Check Point 156-315.81.20 Practice Exams
Last updated on Oct 24,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 24,2026
Question #620
Your manager asked you to check the status of SecureXL, and its enabled templates and features.
What command will you use to provide such information to manager?
- A . fw accel stat
- B . fwaccel stat
- C . fw acces stats
- D . fwaccel stats
Correct Answer: B
B
Explanation:
The fwaccel stat command displays the status of SecureXL, and its enabled templates and features. The other commands are either incorrect or incomplete.
Reference: [SecureXL Commands]
B
Explanation:
The fwaccel stat command displays the status of SecureXL, and its enabled templates and features. The other commands are either incorrect or incomplete.
Reference: [SecureXL Commands]
Question #622
What is the order of NAT priorities?
- A . Static NAT, IP pool NAT, hide NAT
- B . IP pool NAT, static NAT, hide NAT
- C . Static NAT, automatic NAT, hide NAT
- D . Static NAT, hide NAT, IP pool NAT
Correct Answer: A
A
Explanation:
The order of NAT priorities is determined by the type of NAT rule that is applied to the traffic. There are three types of NAT rules in Check Point: static NAT, IP pool NAT, and hide NAT12.
Static NAT: This type of NAT rule maps a single IP address to another single IP address. It is usually used to allow external hosts to access internal servers or devices. Static NAT has the highest priority among the NAT rules, and it is applied before the security policy is enforced12.
IP pool NAT: This type of NAT rule maps a range of IP addresses to another range of IP addresses. It is usually used to balance the load among multiple servers or devices. IP pool NAT has the second highest priority among the NAT rules, and it is applied after the security policy is enforced12.
Hide NAT: This type of NAT rule hides a group of IP addresses behind a single IP address or an interface. It is usually used to allow internal hosts to access external resources. Hide NAT has the lowest priority among the NAT rules, and it is applied after the security policy is enforced12. Therefore, the order of NAT priorities is: static NAT, IP pool NAT, hide NAT.
Reference: 1: Check Point R81 Security Administration Guide – Check Point Software, page
209 2: Check Point R81 Security Engineering Guide – Check Point Software, page 163
A
Explanation:
The order of NAT priorities is determined by the type of NAT rule that is applied to the traffic. There are three types of NAT rules in Check Point: static NAT, IP pool NAT, and hide NAT12.
Static NAT: This type of NAT rule maps a single IP address to another single IP address. It is usually used to allow external hosts to access internal servers or devices. Static NAT has the highest priority among the NAT rules, and it is applied before the security policy is enforced12.
IP pool NAT: This type of NAT rule maps a range of IP addresses to another range of IP addresses. It is usually used to balance the load among multiple servers or devices. IP pool NAT has the second highest priority among the NAT rules, and it is applied after the security policy is enforced12.
Hide NAT: This type of NAT rule hides a group of IP addresses behind a single IP address or an interface. It is usually used to allow internal hosts to access external resources. Hide NAT has the lowest priority among the NAT rules, and it is applied after the security policy is enforced12. Therefore, the order of NAT priorities is: static NAT, IP pool NAT, hide NAT.
Reference: 1: Check Point R81 Security Administration Guide – Check Point Software, page
209 2: Check Point R81 Security Engineering Guide – Check Point Software, page 163
Question #623
What is the command to show SecureXL status?
- A . fwaccel status
- B . fwaccel stats -m
- C . fwaccel -s
- D . fwaccel stat
Correct Answer: D
D
Explanation:
The command to show SecureXL status is fwaccel stat. This command displays information about SecureXL acceleration, such as the number of accelerated and non-accelerated connections, the reason for non-acceleration, and the SecureXL device name and mode. The other commands are either invalid or show different statistics.
D
Explanation:
The command to show SecureXL status is fwaccel stat. This command displays information about SecureXL acceleration, such as the number of accelerated and non-accelerated connections, the reason for non-acceleration, and the SecureXL device name and mode. The other commands are either invalid or show different statistics.
Question #623
What is the command to show SecureXL status?
- A . fwaccel status
- B . fwaccel stats -m
- C . fwaccel -s
- D . fwaccel stat
Correct Answer: D
D
Explanation:
The command to show SecureXL status is fwaccel stat. This command displays information about SecureXL acceleration, such as the number of accelerated and non-accelerated connections, the reason for non-acceleration, and the SecureXL device name and mode. The other commands are either invalid or show different statistics.
D
Explanation:
The command to show SecureXL status is fwaccel stat. This command displays information about SecureXL acceleration, such as the number of accelerated and non-accelerated connections, the reason for non-acceleration, and the SecureXL device name and mode. The other commands are either invalid or show different statistics.
