156-215.81.20 Application Control and URL Filtering Practice Question
Exhibit
fw ctl debug -m fw + drop [...] fw_log_drop: Rule 15, Application: 'Unknown', Category: 'Uncategorized', Reason: 'Blocked by Application Control - No match'
Refer to the exhibit. An administrator sees the following debug output while troubleshooting a blocked connection. What is the most likely cause for this traffic being dropped?
⚠ Common exam trap
Candidates often blame the firewall rule itself rather than the Application Control blade, failing to realize that an 'Unknown' categorization often defaults to a drop action in strict security policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule base contains a drop rule for 'Unknown' applications.
The debug output indicates that the traffic was dropped because Application Control could not identify the application or categorize the traffic. When the policy is set to 'Block' for non-matching or unknown traffic, the gateway drops packets that do not trigger a specific rule match. This is a common security best practice to prevent unauthorized or potentially malicious protocols from traversing the gateway undetected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The connection is being dropped by a malicious URL category.
Why it's wrong here
The debug output explicitly states 'Uncategorized' and 'No match' as the reason for the drop. If it were a malicious URL, the log would specify a category name like 'Malicious' or 'Phishing'. This indicates the issue is related to application identification, not domain classification or reputation filtering.
- ✓
The rule base contains a drop rule for 'Unknown' applications.
Why this is correct
The log message 'Blocked by Application Control - No match' confirms that the traffic hit a policy rule that does not allow unidentified applications. This is a deliberate configuration to ensure that only known, permitted traffic is allowed, forcing the administrator to identify the protocol and create a rule.
- ✗
The HTTPS inspection certificate is expired.
Why it's wrong here
Expired certificates would trigger specific SSL/TLS inspection errors in the logs, not an 'Application Control - No match' error. The application identification failure indicates that the packet flow does not match any existing application signature in the database, regardless of the encryption status or the certificate's validity.
- ✗
The user is not authenticated.
Why it's wrong here
Authentication failures result in logs indicating that access is denied due to missing credentials or failed identity verification. The 'No match' error specifically refers to the application identification engine's inability to recognize the traffic type, which is independent of the user's identity or their authentication state.
About these practice questions
One of 210 original 156-215.81.20 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.