156-315.81.20 Advanced VPN Design Practice Question
A Check Point administrator is configuring a Remote Access VPN using Endpoint Security VPN clients. The administrator wants to ensure that all client traffic, including Internet-bound traffic, is routed through the Security Gateway for inspection. Which option must be enabled in the VPN community or client configuration?
⚠ Common exam trap
Candidates often confuse Visitor Mode or Hub Mode with traffic routing options, when the key is Full Tunnel vs. Split Tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Route all traffic through gateway (Full Tunnel)
To route all client traffic, including Internet-bound, through the Security Gateway, the administrator must enable Full Tunnel mode, often configured via 'Route all traffic through gateway' in the client or community settings. Split Tunnel would only route corporate traffic, and Visitor Mode or Hub Mode do not affect traffic routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Split Tunnel
Why it's wrong here
Split Tunnel allows the client to send only traffic destined for the encryption domain through the VPN, while other traffic goes directly to the Internet. This does not meet the requirement to route all traffic through the gateway for inspection.
- ✗
Visitor Mode
Why it's wrong here
Visitor Mode is used to allow remote access clients to connect from behind a gateway that does not support NAT-T. It does not control traffic routing for all client traffic. It is unrelated to forcing Internet traffic through the gateway.
- ✓
Route all traffic through gateway (Full Tunnel)
Why this is correct
Enabling 'Route all traffic through gateway' (often called Full Tunnel) forces all client traffic, including Internet-bound, to be sent through the VPN tunnel to the Security Gateway. This allows the gateway to inspect and apply policies to all traffic, meeting the requirement.
- ✗
Hub Mode
Why it's wrong here
Hub Mode is a feature of Remote Access VPN where the client acts as a hub for other clients, but it does not force all traffic through the gateway. It is used for client-to-client communication, not for Internet traffic redirection.
About these practice questions
One of 210 original 156-315.81.20 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-315.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-315.81.20 exam.