Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #51
Which Remote Access Client does not provide an Office-Mode Address?
- A . SecuRemote
- B . Endpoint Security Suite
- C . Endpoint Security VPN
- D . Check Point Mobile
Correct Answer: A
A
Explanation:
In the context of Check Point remote access clients and Office Mode, the correct answer is:
A) SecuRemote: SecuRemote is a Check Point remote access client that does not provide an Office-Mode Address. Office Mode is a feature that assigns a unique IP address from a designated IP pool to remote users when they connect to the corporate network. SecuRemote does not support this feature.
B) Endpoint Security Suite,
C. Endpoint Security VPN, and
D. Check Point Mobile are remote access clients that support Office Mode and can provide an Office-Mode Address to remote users.
Therefore, option A is the correct answer as it correctly identifies a remote access client that does not provide an Office-Mode Address.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
A
Explanation:
In the context of Check Point remote access clients and Office Mode, the correct answer is:
A) SecuRemote: SecuRemote is a Check Point remote access client that does not provide an Office-Mode Address. Office Mode is a feature that assigns a unique IP address from a designated IP pool to remote users when they connect to the corporate network. SecuRemote does not support this feature.
B) Endpoint Security Suite,
C. Endpoint Security VPN, and
D. Check Point Mobile are remote access clients that support Office Mode and can provide an Office-Mode Address to remote users.
Therefore, option A is the correct answer as it correctly identifies a remote access client that does not provide an Office-Mode Address.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #52
Which process handles connection from SmartConsole R81?
- A . fwm
- B . cpmd
- C . cpm
- D . cpd
Correct Answer: C
C
Explanation:
The CPM process handles connection from SmartConsole R81. The CPM process is the main process of the Security Management Server and the Multi-Domain Security Management Server. It is responsible for managing the database, handling policy installation, communicating with SmartConsole clients, and providing REST API services. The CPM process runs on port 19009 and uses the CPD process as a proxy for communication with other processes.
Reference: Check Point Processes and Daemons, section “CPM”
Check Point R81, section “SmartConsole”
Check Point R81.20, section “REST API”
C
Explanation:
The CPM process handles connection from SmartConsole R81. The CPM process is the main process of the Security Management Server and the Multi-Domain Security Management Server. It is responsible for managing the database, handling policy installation, communicating with SmartConsole clients, and providing REST API services. The CPM process runs on port 19009 and uses the CPD process as a proxy for communication with other processes.
Reference: Check Point Processes and Daemons, section “CPM”
Check Point R81, section “SmartConsole”
Check Point R81.20, section “REST API”
Question #53
Which of the SecureXL templates are enabled by default on Security Gateway?
- A . Accept
- B . Drop
- C . NAT
- D . None
Correct Answer: D
Question #54
Alice & Bob are concurrently logged In via SSH on the same Check Point Security Gateway as user "admin* however Bob was first logged in and acquired the lock Alice Is not aware that Bob is also togged in to the same Security Management Server as she is but she needs to perform very urgent configuration changes – which of the following GAlAclish command is true for overriding Bobs configuration database lock:
- A . lock database override
- B . unlock override database
- C . unlock database override
- D . database unlock override
Correct Answer: A
A
Explanation:
To override Bob’s configuration database lock, Alice can use the command lock database override in the clish shell. This command will transfer the lock from Bob to Alice and allow her to make the urgent configuration changes. However, this command should be used with caution, as it may cause conflicts or inconsistencies if Bob and Alice are working on the same objects or policies. It is recommended to communicate with other administrators before using this command and to release the lock as soon as possible after finishing the changes1. The other commands are not valid in clish and will result in an error message.
A
Explanation:
To override Bob’s configuration database lock, Alice can use the command lock database override in the clish shell. This command will transfer the lock from Bob to Alice and allow her to make the urgent configuration changes. However, this command should be used with caution, as it may cause conflicts or inconsistencies if Bob and Alice are working on the same objects or policies. It is recommended to communicate with other administrators before using this command and to release the lock as soon as possible after finishing the changes1. The other commands are not valid in clish and will result in an error message.
Question #55
What are the main stages of a policy installations?
- A . Verification & Compilation, Transfer and Commit
- B . Verification & Compilation, Transfer and Installation
- C . Verification, Commit, Installation
- D . Verification, Compilation & Transfer, Installation
Correct Answer: A
A
Explanation:
The main stages of a policy installation are Verification & Compilation, Transfer and Commit. Verification & Compilation is the stage where the Security Management Server checks the validity and consistency of the policy and compiles it into a binary format. Transfer is the stage where the compiled policy is sent to the Security Gateways over a secure channel. Commit is the stage where the Security Gateways activate the new policy and update their connections table accordingly.
Reference: Check Point Security Expert R81 Course, Policy Installation Process
A
Explanation:
The main stages of a policy installation are Verification & Compilation, Transfer and Commit. Verification & Compilation is the stage where the Security Management Server checks the validity and consistency of the policy and compiles it into a binary format. Transfer is the stage where the compiled policy is sent to the Security Gateways over a secure channel. Commit is the stage where the Security Gateways activate the new policy and update their connections table accordingly.
Reference: Check Point Security Expert R81 Course, Policy Installation Process
Question #56
What is the name of the secure application for Mail/Calendar for mobile devices?
