156-215.81.20 User and Access Management Practice Question
A Check Point administrator is configuring a new administrator account in SmartConsole. The administrator wants to grant this account permissions to manage only the Security Policies and objects within a specific Domain, while restricting access to other Domains in a Multi-Domain Management environment. The administrator plans to use a Permission Profile that is scoped to that Domain. Which two statements are true regarding this configuration? (Choose two.)
⚠ Common exam trap
The trap here is assuming that a global Permission Profile can be used to restrict access to a single Domain, when in fact it grants access to all Domains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The administrator must assign a Permission Profile that is defined in the same Domain as the administrator account.
In a Multi-Domain Management environment, to restrict an administrator to a specific Domain, the administrator account must be created in that Domain, and a Permission Profile defined in that same Domain must be assigned. This ensures that the account's permissions are scoped only to that Domain, preventing access to other Domains.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The administrator can use a Domain-level Permission Profile to grant access to multiple Domains simultaneously.
Why it's wrong here
Domain-level Permission Profiles are scoped to a single Domain. They cannot be used to grant access to multiple Domains at once. To grant access to multiple Domains, separate accounts or global profiles would be needed. Thus, this statement is incorrect for the given requirement.
- ✗
The administrator can assign a global Permission Profile that applies to all Domains, but it will grant access to all Domains.
Why it's wrong here
Global Permission Profiles are defined at the Multi-Domain level and apply across all Domains. If assigned, the administrator would have permissions in all Domains, which contradicts the requirement to restrict access to only one Domain. Therefore, this statement is false in the context of the scenario.
- ✓
The administrator must assign a Permission Profile that is defined in the same Domain as the administrator account.
Why this is correct
In Multi-Domain Management, Permission Profiles are defined per Domain. To grant access only to a specific Domain, the administrator account must be assigned a Permission Profile that exists within that Domain. This ensures that the permissions are scoped correctly and do not inadvertently grant access to other Domains.
- ✓
The administrator account must be created in the Domain to which access is to be granted.
Why this is correct
In Multi-Domain Management, administrator accounts are created within a specific Domain. To restrict access to that Domain, the account must be created in that Domain. This ensures that the account's scope is limited to that Domain and its associated Permission Profiles.
- ✗
The administrator must assign the 'Super User' Permission Profile to allow management of Security Policies in the Domain.
Why it's wrong here
The 'Super User' Permission Profile grants full access, including to all Domains if assigned globally. It is not necessary to manage Security Policies within a single Domain; a more restrictive Domain-level profile can be used. Assigning Super User would violate the principle of least privilege and exceed the required permissions.
About these practice questions
This 156-215.81.20 question is part of Courseiva's 210-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.