Check Point 156-315.81.20 Practice Exams
Last updated on Oct 24,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 24,2026
Question #631
Which GUI client is supported in R81?
- A . SmartProvisioning
- B . SmartView Tracker
- C . SmartView Monitor
- D . SmartLog
Correct Answer: C
C
Explanation:
SmartView Monitor is a GUI client that is supported in R81. It allows you to monitor the network and security performance of your Security Gateways and devices5. You can use it to view real-time statistics, alerts, logs, reports, and graphs6. The other GUI clients are not supported in R81 because:
A) SmartProvisioning was replaced by SmartLSM in R80.20 and later versions7. SmartLSM is a unified solution for managing large-scale deployments of Security Gateways8.
B) SmartView Tracker was replaced by SmartLog in R80 and later versions9. SmartLog is a powerful log analysis tool that enables fast and easy access to log data from multiple Security Gateways10.
D) SmartLog is not a GUI client, but a web-based application that runs on the Security Management Server or Log Server10. You can access it from any web browser or from SmartConsole.
Reference: SmartView Monitor R81 Help, SmartView Monitor R81 Administration Guide, What’s New in Check Point R80.20, SmartLSM R81 Help, What’s New in Check Point R80, SmartLog R81 Help
C
Explanation:
SmartView Monitor is a GUI client that is supported in R81. It allows you to monitor the network and security performance of your Security Gateways and devices5. You can use it to view real-time statistics, alerts, logs, reports, and graphs6. The other GUI clients are not supported in R81 because:
A) SmartProvisioning was replaced by SmartLSM in R80.20 and later versions7. SmartLSM is a unified solution for managing large-scale deployments of Security Gateways8.
B) SmartView Tracker was replaced by SmartLog in R80 and later versions9. SmartLog is a powerful log analysis tool that enables fast and easy access to log data from multiple Security Gateways10.
D) SmartLog is not a GUI client, but a web-based application that runs on the Security Management Server or Log Server10. You can access it from any web browser or from SmartConsole.
Reference: SmartView Monitor R81 Help, SmartView Monitor R81 Administration Guide, What’s New in Check Point R80.20, SmartLSM R81 Help, What’s New in Check Point R80, SmartLog R81 Help
Question #632
Which of the following is NOT an attribute of packet acceleration?
- A . Source address
- B . Protocol
- C . Destination port
- D . VLAN Tag
Correct Answer: D
D
Explanation:
VLAN Tag is not an attribute of packet acceleration. Packet acceleration is a feature of SecureXL that allows certain packets to bypass the Firewall kernel and be processed by a more efficient mechanism. Packet acceleration is based on templates that match packets based on four attributes: Source IP address, Destination IP address, Protocol, and Destination port. If a packet matches an existing template, it is accelerated; otherwise, it is sent to the Firewall path for inspection.
Reference: [SecureXL Mechanism]
D
Explanation:
VLAN Tag is not an attribute of packet acceleration. Packet acceleration is a feature of SecureXL that allows certain packets to bypass the Firewall kernel and be processed by a more efficient mechanism. Packet acceleration is based on templates that match packets based on four attributes: Source IP address, Destination IP address, Protocol, and Destination port. If a packet matches an existing template, it is accelerated; otherwise, it is sent to the Firewall path for inspection.
Reference: [SecureXL Mechanism]
Question #633
To ensure that VMAC mode is enabled, which CLI command should you run on all cluster members?
- A . fw ctl set int fwha vmac global param enabled
- B . fw ctl get int vmac global param enabled; result of command should return value 1
- C . cphaprob-a if
- D . fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1
Correct Answer: D
D
Explanation:
To ensure that VMAC mode is enabled, the CLI command that should be run on all cluster members is fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1. VMAC mode is a feature that allows ClusterXL to use virtual MAC addresses for cluster interfaces, instead of physical MAC addresses. This improves the failover performance and compatibility of ClusterXL with switches and routers. To check if VMAC mode is enabled, the command fw ctl get int fwha_vmac_global_param_enabled can be used, which returns 1 if VMAC mode is enabled, and 0 if
VMAC mode is disabled.
