Check Point 156-315.81.20 Practice Exams
Last updated on Oct 22,2026- Exam Code: 156-315.81.20
- Exam Name: Check Point Certified Security Expert - R81.20
- Certification Provider: Check Point
- Latest update: Oct 22,2026
Question #81
Fill in the blank: Identity Awareness AD-Query is using the Microsoft _______________ API to learn
users from AD.
- A . WMI
- B . Eventvwr
- C . XML
- D . Services.msc
Correct Answer: A
A
Explanation:
Identity Awareness AD-Query is using the Microsoft WMI API to learn users from AD. WMI stands for Windows Management Instrumentation, and it is an API that allows remote management and monitoring of Windows systems. Identity Awareness AD-Query is a feature that enables the Security Gateway to query Active Directory servers for user and computer information, such as login events, group membership, and IP addresses. By using the WMI API, Identity Awareness AD-Query can receive real-time notifications from Active Directory servers without installing any agents or scripts on them.
A
Explanation:
Identity Awareness AD-Query is using the Microsoft WMI API to learn users from AD. WMI stands for Windows Management Instrumentation, and it is an API that allows remote management and monitoring of Windows systems. Identity Awareness AD-Query is a feature that enables the Security Gateway to query Active Directory servers for user and computer information, such as login events, group membership, and IP addresses. By using the WMI API, Identity Awareness AD-Query can receive real-time notifications from Active Directory servers without installing any agents or scripts on them.
Question #82
After making modifications to the $CVPNDIR/conf/cvpnd.C file, how would you restart the daemon?
- A . cvpnd_restart
- B . cvpnd_restart
- C . cvpnd restart
- D . cvpnrestart
Correct Answer: B
B
Explanation:
The cvpnd_restart command is used to restart the daemon after making modifications to the $CVPNDIR/conf/cvpnd.C file. The cvpnd daemon is responsible for managing the communication between the Check Point components and the Content Vectoring Protocol (CVP) server. The CVP server is an external server that provides content inspection and filtering services for Check Point gateways. The $CVPNDIR/conf/cvpnd.C file contains the configuration settings for the cvpnd daemon, such as the CVP server IP address, port number, timeout value, and debug level.
Reference: Check Point Security Expert R81 Course, Content Inspection Using ICAP, cvpnd daemon debug file
B
Explanation:
The cvpnd_restart command is used to restart the daemon after making modifications to the $CVPNDIR/conf/cvpnd.C file. The cvpnd daemon is responsible for managing the communication between the Check Point components and the Content Vectoring Protocol (CVP) server. The CVP server is an external server that provides content inspection and filtering services for Check Point gateways. The $CVPNDIR/conf/cvpnd.C file contains the configuration settings for the cvpnd daemon, such as the CVP server IP address, port number, timeout value, and debug level.
Reference: Check Point Security Expert R81 Course, Content Inspection Using ICAP, cvpnd daemon debug file
Question #83
Which command collects diagnostic data for analyzing customer setup remotely?
- A . cpinfo
- B . migrate export
- C . sysinfo
- D . cpview
Correct Answer: A
A
Explanation:
CPInfo is an auto-updatable utility that collects diagnostics data on a customer’s machine at the time of execution and uploads it to Check Point servers (it replaces the standalone cp_uploader utility for uploading files to Check Point servers).
The CPInfo output file allows analyzing customer setups from a remote location. Check Point support engineers can open the CPInfo file in a demo mode, while viewing actual customer Security Policies and Objects. This allows the in-depth analysis of customer’s configuration and environment settings.
A
Explanation:
CPInfo is an auto-updatable utility that collects diagnostics data on a customer’s machine at the time of execution and uploads it to Check Point servers (it replaces the standalone cp_uploader utility for uploading files to Check Point servers).
The CPInfo output file allows analyzing customer setups from a remote location. Check Point support engineers can open the CPInfo file in a demo mode, while viewing actual customer Security Policies and Objects. This allows the in-depth analysis of customer’s configuration and environment settings.
Question #84
What is mandatory for ClusterXL to work properly?
