CertArea
All Check Point exams

Free 156-215.82 practice test: 30 questions with answers

30 original questions for Check Point Certified Security Administrator R82 (CCSA), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
100 questions, 90 min
Passing score
70%

156-215.82 exam guide: topics, cost and format

All 30 156-215.82 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Introduction to Quantum Security (3 questions)

  1. Question 1

    In the Check Point three-tier architecture, which component enforces the security policy on the traffic that passes through the network?

    1. ASmartConsole, which compiles the rule base and pushes it directly into the packet path
    2. BThe Security Gateway, which receives the policy from the management server and enforces it on traffic
    3. CThe Security Management Server, which inspects every packet as it crosses the gateway interfaces and logs each decision
    4. DThe Gaia Portal, which stores the rule base and applies it to the interfaces of the appliance
    Show answer and explanation
    Correct answer: B

    The Security Gateway enforces the policy it receives from the management server. SmartConsole is only the client used to edit policy, the management server stores policy and logs without inspecting packets, and the Gaia Portal manages operating system settings.

  2. Question 2

    An administrator at a workstation needs to build a new rule and review the logs for a remote Check Point deployment. Which tool should be used for this work?

    1. AGaia Clish, the command shell that changes interface and routing settings on one gateway
    2. BThe Gaia Portal on the management server, which edits the rule base through a standard web browser
    3. CSmartEvent, the correlation server that creates rules automatically from the events it has received
    4. DSmartConsole, the graphical management client that connects to the management server
    Show answer and explanation
    Correct answer: D

    SmartConsole is the graphical management client used to create rules and review logs through the management server. Gaia Clish and the Gaia Portal manage operating system settings, and SmartEvent correlates events rather than editing the rule base.

  3. Question 3

    Which two tools are used to administer the operating system settings of a Check Point Gaia system? (Choose two.)

    1. AGaia Portal, the web-based administration interface
    2. BGaia Clish, the command-line shell
    3. CSmartConsole, the graphical management client
    4. DSmartEvent, the event correlation and reporting server
    Show answer and explanation
    Correct answer: A, B

    The Gaia Portal and Gaia Clish are the two Gaia administration interfaces for operating system configuration. SmartConsole edits policy and objects through the management server, and SmartEvent correlates logs into events, so neither is a Gaia operating system tool.

Administrator Account Management (3 questions)

  1. Question 4

    An auditor requires that a help desk technician can view the firewall policy and logs but cannot change them. The management team wants this enforced by the management server rather than by procedure alone. What should the administrator do?

    1. AGive the technician a full-access administrator account and ask them not to publish any changes
    2. BCreate an administrator account for the technician that uses a read-only permission profile
    3. CBlock SmartConsole for the technician and have them submit change requests through a shared mailbox
    4. DShare a read-only administrator password with the technician and store it in a locked vault
    Show answer and explanation
    Correct answer: B

    A read-only permission profile on the administrator account is enforced by the management server, so the technician cannot change the policy. A full-access account relies on procedure, sharing a password is poor practice, and blocking SmartConsole would also stop the technician from viewing the policy and logs.

  2. Question 5

    Which statement about concurrent administration in SmartConsole is correct?

    1. AOnly one administrator can be connected to the management server at a time, and other logins are rejected
    2. BEach administrator edits a private copy of the gateway configuration, and the copies merge when the gateway restarts
    3. CEach change is installed on all gateways as soon as it is saved, without any publish step
    4. DSeveral administrators can work in separate sessions, and changes are visible to others after publishing
    Show answer and explanation
    Correct answer: D

    Administrators work in separate sessions, and unpublished changes stay private to a session until it is published. Single-login restrictions, automatic installation on save, and merging copies at gateway restart are all incorrect.

  3. Question 6

    An administrator edits several rules in a SmartConsole session and does not publish the session. A second administrator logs in and opens the same rule base. What does the second administrator see?

    1. AA login block that stays in place until the first administrator's session ends and its changes are discarded
    2. BThe unpublished edits immediately, because all sessions share a single live copy of the rule base
    3. CThe edits already installed on the gateways, which are enforced for both administrators at once
    4. DThe last published version of the rule base, without the first administrator's unpublished edits
    Show answer and explanation
    Correct answer: D

    Unpublished changes are private to the session that made them, so other administrators see only the last published database. Gateways do not receive the edits until a policy is installed, and the second administrator is not blocked from logging in.

