156-215.81.20 Identity Awareness Practice Question
An administrator has configured Identity Awareness with Terminal Server Agent on a Terminal Server. Users report that after disconnecting from a Remote Desktop session and reconnecting, they are sometimes identified as the previous user. What is the most likely cause of this issue?
⚠ Common exam trap
The trap here is assuming that a network or configuration error is the cause, when the issue is actually due to how session IDs are reused and how logoff events are processed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Terminal Server Agent maps users to session IDs, and when a session ID is reused without a proper logoff event, the previous user's identity can persist.
The correct answer is that the Terminal Server Agent maps users to session IDs, and if a session ID is reused without a proper logoff event, the previous user's identity can persist. This can happen when users disconnect instead of logging off, leaving the session in a disconnected state. When the session ID is later assigned to a new user, the agent may not have processed a logoff for the old user, causing misidentification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Terminal Server Agent is not configured to monitor session state changes.
Why it's wrong here
The Terminal Server Agent is specifically designed to monitor session state changes such as logon, logoff, connect, and disconnect. If it were not monitoring these events, no users would be identified at all. The intermittent nature of the issue points to a different cause, such as session ID reuse or timing, rather than a complete failure to monitor state changes.
- ✗
The Security Gateway is not receiving updates from the Terminal Server Agent due to a network issue.
Why it's wrong here
A network issue would typically cause all users to be unidentified or cause delays for multiple users, not just intermittent misidentification after reconnecting. The specific symptom of being identified as the previous user suggests that the gateway is receiving updates but they are stale or associated with the wrong session, rather than a complete communication failure.
- ✗
The Identity Awareness blade is not enabled on the Security Gateway.
Why it's wrong here
If the Identity Awareness blade were not enabled, no users would be identified at all. The fact that users are sometimes identified correctly, and sometimes as the previous user, indicates that the blade is active and processing identities. The issue is more specific to session tracking and event handling on the Terminal Server.
- ✓
The Terminal Server Agent maps users to session IDs, and when a session ID is reused without a proper logoff event, the previous user's identity can persist.
Why this is correct
The Terminal Server Agent tracks user sessions by their session ID. If a user disconnects without properly logging off, the session remains in a disconnected state. When the same session ID is later reused by a different user, the agent may not have received a logoff event for the previous user, leading to the old identity being associated with the new session. This is a known behavior that can cause incorrect user identification.
About these practice questions
Courseiva writes every 156-215.81.20 question from scratch — 210 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.