Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #71
Which file contains the host address to be published, the MAC address that needs to be associated with the IP Address, and the unique IP of the interface that responds to ARP request?
- A . /opt/CPshrd-R81/conf/local.arp
- B . /var/opt/CPshrd-R81/conf/local.arp
- C . $CPDIR/conf/local.arp
- D . $FWDIR/conf/local.arp
Correct Answer: D
D
Explanation:
The file that contains the host address to be published, the MAC address that needs to be associated with the IP address, and the unique IP of the interface that responds to ARP request
is $FWDIR/conf/local.arp. Local.arp is a configuration file that defines static ARP entries for hosts behind NAT devices. This file allows the Security Gateway to respond to ARP requests for NATed hosts with the correct MAC address, and to publish the NATed IP address instead of the real IP address. The other files are either not related or not valid.
D
Explanation:
The file that contains the host address to be published, the MAC address that needs to be associated with the IP address, and the unique IP of the interface that responds to ARP request
is $FWDIR/conf/local.arp. Local.arp is a configuration file that defines static ARP entries for hosts behind NAT devices. This file allows the Security Gateway to respond to ARP requests for NATed hosts with the correct MAC address, and to publish the NATed IP address instead of the real IP address. The other files are either not related or not valid.
Question #72
Fill in the blanks: A _______ license requires an administrator to designate a gateway for attachment
whereas a ________ license is automatically attached to a Security Gateway.
- A . Formal; corporate
- B . Local; formal
- C . Local; central
- D . Central; local
Correct Answer: D
D
Explanation:
A central license requires an administrator to designate a gateway for attachment whereas a local license is automatically attached to a Security Gateway. A central license is managed by a Security Management Server or a Multi-Domain Security Management Server and can be attached to any gateway that is managed by that server. A local license is managed by a local license server on each gateway and cannot be moved to another gateway. Central licenses are more flexible and scalable than local licenses, as they can be easily transferred between gateways without generating new licenses.
D
Explanation:
A central license requires an administrator to designate a gateway for attachment whereas a local license is automatically attached to a Security Gateway. A central license is managed by a Security Management Server or a Multi-Domain Security Management Server and can be attached to any gateway that is managed by that server. A local license is managed by a local license server on each gateway and cannot be moved to another gateway. Central licenses are more flexible and scalable than local licenses, as they can be easily transferred between gateways without generating new licenses.
Question #73
Which statement is false in respect of the SmartConsole after upgrading the management server to R81.20?
- A . Yes. You can download the SmartConsole directly from the Download Center
- B . As far as you use version R80.40, no upgrade is needed due to compatibility mode
- C . Yes, using CPUSE you can make the installer available in the Web Portal of the Management Server
- D . Yes, the SmartConsole Upgrade package can be installed using CPUSE
Correct Answer: B
B
Explanation:
The statement that is false in respect of the SmartConsole after upgrading the management server to R81.20 is that as far as you use version R80.40, no upgrade is needed due to compatibility mode. This is false because SmartConsole R80.40 is not compatible with R81.20 management server and you need to upgrade your SmartConsole to R81.20 as well. The other statements are true and valid ways to obtain the SmartConsole upgrade package.
Reference: [Check Point Security Expert R81
Installation and Upgrade Guide], page 18.
B
Explanation:
The statement that is false in respect of the SmartConsole after upgrading the management server to R81.20 is that as far as you use version R80.40, no upgrade is needed due to compatibility mode. This is false because SmartConsole R80.40 is not compatible with R81.20 management server and you need to upgrade your SmartConsole to R81.20 as well. The other statements are true and valid ways to obtain the SmartConsole upgrade package.
Reference: [Check Point Security Expert R81
Installation and Upgrade Guide], page 18.
Question #74
Fill in the blank: A ________ VPN deployment is used to provide remote users with secure access to
internal corporate resources by authenticating the user through an internet browser.
