156-215.81.20 User and Access Management Practice Question
An administrator is configuring a new user group in SmartConsole. The group will be used in a rule to allow access to a specific server. The administrator wants to ensure that only users who are members of this group can access the server, and that membership is managed dynamically based on the user's department in the LDAP directory. Which type of user group should the administrator create?
⚠ Common exam trap
The trap here is assuming that any external group type can provide dynamic LDAP membership, overlooking the specific need for an LDAP user group object.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An LDAP user group that maps to an LDAP group
To achieve dynamic membership based on the LDAP directory, an LDAP user group object must be created. This object references an LDAP group, and membership is automatically synchronized. Local user groups, generic groups, and RADIUS-based groups do not provide the required dynamic LDAP integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An external user group defined by a RADIUS server
Why it's wrong here
An external user group defined by RADIUS relies on a RADIUS server for authentication and group membership. While RADIUS can provide dynamic membership, the scenario specifies an LDAP directory. Using RADIUS would require additional infrastructure and is not aligned with the existing LDAP setup, making it incorrect.
- ✗
A generic user group with a wildcard
Why it's wrong here
A generic user group with a wildcard is used for legacy authentication and does not integrate with LDAP. It cannot dynamically reflect department changes. This type of group is not suitable for modern directory-based dynamic membership and would not enforce the required access control accurately.
- ✓
An LDAP user group that maps to an LDAP group
Why this is correct
An LDAP user group object references a group in the external LDAP directory. Membership is determined by the LDAP group's membership, which can be dynamically managed based on department attributes. This allows automatic updates when users are added or removed from the LDAP group, satisfying the dynamic requirement.
- ✗
A local user group with manually added users
Why it's wrong here
A local user group requires manual addition of users, which does not provide dynamic membership based on LDAP department. If a user's department changes, an administrator would need to manually update the group. This does not meet the requirement for dynamic management based on the LDAP directory.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
One of 210 original 156-215.81.20 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.