CCSA/CCSE Exam Tips & Content - R80.X vs. R81.X

[Timothy_Hall]

Edit: This deprecated article covers students that attended a CCSA/CCSE R80 course that were planning to challenge the R81.10 exam.  For those that attended a CCSA/CCSE course version R81.10 and are planning to challenge the R81.20 exam, see my updated article here: CCSA/CCSE Exam Tips & Content - R81.10 vs. R81.20 

With the release of the new CCSA/CCSE R81.10 exams on Monday, as someone who has taught both the old and new classes I thought it would be helpful to provide some general tips and a comparison of the CCSA/CCSE R80.X content vs. the updated CCSA/CCSE R81.10 content.  The goal here is to highlight content differences, so that those who have attended a CCSA/CCSE R80.x class or not worked with R81+ at all yet can assess their preparation options for challenging the R81.10 exams.

Disclaimer: I have not taken any of the R81.10 exams yet so anything you read here should be considered rank speculation, possibly deluded, or even flat-out wrong.  By the same token since I haven't even seen the new exams I can't be violating any confidentiality agreements with the following speculation.  😀

First off, some general CCSA/CCSE Check Point exam tips regardless of version (I shared these during a CCTE exam prep session I hosted for CPX 360 2022):

1) You have 90 minutes to complete 100 multiple choice questions with one correct answer for each.  There used to be fill-in-the-blank questions but those seem to have gone away recently.

2) Pass is a 70%.

3) You are allowed to back up and return to prior questions (unlike say Cisco exams).  You also have the ability to flag a question you are not sure about, then at the end of the exam if there is time left, jump back through all the questions you flagged.  My suggestion is to always answer every question on the first run-through even if it is a wild guess, as a question will be marked equally wrong regardless of whether you selected an incorrect answer or left it unanswered.

4) If the context of the question is unclear, try to remember how that topic was presented in the lecture and labs during class.

5) I still personally struggle with this one: For those with extensive Check Point experience try to take the questions at face value and not overthink, or start pondering "well that depends on...".  Generally the questions are pretty straightforward and are not asking you about some obscure situation you vaguely remember seeing 10 years ago at 3am on a Saturday night.  😀

6) Check Point exams are not adaptive and will not try to beat you over the head with the same topic if you have answered an earlier question on that topic incorrectly. Questions are drawn from a pool at the start of the exam and do not change during the course of the exam. By the same token you may draw two questions that are extremely similar or even identical; do not automatically assume you answered the first instance incorrectly when the second instance appears.

7) 80% of the exam questions are taken right from the courseware lecture and labs, the remaining 20% are "real-world" questions so having at least some real-world experience with Check Point (and not just the class) will be helpful. Do not panic if you face one of those 20% questions that were not mentioned/covered at all in the class, and initially draw a complete blank.

8) Refer to sk163417: Check Point Learning & Training FAQ for any questions about certification length, renewals, etc.

9) Online practice exams for CCSA and CCSE are available from PearsonVue and are well worth the $50 USD they cost, as they draw their practice questions directly from the live exam pool.  There aren't really any other legit exam prep guides available other than the official course material, and there are most certainly NOT any out there that are worth forking over money for.  The courses are to some degree based on portions of the official documentation administration guide PDFs, which can be accessed for free at the Check Point Support Center if you need to bone up on a covered topic or feature you aren't familiar with.

10) Check the exam numbers carefully when booking:

Check Point Certified Security Administrator (CCSA) R81 – Exam #: 156-215.81
Check Point Certified Security Expert (CCSE) R81 – Exam #: 156-315.81

Tips for the CCSA R81.X exam:

1) The main thing to watch out for is that all Threat Prevention (TP) coverage (IPS, AV, ABOT, TE, TX) was taken out of CCSE and put into CCSA for R81.10.  So any questions about TP are fair game along with the new Autonomous Threat Prevention, which you should at least check out in SmartConsole's Demo Mode if you haven't worked with it.

2) ClusterXL is no longer covered in CCSA R81.10; was moved to CCSE R81.10.

3) IPSec VPNs, SmartEvent, and the Compliance blade are no longer covered in CCSA R81.10; moved to CCSE R81.10.

4) Note that most Licensing operations can be conducted directly from the SmartConsole and not using SmartUpdate in R81+.

5) APCL/URLF is covered much more heavily in CCSA R81.10 vs. CCSA R80.X.

6) Know the new NAT features (hit counts, etc.) and the Access Control policy default column field of "None" instead of "Any" in R81+.

7) Inline layers are covered much more heavily in CCSA R81.10 vs. CCSA R80.X.

8) cpview is no longer covered at all.

Tips for the CCSE R81.X exam:

1) IPSec VPNs (including interoperable/heterogenous), SmartEvent, and the Compliance blade are now covered in CCSE R81.10 instead of CCSA.

2) SMS Migration/Upgrade tools have changed pretty significantly in R81+, along with the use of Blink for gateways.

3) ClusterXL is more heavily covered including the new Correction Layer.

