156-315.81.20 Threat Prevention and SandBlast — 25 Questions

Question 1

Which SandBlast Threat Emulation feature is specifically designed to minimize the impact of file delivery delays on end-users?

Accepted Answer

Rapid Delivery. Threat Emulation can cause latency when files are inspected. The 'Threat Emulation Rapid Delivery' feature allows the gateway to deliver the file to the user immediately while the emulation process runs in the background. If the file is later determined to be malicious, the gateway blocks it retrospectively and alerts the administrator. This balances the critical need for security with the business requirement for high-speed file access in modern enterprise environments.

Answer

File Conversion

Answer

Threat Cloud Cache

Answer

Archive Inspection

Question 2

Refer to the exhibit. An administrator sees the provided debug output after a user reports connectivity issues. Based on the drop reason, what is the most likely cause?

Accepted Answer

The host 192.168.1.50 is attempting to reach a blacklisted IP address defined in the ThreatCloud repository.. The IPS drop reason indicates that the connection was blocked due to a policy configured within the Threat Prevention profile. Specifically, 'Malicious DNS/IP Activity' is triggered by the Anti-Bot or IPS blades when a host attempts to contact a known Command and Control server or an IP address categorized as malicious by the ThreatCloud database. This shows the firewall is actively enforcing reputation-based filtering to prevent compromised hosts from communicating with botnet infrastructure.

Answer

The Threat Emulation blade is currently in the process of sandboxing the ICMP request.

Answer

The IPS blade is misconfigured and is dropping all ICMP traffic from the internal segment.

Answer

The Threat Extraction blade is stripping metadata from the ICMP header.

Question 3

When configuring a Threat Prevention profile, what is the primary difference between 'Staging' and 'Prevent' modes for a specific protection?

Accepted Answer

Staging mode allows traffic while logging the event, whereas Prevent mode blocks the traffic.. In Check Point Threat Prevention, 'Prevent' mode actively blocks traffic that matches the signature, effectively stopping the attack. 'Staging' mode, however, allows traffic to pass while simultaneously generating logs, enabling administrators to test the impact of a rule before fully enforcing it. This is critical for avoiding false positives in production environments where overly aggressive blocking could disrupt legitimate business operations, allowing for policy tuning without affecting user productivity.

Answer

Staging mode requires a manual review before the protection can be enabled in Prevent mode.

Answer

Prevent mode only triggers for high-confidence threats, whereas Staging triggers for all threats.

Answer

Prevent mode is only available for IPS, while Staging is only available for Threat Emulation.

Question 4

Refer to the exhibit. Why did the Threat Emulation blade bypass the file?

Accepted Answer

The gateway is configured to skip emulation for files already inspected by Antivirus.. Check Point security blades are designed to work together efficiently. When the Antivirus blade identifies a file as malicious (or in this case, the test file), it takes action. Subsequent blades like Threat Emulation are then optimized to skip the file to save CPU cycles. This 'bypass' mechanism ensures the gateway maintains high performance by avoiding redundant inspection of files that have already been definitively flagged or cleared by another blade.

Answer

The file was too large for the emulation engine to process.

Answer

The Threat Emulation blade is not configured in the policy.

Answer

The file is a known safe file according to the ThreatCloud whitelist.

Question 5

Which THREE file types are typically supported for inspection by the Threat Emulation blade?

Accepted Answer

Microsoft Office documents (.docx, .xlsx, .pptx). Threat Emulation is designed to inspect a wide variety of file types commonly used as delivery vectors for malware. By supporting documents, archives, and executables, it covers the most frequent attack surfaces. Understanding these supported file types is essential for administrators to design an effective policy that balances performance with security coverage, ensuring that high-risk files are always subjected to sandbox detonation before being allowed into the network.

Answer

Encrypted ZIP archives

Answer

Raw binary image data

Question 6

Refer to the exhibit. The admin sees 'Suspicious' in the logs. What does this indicate about the file's classification?

Accepted Answer

The file behaved in a way that is indicative of malware but was not previously known.. A 'Suspicious' verdict from Threat Emulation indicates that the file exhibited behavior in the sandbox that is consistent with malware, even if it does not match a known signature. This is the core value of SandBlast, as it allows for the identification of zero-day threats. The system blocked the file because it deemed the behavioral anomalies significant enough to pose a threat to the internal network security.