- A . Clientless remote access
- B . Clientless direct access
- C . Client-based remote access
- D . Direct access
Correct Answer: A
A
Explanation:
A clientless remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. A clientless remote access VPN does not require any software installation or configuration on the user’s device. Instead, it uses a web-based portal that acts as a proxy between the user and the corporate resources. The user can access web applications and services through the portal using a standard web browser that supports SSL/TLS encryption. The portal can also provide single sign-on (SSO) capabilities for SAML-enabled applications. A clientless remote access VPN is suitable for scenarios where users need to access mainly web-based resources from unmanaged devices or devices that cannot run VPN clients.
The other options are incorrect because:
A client-based remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by installing a VPN client software on the user’s device. A client-based remote access VPN requires software installation and configuration on the user’s device. It uses IPsec or SSL/TLS protocols to create a secure tunnel between the user’s device and the VPN gateway. The user can access any type of resource through the tunnel using any application that supports TCP/IP protocols. A client-based remote access VPN is suitable for scenarios where users need to access various types of resources from managed devices or devices that can run VPN clients.
A clientless direct access deployment is not a valid term for a VPN deployment. Direct access is a feature of Windows Server that allows remote users to securely access internal corporate resources
without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user’s device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user’s device and the direct access server.
A direct access deployment is not a term for a VPN deployment, but a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user’s device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user’s device and the direct access server.
A
Explanation:
A clientless remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by authenticating the user through an internet browser. A clientless remote access VPN does not require any software installation or configuration on the user’s device. Instead, it uses a web-based portal that acts as a proxy between the user and the corporate resources. The user can access web applications and services through the portal using a standard web browser that supports SSL/TLS encryption. The portal can also provide single sign-on (SSO) capabilities for SAML-enabled applications. A clientless remote access VPN is suitable for scenarios where users need to access mainly web-based resources from unmanaged devices or devices that cannot run VPN clients.
The other options are incorrect because:
A client-based remote access VPN deployment is used to provide remote users with secure access to internal corporate resources by installing a VPN client software on the user’s device. A client-based remote access VPN requires software installation and configuration on the user’s device. It uses IPsec or SSL/TLS protocols to create a secure tunnel between the user’s device and the VPN gateway. The user can access any type of resource through the tunnel using any application that supports TCP/IP protocols. A client-based remote access VPN is suitable for scenarios where users need to access various types of resources from managed devices or devices that can run VPN clients.
A clientless direct access deployment is not a valid term for a VPN deployment. Direct access is a feature of Windows Server that allows remote users to securely access internal corporate resources
without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user’s device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user’s device and the direct access server.
A direct access deployment is not a term for a VPN deployment, but a feature of Windows Server that allows remote users to securely access internal corporate resources without using a VPN connection. Direct access uses IPv6 transition technologies and IPsec protocols to create a secure connection between the user’s device and the direct access server. The user can access any type of resource through the connection using any application that supports TCP/IP protocols. Direct access requires software installation and configuration on both the user’s device and the direct access server.
Question #75
What cloud-based SandBlast Mobile application is used to register new devices and users?
- A . Check Point Protect Application
- B . Management Dashboard
- C . Behavior Risk Engine
- D . Check Point Gateway
Correct Answer: D
D
Explanation:
The cloud-based SandBlast Mobile application that is used to register new devices and users is Check Point Gateway. Check Point Gateway is a web portal that allows administrators to enroll devices and users into the SandBlast Mobile service, which is a cloud-based solution that protects mobile devices from advanced threats. Check Point Gateway also allows administrators to configure policies, monitor device status, and generate reports for SandBlast Mobile.
D
Explanation:
The cloud-based SandBlast Mobile application that is used to register new devices and users is Check Point Gateway. Check Point Gateway is a web portal that allows administrators to enroll devices and users into the SandBlast Mobile service, which is a cloud-based solution that protects mobile devices from advanced threats. Check Point Gateway also allows administrators to configure policies, monitor device status, and generate reports for SandBlast Mobile.
Question #76
Which of the following statements about SecureXL NAT Templates is true?
- A . NAT Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new
connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are enabled by default and work only if Accept Templates are enabled. - B . DROP Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new
connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are disabled by default and work only if NAT Templates are disabled. - C . NAT Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new
connections can take advantage of this information and do NAT without the expensive rulebase
lookup. These are disabled by default and work only if Accept Templates are disabled. - D . ACCEPT Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are disabled by default and work only if NAT Templates are disabled.