4) VRRP is no longer covered at all.

5) cpview and advanced clish options are extensively covered and used.

6) Miscellaneous: Be aware of SmartTasks, MDPS, Dynamic/Updatable Objects, Dynamic CoreXL Split/Dynamic Workloads, CDT, and Accelerated Policy Installs.

I'd be happy to answer any additional questions, within the bounds of confidentiality agreements of course.

[RickLin]

promo code: Mind2022

This promotion is valid until June 30, 2022.

[Micha3l]

Hi!

Do you know until when the CCSA R80.X version will be available and if there will be an official announcement? I am studying and wanted to examine myself until it is withdrawn, and be able to plan the dates.

Thanks!!!

[Jason_Tugwell]

An official announcement will be posted on the Pearson Vue site, however our plans are to retire the R80 CCSA and CCSE on August 31.

Thanks

Jason

[Jason_Tugwell]

The exam retirement announcement was posted to Pearson Vue on 31 May. 

https://home.pearsonvue.com/checkpoint

[hassan2go]

Hello MR Timothy,

I am a beginner to CP, want to go for the CCSA exam. is there a book I can read (similar to Cisco study material) or what are the alternatives please?

Thanks  

[Timothy_Hall]

Other than the CCSA courseware itself which can be purchased from Check Point for $600 USD, there are not any official books covering CCSA topics currently available.  However there is the free Check Point for Beginners series that should at least get you started.

The courses and books I create myself normally cover advanced topics that don't really overlap with CCSA much.  However there is an independent book in production right now (not by me) that should be available later this year, and I expect it will meet your needs quite nicely.  Stay tuned.

[hassan2go]

Hello Tim, 

I was asked to follow you as a CP guru by my manager who also admires you for your kind works.

And it is really amazing how you got back to a novice learner with such prompt response. It makes a huge difference. 

Keep the good work up and wish you all the best.

Take care.

Kind regards,

Saif 

[Timothy_Hall]

The "independent book in production" I mysteriously mentioned in my prior post above was in fact @Vladimir's new book announced here: Announcement – Check Point Firewall Administration R81.10+ book release

[Vladimir]

Thank you for the shout-out!

[Alejandro_Flore]

Hi Tim!

Today I have passed CCSE Exam, your general tips are amazing!

However, I think that "real-world" questions are like 30-35% of exam, (the wording of some questions is terrible!)

It is super important to have real life expirience or at least to prepare labs continuously in order to present this certification.

[Timothy_Hall]

Thanks for the feedback, this may be due to the shift in topics between CCSE R80.40 and  CCSE R81.10.  In my experience many questions from the older version end up on the new exam, even if they are for content areas that are no longer covered in the latest version.  These would give the appearance of being real-world questions since the topics they ask about are no longer covered or covered as heavily on the new exam.

[samanthavidya1]

Tim, what would you recommend to take on R80 exam or R81 before August 2022 i have 4 years experience with R77 and r80 multi cluster environment havent done any checkpoint exams planning to take R80 ccsa

[faheb1]

I have passed CCSA R81.10 . thanks for the tips. it was really helpful.

[babicmilan]

Hello, I am interested in to know can I pass CCSE R81.X if I have valid CCSA R80.X or I have to pass CCSA R81.X before?

[Jason_Tugwell]

Yes, you may go from R80 CCSA to R81 CCSE.

Thanks

Tug

[Alex-]

Hi Tim,

I passed the CCSE R81 in time to cover my expiring CCSE R80 largely thanks to your tips so many thanks.

Happy holidays.

Kind regards,

Alex

[_Val_]

@Alex-  congrats!

[Parabol]

Hi Alex,

Could you share what were your methods of preparing for CCSE? I'm currently reading on the listed topics such as ClusterXL, s2s VPN, SecureXL etc.. on the Checkpoint website/admin guides. It's difficult to know how in-depth to go on these topics though.

Thanks,

Jason

[Alejandro_Flore]

Hi Jason!

About methods of preparation, I believe that an essential element is to have enough time to be able to cover in depth all the topics onte CCSE agenda. (Maybe 6 months?, really depends!)

Also, it worked for me to understand the concepts in a general way and then deepen them, also personal labs are a must.

Be sure to have a clear understanding of the different technologies of Check Point (Cluster, CoreXL, SecureXL), exam can be "heavy" regarding these topics (Don't forget about commands!). Questions about Gaia administrative tasks (upgrading, backing up, etc), traffic monitoring, policy compilation and API communication are also covered.

Don't forget about Management blades, there are questions about Compliance and SmartEvent (be sure to have a clear understanding of SmartEvent architecture)

In general, Tim tips are great! be sure to read them carefully!

During exam don't lose your cool, there wording of some questions is terrible and if by chance you have these questions in a row it can be heartbreking.

Finally, there are a few questions regarding pre-R81 releases, same as above dont lose your cool!

Good luck and share your exam experience if you decide to take it!

[akakak]

Thank you.