Object Management (3 questions)

  1. Question 7

    A network group object named Branch-Offices is used in several rules. An administrator adds a new subnet to that group. What is the effect?

    1. AOnly the rule the administrator was editing at the time starts matching the new subnet
    2. BThe change takes effect only after each rule is copied and the copies are installed to the gateway
    3. CEvery rule that uses the group matches the new subnet once the policy is installed
    4. DThe new subnet must be added to each rule manually, because rules do not inherit the members of group objects
    Show answer and explanation
    Correct answer: C

    Rules reference the group object, so a membership change applies to every rule that uses it once the policy is installed. Editing or copying each rule is unnecessary when the object is updated centrally.

  2. Question 8

    Which object type lets an administrator refer to several hosts and networks by one name in a rule?

    1. AA network group object, which can contain hosts and networks as its members
    2. BA service object, which defines a protocol and port combination for matching traffic
    3. CA gateway object, which represents a Check Point gateway managed by the management server
    4. DA time object, which defines the days and hours when a rule is active
    Show answer and explanation
    Correct answer: A

    A network group object bundles hosts, networks and other objects under one name, so a rule can reference them together. Time objects control when rules apply, service objects define protocol and port matches, and gateway objects represent enforcement points.

  3. Question 9

    An administrator tries to delete a host object from the object database, and SmartConsole reports that the object is still used in rules. What should the administrator do first?

    1. AUse the Where Used feature to find each rule and object that refers to the host, then update those references
    2. BDelete the object anyway, because SmartConsole removes it from every rule that refers to it automatically
    3. CCopy the object under a new name and delete the original, since the copy takes over all existing references
    4. DExport the rule base to a file, then delete the object from the exported copy so the live policy stays unchanged
    Show answer and explanation
    Correct answer: A

    The Where Used feature lists every rule and object that depends on the host, so the references can be changed before the object is removed. Deleting the object, copying it, or editing an exported file does not fix the references in the live policy.

Security Policy Management (3 questions)

  1. Question 10

    In an Access Control rule base, what happens when a connection matches more than one rule?

    1. AThe rule with the most specific source and destination is applied, regardless of its position in the rule base
    2. BThe first matching rule from the top of the rule base is applied, and the rules below it are not evaluated
    3. CThe most recently installed rule is applied, because newer rules always take precedence over older rules
    4. DEvery matching rule is applied in sequence, and the last matching rule decides the final action
    Show answer and explanation
    Correct answer: B

    Access Control rules are evaluated from the top, and the first match decides the action, which is why rule order matters. Specificity, applying every match, and installation time do not determine the outcome.

  2. Question 11

    Which two actions are needed before a rule change that an administrator made in SmartConsole is enforced on a gateway? (Choose two.)

    1. APublish the session so the changes are saved to the management database
    2. BRestart the gateway appliance so it reads the new rule base from disk
    3. CInstall the policy on the target gateways that enforce this rule base
    4. DExport the rule base as a CSV file and import it on the gateway
    Show answer and explanation
    Correct answer: A, C

    Publishing saves the session changes to the management database, and installing the policy pushes the resulting policy to the gateways that enforce it. Restarting a gateway or exporting the rule base to CSV is not part of the normal enforcement process.

  3. Question 12

    Which rule action blocks a connection and sends a response to the sender instead of silently discarding the packets?

    1. AAccept, which allows the connection and forwards the packets to the destination
    2. BDrop, which discards the packets without sending any response to the sender
    3. CReject, which blocks the connection and returns a notification to the sender
    4. DAsk, which asks the user to confirm before the connection is allowed to continue
    Show answer and explanation
    Correct answer: C

    Reject blocks the connection and returns a notification such as a TCP reset or an ICMP unreachable message. Drop discards traffic silently, Accept allows it, and Ask prompts the user before allowing it.

Policy Layers (3 questions)

  1. Question 13

    What is an inline layer in an Access Control policy?

