Task: Verify the enabled Software Blades on a Check Point Security Gateway.
Correct Answer:
See the Explanation.Explanation: 1- SSH into the Security Gateway. 2- Run the command: cplic print to check license details. 3- Use: enabled_blades or cpstat os to verify enabled blades. 4- Confirm Threat Prevention blades like IPS, Anti-Bot, and Anti-Virus are listed. 5- Use SmartConsole > Gateway > General Properties to visually confirm the same.
Question 22
In Anti-Virus, what is one of the benefits of Deep Scanning?
Correct Answer: D
The correct answer is D. Thorough protection . Deep Scanning is selected when the organization wants broader and more complete Anti-Virus inspection, even at the cost of additional processing. Check Point's Anti-Virus settings documentation shows that administrators can configure file handling to process file types known to contain malware, process specific file-type families, or process all file types . It also states that enabling deep inspection scanning impacts performance. This is the key tradeoff: Deep Scanning improves protection depth by expanding the set of files and content types subjected to inspection, but it is not the best choice for minimal latency or lowest resource consumption. Options A, B, and C are therefore incorrect because Deep Scanning is not primarily a performance optimization. It can require more CPU, memory, buffering, file classification, and scanning time, especially when paired with archive scanning, HTTPS Inspection, or large file transfers. Its benefit is security completeness: it reduces blind spots by inspecting more file content and providing stronger protection against malware hidden in less common or less obvious file types. Reference topics: Anti-Virus Settings, File Types, Deep Inspection Scanning, process all file types, performance impact, thorough malware protection.
Question 23
Task: Check the health of the Threat Prevention blades.
Correct Answer:
See the Explanation.Explanation: 1- SSH into the Gateway. 2- Run: cpview > Threat Prevention section. 3- Check CPU, memory, and update status. 4- Look for blade-specific errors or crashes. 5- Use cpstat threat-prevention for CLI summary.
Question 24
What is the primary benefit of DNS Trap?
Correct Answer: A
The correct answer is A. Infected host identification . Malware DNS Trap is designed to help identify compromised clients by redirecting malicious DNS resolution to a controlled false IP address and then observing which internal hosts attempt to connect to that trap address. Check Point's R81.20 Threat Prevention guide states that Malware DNS Trap can be used to detect compromised clients by checking logs with connection attempts to the false IP address. It also notes that internal DNS servers can be added to better identify the origin of malicious DNS requests. This makes the primary operational benefit host attribution. While DNS security can block or prevent malicious DNS-related activity, DNS Trap's distinctive value is showing which internal endpoint is likely infected or attempting malicious communication. Option B is more aligned with URL Filtering or URL reputation, not DNS Trap. Option C describes a blocking outcome, but it misses the key trap mechanism and attribution purpose. Option D is incorrect because the usual DNS Trap use case concerns internal clients generating suspicious outbound DNS or follow-up connections, not inbound malicious DNS queries. Reference topics: Malware DNS Trap, Anti-Bot & Advanced DNS, false IP address, compromised-client detection, infected-host investigation.
Question 25
What is the purpose of the Profile Cleanup option?
Correct Answer: A
The correct answer is A. It lets you start over by removing all administrator overrides . Profile Cleanup is a profile-maintenance function used when manual IPS protection changes have accumulated and the administrator wants to return the profile to its intended baseline logic. Check Point's IPS Protections documentation describes the Profile Cleanup window as offering actions such as Remove all user modified and Clear all staging , followed by installing the Threat Prevention Policy. This makes the feature a reset and hygiene mechanism, not a rulebase cleanup rule. It removes administrator- level overrides that may have been introduced during tuning, temporary mitigation, testing, exception handling, or staged rollout of protections. Option B is incorrect because Profile Cleanup does not merge settings from several profiles into the Optimized Profile. Option C is incorrect because unmatched traffic handling is controlled by policy/rule behavior, not by Profile Cleanup. Option D is incorrect because protections are not automatically removed based on usage age by this option. The administrative value of Profile Cleanup is control: it lets the security architect re-align a profile with its default or intended activation criteria. Reference topics: IPS Protections, Activation Overrides, Profile Cleanup, Staging, Threat Prevention Policy installation.
