Check Point 156-315.81.20 Practice Exams
Last updated on Oct 23,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 23,2026
Question #571
Which of the following is NOT a VPN routing option available in a star community?
- A . To satellites through center only.
- B . To center, or through the center to other satellites, to Internet and other VPN targets.
- C . To center and to other satellites through center.
- D . To center only.
Correct Answer: A, D
A, D
Explanation:
A star community is a VPN topology where one or more satellites connect to a center gateway. The center gateway can be a Security Gateway or a Security Management Server. The VPN routing option determines how the traffic is routed between the satellites and the center, and between the satellites themselves. There are three VPN routing options available in a star community12:
To center only: The satellites can only communicate with the center gateway, and not with each other or with any other VPN targets. This option is useful for remote access clients that only need to access resources on the center gateway.
To center, or through the center to other satellites, to Internet and other VPN targets: The satellites can communicate with the center gateway, and also with other satellites, Internet hosts, and other VPN targets through the center gateway. This option is useful for branch offices that need to access resources on the center gateway, as well as on other branch offices, Internet hosts, and other VPN targets.
To center and to other satellites through center: The satellites can communicate with the center gateway, and also with other satellites through the center gateway. However, they cannot communicate with Internet hosts or other VPN targets. This option is useful for branch offices that need to access resources on the center gateway and on other branch offices, but not on Internet hosts or other VPN targets.
Therefore, the options A (To satellites through center only) and D (To center only) are not valid VPN routing options in a star community.
Reference: 1: Remote Access VPN R81.20 Administration Guide – Check Point Software, page 13 2: Gaia R81.20 Administration Guide – Check Point Software, page 1030
A, D
Explanation:
A star community is a VPN topology where one or more satellites connect to a center gateway. The center gateway can be a Security Gateway or a Security Management Server. The VPN routing option determines how the traffic is routed between the satellites and the center, and between the satellites themselves. There are three VPN routing options available in a star community12:
To center only: The satellites can only communicate with the center gateway, and not with each other or with any other VPN targets. This option is useful for remote access clients that only need to access resources on the center gateway.
To center, or through the center to other satellites, to Internet and other VPN targets: The satellites can communicate with the center gateway, and also with other satellites, Internet hosts, and other VPN targets through the center gateway. This option is useful for branch offices that need to access resources on the center gateway, as well as on other branch offices, Internet hosts, and other VPN targets.
To center and to other satellites through center: The satellites can communicate with the center gateway, and also with other satellites through the center gateway. However, they cannot communicate with Internet hosts or other VPN targets. This option is useful for branch offices that need to access resources on the center gateway and on other branch offices, but not on Internet hosts or other VPN targets.
Therefore, the options A (To satellites through center only) and D (To center only) are not valid VPN routing options in a star community.
Reference: 1: Remote Access VPN R81.20 Administration Guide – Check Point Software, page 13 2: Gaia R81.20 Administration Guide – Check Point Software, page 1030
Question #572
What are the correct sleps upgrading a HA cluster (Ml is active. M2 is passive) using Multi-Version
Cluster (MVC) Upgrade?
- A . 1) Enable the MVC mechanism on both cluster members «cphaprob mvc on
2) Upgrade the passive node M2 to R81.20
3) In SmartConsole. change the version of the cluster object
4) Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails
5) After examine the cluster states upgrade node M1 to R81.20
6) On each Cluster Member, disable the MVC mechanism - B . 1) Enable the MVC mechanism on both cluster members #cphaprob mvc on
2) Upgrade the passive node M2 to R81.20
3) In SmartConsole. change the version of the cluster object
4) Install the Access Control Policy
5) After examine the cluster states upgrade node M1 to R81.20
6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy - C . 1) In SmartConsole. change the version of the cluster object
2) Upgrade the passive node M2 to R81.20
3) Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 Wcphaconf mvc on
4) Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails
5) After examine the cluster states upgrade node M1 to R81.20
6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy SmartConsole. change the version of the cluster object - D . 1) Upgrade the passive node M2 to R81.20
2) Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 ttcphaconf mvc on
3) In SmartConsole, change the version of the cluster object 4} Install the Access Control Policy
5) After examine the cluster states upgrade node M1 to R81.20
6) On each Cluster Member, disable the MVC mechanism and Install the Access Control Policy upgrade the passive node M2 to R81.20
Correct Answer: D
D
Explanation:
The correct steps for upgrading a HA cluster using MVC are as follows:
Upgrade the passive node M2 to R81.20 using CPUSE or CLI.
Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 using the command cphaconf mvc on.
In SmartConsole, change the version of the cluster object to R81.20.
Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails.
After examining the cluster states, upgrade node M1 to R81.20 using CPUSE or CLI.
On each Cluster Member, disable the MVC mechanism using the command cphaconf mvc off and install the Access Control Policy.
Reference: Multi-Version Cluster (MVC) Upgrade
D
Explanation:
The correct steps for upgrading a HA cluster using MVC are as follows:
Upgrade the passive node M2 to R81.20 using CPUSE or CLI.
Enable the MVC mechanism on the upgraded R81.20 Cluster Member M2 using the command cphaconf mvc on.
In SmartConsole, change the version of the cluster object to R81.20.
Install the Access Control Policy and make sure that the installation will not stop if installation on one cluster member fails.
After examining the cluster states, upgrade node M1 to R81.20 using CPUSE or CLI.
On each Cluster Member, disable the MVC mechanism using the command cphaconf mvc off and install the Access Control Policy.
Reference: Multi-Version Cluster (MVC) Upgrade
Question #573
You had setup the VPN Community VPN-Stores’with 3 gateways. There are some issues with one remote gateway (1.1.1.1) and an your local gateway.
What will be the best log filter to see only the IKE Phase 2 agreed networks for both gateways
- A . action:"Key Install" AND 1.1.1.1 AND Main Mode
- B . action:"Key Install- AND 1.1.1.1 ANDQuick Mode
- C . Blade:"VPN" AND VPN-Stores AND Main Mode
- D . Blade:"VPN" AND VPN-Stores AND Quick Mode
Correct Answer: B
B
Explanation:
The best log filter to see only the IKE Phase 2 agreed networks for both gateways is B. action:“Key Install” AND 1.1.1.1 AND Quick Mode1. This filter will show you the logs that indicate the successful establishment of IKE Phase 2, which is also known as Quick Mode2. In this phase, the Security Gateway and the remote gateway negotiate the IPSec Security Associations (SAs) and exchange the encryption keys for the VPN tunnel2. The action:“Key Install” field shows that the SAs were installed successfully3. The 1.1.1.1 field shows that the logs are related to the remote gateway with that IP address3. The Quick Mode field shows that the logs are related to IKE Phase 2, as opposed to Main Mode, which is IKE Phase 13. To use this filter, you need to go to SmartConsole, open SmartLog, and enter the filter expression in the search box3.
Reference: How to troubleshoot VPN issues with IKEVIEW tool – Check Point Software, IPsec and IKE – Check Point Software, SmartLog R81.20 Administration Guide – Check Point Software
B
Explanation:
The best log filter to see only the IKE Phase 2 agreed networks for both gateways is B. action:“Key Install” AND 1.1.1.1 AND Quick Mode1. This filter will show you the logs that indicate the successful establishment of IKE Phase 2, which is also known as Quick Mode2. In this phase, the Security Gateway and the remote gateway negotiate the IPSec Security Associations (SAs) and exchange the encryption keys for the VPN tunnel2. The action:“Key Install” field shows that the SAs were installed successfully3. The 1.1.1.1 field shows that the logs are related to the remote gateway with that IP address3. The Quick Mode field shows that the logs are related to IKE Phase 2, as opposed to Main Mode, which is IKE Phase 13. To use this filter, you need to go to SmartConsole, open SmartLog, and enter the filter expression in the search box3.
Reference: How to troubleshoot VPN issues with IKEVIEW tool – Check Point Software, IPsec and IKE – Check Point Software, SmartLog R81.20 Administration Guide – Check Point Software
Question #574
You have used the SmartEvent GUI to create a custom Event policy.
What is the best way to display the correlated Events generated by SmartEvent Policies?
- A . Open SmartView Monitor and select the SmartEvent Window from the main menu.
- B . In the SmartConsole / Logs & Monitor –> open the Logs View and use type:Correlated as query filter.
- C . In the SmartConsole / Logs & Monitor -> open a new Tab and select External Apps / SmartEvent.
- D . Select the Events tab in the SmartEvent GUI or use the Events tab in the SmartView web interface.