    1. AA sub-policy that a rule in a parent layer points to, so matching traffic is checked against its rules
    2. BA copy of the default policy that the gateway uses when the management server is unreachable
    3. CA separate gateway that inspects traffic before the parent layer evaluates the connection and makes the final decision
    4. DA list of objects that rules in every layer can reference, without being evaluated as rules
    Show answer and explanation
    Correct answer: A

    An inline layer is a nested rule set that a parent rule references, and traffic matched by that parent rule is evaluated against the inline layer's rules. It is not a separate gateway, a fallback copy of the policy, or a plain object list.

  2. Question 14

    A company wants one team to own the network-level access rules and a second team to own the application-level rules, each in its own rule set. A connection must be allowed by both sets before it can pass. Which layer design fits this requirement?

    1. AOrdered layers, where a connection must be accepted by every layer in sequence
    2. BSeparate gateways with their own policy packages, so no rule set is shared between them
    3. COne shared rule set with a separate SmartConsole session for each team
    4. DThreat Prevention profiles that apply to each team's rules independently of the access policy
    Show answer and explanation
    Correct answer: A

    Ordered layers are evaluated one after another, and a packet must be accepted by each layer to pass, which fits separate team ownership. A shared rule set with separate sessions does not split the logic, and gateways or Threat Prevention profiles do not create the required sequential check.

  3. Question 15

    A packet is accepted by the first ordered layer but dropped by a later ordered layer in the same policy. What is the final result?

    1. AThe packet is dropped, because it must be accepted by every ordered layer to pass
    2. BThe packet is accepted, because the first layer that accepts a packet decides the final action
    3. CThe packet is accepted and logged, because later layers can only generate alerts and cannot drop traffic
    4. DThe packet is held and re-evaluated by the first layer again before any decision is made
    Show answer and explanation
    Correct answer: A

    In ordered layers each layer is evaluated in sequence, and a drop by any layer stops the packet. The other options assume an earlier accept is final, that later layers can only alert, or that packets are re-evaluated by the first layer.

Security Operations Monitoring (3 questions)

  1. Question 16

    Which feature records changes that administrators make to objects and rules in SmartConsole, so that the changes can be reviewed later?

    1. AConnection logs, which record the traffic that the gateway accepted or dropped by rules
    2. BGateway health checks, which measure CPU, memory and interface usage on each gateway
    3. CAudit logs, which record configuration changes made by administrators in SmartConsole
    4. DHit counts, which show how many times each rule has matched traffic since it was installed
    Show answer and explanation
    Correct answer: C

    Audit logs show who changed what in SmartConsole. Connection logs and hit counts describe traffic handled by rules, and gateway health checks report system resource use.

  2. Question 17

    A security team wants to link repeated failed logins from several gateways into correlated security events, and to build reports from them. Which Check Point product is designed for this task?

    1. ASmartConsole, which edits the policy and displays the rule base on an administrator's workstation
    2. BSmartEvent, which correlates logs from gateways into events and produces reports
    3. CGaia Clish, which configures the operating system and interface settings on one appliance
    4. DSmartUpdate, which installs software packages and manages licenses on the managed gateways
    Show answer and explanation
    Correct answer: B

    SmartEvent is the correlation and reporting product that turns gateway logs into events. SmartConsole is the policy editor, Gaia Clish manages single-appliance operating system settings, and SmartUpdate handles software packages and licenses.

  3. Question 18

    What is the role of the Log Server in a Check Point deployment?

    1. AIt enforces Access Control rules on packets as they pass through the gateway interfaces
    2. BIt receives and stores the log records that gateways send, for later searching
    3. CIt publishes SmartConsole sessions so that other administrators can see the pending changes
    4. DIt stores the operating system images that are used to recover a failed gateway appliance
    Show answer and explanation
    Correct answer: B

    The Log Server receives log records from gateways and stores them so administrators can search and review them. Enforcement belongs to gateways, publishing belongs to the management session, and operating system images are kept separately.

Identity Awareness (3 questions)

  1. Question 19

    A rule should allow only the Finance group to reach a payroll server. The gateway must recognize users without requiring any software on their computers. Which identity source is the best fit?

