156-315.81.20 Identity Awareness Practice Question
A security administrator is troubleshooting an Identity Awareness deployment that uses Identity Agents. Users report that they can access resources based on their identity, but sometimes they are prompted to authenticate again even though they are already logged in. The administrator checks the gateway and sees that the Identity Agent is running on the users' computers. What is a possible cause for the re-authentication prompts?
⚠ Common exam trap
The trap here is assuming that once the Identity Agent authenticates a user, the identity persists indefinitely regardless of IP changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's IP address has changed, and the Identity Agent has not updated the PDP with the new IP.
Identity Agents dynamically update the PDP with the user's current IP address. If the IP changes and the agent fails to update the PDP promptly, the gateway may see traffic from an unknown IP and treat it as unauthenticated, triggering re-authentication. This is a common issue in environments with DHCP or multiple network interfaces. Ensuring the agent is running and can communicate with the gateway is essential.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Identity Agent is not configured to start automatically, so it stops when the user logs off and on.
Why it's wrong here
If the Identity Agent were not running, the user would not be identified at all. The scenario states the agent is running and users are identified initially. Intermittent re-authentication suggests the agent is running but losing synchronization, not that it is stopped. This option does not explain the intermittent nature.
- ✓
The user's IP address has changed, and the Identity Agent has not updated the PDP with the new IP.
Why this is correct
Identity Agents maintain the mapping between the user and their IP address. If the user's IP changes (e.g., due to DHCP lease renewal or switching networks), the agent must send an update to the PDP. If the update is delayed or fails, the gateway may not recognize the new IP as authenticated, prompting re-authentication. This is a common cause of intermittent identity loss.
- ✗
The gateway is configured to use AD Query in addition to Identity Agents, causing conflicting identity information.
Why it's wrong here
Using multiple identity sources can cause conflicts, but the scenario does not indicate AD Query is enabled. Even if it were, the symptom of re-authentication prompts is more directly related to IP address changes. This option introduces an unsupported assumption and is not the most likely cause.
- ✗
The Identity Agent is configured to use a different port than the gateway's Identity Awareness service.
Why it's wrong here
If the port were mismatched, the Identity Agent would not communicate at all, and users would not be identified. The scenario states that users can access resources based on identity, indicating communication is working. Thus, a port mismatch is unlikely to cause intermittent re-authentication prompts.
Visual reference
About these practice questions
One of 210 original 156-315.81.20 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-315.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-315.81.20 exam.