Check Point 156-315.81.20 Practice Exams
Last updated on Oct 24,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 24,2026
Question #611
After having saved the Cllsh Configuration with the "save configuration config.txt* command, where can you find the config.txt file?
- A . You will find it in the home directory of your usef account (e.g. /home/admirV)
- B . You can locate the file via SmartConsole > Command Line.
- C . You have to launch the WebUl and go to "Config" -> "Export Conflg File" and specifly the destination directory of your local tile system
- D . You cannot locate the file in the file system sine© Clish does not have any access to the bash fie system
Correct Answer: B
B
Explanation:
You can locate the file via SmartConsole > Command Line. According to the CLISH documentation1, when you save the configuration with the “save configuration config.txt” command, the file is stored in a temporary location on the management server. To access the file, you need to use SmartConsole and go to Command Line > View File > config.txt2. Alternatively, you can also use the “show configuration” command in CLISH to view the current configuration2.
Reference: CLISH – SourceForge: Summary of Gaia Clish Commands – Check Point Software
B
Explanation:
You can locate the file via SmartConsole > Command Line. According to the CLISH documentation1, when you save the configuration with the “save configuration config.txt” command, the file is stored in a temporary location on the management server. To access the file, you need to use SmartConsole and go to Command Line > View File > config.txt2. Alternatively, you can also use the “show configuration” command in CLISH to view the current configuration2.
Reference: CLISH – SourceForge: Summary of Gaia Clish Commands – Check Point Software
Question #612
On what port does the CPM process run?
- A . TCP 857
- B . TCP 18192
- C . TCP 900
- D . TCP 19009
Correct Answer: D
D
Explanation:
The port that the CPM process runs on is TCP 19009. CPM stands for Check Point Management, and it is the main process that runs on the Security Management Server and interacts with SmartConsole clients. CPM is responsible for managing policies, objects, logs, tasks, and other management functions. CPM listens on TCP port 19009 for incoming connections from SmartConsole clients. The other ports are either used by other processes or not related to CPM.
D
Explanation:
The port that the CPM process runs on is TCP 19009. CPM stands for Check Point Management, and it is the main process that runs on the Security Management Server and interacts with SmartConsole clients. CPM is responsible for managing policies, objects, logs, tasks, and other management functions. CPM listens on TCP port 19009 for incoming connections from SmartConsole clients. The other ports are either used by other processes or not related to CPM.
Question #613
Which view is NOT a valid CPVIEW view?
- A . IDA
- B . RAD
- C . PDP
- D . VPN
Correct Answer: C
C
Explanation:
PDP is not a valid CPVIEW view. CPVIEW is a command-line tool that shows the status of different system parameters, such as CPU, memory, disk, network, and firewall. The valid views are IDA, RAD, VPN, FW, QoS, and others. PDP is a process that handles identity awareness and authentication.
Reference: Check Point R81 Gaia Administration Guide, Check Point Identity Awareness Administration Guide R81
C
Explanation:
PDP is not a valid CPVIEW view. CPVIEW is a command-line tool that shows the status of different system parameters, such as CPU, memory, disk, network, and firewall. The valid views are IDA, RAD, VPN, FW, QoS, and others. PDP is a process that handles identity awareness and authentication.
Reference: Check Point R81 Gaia Administration Guide, Check Point Identity Awareness Administration Guide R81
Question #614
In R81, how do you manage your Mobile Access Policy?
- A . Through the Unified Policy
- B . Through the Mobile Console
- C . From SmartDashboard
- D . From the Dedicated Mobility Tab
Correct Answer: A
A
Explanation:
In R81, you can manage your Mobile Access Policy through the Unified Policy. The Unified Policy is a single policy that combines access control, threat prevention, data protection, and identity awareness. You can create rules for mobile access in the Unified Policy rulebase and apply them to mobile devices, users, and applications. You can also use the Mobile Access blade to configure additional settings for mobile access, such as authentication methods, VPN settings, and application portal.
A
Explanation:
In R81, you can manage your Mobile Access Policy through the Unified Policy. The Unified Policy is a single policy that combines access control, threat prevention, data protection, and identity awareness. You can create rules for mobile access in the Unified Policy rulebase and apply them to mobile devices, users, and applications. You can also use the Mobile Access blade to configure additional settings for mobile access, such as authentication methods, VPN settings, and application portal.
Question #615
The Check Point installation history feature in provides the following:
- A . View install changes and install specific version
- B . Policy Installation Date only
- C . Policy Installation Date, view install changes and install specific version
- D . View install changes
Correct Answer: C
C
Explanation:
The Check Point installation history feature provides the following:
Policy Installation Date: The date and time when the policy was installed on the Security Gateway.
View install changes: The ability to view the differences between two policy versions that were installed on the Security Gateway.
Install specific version: The ability to install a specific policy version from the installation history on
the Security Gateway3.