D
Explanation:
To ensure that VMAC mode is enabled, the CLI command that should be run on all cluster members is fw ctl get int fwha_vmac_global_param_enabled; result of command should return value 1. VMAC mode is a feature that allows ClusterXL to use virtual MAC addresses for cluster interfaces, instead of physical MAC addresses. This improves the failover performance and compatibility of ClusterXL with switches and routers. To check if VMAC mode is enabled, the command fw ctl get int fwha_vmac_global_param_enabled can be used, which returns 1 if VMAC mode is enabled, and 0 if
VMAC mode is disabled.
Question #634
Besides fw monitor, what is another command that can be used to capture packets?
- A . arp
- B . traceroute
- C . tcpdump
- D . ping
Correct Answer: C
C
Explanation:
Tcpdump is a tool that captures and analyzes network traffic on a given interface2. It can be used to troubleshoot connectivity or performance issues, or to inspect the content of the packets2. To use tcpdump, you need to access the Security Gateway in expert mode and run tcpdump -i <interface> [options] [filter]2. You can specify various options and filters to customize the output, such as source or destination IP address, port number, protocol, packet size, etc2. You can also save the captured packets to a file for later analysis by using the -w option2. For more information about tcpdump, you can run man tcpdump or visit the official website3.
C
Explanation:
Tcpdump is a tool that captures and analyzes network traffic on a given interface2. It can be used to troubleshoot connectivity or performance issues, or to inspect the content of the packets2. To use tcpdump, you need to access the Security Gateway in expert mode and run tcpdump -i <interface> [options] [filter]2. You can specify various options and filters to customize the output, such as source or destination IP address, port number, protocol, packet size, etc2. You can also save the captured packets to a file for later analysis by using the -w option2. For more information about tcpdump, you can run man tcpdump or visit the official website3.
Question #635
What are scenarios supported by the Central Deployment in SmartConsole?
- A . Installation of Jumbo Hotfix on a ClusterXL environment in High Availability Mode
- B . Upgrading a Dedicated SmartEvent Server
- C . Upgrading a Dedicated Log Server to R81
- D . Upgrading a Standalone environment
Correct Answer: A
Question #636
You have existing dbedit scripts from R77. Can you use them with R81.20?
- A . dbedit is not supported in R81.20
- B . dbedit is fully supported in R81.20
- C . You can use dbedit to modify threat prevention or access policies, but not create or modify layers
- D . dbedit scripts are being replaced by mgmt_cli in R81.20
Correct Answer: D
D
Explanation:
In R81.20, dbedit scripts are being replaced by the mgmt_cli utility for managing and configuring security policies and objects.
Here’s an explanation of each option:
A) dbedit is not supported in R81.20: This is not entirely accurate. While dbedit is still available and functional in R81.20, it is being phased out in favor of mgmt_cli for policy and object management.
B) dbedit is fully supported in R81.20: This statement is not accurate because although dbedit can still be used, it is not the primary recommended tool for policy management in R81.20.
C) You can use dbedit to modify threat prevention or access policies, but not create or modify layers: This statement is partially true, but it does not provide the complete picture. You can use dbedit for some policy-related tasks, but it’s not the primary tool for policy management in R81.20.
D) dbedit scripts are being replaced by mgmt_cli in R81.20: This is the correct and recommended
approach. mgmt_cli is the primary tool for managing security policies and objects in R81.20, and it is gradually replacing dbedit for these tasks.
Therefore, option D is the most accurate and recommended answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
D
Explanation:
In R81.20, dbedit scripts are being replaced by the mgmt_cli utility for managing and configuring security policies and objects.
Here’s an explanation of each option:
A) dbedit is not supported in R81.20: This is not entirely accurate. While dbedit is still available and functional in R81.20, it is being phased out in favor of mgmt_cli for policy and object management.
B) dbedit is fully supported in R81.20: This statement is not accurate because although dbedit can still be used, it is not the primary recommended tool for policy management in R81.20.
C) You can use dbedit to modify threat prevention or access policies, but not create or modify layers: This statement is partially true, but it does not provide the complete picture. You can use dbedit for some policy-related tasks, but it’s not the primary tool for policy management in R81.20.
D) dbedit scripts are being replaced by mgmt_cli in R81.20: This is the correct and recommended
approach. mgmt_cli is the primary tool for managing security policies and objects in R81.20, and it is gradually replacing dbedit for these tasks.
