Check Point 156-315.81.20 Practice Exams
Last updated on Oct 24,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 24,2026
Question #601
To enable Dynamic Dispatch on Security Gateway without the Firewall Priority Queues, run the following command in Expert mode and reboot:
- A . fw ctl multik set_mode 1
- B . fw ctl multik prioq 2
- C . fw ctl Dyn_Dispatch on
- D . fw ctl Dyn_Dispatch enable
Correct Answer: D
D
Explanation:
According to the Check Point R81.20 documentation, the fw ctl Dyn_Dispatch enable command enables the CoreXL Dynamic Dispatcher on Security Gateway, which improves the performance of multi-core systems by dynamically balancing the traffic among the available cores1. Reference
1: CoreXL Dynamic Dispatcher – Check Point Software, section “Enabling the CoreXL Dynamic Dispatcher on Security
D
Explanation:
According to the Check Point R81.20 documentation, the fw ctl Dyn_Dispatch enable command enables the CoreXL Dynamic Dispatcher on Security Gateway, which improves the performance of multi-core systems by dynamically balancing the traffic among the available cores1. Reference
1: CoreXL Dynamic Dispatcher – Check Point Software, section “Enabling the CoreXL Dynamic Dispatcher on Security
Question #602
What are the two high availability modes?
- A . Load Sharing and Legacy
- B . Traditional and New
- C . Active and Standby
- D . New and Legacy
Correct Answer: D
D
Explanation:
The two high availability modes are New and Legacy. High availability (HA) is a feature that allows you to create a cluster of two or more Security Gateways that act as a single entity to provide redundancy and reliability for your network traffic. HA ensures that if one Security Gateway fails or becomes unavailable, another Security Gateway in the cluster takes over its role seamlessly and continues to process the traffic. HA also provides load balancing and synchronization of the cluster members. The New mode is the recommended mode for HA clusters, as it provides better performance, scalability, and stability than the Legacy mode. The New mode uses the ClusterXL mechanism to manage the cluster members and the state synchronization. The Legacy mode uses the High Availability Security Extension (HASE) mechanism to manage the cluster members and the state synchronization. The Legacy mode is supported for backward compatibility with older versions of Check Point products, but it has some limitations and disadvantages compared to the New mode.
D
Explanation:
The two high availability modes are New and Legacy. High availability (HA) is a feature that allows you to create a cluster of two or more Security Gateways that act as a single entity to provide redundancy and reliability for your network traffic. HA ensures that if one Security Gateway fails or becomes unavailable, another Security Gateway in the cluster takes over its role seamlessly and continues to process the traffic. HA also provides load balancing and synchronization of the cluster members. The New mode is the recommended mode for HA clusters, as it provides better performance, scalability, and stability than the Legacy mode. The New mode uses the ClusterXL mechanism to manage the cluster members and the state synchronization. The Legacy mode uses the High Availability Security Extension (HASE) mechanism to manage the cluster members and the state synchronization. The Legacy mode is supported for backward compatibility with older versions of Check Point products, but it has some limitations and disadvantages compared to the New mode.
Question #603
The “Hit count” feature allows tracking the number of connections that each rule matches. Will the Hit count feature work independently from logging and Track the hits if the Track option is set to “None”?
- A . No, it will work independently. Hit Count will be shown only for rules Track option set as Log or alert.
- B . Yes it will work independently as long as “analyze all rules” tick box is enabled on the Security Gateway.
- C . No, it will not work independently because hit count requires all rules to be logged.
- D . Yes it will work independently because when you enable Hit Count, the SMS collects the data from supported Security Gateways.
Correct Answer: D
D
Explanation:
The Hit Count feature allows tracking the number of connections that each rule matches, regardless
of the Track option set for the rule. When you enable Hit Count, the Security Management Server collects the data from supported Security Gateways and displays it in SmartConsole. You can use the Hit Count feature to optimize your rule base by identifying unused or rarely used rules, or rules that match too many connections.
D
Explanation:
The Hit Count feature allows tracking the number of connections that each rule matches, regardless
of the Track option set for the rule. When you enable Hit Count, the Security Management Server collects the data from supported Security Gateways and displays it in SmartConsole. You can use the Hit Count feature to optimize your rule base by identifying unused or rarely used rules, or rules that match too many connections.
