What is the default Anti-Virus protected scope interface settings?
Correct Answer: C
The correct answer is C. External . Anti-Virus protected scope settings define which traffic direction and interface types are sent for file inspection. Check Point explains that these settings are based on interface type, such as internal or external, and traffic direction, such as incoming or outgoing. In the Anti-Virus Protected Scope section, Check Point defines the option Inspect incoming files from and lists interface choices including External , External and DMZ , and All . The External choice means the gateway inspects incoming files from external interfaces, while files from DMZ and internal interfaces are not inspected. The default exam answer is therefore External: the baseline Anti-Virus behavior focuses on inbound files arriving from untrusted external interfaces, which is the most common malware-introduction path for perimeter deployments. Option A is too narrow because DMZ alone would ignore Internet-to-user inbound exposure. Option B expands inspection to DMZ traffic, which is valid as a configuration choice but not the default answer. Option D is broader still and increases inspection coverage and resource use, but it is not the default protected-scope setting in this question. Reference topics: Anti-Virus Settings, Protected Scope, interface topology, incoming file inspection, External interface classification.
Question 12
Task: Verify if a specific IPS protection is active.
Correct Answer:
See the Explanation.Explanation: 1- Go to Threat Tools > IPS Protections. 2- Use the filter to search by name or CVE ID. 3- Confirm status is "Active" and assigned to profile. 4- Double-click to view scope and affected profiles. 5- Confirm via SmartConsole logs if it triggered recently.
Question 13
Task: Check Secure Internal Communication (SIC) status between Management Server and Gateway.
Correct Answer:
See the Explanation.Explanation: 1- On Management, open SmartConsole > Gateways. 2- Right-click the gateway > Test SIC status. 3- CLI: Run cp_conf sic state on the gateway. 4- Check logs in $FWDIR/log/sic.log. 5- Re-initialize SIC if needed via SmartConsole or CLI.
Question 14
What is the correct action to exclude one or more Threat Prevention Blades in a Blade exception rule?
Correct Answer: D
The correct answer is D. "bypass" . A blade exception rule is used when matching traffic should be excluded from inspection by one or more Threat Prevention blades. In this context, bypass is the correct action because it tells the gateway not to apply the selected blade inspection to that traffic. Check Point's exception documentation describes exceptions as a way to set a different action for an object in the protected scope, usually to reduce enforcement. The same guide shows that exception rules can include a Protection/Site/File /Blade cell, where administrators can select categories including Blades as exception items. This is distinct from making a protection inactive globally. Inactive disables a protection or blade more broadly and is not the correct per-exception action for excluding selected traffic. Ignore is not the Threat Prevention exception action used in this context. Ask user is a UserCheck-style interaction and is not appropriate for bypassing Threat Prevention blade inspection. Bypass is precise: it preserves the broader policy while excluding only the matching scope from the selected blade or file-processing behavior. The guide also shows bypass behavior in file-type exception configuration, where a file type can be selected and bypassed under profile exception handling. Reference topics: Threat Prevention Exception Rules, Blade exceptions, bypass action, protected scope, file/blade exclusion.
Question 15
Task: Verify if Anti-Bot and Anti-Virus protections are active on a Security Gateway.
Correct Answer:
See the Explanation.Explanation: 1- SSH into the gateway. 2- Run: cpstat antimalware and cpstat anti-bot. 3- Confirm both blades are "Active" and signatures are "Up-to-date." 4- Check with cpview > Threat Prevention section. 5- Use watch -n 5 cpstat antimalware to monitor real-time status.