    1. AIdentity Agent installed on every employee laptop, which reports the logged-in user name to the gateway
    2. BManual entries that map each Finance user to a fixed IP address on the gateway
    3. CAD Query, which reads domain login events from Active Directory without client software
    4. DLog export to an external syslog server, which resolves IP addresses into user names for rules
    Show answer and explanation
    Correct answer: C

    AD Query reads login information from the domain, so the gateway can map users to IP addresses without installing software on each computer. An Identity Agent requires installed software, manual mappings are static, and syslog export does not resolve identities.

  2. Question 20

    What is the purpose of an access role object in Identity Awareness?

    1. AIt maps one IP address to a user name and removes the mapping when that user logs out
    2. BIt groups users, machines, or networks so that rules can match them as a source or destination
    3. CIt defines the captive portal page that users see when they first browse to the Internet
    4. DIt stores the passwords of users who authenticate through RADIUS for VPN connections and keeps a copy of each one in the rule base
    Show answer and explanation
    Correct answer: B

    Access role objects group users, machines and networks so that a single rule can match them. IP-to-user mapping, captive portal pages and RADIUS password storage are handled by other features, not by access roles.

  3. Question 21

    Which two identity sources can map users to IP addresses without installing agent software on each user's computer? (Choose two.)

    1. AIdentity Agent, which is installed on each user's computer
    2. BAD Query, which reads domain login events from Active Directory
    3. CLog export to a syslog server, which forwards gateway logs to a central collector
    4. DBrowser-Based Authentication, which asks users to log in through a web page
    Show answer and explanation
    Correct answer: B, D

    AD Query reads domain login information and Browser-Based Authentication uses a web login page, so neither needs client software. Identity Agent is installed on each computer, and syslog export forwards logs without identifying users.

HTTPS Inspection (3 questions)

  1. Question 22

    Why must client computers trust the internal certificate authority that HTTPS Inspection uses?

    1. AThe gateway presents certificates signed by that CA, so clients that do not trust it show certificate errors
    2. BThe CA encrypts the traffic between the client and the gateway with a key that the server must also trust
    3. CThe CA signs each packet so the gateway can verify that the traffic came from an authorized administrator on the internal network
    4. DThe CA is needed only for logging, so the gateway can record the names of the websites that users visit
    Show answer and explanation
    Correct answer: A

    During HTTPS Inspection the gateway presents site certificates signed by its internal CA. Clients that do not trust that CA report certificate warnings. The CA does not sign packets or encrypt traffic for the server, and it is not limited to logging.

  2. Question 23

    A finance application uses client certificates for authentication, and it fails after HTTPS Inspection is turned on for all users. The application must keep working, and other HTTPS traffic should still be inspected. What is the best change?

    1. ATurn off HTTPS Inspection for all traffic, so the application works without any further changes
    2. BDisable the Application Control blade on the gateway, so the application is no longer examined
    3. CAdd a bypass rule for the application's destination in the HTTPS Inspection rule base
    4. DChange the Threat Prevention rule for the application to Detect, so that client certificate checks are skipped
    Show answer and explanation
    Correct answer: C

    A bypass rule in the HTTPS Inspection rule base stops the gateway from re-signing traffic for that destination, so client certificate authentication works. Turning off inspection for everything, disabling Application Control, or changing a Threat Prevention action does not address the cause.

  3. Question 24

    Which two kinds of HTTPS traffic are typical candidates for a bypass rule? (Choose two.)

    1. APlain HTTP websites that do not use encryption and are served on port 80
    2. BBanking and healthcare sites where privacy rules prohibit inspecting the content
    3. CAny website whose certificate was issued by a publicly trusted certificate authority
    4. DApplications that use certificate pinning and fail when they receive a substituted certificate
    Show answer and explanation
    Correct answer: B, D

    Privacy-sensitive services and pinned applications are typical bypass candidates because inspection either conflicts with policy or breaks them. Plain HTTP is not HTTPS Inspection traffic, and sites with publicly trusted certificates are inspected normally.

Application Control and URL Filtering (3 questions)

  1. Question 25

    A company wants to block streaming video sites without maintaining a list of individual domain names. Which approach should the administrator use?