- A . The number of cores must be the same on every participating cluster node
- B . The Magic MAC number must be unique per cluster node
- C . The Sync interface must not have an IP address configured
- D . If you have “Non-monitored Private” interfaces, the number of those interfaces must be the same on all cluster members
Correct Answer: B
B
Explanation:
For ClusterXL to work properly, one of the mandatory requirements is that the Magic MAC number must be unique per cluster node. The Magic MAC number is a MAC address that is used by ClusterXL to hide the physical MAC addresses of the cluster members from the network. This way, the cluster can present a single virtual MAC address to the network, and avoid ARP issues when a failover occurs. The Magic MAC number is derived from the Cluster Virtual IP address, which must also be unique per cluster.
B
Explanation:
For ClusterXL to work properly, one of the mandatory requirements is that the Magic MAC number must be unique per cluster node. The Magic MAC number is a MAC address that is used by ClusterXL to hide the physical MAC addresses of the cluster members from the network. This way, the cluster can present a single virtual MAC address to the network, and avoid ARP issues when a failover occurs. The Magic MAC number is derived from the Cluster Virtual IP address, which must also be unique per cluster.
Question #85
If there are two administration logged in at the same time to the SmartConsole, and there are objects locked for editing, what must be done to make them available or other administrators? (Choose the BEST answer.)
- A . Publish or discard the session.
- B . Revert the session.
- C . Save and install the Policy.
- D . Delete older versions of database.
Correct Answer: A
A
Explanation:
The only way to make objects locked for editing available for other administrators is to publish or discard the session that contains the changes. Publishing the session will save and share the changes with other administrators, while discarding the session will undo and discard the changes. Saving the session will only save the changes locally, but not share them with others or release the locks. Reverting the session will restore a previous version of the session, but not affect the locks. Saving and installing the policy will only install the policy on the gateways, but not share or discard the changes in SmartConsole. Deleting older versions of database will only free up disk space, but not affect the locks.
A
Explanation:
The only way to make objects locked for editing available for other administrators is to publish or discard the session that contains the changes. Publishing the session will save and share the changes with other administrators, while discarding the session will undo and discard the changes. Saving the session will only save the changes locally, but not share them with others or release the locks. Reverting the session will restore a previous version of the session, but not affect the locks. Saving and installing the policy will only install the policy on the gateways, but not share or discard the changes in SmartConsole. Deleting older versions of database will only free up disk space, but not affect the locks.
Question #86
Tom has connected to the R81 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity. Connectivity is restored shortly afterward.
What will happen to the changes already made?
- A . Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.
- B . Tom will have to reboot his SmartConsole computer, and access the Management cache store on that computer, which is only accessible after a reboot.
- C . Tom’s changes will be lost since he lost connectivity and he will have to start again.
- D . Tom will have to reboot his SmartConsole computer, clear to cache, and restore changes.
Correct Answer: A
A
Explanation:
Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.
This is because SmartConsole has a feature called Concurrent Administration, which allows multiple
administrators to work on the same Security Policy simultaneously, without blocking each other or creating conflicts. Concurrent Administration uses a locking mechanism to prevent multiple administrators from modifying the same rule or object at the same time. When an administrator clicks on a rule or an object, it becomes locked and a lock icon appears next to it. The lock icon shows the name of the administrator who is working on that rule or object, and prevents other administrators from editing it until it is unlocked12.
Concurrent Administration also has a feature called Session Persistence, which preserves the changes made by an administrator in case of a network failure or a SmartConsole crash. When an administrator reconnects to the Management Server after a network failure or a SmartConsole crash, they can resume their work from where they left off, without losing any changes. The changes are stored locally on the administrator’s machine until they are published to the Management Server13. Therefore, if Tom has connected to the R81 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity, his changes will not be lost. They will be stored locally on his machine and he can resume his work when he reconnects to the Management Server.
A
Explanation:
Tom’s changes will have been stored on the Management when he reconnects and he will not lose any of his work.
This is because SmartConsole has a feature called Concurrent Administration, which allows multiple
administrators to work on the same Security Policy simultaneously, without blocking each other or creating conflicts. Concurrent Administration uses a locking mechanism to prevent multiple administrators from modifying the same rule or object at the same time. When an administrator clicks on a rule or an object, it becomes locked and a lock icon appears next to it. The lock icon shows the name of the administrator who is working on that rule or object, and prevents other administrators from editing it until it is unlocked12.