Question #625
What is the purpose of the CPCA process?
- A . Monitoring the status of processes.
- B . Sending and receiving logs.
- C . Communication between GUI clients and the SmartCenter server.
- D . Generating and modifying certificates.
Correct Answer: D
D
Explanation:
The purpose of the CPCA process is to generate and modify certificates for Check Point products and features. CPCA stands for Check Point Certificate Authority and it is responsible for creating and managing certificates for internal communication between Check Point components, such as Security Gateways, Security Management Servers, SmartConsole clients, and OPSEC applications. CPCA also supports external certificate authorities and can import and export certificates from other sources.
D
Explanation:
The purpose of the CPCA process is to generate and modify certificates for Check Point products and features. CPCA stands for Check Point Certificate Authority and it is responsible for creating and managing certificates for internal communication between Check Point components, such as Security Gateways, Security Management Servers, SmartConsole clients, and OPSEC applications. CPCA also supports external certificate authorities and can import and export certificates from other sources.
Question #626
You have enabled “Full Log” as a tracking option to a security rule. However, you are still not seeing any data type information.
What is the MOST likely reason?
- A . Logging has disk space issues. Change logging storage options on the logging server or Security Management Server properties and install database.
- B . Data Awareness is not enabled.
- C . Identity Awareness is not enabled.
- D . Logs are arriving from Pre-R81 gateways.
Correct Answer: B
B
Explanation:
The most likely reason why you are not seeing any data type information in your logs even though you have enabled Full Log as a tracking option to a security rule is that Data Awareness is not enabled on your Security Gateway. Data Awareness is a feature that allows you to monitor and control data types that are transferred over HTTP, HTTPS, FTP, SMTP, POP3, or IMAP protocols. Data Awareness can identify over 700 data types, such as credit card numbers, social security numbers, bank account numbers, medical records, etc., and provide visibility into the data usage patterns of your users. Data Awareness can also enforce data loss prevention (DLP) policies to prevent sensitive data from leaving your network or entering your network from untrusted sources. To enable Data Awareness on your Security Gateway, you need to activate the Data Awareness Software Blade in SmartConsole and install the policy on the Security Gateway.
B
Explanation:
The most likely reason why you are not seeing any data type information in your logs even though you have enabled Full Log as a tracking option to a security rule is that Data Awareness is not enabled on your Security Gateway. Data Awareness is a feature that allows you to monitor and control data types that are transferred over HTTP, HTTPS, FTP, SMTP, POP3, or IMAP protocols. Data Awareness can identify over 700 data types, such as credit card numbers, social security numbers, bank account numbers, medical records, etc., and provide visibility into the data usage patterns of your users. Data Awareness can also enforce data loss prevention (DLP) policies to prevent sensitive data from leaving your network or entering your network from untrusted sources. To enable Data Awareness on your Security Gateway, you need to activate the Data Awareness Software Blade in SmartConsole and install the policy on the Security Gateway.
Question #627
Which Check Point software blades could be enforced under Threat Prevention profile using Check Point R81.20 SmartConsole application?
- A . IPS, Anti-Bot, URL Filtering, Application Control, Threat Emulation.
- B . Firewall, IPS, Threat Emulation, Application Control.
- C . IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction.
- D . Firewall, IPS, Anti-Bot, Anti-Virus, Threat Emulation.
Correct Answer: C
C
Explanation:
The Threat Prevention profile in Check Point R81.20 SmartConsole application allows you to enforce the following software blades: IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction. These software blades provide comprehensive protection against various types of threats, such as network attacks, malware, ransomware, phishing, and zero-day exploits. You can configure the profile settings for each software blade, such as the action to take, the protection scope, and the exceptions.
Reference: Check Point Security Expert R81 Course, Threat Prevention Administration Guide
C
Explanation:
The Threat Prevention profile in Check Point R81.20 SmartConsole application allows you to enforce the following software blades: IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction. These software blades provide comprehensive protection against various types of threats, such as network attacks, malware, ransomware, phishing, and zero-day exploits. You can configure the profile settings for each software blade, such as the action to take, the protection scope, and the exceptions.
Reference: Check Point Security Expert R81 Course, Threat Prevention Administration Guide
Question #628
What mechanism can ensure that the Security Gateway can communicate with the Management Server with ease in situations with overwhelmed network resources?
- A . The corresponding feature is new to R81.20 and is called "Management Data Plane Separation"
- B . The corresponding feature is called "Dynamic Dispatching"
- C . There is a feature for ensuring stable connectivity to the management server and is done via Priority Queuing.