Question #604
Which Queue in the Priority Queue has the maximum priority?
- A . High Priority
- B . Control
- C . Routing
- D . Heavy Data Queue
Correct Answer: C
C
Explanation:
The Priority Queue is a feature that allows the firewall to prioritize certain types of traffic over others, such as control and routing traffic, when the CPU load is high. The Priority Queue has four levels of priority: Control, Routing, High Priority and Heavy Data Queue1. The Control level has the highest priority and is reserved for firewall control traffic, such as policy installation and synchronization. The Routing level has the second highest priority and is used for routing protocols, such as OSPF and BGP. The High Priority level has the third highest priority and is used for user-defined traffic that needs to be prioritized, such as VoIP or video conferencing. The Heavy Data Queue level has the lowest priority and is used for bulk data transfer, such as FTP or HTTP2. Therefore, the correct answer is C.
Reference: 1: Firewall Priority Queues 2: Firewall Priority Queues setting
C
Explanation:
The Priority Queue is a feature that allows the firewall to prioritize certain types of traffic over others, such as control and routing traffic, when the CPU load is high. The Priority Queue has four levels of priority: Control, Routing, High Priority and Heavy Data Queue1. The Control level has the highest priority and is reserved for firewall control traffic, such as policy installation and synchronization. The Routing level has the second highest priority and is used for routing protocols, such as OSPF and BGP. The High Priority level has the third highest priority and is used for user-defined traffic that needs to be prioritized, such as VoIP or video conferencing. The Heavy Data Queue level has the lowest priority and is used for bulk data transfer, such as FTP or HTTP2. Therefore, the correct answer is C.
Reference: 1: Firewall Priority Queues 2: Firewall Priority Queues setting
Question #605
In the Firewall chain mode FFF refers to:
- A . Stateful Packets
- B . No Match
- C . All Packets
- D . Stateless Packets
Correct Answer: C
C
Explanation:
In the Firewall chain mode FFF refers to all packets. Firewall chain mode is a feature that allows administrators to define how packets are processed by different firewall kernel modules in inbound and outbound directions. FFF is one of the predefined chain modes that applies all firewall kernel modules (Firewall, VPN, IPS, etc.) to all packets, regardless of their state or connection. This mode provides maximum security, but also consumes more CPU resources.
C
Explanation:
In the Firewall chain mode FFF refers to all packets. Firewall chain mode is a feature that allows administrators to define how packets are processed by different firewall kernel modules in inbound and outbound directions. FFF is one of the predefined chain modes that applies all firewall kernel modules (Firewall, VPN, IPS, etc.) to all packets, regardless of their state or connection. This mode provides maximum security, but also consumes more CPU resources.
Question #606
Check Point Management (cpm) is the main management process in that it provides the architecture for a consolidates management console. CPM allows the GUI client and management server to communicate via web services using ___________.
- A . TCP port 19009
- B . TCP Port 18190
- C . TCP Port 18191
- D . TCP Port 18209
Correct Answer: A
A
Explanation:
Check Point Management (cpm) is the main management process that provides the architecture for a consolidated management console. CPM allows the GUI client and management server to communicate via web services using TCP port 19009 by default.
Reference: CPM process
A
Explanation:
Check Point Management (cpm) is the main management process that provides the architecture for a consolidated management console. CPM allows the GUI client and management server to communicate via web services using TCP port 19009 by default.
Reference: CPM process
Question #607
CPM process stores objects, policies, users, administrators, licenses and management data in a database. The database is:
- A . MySQL
- B . Postgres SQL
- C . MarisDB
- D . SOLR
Correct Answer: B
B
Explanation:
CPM process stores objects, policies, users, administrators, licenses and management data in a Postgres SQL database. This database is located in $FWDIR/conf and can be accessed using the pg_client command2. The other options are not the correct database type for CPM.
