Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #61
Can multiple administrators connect to a Security Management Server at the same time?
- A . No, only one can be connected
- B . Yes, all administrators can modify a network object at the same time
- C . Yes, every administrator has their own username, and works in a session that is independent of other administrators.
- D . Yes, but only one has the right to write.
Correct Answer: C
C
Explanation:
Multiple administrators can connect to a Security Management Server at the same time. Each administrator has their own username and works in a session that is independent of other administrators. This allows for collaboration and simultaneous management tasks by different administrators.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
C
Explanation:
Multiple administrators can connect to a Security Management Server at the same time. Each administrator has their own username and works in a session that is independent of other administrators. This allows for collaboration and simultaneous management tasks by different administrators.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #62
You need to change the MAC-address on eth2 interface of the gateway.
What is the correct way to change MAC-address in Check Point Gaia?
- A . In CLISH run: set interface eth2 mac-addr 11:11:11:11:11:11
- B . In expert-mode run ifconfig eth1 hw 11:11:11:11 11 11
- C . In CLISH run set interface eth2 hw-addr 11 11 11:11:11 11
- D . In expert-mode run: ethtool -4 eth2 mac 11 11:11:11:11:11
Correct Answer: A
A
Explanation:
The correct way to change MAC-address in Check Point Gaia is to run the command set interface eth2 mac-addr 11:11:11:11:11:11 in CLISH mode. This command will change the MAC address of the eth2 interface to 11:11:11:11:11:11 and save the configuration. The other commands are either incorrect or not supported in Gaia. The ifconfig command is used in Expert mode to configure network interfaces, but it does not support changing MAC addresses. The ethtool command is used in Expert mode to query and control network device driver and hardware settings, but it does not support changing MAC addresses. The set interface eth2 hw-addr command is not a valid command in CLISH mode.
Reference: [Changing MAC Address]
A
Explanation:
The correct way to change MAC-address in Check Point Gaia is to run the command set interface eth2 mac-addr 11:11:11:11:11:11 in CLISH mode. This command will change the MAC address of the eth2 interface to 11:11:11:11:11:11 and save the configuration. The other commands are either incorrect or not supported in Gaia. The ifconfig command is used in Expert mode to configure network interfaces, but it does not support changing MAC addresses. The ethtool command is used in Expert mode to query and control network device driver and hardware settings, but it does not support changing MAC addresses. The set interface eth2 hw-addr command is not a valid command in CLISH mode.
Reference: [Changing MAC Address]
Question #63
CoreXL is NOT supported when one of the following features is enabled: (Choose three)
- A . Route-based VPN
- B . IPS
- C . IPv6
- D . Overlapping NAT
Correct Answer: A, C, D
A, C, D
Explanation:
CoreXL is not supported when one of the following features is enabled: Check Point QoS (Quality of Service), Route-based VPN, IPv6 on IPSO, or Overlapping NAT. CoreXL is a performance-enhancing technology that allows multiple CPU cores to concurrently handle network traffic. IPS is supported by CoreXL and can benefit from its acceleration.
Reference: Check Point Software, Getting Started, CoreXL;: Check Point Software, Getting Started, IPS.
A, C, D
Explanation:
CoreXL is not supported when one of the following features is enabled: Check Point QoS (Quality of Service), Route-based VPN, IPv6 on IPSO, or Overlapping NAT. CoreXL is a performance-enhancing technology that allows multiple CPU cores to concurrently handle network traffic. IPS is supported by CoreXL and can benefit from its acceleration.
Reference: Check Point Software, Getting Started, CoreXL;: Check Point Software, Getting Started, IPS.
Question #64
Which application should you use to install a contract file?
- A . SmartView Monitor
- B . WebUI
- C . SmartUpdate
- D . SmartProvisioning
Correct Answer: C
C
Explanation:
According to the Check Point website, SmartUpdate is the application that should be used to install a contract file. A contract file contains information about the licenses and services that are purchased from Check Point. SmartUpdate can also be used to install software packages and patches on Security Gateways and Management Servers. The other applications are either not relevant or not capable of installing a contract file.
Reference: SmartUpdate
C
Explanation:
According to the Check Point website, SmartUpdate is the application that should be used to install a contract file. A contract file contains information about the licenses and services that are purchased from Check Point. SmartUpdate can also be used to install software packages and patches on Security Gateways and Management Servers. The other applications are either not relevant or not capable of installing a contract file.
Reference: SmartUpdate
Question #65
What is the minimum number of CPU cores required to enable CoreXL?
- A . 1
- B . 6
- C . 2
- D . 4
Correct Answer: C
C
Explanation:
CoreXL is a technology that improves the performance of the Security Gateway by utilizing multiple CPU cores for processing traffic. CoreXL creates multiple instances of the firewall kernel (fwk) that run in parallel on different CPU cores. The number of kernel instances can be configured using the cpconfig command on the Security Gateway3. The minimum number of CPU cores required to enable CoreXL is 2, as one core is reserved for SND (Secure Network Distributor) and one core is used for running a kernel instance4. If the Security Gateway has only one CPU core, CoreXL cannot be enabled. Therefore, the correct answer is C.
Reference: 3: CoreXL Administration Guide 4: [CoreXL Frequently Asked Questions (FAQ)]
C
Explanation:
CoreXL is a technology that improves the performance of the Security Gateway by utilizing multiple CPU cores for processing traffic. CoreXL creates multiple instances of the firewall kernel (fwk) that run in parallel on different CPU cores. The number of kernel instances can be configured using the cpconfig command on the Security Gateway3. The minimum number of CPU cores required to enable CoreXL is 2, as one core is reserved for SND (Secure Network Distributor) and one core is used for running a kernel instance4. If the Security Gateway has only one CPU core, CoreXL cannot be enabled. Therefore, the correct answer is C.
