156-215.81.20 Identity Awareness Practice Question
An administrator configures Identity Awareness to use AD Query and creates an Access Control rule allowing the 'Sales' identity group to reach a CRM server. Users in Sales are identified, yet some still get blocked. Reviewing logs shows their sessions exist but the group membership is missing. Which configuration should the administrator verify first?
⚠ Common exam trap
The trap here is chasing portal or agent settings for a symptom that is really about how group data is synchronized from Active Directory.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The AD Query refresh and group synchronization settings that determine how often group membership is updated from Active Directory.
When an identity session exists but group membership is absent, the issue is usually in how group data is resolved and refreshed from Active Directory. AD Query relies on periodic synchronization to map users to their groups, so stale or misconfigured group synchronization settings explain why identified Sales users lack the group needed to match the rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The AD Query refresh and group synchronization settings that determine how often group membership is updated from Active Directory.
Why this is correct
AD Query builds identity sessions from logon events and then resolves the user's group membership from Active Directory. If group synchronization is infrequent or misconfigured, the session can exist while the associated group data is stale or absent, causing the identity-based rule to fail. Verifying these settings directly addresses the missing group membership shown in the logs.
- ✗
The Identity Agent installation package version deployed to Sales laptops.
Why it's wrong here
The scenario uses AD Query, not the Identity Agent, as the acquisition method. The agent version would matter only if endpoints reported identity through the agent. Since Sales users are identified via domain events, agent version does not affect group membership resolution and cannot explain why the group is missing from their sessions.
- ✗
The Captive Portal login page branding and timeout values.
Why it's wrong here
Captive Portal branding and timeouts affect browser-based authentication flows and how long portal sessions persist. In an AD Query deployment, users are identified through domain events, not the portal, so these settings do not influence whether Sales group membership is resolved. They are unrelated to the missing group data observed in the logs.
- ✗
The Security Gateway's routing table entries toward the CRM server subnet.
Why it's wrong here
Routing affects whether traffic can reach the CRM server, but the logs already show that identity sessions exist and the block is due to missing group membership, not unreachable destinations. Correcting routes would not populate the Sales group in the identity session. The problem lies in identity data resolution, not packet forwarding.
Visual reference
About these practice questions
This 156-215.81.20 question is part of Courseiva's 210-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.