Therefore, option D is the most accurate and recommended answer.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #637
How can you grant GAiAAPI Permissions for a newly created user?
- A . Assign the user a permission profile in SmartConsole
- B . Assign the user the admin RBAC role in dish
- C . No need to grant access since every user has access by default.
- D . In bash, use the following command: "gaia_api access –user Tom -enable true"
Correct Answer: A
A
Explanation:
To grant GAiAAPI permissions for a newly created user, you need to assign the user a permission profile in SmartConsole. A permission profile defines the access level and scope of actions that a user can perform using the GAiAAPI. You can choose from predefined permission profiles or create your own custom profiles. You cannot grant GAiAAPI permissions using dish or bash commands.
Reference: [Check Point Security Expert R81 API Reference Guide], page 9.
A
Explanation:
To grant GAiAAPI permissions for a newly created user, you need to assign the user a permission profile in SmartConsole. A permission profile defines the access level and scope of actions that a user can perform using the GAiAAPI. You can choose from predefined permission profiles or create your own custom profiles. You cannot grant GAiAAPI permissions using dish or bash commands.
Reference: [Check Point Security Expert R81 API Reference Guide], page 9.
Question #638
What a valid SecureXL paths in R81.20?
- A . F2F (Slow path). Templated Path. PQX and F2V
- B . F2F (Slow path). PXL, QXL and F2V
- C . F2F (Slow path), Accelerated Path, PQX and F2V
- D . F2F (Slow path), Accelerated Path, Medium Path and F2V
Correct Answer: D
D
Explanation:
The valid SecureXL paths in R81.20 are F2F (Slow path), Accelerated Path, Medium Path and F2V1. SecureXL is a technology that accelerates the performance of the Security Gateway by offloading CPU-intensive operations to the SecureXL device2. SecureXL uses different paths to process packets, depending on the type and state of the connection3. The SecureXL paths are3: F2F (Slow path): This path handles packets that require a full inspection by the Firewall kernel. It is the slowest path, but it supports all features and blades. Examples of packets that use this path are packets that belong to a new connection, packets that match a rule with UTM blades, or packets that require address translation.
Accelerated Path: This path handles packets that belong to an established connection that does not require any further inspection by the Firewall kernel. It is the fastest path, but it supports only a limited set of features and blades. Examples of packets that use this path are packets that match an accept rule with no UTM blades, or packets that match a rule with SecureXL acceleration enabled.
Medium Path: This path handles packets that belong to an established connection that requires some inspection by the Firewall kernel, but not a full inspection. It is faster than the F2F path, but slower than the Accelerated path. It supports more features and blades than the Accelerated path, but less than the F2F path. Examples of packets that use this path are packets that match a rule with IPS or Anti-Bot blades, or packets that require NAT templates.
F2V: This path handles packets that are encapsulated or decapsulated by the VPN kernel. It is faster than the F2F path, but slower than the Accelerated path. It supports VPN features such as encryption, decryption, encapsulation, and decapsulation.
Reference: R81.x Security Gateway Architecture (Logical Packet Flow) – Check Point CheckMates, SecureXL Mechanism in R80.10 and above – Check Point Software, SecureXL – Check Point Software
D
Explanation:
The valid SecureXL paths in R81.20 are F2F (Slow path), Accelerated Path, Medium Path and F2V1. SecureXL is a technology that accelerates the performance of the Security Gateway by offloading CPU-intensive operations to the SecureXL device2. SecureXL uses different paths to process packets, depending on the type and state of the connection3. The SecureXL paths are3: F2F (Slow path): This path handles packets that require a full inspection by the Firewall kernel. It is the slowest path, but it supports all features and blades. Examples of packets that use this path are packets that belong to a new connection, packets that match a rule with UTM blades, or packets that require address translation.
Accelerated Path: This path handles packets that belong to an established connection that does not require any further inspection by the Firewall kernel. It is the fastest path, but it supports only a limited set of features and blades. Examples of packets that use this path are packets that match an accept rule with no UTM blades, or packets that match a rule with SecureXL acceleration enabled.
