156-315.81.20 Performance Tuning (SecureXL/CoreXL) Practice Question
A Check Point Security Gateway is experiencing high CPU utilization on a single core, while other cores are underutilized. CoreXL is enabled, and the administrator suspects that the traffic is not being distributed evenly across the CoreXL firewall instances. Which command should the administrator use to verify the distribution of connections across CoreXL instances?
⚠ Common exam trap
Watch out — candidates often confuse CoreXL instance statistics with SecureXL statistics or general CPU monitoring tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
fw ctl multik stat
To verify the distribution of connections across CoreXL instances, the administrator should use 'fw ctl multik stat'. This command provides per-instance statistics, including the number of connections and packets, allowing the administrator to see if the load is balanced. If one instance is handling more traffic, it may indicate a configuration issue or a traffic pattern that is not being hashed evenly. The other commands provide different information, such as SecureXL statistics or thread-level CPU usage, which are not specific to CoreXL instance distribution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
fw ctl multik print_instances
Why it's wrong here
The command 'fw ctl multik print_instances' displays information about the CoreXL instances, such as their IDs and CPU affinity, but it does not show the distribution of connections or traffic across those instances. It is useful for verifying the configuration of CoreXL instances but not for monitoring their load. To see connection distribution, a different command is needed that provides statistics per instance.
- ✗
top -H
Why it's wrong here
The 'top -H' command shows per-thread CPU utilization, which can indicate which threads are consuming CPU, but it does not directly show the distribution of connections across CoreXL instances. While it can help identify a busy core, it does not provide the connection counts per instance that are needed to verify CoreXL load balancing. The administrator would need to correlate thread IDs with CoreXL instances manually, which is less direct than using a dedicated command.
- ✓
fw ctl multik stat
Why this is correct
The command 'fw ctl multik stat' displays statistics for each CoreXL instance, including the number of connections and packets processed. This allows the administrator to see if the load is evenly distributed across instances. If one instance is handling significantly more connections than others, it indicates an imbalance. This is the correct command to verify CoreXL instance distribution and diagnose the high CPU on a single core.
- ✗
fwaccel stats -s
Why it's wrong here
The command 'fwaccel stats -s' provides SecureXL statistics, such as the number of accelerated and non-accelerated connections, but it does not break down the distribution across CoreXL instances. SecureXL and CoreXL are separate acceleration technologies; SecureXL offloads traffic before it reaches CoreXL, so its statistics do not reflect per-instance load. This command would not help the administrator verify CoreXL instance distribution.
About these practice questions
Courseiva writes every 156-315.81.20 question from scratch — 210 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-315.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-315.81.20 exam.