Correct Answer: C
C
Explanation:
The best way to display the correlated events generated by SmartEvent policies is to open a new tab in the SmartConsole / Logs & Monitor and select External Apps / SmartEvent. This will launch the SmartEvent GUI, which provides a comprehensive view of the network security events, including charts, reports, and timelines. The SmartEvent GUI can also be accessed from a web browser using the SmartView web interface1.
Reference: Check Point R81 SmartEvent Administration Guide
C
Explanation:
The best way to display the correlated events generated by SmartEvent policies is to open a new tab in the SmartConsole / Logs & Monitor and select External Apps / SmartEvent. This will launch the SmartEvent GUI, which provides a comprehensive view of the network security events, including charts, reports, and timelines. The SmartEvent GUI can also be accessed from a web browser using the SmartView web interface1.
Reference: Check Point R81 SmartEvent Administration Guide
Question #575
What is the default size of NAT table fwx_alloc?
- A . 20000
- B . 35000
- C . 25000
- D . 10000
Correct Answer: C
C
Explanation:
What is the default size of NAT table fwx_alloc? The default size of NAT table fwx_alloc is 25000. This table stores the connections that require NAT translation by the Security Gateway. The size of this table can be changed by using the command fw ctl set int fwx_alloc <value>, where <value> is the desired number of connections. The maximum value is 65535. To make this change permanent, you need to add this command to the file $FWDIR/conf/fwaffinity.conf on the Security Gateway.
Reference: [R81 Performance Tuning Administration Guide], page 126.
C
Explanation:
What is the default size of NAT table fwx_alloc? The default size of NAT table fwx_alloc is 25000. This table stores the connections that require NAT translation by the Security Gateway. The size of this table can be changed by using the command fw ctl set int fwx_alloc <value>, where <value> is the desired number of connections. The maximum value is 65535. To make this change permanent, you need to add this command to the file $FWDIR/conf/fwaffinity.conf on the Security Gateway.
Reference: [R81 Performance Tuning Administration Guide], page 126.
Question #576
What is the command to check the status of Check Point processes?
- A . top
- B . cptop
- C . cphaprob list
- D . cpwd_admin list
Correct Answer: D
D
Explanation:
The command to check the status of Check Point processes is cpwd_admin list. This command displays the process ID, name, state, start time, and watchdog status of all the processes that are monitored by the Check Point WatchDog daemon (CPWD). You can also use this command to start, stop, or restart a specific process.
Reference: [cpwd_admin Command]
D
Explanation:
The command to check the status of Check Point processes is cpwd_admin list. This command displays the process ID, name, state, start time, and watchdog status of all the processes that are monitored by the Check Point WatchDog daemon (CPWD). You can also use this command to start, stop, or restart a specific process.
Reference: [cpwd_admin Command]
Question #577
What destination versions are supported for a Multi-Version Cluster Upgrade?
- A . R77.30 and later
- B . R80.10 and Later
- C . R70 and Later
- D . R76 and later
Correct Answer: B
B
Explanation:
The correct answer is B) R80.10 and later.
According to the Check Point documentation1, the Multi-Version Cluster Upgrade (MVC) is a new feature in R80.40 and higher that replaces the Connectivity Upgrade (CU) method. MVC allows you to upgrade a cluster to a newer version without a loss in connectivity and test the new version on some of the cluster members before you decide to upgrade the rest of the cluster members.
The MVC feature supports the following destination versions2:
R80.10
R80.20
R80.30
R80.40
R81
R81.20
The other options are incorrect because they are either not supported by MVC or they are older than the source version (R80.40).
Reference: Multi-Version Cluster (MVC) replaces Connectivity Upgrade (CU) in R80.401 ClusterXL upgrade methods and paths2
B
Explanation:
The correct answer is B) R80.10 and later.
According to the Check Point documentation1, the Multi-Version Cluster Upgrade (MVC) is a new feature in R80.40 and higher that replaces the Connectivity Upgrade (CU) method. MVC allows you to upgrade a cluster to a newer version without a loss in connectivity and test the new version on some of the cluster members before you decide to upgrade the rest of the cluster members.
The MVC feature supports the following destination versions2:
R80.10
R80.20
R80.30
R80.40
R81
R81.20
The other options are incorrect because they are either not supported by MVC or they are older than the source version (R80.40).
Reference: Multi-Version Cluster (MVC) replaces Connectivity Upgrade (CU) in R80.401 ClusterXL upgrade methods and paths2
Question #578
Which of the following is NOT a component of a Distinguished Name?