Reference: 3: CoreXL Administration Guide 4: [CoreXL Frequently Asked Questions (FAQ)]
Question #66
What is the correct order of the default “fw monitor” inspection points?
- A . i, o, l, O
- B . i, l, o, O
- C . 1,2,3,4
- D . l, i, O, o
Correct Answer: B
B
Explanation:
https://community.checkpoint.com/t5/General-Topics/Check-Point-Inspection-points-iIoO/td-p/34938
The default order of the "fw monitor" inspection points is:
i (input): this is the first inspection point, where packets enter the firewall.
l (local): this is the second inspection point, where packets are processed locally by the firewall, before being forwarded to the next hop.
o (output): this is the third inspection point, where packets are sent out to their final destination.
O (offload): this is the fourth inspection point, where packets are offloaded to hardware acceleration for faster processing.
B
Explanation:
https://community.checkpoint.com/t5/General-Topics/Check-Point-Inspection-points-iIoO/td-p/34938
The default order of the "fw monitor" inspection points is:
i (input): this is the first inspection point, where packets enter the firewall.
l (local): this is the second inspection point, where packets are processed locally by the firewall, before being forwarded to the next hop.
o (output): this is the third inspection point, where packets are sent out to their final destination.
O (offload): this is the fourth inspection point, where packets are offloaded to hardware acceleration for faster processing.
Question #67
SSL Network Extender (SNX) is a thin SSL VPN on-demand client that is installed on the remote user’s machine via the web browser.
What are the two modes of SNX?
- A . Application and Client Service
- B . Network and Application
- C . Network and Layers
- D . Virtual Adapter and Mobile App
Correct Answer: B
B
Explanation:
SSL Network Extender (SNX) has two modes of operation: Network Mode and Application Mode. Network Mode provides full network connectivity to the remote user, while Application Mode provides access to specific applications on the corporate network.
Reference: [SSL Network Extender]
B
Explanation:
SSL Network Extender (SNX) has two modes of operation: Network Mode and Application Mode. Network Mode provides full network connectivity to the remote user, while Application Mode provides access to specific applications on the corporate network.
Reference: [SSL Network Extender]
Question #68
What is the default shell of Gaia CLI?
- A . Monitor
- B . CLI.sh
- C . Read-only
- D . Bash
Correct Answer: A
A
Explanation:
The default shell of Gaia CLI is clish. Clish stands for Command Line Interface Shell and it is a restrictive shell that controls the number of commands available in the CLI. Clish provides a user-friendly interface that supports command completion, history, and help functions. Clish also supports role-based administration, which means that different users can have different levels of access to Gaia features and commands based on their roles.
A
Explanation:
The default shell of Gaia CLI is clish. Clish stands for Command Line Interface Shell and it is a restrictive shell that controls the number of commands available in the CLI. Clish provides a user-friendly interface that supports command completion, history, and help functions. Clish also supports role-based administration, which means that different users can have different levels of access to Gaia features and commands based on their roles.
Question #69
What will SmartEvent automatically define as events?
- A . Firewall
- B . VPN
- C . IPS
- D . HTTPS
Correct Answer: C
C
Explanation:
SmartEvent automatically defines events based on IPS (Intrusion Prevention System) alerts. IPS is a feature that detects and prevents malicious network traffic based on predefined or custom signatures. IPS alerts are generated when IPS detects an attack or an anomaly that matches a signature. SmartEvent collects and correlates IPS alerts from different gateways and displays them as events in SmartEventWeb. The other options are not automatically defined as events by SmartEvent.
C
Explanation:
SmartEvent automatically defines events based on IPS (Intrusion Prevention System) alerts. IPS is a feature that detects and prevents malicious network traffic based on predefined or custom signatures. IPS alerts are generated when IPS detects an attack or an anomaly that matches a signature. SmartEvent collects and correlates IPS alerts from different gateways and displays them as events in SmartEventWeb. The other options are not automatically defined as events by SmartEvent.
Question #70
Secure Configuration Verification (SCV), makes sure that remote access client computers are configured in accordance with the enterprise Security Policy. Bob was asked by Alice to implement a specific SCV configuration but therefore Bob needs to edit and configure a specific Check Point file.
Which location file and directory is true?
- A . $FWDIR/conf/client.scv
- B . $CPDIR/conf/local.scv
- C . $CPDIR/conf/client.svc
- D . $FWDIR/conf/local.scv
Correct Answer: D
D
Explanation:
Secure Configuration Verification (SCV) is a feature that allows the Mobile Access Gateway to check the compliance of remote access clients with the enterprise security policy before granting them access to internal resources. SCV checks can be defined in a file named local.scv, which is located in the $FWDIR/conf directory on the Mobile Access Gateway1. The file can be edited manually or using the SCV Editor tool2. Therefore, the correct answer is D)
Reference: 1: Secure Configuration Verification 2: SCV Editor
D
Explanation:
Secure Configuration Verification (SCV) is a feature that allows the Mobile Access Gateway to check the compliance of remote access clients with the enterprise security policy before granting them access to internal resources. SCV checks can be defined in a file named local.scv, which is located in the $FWDIR/conf directory on the Mobile Access Gateway1. The file can be edited manually or using the SCV Editor tool2. Therefore, the correct answer is D)
Reference: 1: Secure Configuration Verification 2: SCV Editor