Answer

The file matched a known signature in the local database.

Answer

The file was blocked due to an administrative override.

Answer

The file was blocked because it was an unsupported file type.

Question 7

Which THREE of the following are benefits of the 'ThreatCloud' service for an enterprise gateway? (Choose three)

Accepted Answer

Instant access to global malware signatures.. ThreatCloud provides the necessary intelligence for modern gateways to block advanced threats. By providing real-time reputation data for IPs, URLs, and file hashes, it enables the gateway to make instant decisions. This centralized intelligence allows smaller organizations to benefit from the global security research of the Check Point threat intelligence team, effectively leveling the playing field against highly resourced, sophisticated cyber attackers targeting the network.

Answer

Automated local policy generation based on user behavior.

Answer

Replacing the need for local gateway logs and analytics.

Question 8

An administrator wants to ensure that Threat Emulation is only applied to web-downloaded files, excluding internal file shares. How can this be achieved?

Accepted Answer

Create a new rule in the Threat Prevention policy that specifies the source as 'External' and the destination as 'Internal' networks.. By configuring the Threat Prevention policy with specific criteria in the 'Source' and 'Destination' fields, the administrator can control the scope of the inspection. Restricting the rule to traffic originating from the internet or specific user subnets while excluding internal server segments ensures that resources are not wasted on trusted, internal traffic, while maintaining a strict perimeter defense for external threats.

Answer

Modify the global Threat Emulation blade settings to only accept Internet as a source.

Answer

Use the 'Exclude' option in the global Threat Emulation settings for all internal IP ranges.

Answer

Disable Threat Emulation on all internal interfaces.

Question 9

An administrator notes that a specific file is being 'Bypassed' by Threat Emulation. What is the most likely cause?

Accepted Answer

The file matches an exclusion defined in the Threat Prevention policy.. Bypass occurs when a file is explicitly ignored by the policy or exceeds certain technical constraints that prevent analysis. This can be caused by an 'Exclusion' in the policy, the file being too large, or the file type not being supported by the emulation engine. Identifying the cause requires checking the specific 'Bypass' reason in the Threat Prevention logs to ensure it is intended behavior and not a security misconfiguration.

Answer

The file is a known malicious file from the ThreatCloud database.

Answer

The Threat Emulation process is crashed or unresponsive.

Answer

The file is too small to be considered a threat.

Question 10

An administrator notices that the Threat Prevention blade is inspecting traffic, but suspected zero-day malware is passing through without triggering Threat Emulation. The files are transferred over standard HTTP. Upon investigation, the gateway's Threat Emulation profile is set to inspect archives, and the file size is within the allowed limit. What is the most likely cause of this behavior?

Accepted Answer

The Security Gateway is operating in Optimized inspection mode, which skips Threat Emulation for non-critical HTTP traffic to conserve CPU resources during peak loads.. Threat Emulation relies heavily on specialized Threat Extraction technology or proper inspection scope to evaluate active content inside specific file formats. When traffic bypasses inspection despite valid profile settings, it is often due to protocol support limitations or misconfigured signature updates that prevent files from being queued for emulation analysis.

Answer

The file extension is explicitly excluded from the global Threat Prevention exclusion list inside the Advanced settings pane.

Answer

The Threat Extraction blade is disabled, preventing the gateway from holding the file and stripping active content before emulation completes.

Answer

The HTTP inspection settings in the Threat Prevention profile have file type blocking disabled for executables, causing the traffic stream to bypass emulation queuing.

Question 11

A security engineer observes that Threat Emulation is inspecting files, but the gateway is not sending files to ThreatCloud for analysis. The engineer verifies that the ThreatCloud component is enabled and the gateway has internet connectivity. Which configuration setting should be checked next to ensure files are sent to ThreatCloud for emulation?

Accepted Answer

The Threat Emulation blade's 'File Size Limit' is set appropriately.. The File Size Limit setting in Threat Emulation determines the maximum file size that will be sent to ThreatCloud for analysis. If files exceed this limit, they are not submitted. The engineer should check and adjust this limit to ensure files are sent. Other options like 'Send files to ThreatCloud' do not exist, and Emulation Scope affects local emulation, not cloud submission.