- A . Capsule Workspace
- B . Capsule Mail
- C . Capsule VPN
- D . Secure Workspace
Correct Answer: A
A
Explanation:
The secure application for Mail/Calendar for mobile devices in Check Point is called "Capsule Workspace." Capsule Workspace provides secure access to email and calendar data on mobile devices while maintaining security policies and controls.
Reference: Check Point Certified Security Expert R81 documentation and learning resources.
A
Explanation:
The secure application for Mail/Calendar for mobile devices in Check Point is called "Capsule Workspace." Capsule Workspace provides secure access to email and calendar data on mobile devices while maintaining security policies and controls.
Reference: Check Point Certified Security Expert R81 documentation and learning resources.
Question #57
How do Capsule Connect and Capsule Workspace differ?
- A . Capsule Connect provides a Layer3 VPN. Capsule Workspace provides a Desktop with usable applications.
- B . Capsule Workspace can provide access to any application.
- C . Capsule Connect provides Business data isolation.
- D . Capsule Connect does not require an installed application at client.
Correct Answer: A
A
Explanation:
Capsule Connect and Capsule Workspace are both components of Check Point’s remote access solution, but they serve different purposes and have distinct features:
A) Capsule Connect provides a Layer 3 VPN, which allows remote users to connect securely to their corporate network. It typically provides network-level access, allowing users to access resources on the corporate network. On the other hand, Capsule Workspace provides a secure workspace environment, including a virtual desktop with usable applications. It is more focused on providing application-level access to users in a secure manner.
B) This statement is partially true. Capsule Workspace is designed to provide secure access to a wide range of applications and resources, not limited to specific applications.
C) Capsule Connect does provide business data isolation by creating a secure VPN tunnel for remote users, ensuring that their network traffic is isolated from the public internet.
D) Capsule Connect usually requires an installed application or VPN client on the client device to establish a secure connection to the corporate network. This statement is not entirely accurate because an installed application or client is typically required.
Therefore, option A is the correct answer as it accurately distinguishes between Capsule Connect and Capsule Workspace based on their primary functionalities.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
A
Explanation:
Capsule Connect and Capsule Workspace are both components of Check Point’s remote access solution, but they serve different purposes and have distinct features:
A) Capsule Connect provides a Layer 3 VPN, which allows remote users to connect securely to their corporate network. It typically provides network-level access, allowing users to access resources on the corporate network. On the other hand, Capsule Workspace provides a secure workspace environment, including a virtual desktop with usable applications. It is more focused on providing application-level access to users in a secure manner.
B) This statement is partially true. Capsule Workspace is designed to provide secure access to a wide range of applications and resources, not limited to specific applications.
C) Capsule Connect does provide business data isolation by creating a secure VPN tunnel for remote users, ensuring that their network traffic is isolated from the public internet.
D) Capsule Connect usually requires an installed application or VPN client on the client device to establish a secure connection to the corporate network. This statement is not entirely accurate because an installed application or client is typically required.
Therefore, option A is the correct answer as it accurately distinguishes between Capsule Connect and Capsule Workspace based on their primary functionalities.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #58
You have created a rule at the top of your Rule Base to permit Guest Wireless access to the Internet. However, when guest users attempt to reach the Internet, they are not seeing the splash page to accept your Terms of Service, and cannot access the Internet.
How can you fix this?
- A . Right click Accept in the rule, select “More”, and then check ‘Enable Identity Captive Portal’.
- B . On the firewall object, Legacy Authentication screen, check ‘Enable Identity Captive Portal’.
- C . In the Captive Portal screen of Global Properties, check ‘Enable Identity Captive Portal’.
- D . On the Security Management Server object, check the box ‘Identity Logging’.
Correct Answer: A
A
Explanation:
The correct way to enable Identity Captive Portal for a specific rule is to right click Accept in the rule, select “More”, and then check ‘Enable Identity Captive Portal’. This will allow guest users to see the splash page and accept the Terms of Service before accessing the Internet. Identity Captive Portal is a feature that enables identity awareness for guest users who are not authenticated by other methods, such as Active Directory or Identity Agent. Identity Captive Portal can be enabled globally or per rule, depending on the security policy requirements.
A
Explanation:
The correct way to enable Identity Captive Portal for a specific rule is to right click Accept in the rule, select “More”, and then check ‘Enable Identity Captive Portal’. This will allow guest users to see the splash page and accept the Terms of Service before accessing the Internet. Identity Captive Portal is a feature that enables identity awareness for guest users who are not authenticated by other methods, such as Active Directory or Identity Agent. Identity Captive Portal can be enabled globally or per rule, depending on the security policy requirements.
Question #59
Which command shows the current Security Gateway Firewall chain?
- A . show current chain
- B . show firewall chain
- C . fw ctl chain
- D . fw ctl firewall-chain
Correct Answer: C
Question #60
Which of these statements describes the Check Point ThreatCloud?
- A . Blocks or limits usage of web applications
- B . Prevents or controls access to web sites based on category
- C . Prevents Cloud vulnerability exploits
- D . A worldwide collaborative security network
Correct Answer: D
D
Explanation:
The Check Point ThreatCloud is a worldwide collaborative security network that collects and analyzes threat data from millions of sensors, security gateways, and other sources, and delivers real-time threat intelligence and protection to Check Point products.
Reference: Check Point ThreatCloud
D
Explanation:
The Check Point ThreatCloud is a worldwide collaborative security network that collects and analyzes threat data from millions of sensors, security gateways, and other sources, and delivers real-time threat intelligence and protection to Check Point products.
Reference: Check Point ThreatCloud