Correct Answer: A
A
Explanation:
NAT Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are enabled by default and work only if Accept Templates are enabled1. According to the web search results, NAT Templates are a feature of SecureXL that accelerates the performance of the Security Gateway by offloading CPU-intensive operations to the SecureXL device2. NAT Templates are supported for Static NAT and Hide NAT using the existing SecureXL Templates mechanism1. NAT Templates are disabled by default on Check Point Security Gateway R80.10 and below, but they are not relevant to SecureXL in versions R80.20 and above, as all template handling has moved to the Firewall1. NAT Templates can be enabled or disabled by setting the relevant kernel parameters in $FWDIR/boot/modules/fwkern.conf file1.
Reference: SecureXL NAT Templates in R80.20 and lower – Check Point Software, SecureXL – Check Point Software
A
Explanation:
NAT Templates are generated to achieve high session rate for NAT. These templates store the NAT attributes of connections matched by rulebase so that similar new connections can take advantage of this information and do NAT without the expensive rulebase lookup. These are enabled by default and work only if Accept Templates are enabled1. According to the web search results, NAT Templates are a feature of SecureXL that accelerates the performance of the Security Gateway by offloading CPU-intensive operations to the SecureXL device2. NAT Templates are supported for Static NAT and Hide NAT using the existing SecureXL Templates mechanism1. NAT Templates are disabled by default on Check Point Security Gateway R80.10 and below, but they are not relevant to SecureXL in versions R80.20 and above, as all template handling has moved to the Firewall1. NAT Templates can be enabled or disabled by setting the relevant kernel parameters in $FWDIR/boot/modules/fwkern.conf file1.
Reference: SecureXL NAT Templates in R80.20 and lower – Check Point Software, SecureXL – Check Point Software
Question #77
What is the minimum amount of RAM needed for a Threat Prevention Appliance?
- A . 6GB
- B . 8GB with Gaia in 64-bit mode
- C . 4GB
- D . It depends on the number of software blades enabled
Correct Answer: C
C
Explanation:
According to the Check Point Resource Library, the minimum amount of RAM needed for a Threat Prevention Appliance is 4 GB. This applies to both physical and virtual appliances. The other options are either incorrect or irrelevant.
Reference: Check Point Resource Library
C
Explanation:
According to the Check Point Resource Library, the minimum amount of RAM needed for a Threat Prevention Appliance is 4 GB. This applies to both physical and virtual appliances. The other options are either incorrect or irrelevant.
Reference: Check Point Resource Library
Question #78
Which of the following Central Deployment is NOT a limitation in R81.20 SmartConsole?
- A . Security Gateway Clusters in Load Sharing mode
- B . Dedicated Log Server
- C . Dedicated SmartEvent Server
- D . Security Gateways/Clusters in ClusterXL HA new mode
Correct Answer: A
A
Explanation:
Security Gateway Clusters in Load Sharing mode are not supported by the Central Deployment feature in R81.20 SmartConsole. According to the Check Point R81.20 Known Limitations article1, Central Deployment in SmartConsole does not support:
Connection from SmartConsole Client to the Management Server through a proxy server. In this case,
use the applicable API command
ClusterXL in Load Sharing mode
VRRP Cluster
Installation of a package on a VSX VSLS Cluster that contains more than 3 members.
On Multi-Domain Servers: Global Domain, or the MDS context
Standalone server
Standby Security Management Server or Multi-Domain Security Management
Scalable Platforms 40000 / 60000
SMB Appliances
The other options are supported by the Central Deployment feature in R81.20 SmartConsole. Dedicated Log Server, Dedicated SmartEvent Server, and Security Gateways/Clusters in ClusterXL HA new mode can be selected as targets for installing packages using the Central Deployment wizard.
A
Explanation:
Security Gateway Clusters in Load Sharing mode are not supported by the Central Deployment feature in R81.20 SmartConsole. According to the Check Point R81.20 Known Limitations article1, Central Deployment in SmartConsole does not support:
Connection from SmartConsole Client to the Management Server through a proxy server. In this case,
use the applicable API command
ClusterXL in Load Sharing mode
VRRP Cluster
Installation of a package on a VSX VSLS Cluster that contains more than 3 members.