Answer

The Threat Emulation blade's 'Send files to ThreatCloud' option is enabled.

Answer

The Threat Emulation blade's 'Emulation Scope' is set to 'All files'.

Answer

The ThreatCloud repository is configured to receive files.

Question 12

An administrator notices that a specific executable file was allowed by Threat Emulation even though it was later found to be malicious. The administrator wants to ensure that such files are blocked in the future. Which action should be taken?

Accepted Answer

Adjust the Threat Emulation confidence level to block files with lower confidence.. The confidence level in Threat Emulation sets the threshold for blocking files. If the confidence is set high, files with lower confidence are allowed. Lowering the confidence level will block files that are suspected malicious, reducing the chance of allowing a malicious file. This is the correct action to prevent future occurrences of this issue.

Answer

Enable the 'Indicators' blade to detect malicious files.

Answer

Add the file's hash to the ThreatCloud blocklist.

Answer

Change the Threat Emulation action from Detect to Prevent.

Question 13

A security administrator is configuring Threat Prevention on a Check Point Security Gateway and wants to ensure that Threat Emulation and Threat Extraction work together effectively to protect against malicious files. Which TWO actions should the administrator take to optimize this configuration? (Choose two.)

Accepted Answer

Enable Threat Extraction to provide sanitized versions of files while Threat Emulation analyzes the original files in the background.. Enabling Threat Extraction to provide sanitized files while Threat Emulation analyzes originals in the background allows users to receive safe content quickly without waiting for emulation. Enabling ThreatCloud ensures both blades receive real-time threat intelligence, improving detection and prevention. These two actions optimize the combined use of Threat Emulation and Threat Extraction.

Answer

Configure Threat Extraction to only work on files that Threat Emulation has confirmed as malicious.

Answer

Set Threat Emulation to 'Detect' mode to avoid blocking files, while Threat Extraction provides sanitized files.

Answer

Set Threat Extraction to 'Prevent' mode to block all files until emulation is complete.

Question 14

A security administrator has configured a Threat Prevention policy that applies a Threat Emulation profile to HTTP and HTTPS traffic. Users report that a downloaded file was allowed after emulation determined it was benign. However, the administrator later discovers the same file hash was previously identified as malicious by ThreatCloud. Which Threat Prevention component should be reviewed to ensure it is enabled and properly configured to catch such known threats before emulation?

Accepted Answer

ThreatCloud Reputation service via the Threat Prevention policy. The ThreatCloud Reputation service is designed to immediately block files whose hashes are already known to be malicious, based on global threat intelligence. Since the file hash was previously identified as malicious, this service should have caught it. Threat Extraction, Anti-Bot, and a non-existent IntelliBlock component do not perform hash-based blocking against ThreatCloud's reputation database, making them incorrect for this scenario.

Answer

ThreatCloud IntelliBlock

Answer

Threat Extraction

Answer

Anti-Bot

Question 15

A security administrator has configured a Threat Prevention policy with the 'Recommended' profile on a R81 Security Gateway. They notice that Threat Emulation is skipping files that are larger than 20 MB. What is the most likely reason for this behavior?

Accepted Answer

The 'Recommended' profile enforces a default maximum file size limit for emulation, which can be adjusted in the Threat Prevention policy.. The 'Recommended' profile applies a default maximum file size for Threat Emulation to prevent resource exhaustion. This limit is 20 MB by default but can be modified. The observed skip is a direct result of this profile setting, not an inherent limitation of the blade or ThreatCloud.

Answer

The gateway is configured to bypass emulation for files larger than 20 MB because of a global property in the ThreatCloud repository.

Answer

Threat Emulation only inspects files that are smaller than 10 MB; the 20 MB limit is not configurable.

Answer

Threat Emulation automatically skips files larger than 20 MB to avoid performance impact, and this cannot be changed.

Question 16

An administrator is configuring Threat Prevention on a Check Point R81 gateway. They want to ensure that files downloaded from the internet are inspected for malicious content, but they also need to minimize the impact on user productivity. Which Threat Prevention profile setting should they use to achieve a balance between security and performance?

