156-315.81.20 Identity Awareness Practice Question
A security administrator is deploying Identity Awareness on a Check Point R81 Security Gateway using the Identity Agents method. The organization wants to avoid installing additional client software on user workstations. Which Check Point component must be deployed to collect identities from the Active Directory domain controllers without requiring a full Identity Agent on each endpoint?
⚠ Common exam trap
The trap here is assuming that any Check Point component with 'Identity' in its name can collect identities from domain controllers without endpoint agents, when actually only Identity Collector is purpose-built for that role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Collector
Identity Collector is specifically designed to gather user identities from Active Directory domain controllers without installing software on user endpoints. It communicates with domain controllers using WMI or the Check Point Identity Collector API, making it suitable for large environments. The other options either require endpoint installation, rely on user interaction, or are management tools that do not collect identities at runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Endpoint Security Client with Identity Awareness blade enabled
Why it's wrong here
The Endpoint Security Client with the Identity Awareness blade enabled is a full client that must be installed on each endpoint. This contradicts the requirement to avoid installing additional client software on workstations. While it can provide identity information, it is not the component used to collect identities from domain controllers without endpoint installation, making it incorrect for this scenario.
- ✓
Identity Collector
Why this is correct
Identity Collector is a Check Point component that receives identity information directly from Active Directory domain controllers via the Check Point Identity Collector API or WMI, without installing software on user endpoints. It is designed for large environments and supports multiple domain controllers. In this scenario, it eliminates the need for a full Identity Agent on each workstation while still providing transparent user identification.
- ✗
Captive Portal with AD Query
Why it's wrong here
Captive Portal with AD Query is a transparent identification method that uses browser-based authentication and AD Query to map users to IP addresses. It does not collect identities directly from domain controllers without endpoint software; instead, it relies on user interaction and gateway queries. This does not meet the requirement of avoiding endpoint installation while collecting identities from domain controllers, so it is incorrect.
- ✗
SmartConsole Identity Awareness extension
Why it's wrong here
SmartConsole is the management interface used to configure and monitor Check Point security policies, including Identity Awareness settings. It is not a runtime component that collects identities from domain controllers. The SmartConsole Identity Awareness extension does not exist as a separate identity collection mechanism; therefore, it cannot fulfill the requirement of gathering identities without endpoint agents.
About these practice questions
This 156-315.81.20 question is part of Courseiva's 210-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-315.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-315.81.20 exam.