Medium Path: This path handles packets that belong to an established connection that requires some inspection by the Firewall kernel, but not a full inspection. It is faster than the F2F path, but slower than the Accelerated path. It supports more features and blades than the Accelerated path, but less than the F2F path. Examples of packets that use this path are packets that match a rule with IPS or Anti-Bot blades, or packets that require NAT templates.
F2V: This path handles packets that are encapsulated or decapsulated by the VPN kernel. It is faster than the F2F path, but slower than the Accelerated path. It supports VPN features such as encryption, decryption, encapsulation, and decapsulation.
Reference: R81.x Security Gateway Architecture (Logical Packet Flow) – Check Point CheckMates, SecureXL Mechanism in R80.10 and above – Check Point Software, SecureXL – Check Point Software
Question #639
After replacing a faulty Gateway the admin installed the new Hardware and want to push the policy. Installing the policy using the SmartConsole he got an Error for the Threat Prevention Policy. There is no error for the Access Control Policy.
What will be the most common cause for the issue?
- A . The admin forgot to reestablish the SIC for the new hardware. That is typically the case when configure only the interfaces of the replacement hardware instead restoring a backup.
- B . The IPS Protection engine on the replacement hardware is too old. Before pushing the Threat Prevention Policy use SmartConsole -> Security Policies -> Updates -> IPS ‘Update Now’ to update the engine.
- C . The admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing.
- D . The Threat Prevention Policy can’t be installed on a Gateway without an already installed Access Control Policy. First install only the Access Control Policy.
Correct Answer: C
C
Explanation:
The most common cause for the issue is that the admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing. Without a valid license, the Threat Prevention Policy cannot be installed on the new hardware. The admin should check the license status on the SmartConsole -> Gateways & Servers -> Licenses & Contracts and apply the appropriate license for the replacement
hardware.
Reference: Check Point Certified Security Expert R81.20 Course Overview, sk171213:
Threat Prevention policy installation reports failure in SmartConsole with this error: “Policy installation had failed due to an internal error.”
C
Explanation:
The most common cause for the issue is that the admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing. Without a valid license, the Threat Prevention Policy cannot be installed on the new hardware. The admin should check the license status on the SmartConsole -> Gateways & Servers -> Licenses & Contracts and apply the appropriate license for the replacement
hardware.
Reference: Check Point Certified Security Expert R81.20 Course Overview, sk171213:
Threat Prevention policy installation reports failure in SmartConsole with this error: “Policy installation had failed due to an internal error.”
Question #639
After replacing a faulty Gateway the admin installed the new Hardware and want to push the policy. Installing the policy using the SmartConsole he got an Error for the Threat Prevention Policy. There is no error for the Access Control Policy.
What will be the most common cause for the issue?
- A . The admin forgot to reestablish the SIC for the new hardware. That is typically the case when configure only the interfaces of the replacement hardware instead restoring a backup.
- B . The IPS Protection engine on the replacement hardware is too old. Before pushing the Threat Prevention Policy use SmartConsole -> Security Policies -> Updates -> IPS ‘Update Now’ to update the engine.
- C . The admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing.
- D . The Threat Prevention Policy can’t be installed on a Gateway without an already installed Access Control Policy. First install only the Access Control Policy.
Correct Answer: C
C
Explanation:
The most common cause for the issue is that the admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing. Without a valid license, the Threat Prevention Policy cannot be installed on the new hardware. The admin should check the license status on the SmartConsole -> Gateways & Servers -> Licenses & Contracts and apply the appropriate license for the replacement
hardware.
Reference: Check Point Certified Security Expert R81.20 Course Overview, sk171213:
Threat Prevention policy installation reports failure in SmartConsole with this error: “Policy installation had failed due to an internal error.”
C
Explanation:
The most common cause for the issue is that the admin forgot to apply the new license. The Access Control license is included by default but the service subscriptions for the Threat Prevention Blades are missing. Without a valid license, the Threat Prevention Policy cannot be installed on the new hardware. The admin should check the license status on the SmartConsole -> Gateways & Servers -> Licenses & Contracts and apply the appropriate license for the replacement
hardware.
Reference: Check Point Certified Security Expert R81.20 Course Overview, sk171213:
Threat Prevention policy installation reports failure in SmartConsole with this error: “Policy installation had failed due to an internal error.”