- A . Common Name
- B . Country
- C . User container
- D . Organizational Unit
Correct Answer: D
D
Explanation:
A Distinguished Name (DN) is a unique identifier for an object in an LDAP directory, such as a user, a group, or an organization. A DN consists of a sequence of relative distinguished names (RDNs), which are attributes that describe the object.
The most common RDNs are:
Common Name (CN): The name of the object, such as a user’s full name or a group’s name Country ©: The two-letter ISO code of the country where the object is located, such as US or PK User container (UC): The name of the container that holds the user objects, such as Users or People Domain Component (DC): The name of the domain that the object belongs to, such as checkpoint.com or example.org
An Organizational Unit (OU) is not a component of a DN, but a type of object that can be used to organize other objects in a hierarchical structure. An OU can have its own DN, which includes the OU attribute as an RDN, such as OU=Sales,DC=checkpoint,DC=com.
The references are:
Check Point R81 Identity Awareness Administration Guide, page 14
LDAP Distinguished Names
What is a Distinguished Name?
D
Explanation:
A Distinguished Name (DN) is a unique identifier for an object in an LDAP directory, such as a user, a group, or an organization. A DN consists of a sequence of relative distinguished names (RDNs), which are attributes that describe the object.
The most common RDNs are:
Common Name (CN): The name of the object, such as a user’s full name or a group’s name Country ©: The two-letter ISO code of the country where the object is located, such as US or PK User container (UC): The name of the container that holds the user objects, such as Users or People Domain Component (DC): The name of the domain that the object belongs to, such as checkpoint.com or example.org
An Organizational Unit (OU) is not a component of a DN, but a type of object that can be used to organize other objects in a hierarchical structure. An OU can have its own DN, which includes the OU attribute as an RDN, such as OU=Sales,DC=checkpoint,DC=com.
The references are:
Check Point R81 Identity Awareness Administration Guide, page 14
LDAP Distinguished Names
What is a Distinguished Name?
Question #579
What is the best sync method in the ClusterXL deployment?
- A . Use 1 cluster + 1st sync
- B . Use 1 dedicated sync interface
- C . Use 3 clusters + 1st sync + 2nd sync + 3rd sync
- D . Use 2 clusters +1st sync + 2nd sync
Correct Answer: B
B
Explanation:
The best sync method in the ClusterXL deployment is to use one dedicated sync interface. This means that one interface on each cluster member is used exclusively for synchronization traffic, which improves performance and security. Using multiple clusters or sync interfaces is not recommended, as it can cause network congestion or synchronization issues.
Reference: Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 8.
B
Explanation:
The best sync method in the ClusterXL deployment is to use one dedicated sync interface. This means that one interface on each cluster member is used exclusively for synchronization traffic, which improves performance and security. Using multiple clusters or sync interfaces is not recommended, as it can cause network congestion or synchronization issues.
Reference: Check Point Resource Library, Certified Security Expert (CCSE) R81.20 Course Overview, page 8.
Question #580
What is the mechanism behind Threat Extraction?
- A . This a new mechanism which extracts malicious files from a document to use it as a counter-attack against its sender.
- B . This is a new mechanism which is able to collect malicious files out of any kind of file types to destroy it prior to sending it to the intended recipient.
- C . This is a new mechanism to identify the IP address of the sender of malicious codes and put it into the SAM database (Suspicious Activity Monitoring).
- D . Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast.
Correct Answer: D
D
Explanation:
Threat Extraction is a technology that removes potentially malicious features that are known to be risky from files (macros, embedded objects and more), rather than determining their maliciousness. By cleaning the file before it enters the organization, Threat Extraction preemptively prevents both known and unknown threats, providing better protection against zero-day attacks1. Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast2.
The other options are either incorrect or irrelevant to the mechanism behind Threat Extraction.
Reference: Threat Extraction (CDR) – Check Point Software, Check Point Document Threat Extraction Technology
D
Explanation:
Threat Extraction is a technology that removes potentially malicious features that are known to be risky from files (macros, embedded objects and more), rather than determining their maliciousness. By cleaning the file before it enters the organization, Threat Extraction preemptively prevents both known and unknown threats, providing better protection against zero-day attacks1. Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast2.
The other options are either incorrect or irrelevant to the mechanism behind Threat Extraction.
Reference: Threat Extraction (CDR) – Check Point Software, Check Point Document Threat Extraction Technology