Reference: Check Point R81 Security Management Administration Guide
B
Explanation:
CPM process stores objects, policies, users, administrators, licenses and management data in a Postgres SQL database. This database is located in $FWDIR/conf and can be accessed using the pg_client command2. The other options are not the correct database type for CPM.
Reference: Check Point R81 Security Management Administration Guide
Question #608
Alice & Bob are going to use Management Data Plane Separation and therefore the routing separation needs to be enabled.
Which of the following command is true for enabling the Management Data Plane Separation (MDPS):
- A . set mdps split brain on
- B . set mdps split plane on
- C . set mdps mgmt plane on
- D . set mdps data plane off
Correct Answer: C
C
Explanation:
The correct command for enabling the management data plane separation (MDPS) is set mdps mgmt plane on. This command enables routing separation between management and data planes on a security gateway. This means that management traffic will use a different routing table than data traffic, which can improve security and performance.
Reference: [Check Point Security Expert R81 Administration Guide], page 76.
C
Explanation:
The correct command for enabling the management data plane separation (MDPS) is set mdps mgmt plane on. This command enables routing separation between management and data planes on a security gateway. This means that management traffic will use a different routing table than data traffic, which can improve security and performance.
Reference: [Check Point Security Expert R81 Administration Guide], page 76.
Question #609
Due to high CPU workload on the Security Gateway, the security administrator decided to purchase a new multicore CPU to replace the existing single core CPU.
After installation, is the administrator required to perform any additional tasks?
- A . After upgrading the hardware, increase the number of kernel instances using cpconfig
- B . Hyperthreading must be enabled in the bios to use CoreXL
- C . Run cprestart from dish
- D . Administrator does not need to perform any task. Check Point will make use of the newly installed CPU and Cores.
Correct Answer: A
A
Explanation:
https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_PerformanceTuning_AdminGuide/Content/Topics-PTG/CoreXL-Configuring-IPv4-and-IPv6-CoreXL-FW-instances.htm?Highlight=Configuring%20the%20Number%20of%20IPv4%20CoreXL%20Firewall%20Instances R81
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_PerformanceTuning_AdminGuide/Topics-PTG/CoreXL-Configuring-IPv4-and-IPv6-CoreXL-FW-instances.htm cpconfig -> Enter the number of the Check Point CoreXL option. (Enter 1 to select Change the number of firewall instances. OR Enter 2 for the option Change the number of IPv6 firewall instances.) -> Enter the total number of IPv4 (IPv6) CoreXL Firewall instances you wish the Security Gateway to run. Follow the instructions on the screen. -> Exit from the cpconfig menu. – Reboot the Security Gateway.
A
Explanation:
https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_PerformanceTuning_AdminGuide/Content/Topics-PTG/CoreXL-Configuring-IPv4-and-IPv6-CoreXL-FW-instances.htm?Highlight=Configuring%20the%20Number%20of%20IPv4%20CoreXL%20Firewall%20Instances R81
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_PerformanceTuning_AdminGuide/Topics-PTG/CoreXL-Configuring-IPv4-and-IPv6-CoreXL-FW-instances.htm cpconfig -> Enter the number of the Check Point CoreXL option. (Enter 1 to select Change the number of firewall instances. OR Enter 2 for the option Change the number of IPv6 firewall instances.) -> Enter the total number of IPv4 (IPv6) CoreXL Firewall instances you wish the Security Gateway to run. Follow the instructions on the screen. -> Exit from the cpconfig menu. – Reboot the Security Gateway.
Question #610
What is not a component of Check Point SandBlast?
- A . Threat Emulation
- B . Threat Simulator
- C . Threat Extraction
- D . Threat Cloud
Correct Answer: B
B
Explanation:
Threat Simulator is not a component of Check Point SandBlast. Check Point SandBlast is a solution that provides advanced protection against zero-day threats using four components: Threat Emulation, Threat Extraction, Threat Cloud, and Threat Prevention.
Reference: Check Point SandBlast Network
B
Explanation:
Threat Simulator is not a component of Check Point SandBlast. Check Point SandBlast is a solution that provides advanced protection against zero-day threats using four components: Threat Emulation, Threat Extraction, Threat Cloud, and Threat Prevention.
Reference: Check Point SandBlast Network