156-215.81.20 Identity Awareness Practice Question
An administrator is configuring Identity Awareness on a Check Point R81.20 Security Gateway. The company uses a single Active Directory domain and wants to identify users without installing any software on client machines. Which Identity Awareness method should the administrator choose?
⚠ Common exam trap
The trap here is assuming that Browser-Based Authentication is a no-client-software solution, but it requires user interaction and is not automatic, unlike AD Query which seamlessly identifies domain users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AD Query
AD Query is the only method that automatically identifies users in an Active Directory domain without installing any software on client machines. It leverages the existing domain infrastructure and the Security Gateway's ability to query domain controllers, making it the correct choice for this scenario. Other methods either require client software or manual authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Agent
Why it's wrong here
Identity Agent requires installation on each client machine, which contradicts the requirement to avoid client-side software. It provides strong identity information but is not suitable when no software can be deployed. Therefore, it does not meet the scenario's constraint of identifying users without installing anything on endpoints.
- ✗
Browser-Based Authentication
Why it's wrong here
Browser-Based Authentication requires users to manually authenticate through a web portal, which is not seamless and may not identify all traffic. It also does not automatically identify users based on their domain logon. While it requires no client software, it is not the best fit for an environment where users are already logging into an Active Directory domain and automatic identification is desired.
- ✗
Terminal Server Agent
Why it's wrong here
Terminal Server Agent is designed for multi-user servers and must be installed on those servers. It is not applicable for identifying users on standard workstations in a domain. Since the scenario does not mention terminal servers and explicitly avoids client software, this method is inappropriate and does not meet the requirements.
- ✓
AD Query
Why this is correct
AD Query retrieves user logon information directly from Active Directory domain controllers without any client software. It works with domain-joined machines and requires only that the Security Gateway can communicate with the domain controllers. This makes it the ideal choice for identifying users in a single AD domain without deploying agents, satisfying the administrator's requirement.
About these practice questions
Courseiva writes every 156-215.81.20 question from scratch — 210 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.