156-215.81.20 Monitoring and Logging Practice Question
A Security Gateway stops sending logs to the Management Server, and users report that SmartView Logs shows no new entries. The administrator confirms the gateway is passing traffic. Which action should be taken first to diagnose the log transmission problem?
⚠ Common exam trap
The trap here is assuming missing logs always indicate a logging configuration error, when a broken SIC trust relationship can silently stop log delivery while traffic forwarding continues normally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify SIC trust status between the Security Gateway and the Management Server.
Secure Internal Communication, or SIC, is the trust foundation for all traffic between a Security Gateway and its Management Server, including log delivery. When logs stop arriving but traffic still flows, verifying SIC status quickly identifies whether the management channel itself is broken. Other actions either treat display symptoms or alter configuration without evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the log storage quota on the Security Gateway.
Why it's wrong here
The gateway does not store logs locally in the same way the Management Server does; storage quota changes would not re-establish transmission. Even if local buffering were involved, the reported symptom of no new entries in SmartView points to a communication issue, not a capacity limit.
- ✓
Verify SIC trust status between the Security Gateway and the Management Server.
Why this is correct
Log transmission depends on the secure communication channel established by SIC. If SIC is broken or the trust state is not established, the gateway cannot deliver logs even though traffic forwarding continues. Checking SIC status is therefore the logical first diagnostic step for missing logs.
- ✗
Restart the SmartConsole client to refresh the log view.
Why it's wrong here
Restarting SmartConsole only affects the client display and cannot restore a broken log channel. If logs are genuinely not arriving, refreshing the interface will not populate new entries. This action treats a display symptom rather than the underlying transmission failure.
- ✗
Change the log forwarding port in Global Properties.
Why it's wrong here
Modifying the forwarding port is a configuration change that should only follow evidence of a port conflict or network block. Making it blindly could introduce a new failure. The first step should be confirming the trust relationship that underpins all management communication.
About these practice questions
Courseiva writes every 156-215.81.20 question from scratch — 210 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.