Check Point CCSM Practice Test

CCSM practice test: what's covered

• Certified Security Master
• R81.20

Free CCSM sample questions

1. In a Multi-Domain Security Management (MDSM) deployment, you must add a CMA for a new tenant "AcmeBank" on the MDS. Which component is actually instantiated on the MDS server when you create this Domain?

   • A. A new Multi-Domain Log Server (MDLS) process bound to the tenant
   • B. A Customer Management Add-on (CMA) — a fully isolated Security Management process with its own Postgres DB, FWM, CPM, and management VIP, running on the MDS
   • C. A SmartConsole client process for the tenant admin
   • D. A Global Domain replica only
   Show answer

   Correct: B. Each Domain = one CMA = a self-contained SmartCenter (Postgres, FWM/CPM, ICA, log indexer) with its own VIP. MDLS is a SEPARATE log-only role you can add per Domain; it is not auto-created with the CMA. The classic trap is conflating CMA (mgmt plane) with MDLS (log plane).

2. Which TWO statements about the Global Domain in an MDSM environment are correct? (Choose 2)

   • A. Global Domain policies are pushed directly to gateways
   • B. Global Domain holds reusable objects and global policy layers that are assigned to Domain Management Servers (CMAs) and then included in their local policies
   • C. Global Domain is the only Domain that can host VPN communities
   • D. Global Policy assignment requires re-assignment after each Global edit; otherwise CMAs run the cached copy
   • E. Global Domain replaces the Standby MDS
   Show answer

   Correct: B and D. Global objects/policies live on the Global Domain and are referenced by local Domains. Gateways NEVER receive a policy direct from Global — only from their CMA. Re-assignment is mandatory after Global changes. Global Domain has no role in HA between MDS servers.

3. You run the following on the MDS: <pre>$ mdsstat Process Status FWM up CPCA up CPM (MDS) up CPM (AcmeBank) down CPM (TechClick) up</pre> Which action is the FIRST correct step?

   • A. Reboot the MDS server
   • B. Switch environment to the AcmeBank Domain ("mdsenv AcmeBank") and restart its CPM with "cpwd_admin start -name CPM" or "mdsstart_customer AcmeBank"
   • C. Reinstall the entire MDS from scratch
   • D. Delete the AcmeBank Domain
   Show answer

   Correct: B. Each CMA has its own CPM. The correct first step is to scope to the affected Domain via mdsenv, then restart the failed CPM. Rebooting the entire MDS impacts every tenant. Without mdsenv, cpwd_admin acts on whichever Domain is currently scoped.

4. You are migrating an R80.40 stand-alone management to a fresh R81.20 management on new hardware. Which official toolchain is used?

   • A. snapshot / revert
   • B. migrate_server export on the source, then migrate_server import on the target (or Migration Tool / "Advanced Upgrade" wizard in R81.20)
   • C. cp_merge / cp_split
   • D. fw export / fw import
   Show answer

   Correct: B. migrate_server (formerly migrate.tgz / migrate.sh) is the supported tool for management upgrades and hardware migrations. "snapshot" is image-level and not cross-version safe; cp_merge/cp_split are for policy package merge ops only. R81+ wraps migrate_server in a wizard.

5. A scripted CI/CD pipeline must add 50 host objects nightly. Which interface is the correct one for this in R81.20?

   • A. SmartDashboard scripting
   • B. Web Visualization Tool (WebVT)
   • C. Management API — REST calls to https://<mgmt>/web_api/ using login → add-host (in a session) → publish → logout, or via the "mgmt_cli" tool
   • D. cpconfig
   Show answer

   Correct: C. The R81.x Management API is the supported automation surface. Any change must be made inside a session (login returns sid) and must be published to commit. mgmt_cli is the official CLI wrapper. Trap: forgetting to publish — your changes remain in your private session and are invisible to others.

Last updated: 2026-10-19

CCSM practice test FAQ

Related practice tests

• CCSA R81 practice test
• Check Point CCSE practice test