Task: Assign Anti-Bot and Anti-Virus profiles to a Threat Prevention policy rule.
Correct Answer:
See the Explanation.Explanation: 1- Open Threat Prevention > Policy. 2- Add a rule with appropriate Source, Destination, Services. 3- Under "Profile," assign the custom AV/AB profile. 4- Set Action to "Accept" and Track to "Log." 5- Publish and install the policy.
Question 2
Task: Troubleshoot policy installation failure.
Correct Answer:
See the Explanation.Explanation: 1- In SmartConsole, attempt policy install again and note error. 2- View install_policy.elg in $FWDIR/log/. 3- Verify SIC is active. 4- Ensure policy contains no rulebase errors. 5- Re-push after resolving syntax or connectivity issues.
Question 3
Task: Simulate a malicious file download and validate AV detection.
Correct Answer:
See the Explanation.Explanation: 1- In test environment, download EICAR test file. 2- Monitor logs: blade:"Anti-Virus" AND action:"Prevented". 3- Confirm file type, source IP, and destination file path. 4- Check associated protection name. 5- Ensure AV blade action is set to "Prevent."
Question 4
What is necessary to do after an IPS Signature update?
Correct Answer: B
The correct official-guide answer is B. Install the Threat Prevention Policy . IPS protections can be updated manually or by schedule, and Check Point documentation states that IPS can be updated with real-time information on attacks and the latest protections. However, the same official section explicitly notes that to enforce the IPS updates, you must install the Threat Prevention Policy . The documented update procedure also ends with installing the Threat Prevention Policy after selecting the IPS update method. This distinction is important: downloading or updating the IPS package makes the updated protections available to management and policy logic, but enforcement on Security Gateways depends on policy installation. "Install Database" is not the correct enforcement step for gateway inspection. Installing the Access Control Policy is also incorrect because IPS ThreatCloud protections are part of the Threat Prevention policy framework, not the Access Control rulebase. The statement that changes are immediately active is not the current official behavior for enforcing IPS updates on gateways. In production operations, scheduled IPS updates may be paired with automatic Threat Prevention policy installation, but that still confirms the requirement: the policy must be installed for enforcement. Reference topics: Updating IPS Protections, Threat Prevention Policy installation, IPS update enforcement, scheduled updates.
Question 5
What is the maximum number of patterns/observables are supported in R81.20 IOC Files?
Correct Answer: B
The correct answer for the uploaded course-question set is B. 1 Million . IOC files are used to import indicators of compromise so that the gateway can match known malicious or suspicious observables such as domains, URLs, IP addresses, and file hashes. In the Threat Prevention architecture, these indicators complement ThreatCloud intelligence by letting administrators add organization-specific or third-party intelligence into enforcement. The key certification point in this question is scale: R81.20 IOC Files are tested with a maximum of 1 million patterns or observables in this exam context. Operationally, this limit matters because large IOC files affect memory use, update processing, compilation time, and gateway enforcement behavior. Architects should avoid treating IOC ingestion as unlimited; feeds must be curated, deduplicated, normalized, and prioritized. The current public R81.20 release documentation distinguishes expanded IoC feed scale and states that IoC feeds can support significantly more observables on XFS systems, while EXT3 has a lower limit. For this specific question wording, however, the answer key's "IOC Files" limit is 1 Million , while later Custom Threat Indicators and external-feed capacities are treated separately in related questions. Reference topics: IOC Files, Threat Indicators, R81.20 Threat Prevention, observable limits, feed sizing and gateway resource planning.
