156-215.81.20 User and Access Management Practice Question
A security administrator is configuring user authentication for the corporate VPN. Employees must authenticate using their Active Directory credentials via LDAP, but the administrator wants to avoid storing user passwords in the Check Point database. Which Check Point object should be used to integrate the AD server for authentication?
⚠ Common exam trap
Watch out — candidates often confuse an LDAP Account Unit with an Internal User Group, assuming that creating a group is sufficient to integrate external users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LDAP Account Unit
To integrate an external LDAP directory such as Active Directory for user authentication, the administrator must create an LDAP Account Unit. This object defines the connection to the LDAP server and allows the Security Gateway to query it during authentication. It avoids storing user passwords locally and leverages existing AD credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
LDAP Account Unit
Why this is correct
An LDAP Account Unit object connects Security Gateway and Management Server to an external LDAP directory, such as Active Directory, for user authentication. It allows users to authenticate with their directory credentials without storing passwords locally. This is the standard method to integrate AD for authentication in Check Point.
- ✗
Generic User
Why it's wrong here
A Generic User object is used for pre-shared key or certificate-based authentication, not for directory-based username/password authentication. It does not query an external LDAP server. Using a Generic User would not allow employees to authenticate with their AD credentials and would require separate credentials.
- ✗
Internal User Group
Why it's wrong here
An Internal User Group is a container for locally defined users and groups, not for external directory integration. It does not connect to Active Directory or perform LDAP queries. Creating an Internal User Group would require manually creating each user and managing passwords locally, which contradicts the requirement.
- ✗
User Template
Why it's wrong here
A User Template is used to define default settings for new users created in the internal database. It does not provide a connection to an external LDAP directory. While it can streamline local user creation, it does not enable AD authentication without storing passwords in Check Point.
About these practice questions
Courseiva writes every 156-215.81.20 question from scratch — 210 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.