Concurrent Administration also has a feature called Session Persistence, which preserves the changes made by an administrator in case of a network failure or a SmartConsole crash. When an administrator reconnects to the Management Server after a network failure or a SmartConsole crash, they can resume their work from where they left off, without losing any changes. The changes are stored locally on the administrator’s machine until they are published to the Management Server13. Therefore, if Tom has connected to the R81 Management Server remotely using SmartConsole and is in the process of making some Rule Base changes, when he suddenly loses connectivity, his changes will not be lost. They will be stored locally on his machine and he can resume his work when he reconnects to the Management Server.
Question #87
What are the blades of Threat Prevention?
- A . IPS, DLP, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction
- B . DLP, AntiVirus, QoS, AntiBot, Sandblast Threat Emulation/Extraction
- C . IPS, AntiVirus, AntiBot
- D . IPS, AntiVirus, AntiBot, Sandblast Threat Emulation/Extraction
Correct Answer: D
D
Explanation:
The blades of Threat Prevention in Check Point include:
Intrusion Prevention System (IPS)
AntiVirus
AntiBot
SandBlast Threat Emulation/Extraction
So, the correct answer is D, which includes all the mentioned blades.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
D
Explanation:
The blades of Threat Prevention in Check Point include:
Intrusion Prevention System (IPS)
AntiVirus
AntiBot
SandBlast Threat Emulation/Extraction
So, the correct answer is D, which includes all the mentioned blades.
Reference: Check Point Certified Security Expert (CCSE) R81 documentation and learning resources.
Question #88
Aaron is a Syber Security Engineer working for Global Law Firm with large scale deployment of Check Point Enterprise Appliances running GAiA R81.X The Network Security Developer Team is having an issue testing the API with a newly deployed R81.X Security Management Server Aaron wants to confirm API services are working properly.
What should he do first?
- A . Aaron should check API Server status with "fwm api status" from Expert mode If services are stopped, he should start them with "fwm api start".
- B . Aaron should check API Server status with "cpapi status" from Expert mode. If services are stopped, he should start them with "cpapi start"
- C . Aaron should check API Server status with "api status" from Expert mode If services are stopped, he should start them with "api start"
- D . Aaron should check API Server status with "cpm api status" from Expert mode. If services are stopped, he should start them with "cpi api start".
Correct Answer: C
C
Explanation:
Aaron should check API Server status with “api status” from Expert mode. If services are stopped, he should start them with “api start”. This is the correct way to verify and start the API Server on a Security Management Server running Gaia R81.X. The other commands are either invalid or not related to the API Server. The api command is a wrapper script that simplifies the management of the API Server. It can be used to start, stop, restart, status, enable, or disable the API Server.
Reference: [API Server]
C
Explanation:
Aaron should check API Server status with “api status” from Expert mode. If services are stopped, he should start them with “api start”. This is the correct way to verify and start the API Server on a Security Management Server running Gaia R81.X. The other commands are either invalid or not related to the API Server. The api command is a wrapper script that simplifies the management of the API Server. It can be used to start, stop, restart, status, enable, or disable the API Server.
Reference: [API Server]
Question #89
SmartEvent Security Checkups can be run from the following Logs and Monitor activity:
- A . Reports
- B . Advanced
- C . Checkups
- D . Views
Correct Answer: A
A
Explanation:
SmartEvent Security Checkups can be run from the Reports activity in Logs and Monitor. A Security Checkup is a report that analyzes network traffic and security events and provides recommendations for improving security posture. To run a Security Checkup, go to Logs & Monitor > Reports > New
Report > Security Checkup. The other activities in Logs and Monitor do not have the option to run a Security Checkup.
Reference: Check Point Software, Getting Started, Running a Security Checkup Report.
A
Explanation:
SmartEvent Security Checkups can be run from the Reports activity in Logs and Monitor. A Security Checkup is a report that analyzes network traffic and security events and provides recommendations for improving security posture. To run a Security Checkup, go to Logs & Monitor > Reports > New
Report > Security Checkup. The other activities in Logs and Monitor do not have the option to run a Security Checkup.
Reference: Check Point Software, Getting Started, Running a Security Checkup Report.
Question #90
What is true about VRRP implementations?
- A . VRRP membership is enabled in cpconfig
- B . VRRP can be used together with ClusterXL, but with degraded performance
- C . You cannot have a standalone deployment
- D . You cannot have different VRIDs in the same physical network
Correct Answer: C