[2026] 156-590 by CTPS Actual Free Exam Practice Test [Q17-Q35]

See the Explanation.Explanation:
1- Go to Threat Prevention > Profiles.
2- Click “New Profile,” name it (e.g., “AV_AB_Only”).
3- Enable “Anti-Bot” and “Anti-Virus”; disable IPS and TE.
4- Set Action to “Prevent” for high/medium confidence threats.
5- Save and apply this profile to your Threat Prevention rule.

The correct answer is A. Automatically activates new protections based on profile . IPS protections are governed by Threat Prevention profiles, and those profiles determine which protections are activated for a rule or policy. Check Point documentation states that a Threat Prevention profile determines which protections are activated and which Software Blades are enabled for the specified rule or policy. For newly downloaded IPS protections, Check Point documents that automatic IPS update behavior can use the profile settings as the default action for those newly downloaded protections.
This is the core logic behind the answer: IPS Follow Protections aligns newly available protections with the active profile’s protection-selection logic instead of requiring the administrator to manually evaluate and activate every update. The profile already contains the criteria for activation, including threat severity, confidence, and performance considerations. Option B describes a different review-oriented workflow, commonly associated with marking protections for follow-up or staging. Option C is incorrect because reporting is a SmartEvent or logging function, not the purpose of Follow Protections. Option D is also incorrect because highlighting log entries does not activate enforcement. Reference topics: IPS profile settings, newly updated IPS protections, automatic update behavior, activation according to profile settings, IPS protection lifecycle.

See the Explanation.Explanation:
1- Open SmartConsole > Threat Prevention > Policy.
2- Ensure the policy is assigned to the correct Gateway.
3- Publish and Install the policy.
4- SSH into the Gateway and run: fw stat to confirm active policy name.
5- Cross-verify that Threat Prevention blades are enforcing the loaded policy.

The correct answer is D. Thorough protection . Deep Scanning is selected when the organization wants broader and more complete Anti-Virus inspection, even at the cost of additional processing. Check Point’s Anti-Virus settings documentation shows that administrators can configure file handling to process file types known to contain malware, process specific file-type families, or process all file types . It also states that enabling deep inspection scanning impacts performance.
This is the key tradeoff: Deep Scanning improves protection depth by expanding the set of files and content types subjected to inspection, but it is not the best choice for minimal latency or lowest resource consumption.
Options A, B, and C are therefore incorrect because Deep Scanning is not primarily a performance optimization. It can require more CPU, memory, buffering, file classification, and scanning time, especially when paired with archive scanning, HTTPS Inspection, or large file transfers. Its benefit is security completeness: it reduces blind spots by inspecting more file content and providing stronger protection against malware hidden in less common or less obvious file types. Reference topics: Anti-Virus Settings, File Types, Deep Inspection Scanning, process all file types, performance impact, thorough malware protection.

See the Explanation.Explanation:
1- Open SmartConsole > Gateways & Servers.
2- Double-click the relevant Security Gateway.
3- Under the “General Properties” tab, enable “Anti-Bot” and “Anti-Virus.”
4- Click OK > Publish the changes.
5- Install the Access Control and Threat Prevention policy.

The correct answer is D. The Threat Prevention Policy is only applied after traffic is accepted by Access Control Policy . Threat Prevention is a follow-up inspection framework for traffic that has already passed the access decision. The Access Control policy determines whether a connection is allowed, rejected, or dropped.
Only traffic that is allowed by Access Control can proceed into Threat Prevention evaluation for IPS, Anti- Bot, Anti-Virus, Threat Emulation, and related blades. Check Point’s policy workflow separates Access Control and Threat Prevention, and the Threat Prevention guide describes the Threat Prevention rulebase as the policy used to activate needed protections and prevent attacks against accepted traffic flows.
Options B and C are incorrect because Threat Prevention does not resurrect or override a connection that Access Control has already dropped or rejected. The inspection chain is sequential from an enforcement perspective: blocked traffic does not continue to malware or IPS inspection as an accepted connection. Option A is also incorrect because a gateway is assigned policy through its policy package and Threat Prevention policy structure, not by stacking multiple independent Threat Prevention policies on the same target as competing enforcement policies. Reference topics: Threat Prevention Policy workflow, Access Control then Threat Prevention sequence, policy package enforcement, accepted-traffic inspection.

See the Explanation.Explanation:
1- Open SmartConsole > Logs & Monitor.
2- Set a filter: blade:”IPS” or blade:”Anti-Bot”.
3- Review recent events with timestamps.
4- Double-click logs for detailed packet info.
5- Verify policy name and action taken.

See the Explanation.Explanation:
1- Clone the base profile > name it Performance_AV_Profile.
2- Under Anti-Virus, choose Stream Mode scanning.
3- Disable scanning for large file types (e.g., media).
4- Set threshold limits (e.g., max file size).
5- Apply this profile to critical servers or high-traffic rules.

See the Explanation.Explanation:
1- Go to Threat Prevention Policy > Layers tab.
2- Confirm shared layer is attached to Threat Prevention layer.
3- Double-check profile bindings per rule.
4- Publish and install to apply globally.
5- Use logs to validate consistent protection across gateways.

See the Explanation.Explanation:
1- SSH into the Gateway.
2- Run: tecli debug on or pdp debug on.
3- Reproduce the issue.
4- View logs in $FWDIR/log/.
5- Disable debug mode: tecli debug off.