On Multi-Domain Servers: Global Domain, or the MDS context
Standalone server
Standby Security Management Server or Multi-Domain Security Management
Scalable Platforms 40000 / 60000
SMB Appliances
The other options are supported by the Central Deployment feature in R81.20 SmartConsole. Dedicated Log Server, Dedicated SmartEvent Server, and Security Gateways/Clusters in ClusterXL HA new mode can be selected as targets for installing packages using the Central Deployment wizard.
Question #79
When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, which of the following query syntax would you use?
- A . Toni? AND 10.0.4.210 NOT 10.0.4.76
- B . To** AND 10.0.4.210 NOT 10.0.4.76
- C . Ton* AND 10.0.4.210 NOT 10.0.4.75
- D . "Toni" AND 10.0.4.210 NOT 10.0.4.76
Correct Answer: D
D
Explanation:
When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, you would use the following query syntax: “Toni” AND 10.0.4.210 NOT 10.0.4.76
This query will match logs that contain the exact phrase “Toni” and the IP address 10.0.4.210, but not the IP address 10.0.4.76. The quotation marks around “Toni” ensure that only logs with that exact word are matched, not variations like Toni? or To**. The AND operator combines two conditions that must both be true, while the NOT operator excludes logs that match a certain condition.
Reference: [SmartLog User Guide]
D
Explanation:
When running a query on your logs, to find records for user Toni with machine IP of 10.0.4.210 but exclude her tablet IP of 10.0.4.76, you would use the following query syntax: “Toni” AND 10.0.4.210 NOT 10.0.4.76
This query will match logs that contain the exact phrase “Toni” and the IP address 10.0.4.210, but not the IP address 10.0.4.76. The quotation marks around “Toni” ensure that only logs with that exact word are matched, not variations like Toni? or To**. The AND operator combines two conditions that must both be true, while the NOT operator excludes logs that match a certain condition.
Reference: [SmartLog User Guide]
Question #80
What is the most ideal Synchronization Status for Security Management Server High Availability deployment?
- A . Lagging
- B . Synchronized
- C . Never been synchronized
- D . Collision
Correct Answer: B
B
Explanation:
The most ideal Synchronization Status for Security Management Server High Availability deployment is Synchronized. Security Management Server High Availability deployment is a feature that allows two or more Security Management Servers to provide redundancy and load balancing for managing security policies and logs. Synchronization Status is a parameter that indicates how up-to-date the databases of the Security Management Servers are with each other. Synchronization Status can have one of the following values: Synchronized, Lagging, Never been synchronized, or Collision. Synchronized means that the databases of all Security Management Servers are identical and have no conflicts. This is the most ideal status as it ensures consistency and reliability of security management. Lagging means that one or more Security Management Servers have not received all the updates from other Security Management Servers, and their databases are outdated. Never been synchronized means that one or more Security Management Servers have never synchronized their databases with other Security Management Servers, and their databases are independent. Collision means that one or more Security Management Servers have received conflicting updates from other Security Management Servers, and their databases have discrepancies.
B
Explanation:
The most ideal Synchronization Status for Security Management Server High Availability deployment is Synchronized. Security Management Server High Availability deployment is a feature that allows two or more Security Management Servers to provide redundancy and load balancing for managing security policies and logs. Synchronization Status is a parameter that indicates how up-to-date the databases of the Security Management Servers are with each other. Synchronization Status can have one of the following values: Synchronized, Lagging, Never been synchronized, or Collision. Synchronized means that the databases of all Security Management Servers are identical and have no conflicts. This is the most ideal status as it ensures consistency and reliability of security management. Lagging means that one or more Security Management Servers have not received all the updates from other Security Management Servers, and their databases are outdated. Never been synchronized means that one or more Security Management Servers have never synchronized their databases with other Security Management Servers, and their databases are independent. Collision means that one or more Security Management Servers have received conflicting updates from other Security Management Servers, and their databases have discrepancies.