- A . Threat Emulation
- B . HTTPS
- C . QOS
- D . VoIP
Correct Answer: D
D
Explanation:
When Dynamic Dispatcher is enabled, it dynamically assigns connections, but there are exceptions.
The exception mentioned in the question is:
VoIP (Option D): VoIP connections are an exception when Dynamic Dispatcher is enabled. They are not assigned dynamically but follow a different rule set to ensure quality and reliability for VoIP traffic.
The other options, Threat Emulation (Option A), HTTPS (Option B), and QoS (Option C), are dynamically assigned when Dynamic Dispatcher is enabled.
Reference: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.
D
Explanation:
When Dynamic Dispatcher is enabled, it dynamically assigns connections, but there are exceptions.
The exception mentioned in the question is:
VoIP (Option D): VoIP connections are an exception when Dynamic Dispatcher is enabled. They are not assigned dynamically but follow a different rule set to ensure quality and reliability for VoIP traffic.
The other options, Threat Emulation (Option A), HTTPS (Option B), and QoS (Option C), are dynamically assigned when Dynamic Dispatcher is enabled.
Reference: Check Point Certified Security Expert (CCSE) R81 training materials and documentation.
Question #569
You want to gather data and analyze threats to your mobile device. It has to be a lightweight app.
Which application would you use?
- A . Check Point Capsule Cloud
- B . Sandblast Mobile Protect
- C . SecuRemote
- D . SmartEvent Client Info
Correct Answer: B
B
Explanation:
SandBlast Mobile Protect is an application that provides comprehensive protection for mobile devices against cyber threats. SandBlast Mobile Protect is a lightweight app that does not affect the device performance or battery life. It monitors network traffic, device behavior, and installed apps to detect and prevent attacks such as phishing, malware, ransomware, botnets, and man-in-the-middle5. SandBlast Mobile Protect also integrates with Check Point’s ThreatCloud intelligence network to provide real-time threat information and updates6. Therefore, the correct answer is B)
Reference: 5: [SandBlast Mobile Protect] 6: [SandBlast Mobile Administration Guide]
B
Explanation:
SandBlast Mobile Protect is an application that provides comprehensive protection for mobile devices against cyber threats. SandBlast Mobile Protect is a lightweight app that does not affect the device performance or battery life. It monitors network traffic, device behavior, and installed apps to detect and prevent attacks such as phishing, malware, ransomware, botnets, and man-in-the-middle5. SandBlast Mobile Protect also integrates with Check Point’s ThreatCloud intelligence network to provide real-time threat information and updates6. Therefore, the correct answer is B)
Reference: 5: [SandBlast Mobile Protect] 6: [SandBlast Mobile Administration Guide]
Question #569
You want to gather data and analyze threats to your mobile device. It has to be a lightweight app.
Which application would you use?
- A . Check Point Capsule Cloud
- B . Sandblast Mobile Protect
- C . SecuRemote
- D . SmartEvent Client Info
Correct Answer: B
B
Explanation:
SandBlast Mobile Protect is an application that provides comprehensive protection for mobile devices against cyber threats. SandBlast Mobile Protect is a lightweight app that does not affect the device performance or battery life. It monitors network traffic, device behavior, and installed apps to detect and prevent attacks such as phishing, malware, ransomware, botnets, and man-in-the-middle5. SandBlast Mobile Protect also integrates with Check Point’s ThreatCloud intelligence network to provide real-time threat information and updates6. Therefore, the correct answer is B)
Reference: 5: [SandBlast Mobile Protect] 6: [SandBlast Mobile Administration Guide]
B
Explanation:
SandBlast Mobile Protect is an application that provides comprehensive protection for mobile devices against cyber threats. SandBlast Mobile Protect is a lightweight app that does not affect the device performance or battery life. It monitors network traffic, device behavior, and installed apps to detect and prevent attacks such as phishing, malware, ransomware, botnets, and man-in-the-middle5. SandBlast Mobile Protect also integrates with Check Point’s ThreatCloud intelligence network to provide real-time threat information and updates6. Therefore, the correct answer is B)
Reference: 5: [SandBlast Mobile Protect] 6: [SandBlast Mobile Administration Guide]