The correct answer is D. SmartView . Threat Prevention exceptions are created and managed in SmartConsole policy and log workflows, not from SmartView as the tested location. Check Point documentation states that an exception can be added directly to a rule, and the procedure begins by selecting the rule in the Policy pane and clicking Add Exception . It also documents creating exceptions from IPS Protections and from logs or events in the Logs & Monitor view, where the administrator right-clicks a log and selects Add Exception .
This validates Policy Rule, Log Overview, and Log Details-style workflows as valid exception creation contexts. SmartView, by contrast, is primarily used for browser-based log viewing, reporting, dashboards, and event analysis. It is not the SmartConsole policy-editing context where Threat Prevention exception rules are inserted into the policy package and then installed. The operational reason is enforcement integrity:
exceptions modify the compiled Threat Prevention policy, so they must be created in a policy-aware workflow where protected scope, protection/site/file/blade, action, track, install targets, and policy installation are controlled. Reference topics: Exception Rules, Adding Exception to Rule, Creating Exceptions from Logs or Events, IPS Protections exceptions, Threat Prevention Policy installation.

See the Explanation.Explanation:
1- SSH into the Gateway.
2- Run: ips update now to fetch new protections.
3- Verify update status: ips stat or cpview.
4- Check update timestamp in SmartConsole > Gateways > Threat Prevention > Updates.
5- Confirm protections appear in IPS Protections list.

See the Explanation.Explanation:
1- In test environment, download EICAR test file.
2- Monitor logs: blade:”Anti-Virus” AND action:”Prevented”.
3- Confirm file type, source IP, and destination file path.
4- Check associated protection name.
5- Ensure AV blade action is set to “Prevent.”

The correct answer is D. F2F . Protections with high inspection impact generally require deeper processing that cannot remain fully accelerated in SecureXL. In Check Point performance terminology, F2F means traffic is forwarded from SecureXL to the Firewall path for inspection. Performance tuning documentation describes F2F packets as packets that SecureXL forwarded to the Firewall in the slow path, while accelerated traffic remains in the fast path. Threat Prevention protections, especially high-impact IPS protections, can require deeper packet, stream, or protocol analysis and therefore increase the portion of traffic processed outside full SecureXL acceleration.
Check Point IPS documentation explains that Performance Impact is the measure of how much a protection affects gateway performance and warns that activated protections with higher performance impact can cause connectivity or performance issues. The IPS optimization guidance further explains that some protections require more system resources to inspect traffic and recommends focusing on lower-impact protections when reducing gateway resource use is necessary. SXL is the fully accelerated path, PXL is medium-path inspection with acceleration assistance, and CPASXL relates to active streaming acceleration. High Protection Impact aligns with F2F because the gateway must perform deeper inspection. Reference topics: IPS Performance Impact, SecureXL packet paths, F2F, PXL/SXL, IPS optimization.

See the Explanation.Explanation:
1- Ensure HTTPS Inspection is enabled on gateway.
2- In the custom profile, enable Inspect HTTPS traffic under Anti-Virus and Anti-Bot.
3- Set CA certificate deployment for clients.
4- Save changes and install both TP and HTTPS inspection policies.
5- Validate detection using test HTTPS malware download.

See the Explanation.Explanation:
1- Generate test traffic causing a prevent log in SmartConsole.
2- Identify the IPS protection name.
3- Add an exception for that IP or subnet with action “Detect.”
4- Re-test traffic and verify logs reflect “Detect.”
5- Document the false positive and report to Check Point if needed.

See the Explanation.Explanation:
1- SSH into the gateway.
2- Run: cpstat antimalware and cpstat anti-bot.
3- Confirm both blades are “Active” and signatures are “Up-to-date.”
4- Check with cpview > Threat Prevention section.
5- Use watch -n 5 cpstat antimalware to monitor real-time status.

The correct answer is D. Ordered . Threat Prevention policy uses ordered policy layers. Check Point documentation states that you can create a Threat Prevention Rule Base with multiple Ordered Layers , and that Ordered Layers help organize the Rule Base according to organizational needs, such as services or networks. Each Policy Layer calculates its action separately from other layers, and when there is one layer in the policy package, the first matched rule is enforced.
This is a core certification distinction. Access Control can use ordered and inline layers, but Threat Prevention is treated as an ordered layer policy model. The policy evaluates rules in order and applies the appropriate Threat Prevention profile, blades, protection behavior, and tracking according to rule matching. Option C describes when Threat Prevention is applied in the traffic flow-after Access Control accepts the connection-but it does not answer the question about the layer type. Option A is incorrect because Threat Prevention is not both ordered and inline in this context. Option B is incorrect because inline layers are not the Threat Prevention layer type being tested here. Reference topics: Threat Prevention Policy Layers, Ordered Layers, first-match behavior, policy-layer calculation, Threat Prevention Rule Base.

The correct answer is C. MITRE Corporation . CVE, or Common Vulnerabilities and Exposures, is the standardized naming system used across security vendors, vulnerability databases, IPS signatures, advisories, scanners, and remediation programs. In a Check Point Threat Prevention context, CVE identifiers are important because IPS protections frequently map detections and exploit protections to known vulnerabilities.
This allows administrators to correlate a Check Point IPS protection with vendor advisories, exposure management, patching, and risk prioritization. The official CVE site describes CVE as an authoritative reference method for publicly known information-security vulnerabilities and exposures. MITRE documentation states that The MITRE Corporation maintains CVE and its public website , manages compatibility, and provides technical guidance to the CVE Editorial Board.
The distractors represent related but distinct roles. DHS/CISA has historically sponsored or funded the program, but sponsorship is not ownership and maintenance of the CVE list itself. NIST maintains the National Vulnerability Database, which enriches CVE data with scoring and analysis, but NVD is downstream from CVE identifiers. Check Point consumes CVE intelligence through IPS and ThreatCloud- driven protections; it does not own the CVE program. Reference topics: IPS vulnerability mapping, CVE- based protection metadata, threat intelligence normalization, vulnerability-to-protection correlation.