- D . The corresponding feature is called "Dynamic Split"
Correct Answer: A
A
Explanation:
The mechanism that can ensure that the Security Gateway can communicate with the Management Server with ease in situations with overwhelmed network resources is called Management Data Plane Separation (MDPS)1. MDPS is a feature that allows a Security Gateway to have isolated Management and Data networks. The network system of each domain (plane) is independent and includes interfaces, routes, sockets, and processes. The Management Plane is a domain that accesses, provisions, and monitors the Security Gateway. The Data Plane is a domain that handles all other traffic1. MDPS has the following benefits2:
It improves the performance and stability of the Security Gateway by separating the management traffic from the data traffic.
It enhances the security of the Security Gateway by preventing any packet from crossing between the planes.
It simplifies the network configuration and troubleshooting by having separate routing tables for each plane. MDPS is supported on Check Point Appliances with R80.40 and higher versions1. It is also supported on Quantum Maestro and Quantum Scalable Chassis with R81.20 and higher versions3. MDPS can be configured using Gaia Clish commands or Gaia Portal1.
Reference: Management Data Plane Separation (MDPS) – Check Point Software, Tip of the Week: Management Data Plane Separation – Check Point CheckMates, Management Data Plane Separation (MDPS) on Maestro R81.20 – Check Point Software
A
Explanation:
The mechanism that can ensure that the Security Gateway can communicate with the Management Server with ease in situations with overwhelmed network resources is called Management Data Plane Separation (MDPS)1. MDPS is a feature that allows a Security Gateway to have isolated Management and Data networks. The network system of each domain (plane) is independent and includes interfaces, routes, sockets, and processes. The Management Plane is a domain that accesses, provisions, and monitors the Security Gateway. The Data Plane is a domain that handles all other traffic1. MDPS has the following benefits2:
It improves the performance and stability of the Security Gateway by separating the management traffic from the data traffic.
It enhances the security of the Security Gateway by preventing any packet from crossing between the planes.
It simplifies the network configuration and troubleshooting by having separate routing tables for each plane. MDPS is supported on Check Point Appliances with R80.40 and higher versions1. It is also supported on Quantum Maestro and Quantum Scalable Chassis with R81.20 and higher versions3. MDPS can be configured using Gaia Clish commands or Gaia Portal1.
Reference: Management Data Plane Separation (MDPS) – Check Point Software, Tip of the Week: Management Data Plane Separation – Check Point CheckMates, Management Data Plane Separation (MDPS) on Maestro R81.20 – Check Point Software
Question #629
Rugged appliances are small appliances with ruggedized hardware and like Quantum Spark appliance they use which operating system?
- A . Centos Linux
- B . Gaia embedded.
- C . Gaia
- D . Red Hat Enterprise Linux version 5
Correct Answer: B
B
Explanation:
Rugged appliances are small appliances with ruggedized hardware that are designed for harsh environments. Like Quantum Spark appliances, they use Gaia embedded as their operating system. Gaia embedded is a lightweight version of Gaia that supports a subset of features and commands.
Reference: [Check Point R81 Gaia Embedded Administration Guide]
B
Explanation:
Rugged appliances are small appliances with ruggedized hardware that are designed for harsh environments. Like Quantum Spark appliances, they use Gaia embedded as their operating system. Gaia embedded is a lightweight version of Gaia that supports a subset of features and commands.
Reference: [Check Point R81 Gaia Embedded Administration Guide]
Question #630
Which process is used mainly for backward compatibility of gateways in R81.X? It provides communication with GUI-client, database manipulation, policy compilation and Management HA synchronization.
- A . cpm
- B . fwd
- C . cpd
- D . fwm D18912E1457D5D1DDCBD40AB3BF70D5D
Correct Answer: D
D
Explanation:
The process that is used mainly for backward compatibility of gateways in R81.X is fwm. The fwm daemon handles communication with GUI-client, database manipulation, policy compilation and Management HA synchronization for legacy gateways that do not support the cpm daemon. The cpm daemon is the new Check Point Management Server daemon that handles these tasks for R80 and higher gateways. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The fwd daemon is the Firewall Daemon that handles communication between Security Gateways and Security Management Servers2.
Reference: 2: Check Point Software, Getting Started, Processes.
D
Explanation:
The process that is used mainly for backward compatibility of gateways in R81.X is fwm. The fwm daemon handles communication with GUI-client, database manipulation, policy compilation and Management HA synchronization for legacy gateways that do not support the cpm daemon. The cpm daemon is the new Check Point Management Server daemon that handles these tasks for R80 and higher gateways. The cpd daemon is the Check Point Management daemon that handles communication between SmartConsole applications and Security Management Servers. The fwd daemon is the Firewall Daemon that handles communication between Security Gateways and Security Management Servers2.
Reference: 2: Check Point Software, Getting Started, Processes.