Accepted Answer

Recommended profile. The Recommended profile is specifically designed by Check Point to provide a balance between security and performance. It enables Threat Emulation, Threat Extraction, and other protections with settings that are effective without being overly disruptive. This makes it the ideal choice for an administrator seeking to protect users while minimizing productivity impact.

Answer

Strict profile

Answer

Custom profile with only Anti-Virus enabled

Answer

Basic profile

Question 17

A Check Point administrator is troubleshooting why Threat Extraction is not sanitizing a PDF file downloaded from a web server. The file is being allowed without any modification. Which TWO of the following are possible reasons for this behavior? (Choose two.)

Accepted Answer

The file type is not supported by Threat Extraction.. Threat Extraction will not sanitize files if the blade is not enabled on the gateway or if the file type is unsupported. Both conditions prevent the extraction process from running. Other factors like policy mode or SSL inspection may affect threat prevention but do not directly disable extraction for supported files.

Answer

The Threat Prevention policy is set to 'Detect' mode instead of 'Prevent'.

Answer

The 'Recommended' Threat Prevention profile automatically disables Threat Extraction for PDF files.

Answer

The file is downloaded over HTTPS and the gateway is not configured for SSL inspection.

Question 18

An administrator needs to verify that the ThreatCloud Intelligence feeds are being updated correctly on a Security Management Server. The administrator runs the command 'cpstat threatcloud' on the management server, but receives no output. What is the most likely reason for this behavior?

Accepted Answer

The ThreatCloud Intelligence feeds are updated via the Security Gateway, not the Management Server, so 'cpstat threatcloud' must be run on a gateway.. ThreatCloud Intelligence updates are consumed by Security Gateways, which enforce Threat Prevention blades. The 'cpstat threatcloud' command queries the gateway's ThreatCloud client status. Running it on a Management Server produces no output because the management server does not directly interface with ThreatCloud for real-time feeds. Administrators should run this command on the gateway to verify feed updates.

Answer

The administrator must first run 'threatcloud_update' to populate the ThreatCloud database on the Management Server, after which 'cpstat threatcloud' will display status.

Answer

The 'cpstat threatcloud' command requires the ThreatCloud API key to be configured in the Management Server's global properties before it returns any data.

Answer

The Management Server's ThreatCloud service is disabled by default and must be enabled via 'cpconfig' before the command will work.

Question 19

A Check Point administrator wants to test a new Threat Prevention policy that includes Threat Emulation and Anti-Bot blades. The administrator wants to see which files would be emulated and which connections would be blocked without actually enforcing the policy on users. Which feature should be used?

Accepted Answer

Configure a new gateway in a lab environment with the same policy and send test traffic through it to observe Threat Emulation and Anti-Bot actions.. To test Threat Prevention policies without impacting users, the administrator should use a lab gateway with identical configuration. This allows real emulation and inspection to occur, and logs can be analyzed to understand behavior. Other options either do not simulate Threat Prevention actions or do not exist. A lab environment is the most reliable way to validate policy effects before production enforcement.

Answer

Enable 'Threat Prevention Simulation' in the gateway's global properties, which logs what would have happened without enforcing.

Answer

Use the 'Policy Verification' feature in SmartConsole to simulate the policy against a sample traffic profile and see predicted actions.

Answer

Install the policy in 'Detect' mode for the Threat Prevention blades, which logs actions but does not block traffic.

Question 20

A security administrator is configuring Threat Emulation on a Check Point gateway. The administrator wants to ensure that emulation is performed for files that are downloaded via email attachments and web downloads. Which two actions must be configured in the Threat Prevention policy to achieve this? (Choose two.)

Accepted Answer

Enable the Threat Emulation blade on the Security Gateway in the Threat Prevention policy.. To inspect email attachments and web downloads, the Threat Emulation blade must be enabled on the gateway, and the internal networks containing the clients must be included in the protected scope. These two actions ensure that traffic from those clients is subject to emulation. Other options are either incorrect mechanisms or non-existent features.

Answer

Enable the 'Threat Emulation for email and web' option in the gateway's global properties.

Answer

Create a rule in the Threat Prevention policy that specifies the email server and web server as the source and the internal clients as the destination.

Answer

Set the Threat Emulation action to 'Prevent' for all file types in the Threat Prevention profile.