Task: Validate the Threat Prevention policy is applied correctly to a Security Gateway.
Correct Answer:
See the Explanation.Explanation: 1- Open SmartConsole > Threat Prevention > Policy. 2- Ensure the policy is assigned to the correct Gateway. 3- Publish and Install the policy. 4- SSH into the Gateway and run: fw stat to confirm active policy name. 5- Cross-verify that Threat Prevention blades are enforcing the loaded policy.
Question 47
What kind of blade is the IPS considered?
Correct Answer: B
The correct answer is B. Pre-infection . IPS is categorized as a pre-infection Threat Prevention blade because its primary role is to stop exploitation attempts before the protected host becomes compromised. Check Point' s Threat Prevention guide describes IPS as protection against malicious and unwanted network traffic, focusing on application and server vulnerabilities, in-the-wild attacks, exploit kits, and malicious attackers. The same guide distinguishes Anti-Bot & Advanced DNS as post-infection detection of bots on hosts, while Anti-Virus is described as pre-infection detection and blocking of malware at the gateway. IPS belongs in the pre-infection stage because it prevents the exploit chain from succeeding. It inspects network traffic for vulnerability exploitation, protocol abuse, malformed payloads, known CVE exploitation attempts, server attacks, client attacks, and suspicious patterns that could lead to compromise. "Preventative" is broadly true as an English description, but it is not the specific Check Point lifecycle classification tested here. "Inline" describes where a security function may sit in traffic flow, not the infection-stage category. "Post-infection" is associated with Anti-Bot, which detects and blocks command-and-control communications after a host shows signs of compromise. Reference topics: IPS Software Blade, pre-infection prevention, exploit protection, Threat Prevention architecture, Anti-Bot post-infection contrast.
Question 48
Task: Create a custom Threat Prevention profile that includes strict IPS enforcement.
Correct Answer:
See the Explanation.Explanation: 1- Open Threat Prevention > Profiles > New Profile. 2- Name the profile, select "Strict" mode for IPS. 3- Enable Prevent for High and Medium confidence levels. 4- Optionally, enable protections for server-side protections. 5- Save and assign this profile in your Threat Prevention policy.
Question 49
What does not belong to types of exceptions?
Correct Answer: B
The correct answer is B. QoS Policy exemptions . Threat Prevention exceptions are policy constructs used to alter how Threat Prevention blades, IPS protections, files, sites, or protected-scope objects are handled. Check Point documentation explains that an exception sets a different action for an object in the protected scope than the action specified by the Threat Prevention rule, and that exceptions are generally intended to reduce the level of enforcement rather than increase it. The guide also describes creating exceptions from IPS Protections, logs, events, and exception groups, all within the Threat Prevention policy workflow. IPS Settings Exceptions , Core Activation Exceptions , and Implied IPS Exceptions are aligned with the IPS/Threat Prevention exception model because they affect how protections are activated, tuned, or safely excluded from enforcement. QoS Policy exemptions do not belong to Threat Prevention exception taxonomy. QoS relates to traffic prioritization, bandwidth control, and quality-of-service enforcement, not malware, IPS, Anti-Bot, Anti-Virus, or blade exception handling. In certification terms, the key separation is policy domain: Threat Prevention exceptions modify security inspection behavior, while QoS exemptions belong to traffic management. Reference topics: Threat Prevention Exceptions, IPS Exceptions, Core Activation Exceptions, Implied IPS Exceptions, exception groups.
Question 50
Are Cleanup Rules mandatory in a Threat Prevention Policy?
Correct Answer: C
The correct answer is C. Cleanup Rules are not strictly required in the Threat Prevention Policy . Threat Prevention policy behavior is governed by ordered layers and rule matching, but an administrator is not forced to create an explicit cleanup rule in every Threat Prevention rulebase. Check Point documentation explains that a Threat Prevention Rule Base can contain multiple Policy Layers and that each layer calculates its action separately. For a single layer, the enforced rule is the first rule matched; for multiple layers, the final behavior depends on the layer matches and resulting action logic. A cleanup rule is still a strong operational best practice because it makes the terminal behavior explicit, easier to audit, and easier for operations teams to troubleshoot. Without an explicit cleanup rule, behavior depends on the layer's implicit cleanup logic and the policy architecture. Check Point Security Management documentation shows that implicit cleanup behavior exists at the layer level and can be configured as Drop or Accept in the Layer Editor. The question asks whether cleanup rules are mandatory, not whether they are recommended. Options A and D incorrectly tie cleanup rule requirement to the Basic Profile. Option B incorrectly links Threat Prevention cleanup requirements to the Access Control cleanup rule. Reference topics: Threat Prevention Policy Layers, implicit cleanup rule, explicit cleanup best practice, Layer Editor behavior.