Reference: Check Point R81 SmartConsole Guide
C
Explanation:
The Check Point installation history feature provides the following:
Policy Installation Date: The date and time when the policy was installed on the Security Gateway.
View install changes: The ability to view the differences between two policy versions that were installed on the Security Gateway.
Install specific version: The ability to install a specific policy version from the installation history on
the Security Gateway3.
Reference: Check Point R81 SmartConsole Guide
Question #616
You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines a(n) _____ or _____ action for the file types.
- A . Inspect/Bypass
- B . Inspect/Prevent
- C . Prevent/Bypass
- D . Detect/Bypass
Correct Answer: A
A
Explanation:
You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines an Inspect or Bypass action for the file types. The Inspect action means that the file will be sent to the Threat Emulation engine for analysis, and the Bypass action means that the file will not be sent and will be allowed or blocked based on other Threat Prevention blades1. The other options are not valid actions for file types in Threat Prevention profiles.
Reference: Check Point R81 Threat Prevention Administration Guide
A
Explanation:
You can select the file types that are sent for emulation for all the Threat Prevention profiles. Each profile defines an Inspect or Bypass action for the file types. The Inspect action means that the file will be sent to the Threat Emulation engine for analysis, and the Bypass action means that the file will not be sent and will be allowed or blocked based on other Threat Prevention blades1. The other options are not valid actions for file types in Threat Prevention profiles.
Reference: Check Point R81 Threat Prevention Administration Guide
Question #617
When simulating a problem on ClusterXL cluster with cphaprob Cd STOP -s problem -t 0 register, to initiate a failover on an active cluster member, what command allows you remove the problematic state?
- A . cphaprob Cd STOP unregister
- B . cphaprob STOP unregister
- C . cphaprob unregister STOP
- D . cphaprob Cd unregister STOP
Correct Answer: A
A
Explanation:
When simulating a problem on a ClusterXL cluster with the command "cphaprob Cd STOP -s problem -t 0 register" to initiate a failover on an active cluster member, you can use the command "cphaprob Cd STOP unregister" to remove the problematic state and return the cluster to normal operation.
Option A correctly identifies the command that allows you to remove the problematic state, making it the verified answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
A
Explanation:
When simulating a problem on a ClusterXL cluster with the command "cphaprob Cd STOP -s problem -t 0 register" to initiate a failover on an active cluster member, you can use the command "cphaprob Cd STOP unregister" to remove the problematic state and return the cluster to normal operation.
Option A correctly identifies the command that allows you to remove the problematic state, making it the verified answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #618
What is the responsibility of SOLR process on R81.20 management server?
- A . Validating all data before it’s written into the database
- B . It generates indexes of data written to the database
- C . Communication between SmartConsole applications and the Security Management Server
- D . Writing all information into the database
Correct Answer: B
B
Explanation:
The responsibility of SOLR process on R81.20 management server is to generate indexes of data written to the database. SOLR is an open source search platform that provides fast and scalable indexing and querying capabilities. SOLR is used by the R81.20 management server to index data such as logs, objects, policies, tasks, and events, and to enable quick and efficient searches on this data by SmartConsole and SmartView applications.
B
Explanation:
The responsibility of SOLR process on R81.20 management server is to generate indexes of data written to the database. SOLR is an open source search platform that provides fast and scalable indexing and querying capabilities. SOLR is used by the R81.20 management server to index data such as logs, objects, policies, tasks, and events, and to enable quick and efficient searches on this data by SmartConsole and SmartView applications.
Question #619
View the rule below.
What does the lock-symbol in the left column mean? (Choose the BEST answer.)
- A . The current administrator has read-only permissions to Threat Prevention Policy.
- B . Another user has locked the rule for editing.
- C . Configuration lock is present. Click the lock symbol to gain read-write access.
- D . The current administrator is logged in as read-only because someone else is editing the policy.
Correct Answer: B
B
Explanation:
The lock symbol in the left column of the rule means that another user has locked the rule for editing. This is to prevent multiple users from editing the same rule at the same time and causing conflicts.
Reference: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics-TP-Policy/TP-Policy-Edit-Rules.htm
B
Explanation:
The lock symbol in the left column of the rule means that another user has locked the rule for editing. This is to prevent multiple users from editing the same rule at the same time and causing conflicts.
Reference: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics-TP-Policy/TP-Policy-Edit-Rules.htm
Question #620
Your manager asked you to check the status of SecureXL, and its enabled templates and features.
What command will you use to provide such information to manager?
- A . fw accel stat
- B . fwaccel stat
- C . fw acces stats
- D . fwaccel stats
Correct Answer: B
B
Explanation:
The fwaccel stat command displays the status of SecureXL, and its enabled templates and features. The other commands are either incorrect or incomplete.
Reference: [SecureXL Commands]
B
Explanation:
The fwaccel stat command displays the status of SecureXL, and its enabled templates and features. The other commands are either incorrect or incomplete.
Reference: [SecureXL Commands]