    1. AA network group containing the IP addresses of every streaming site that the administrator can find
    2. BA service object that matches the TCP port used by the streaming video providers
    3. CA URL or application category, which matches many sites that share one classification
    4. DAn HTTPS Inspection bypass rule for each streaming provider's domain name, placed before the rule base
    Show answer and explanation
    Correct answer: C

    Category objects in Application Control and URL Filtering group many sites or applications under one classification, so one rule covers them. Port or address lists miss many services and change often, and a bypass rule stops inspection rather than blocking access.

  2. Question 26

    Without HTTPS Inspection, what part of an HTTPS request can URL Filtering normally match?

    1. AThe complete URL, including query strings and page paths, because the handshake exposes them
    2. BThe decrypted page content, using the gateway's own copy of the server certificate
    3. CNothing, so every HTTPS connection must be allowed or blocked by destination port alone
    4. DThe host name carried in the TLS handshake, but not the full URL path or query string
    Show answer and explanation
    Correct answer: D

    Without decryption the gateway can see the host name, for example from the server name indication, but the path and query string are encrypted. Full URL matching requires HTTPS Inspection, and destination ports alone are not a URL match.

  3. Question 27

    A rule uses the Application Control and URL Filtering blade to ask users to confirm before they visit a category of sites. Which mechanism presents this prompt to the user?

    1. ASmartEvent, which emails the administrator whenever a rule with an Ask action matches traffic
    2. BUserCheck, which shows an interactive message in the browser and records the user's response
    3. CThe Gaia Portal, which shows a pop-up on the administrator's workstation whenever the rule matches traffic
    4. DSmartUpdate, which downloads a new category list whenever a user opens a blocked website
    Show answer and explanation
    Correct answer: B

    UserCheck presents interactive messages to users for actions such as Ask and records the response. SmartEvent reports on events, SmartUpdate handles software packages and licenses, and the Gaia Portal does not display prompts to end users.

Threat Prevention Fundamentals (3 questions)

  1. Question 28

    Which Threat Prevention blade detects and blocks hosts that are infected with malware and communicating with command-and-control servers?

    1. AAnti-Virus, which scans files for known malware signatures as they cross the gateway
    2. BThreat Extraction, which removes active content from documents before delivering a clean copy
    3. CThreat Emulation, which runs suspicious files in a sandbox to observe their behavior
    4. DAnti-Bot, which detects infected hosts that contact command-and-control servers
    Show answer and explanation
    Correct answer: D

    Anti-Bot identifies infected internal hosts by their communication with command-and-control infrastructure. Anti-Virus matches known file signatures, Threat Emulation sandboxes files, and Threat Extraction sanitizes documents, so none of these detect infected hosts by their outbound communication.

  2. Question 29

    Employees receive Office documents by email. The company wants users to get a clean, usable copy of each document right away, while the original file is still checked for malicious behavior. Which combination fits best?

    1. AAnti-Bot only, which blocks the document because it arrived from an external sender
    2. BIPS only, which removes macros from the document before the user opens it
    3. CApplication Control only, which blocks every attachment type regardless of its content or the business need for it
    4. DThreat Extraction to deliver a sanitized copy immediately, and Threat Emulation to analyze the original file
    Show answer and explanation
    Correct answer: D

    Threat Extraction removes active content and delivers a clean copy quickly, while Threat Emulation analyzes the original file for malicious behavior. Anti-Bot, IPS and Application Control do not sanitize documents in this way.

  3. Question 30

    Which blade uses protections to detect and block attempts that try to exploit vulnerabilities in applications and network services?

    1. AAnti-Virus, which scans files for known malware signatures as they cross the gateway
    2. BAnti-Bot, which identifies infected hosts that contact command-and-control servers
    3. CThreat Extraction, which removes active content from documents before delivering a clean copy to the user
    4. DIPS, which matches protections against exploit attempts in network traffic
    Show answer and explanation
    Correct answer: D

    IPS applies protections that detect and block exploit attempts against vulnerable applications and services. Anti-Virus, Anti-Bot and Threat Extraction address malicious files or infected hosts rather than exploit attempts in traffic.