156-315.81.20 Identity Awareness Practice Question
A Security Gateway is configured with Identity Awareness using AD Query, and users authenticate to the domain normally. An administrator notices that identities for users who log on to workstations on a remote subnet are not appearing in the Identity Awareness database, while local subnet users are identified correctly. The domain controllers are reachable and audit logging is enabled. Which configuration item should the administrator verify first?
⚠ Common exam trap
The trap here is blaming domain controller connectivity or DNS for an identity gap, when AD Query silently ignores subnets it is not configured to monitor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The remote subnet is included in the AD Query configuration's monitored networks
AD Query filters the domain controller logon events it consumes based on the configured monitored networks. A subnet that is not listed produces no identities for its users, even when domain controllers and auditing are healthy. Verifying that the remote subnet appears in the AD Query network list is the direct and most likely fix for this selective failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Captive Portal certificate is trusted by the remote workstations
Why it's wrong here
Captive Portal certificates matter only when Captive Portal is an active acquisition method. In an AD Query deployment, users are not redirected to a web portal, so certificate trust on the workstations has no bearing on whether their identities are learned from domain controller event logs.
- ✓
The remote subnet is included in the AD Query configuration's monitored networks
Why this is correct
This is correct because AD Query only tracks logons originating from IP ranges that are explicitly listed as monitored networks in the Identity Awareness configuration. If the remote subnet is missing from that list, the gateway ignores logon events from those addresses, so users there never get mapped even though the domain controllers are functioning properly.
- ✗
The gateway's identity sharing setting is set to 'Sharing to all gateways'
Why it's wrong here
Identity sharing controls whether one gateway distributes learned identities to other gateways in a distributed environment. It does not filter which source subnets are monitored by AD Query on the gateway that performs the acquisition, so it would not explain why one subnet's users are missing locally.
- ✗
The gateway's DNS resolver is configured to query the domain controllers
Why it's wrong here
DNS resolution affects name lookup and some identity features, but it does not determine which subnets AD Query monitors. If DNS were the root cause, the symptom would typically affect name resolution or domain controller discovery rather than selectively omitting one subnet from the Identity Awareness database.
Visual reference
About these practice questions
One of 210 original 156-315.81.20 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-315.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-315.81.20 exam.