156-315.81.20 Threat Prevention and SandBlast Practice Test 2 — 15 Questions

Question 1

An administrator is configuring Threat Prevention on a Check Point R81 gateway. They want to ensure that files downloaded from the internet are inspected for malicious content, but they also need to minimize the impact on user productivity. Which Threat Prevention profile setting should they use to achieve a balance between security and performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Recommended profile. The Recommended profile is specifically designed by Check Point to provide a balance between security and performance. It enables Threat Emulation, Threat Extraction, and other protections with settings that are effective without being overly disruptive. This makes it the ideal choice for an administrator seeking to protect users while minimizing productivity impact.

Answer

Strict profile

Answer

Custom profile with only Anti-Virus enabled

Answer

Basic profile

Question 2

A Check Point administrator is troubleshooting why Threat Extraction is not sanitizing a PDF file downloaded from a web server. The file is being allowed without any modification. Which TWO of the following are possible reasons for this behavior? (Choose two.)

Accepted Answer

The file type is not supported by Threat Extraction.. Threat Extraction will not sanitize files if the blade is not enabled on the gateway or if the file type is unsupported. Both conditions prevent the extraction process from running. Other factors like policy mode or SSL inspection may affect threat prevention but do not directly disable extraction for supported files.

Answer

The Threat Prevention policy is set to 'Detect' mode instead of 'Prevent'.

Answer

The 'Recommended' Threat Prevention profile automatically disables Threat Extraction for PDF files.

Answer

The file is downloaded over HTTPS and the gateway is not configured for SSL inspection.

Question 3

An administrator needs to verify that the ThreatCloud Intelligence feeds are being updated correctly on a Security Management Server. The administrator runs the command 'cpstat threatcloud' on the management server, but receives no output. What is the most likely reason for this behavior?

Accepted Answer

The ThreatCloud Intelligence feeds are updated via the Security Gateway, not the Management Server, so 'cpstat threatcloud' must be run on a gateway.. ThreatCloud Intelligence updates are consumed by Security Gateways, which enforce Threat Prevention blades. The 'cpstat threatcloud' command queries the gateway's ThreatCloud client status. Running it on a Management Server produces no output because the management server does not directly interface with ThreatCloud for real-time feeds. Administrators should run this command on the gateway to verify feed updates.

Answer

The administrator must first run 'threatcloud_update' to populate the ThreatCloud database on the Management Server, after which 'cpstat threatcloud' will display status.

Answer

The 'cpstat threatcloud' command requires the ThreatCloud API key to be configured in the Management Server's global properties before it returns any data.

Answer

The Management Server's ThreatCloud service is disabled by default and must be enabled via 'cpconfig' before the command will work.

Question 4

A Check Point administrator wants to test a new Threat Prevention policy that includes Threat Emulation and Anti-Bot blades. The administrator wants to see which files would be emulated and which connections would be blocked without actually enforcing the policy on users. Which feature should be used?

Accepted Answer

Configure a new gateway in a lab environment with the same policy and send test traffic through it to observe Threat Emulation and Anti-Bot actions.. To test Threat Prevention policies without impacting users, the administrator should use a lab gateway with identical configuration. This allows real emulation and inspection to occur, and logs can be analyzed to understand behavior. Other options either do not simulate Threat Prevention actions or do not exist. A lab environment is the most reliable way to validate policy effects before production enforcement.

Answer

Enable 'Threat Prevention Simulation' in the gateway's global properties, which logs what would have happened without enforcing.

Answer

Use the 'Policy Verification' feature in SmartConsole to simulate the policy against a sample traffic profile and see predicted actions.

Answer

Install the policy in 'Detect' mode for the Threat Prevention blades, which logs actions but does not block traffic.

Question 5

A security administrator is configuring Threat Emulation on a Check Point gateway. The administrator wants to ensure that emulation is performed for files that are downloaded via email attachments and web downloads. Which two actions must be configured in the Threat Prevention policy to achieve this? (Choose two.)

Accepted Answer

Enable the Threat Emulation blade on the Security Gateway in the Threat Prevention policy.. To inspect email attachments and web downloads, the Threat Emulation blade must be enabled on the gateway, and the internal networks containing the clients must be included in the protected scope. These two actions ensure that traffic from those clients is subject to emulation. Other options are either incorrect mechanisms or non-existent features.

Answer

Enable the 'Threat Emulation for email and web' option in the gateway's global properties.

Answer

Create a rule in the Threat Prevention policy that specifies the email server and web server as the source and the internal clients as the destination.

Answer

Set the Threat Emulation action to 'Prevent' for all file types in the Threat Prevention profile.

Question 6

An administrator notices that the Threat Extraction blade is converting incoming Microsoft Word documents into static PDF files, but users complain that embedded dynamic macros are completely missing from the converted documents. What is the cause of this behavior?

Accepted Answer

Threat Extraction permanently strips all active content, including macros, when rebuilding documents into safe formats.. Threat Extraction operates by removing active content such as macros, scripts, and embedded objects instantly to deliver a clean file while the full inspection happens. When converting files, active content elements are stripped out rather than preserved. This proactive approach prevents zero-day exploits safely without delaying initial user access, making it essential to understand for user expectation management.

Answer

The Threat Emulation blade failed to sandbox the Word document, causing the macro engine to crash during conversion.

Answer

The Security Gateway lacks sufficient memory resources to process complex Visual Basic for Applications scripts during extraction.

Answer

Anti-Bot policy rules supersede Threat Prevention settings, causing active document elements to be blocked at the firewall layer.

Question 7

A security engineer configures Threat Emulation to inspect incoming archive files containing nested compressed directories. During testing, an archive containing six nested levels of ZIP files bypasses deep emulation inspection. What is the most likely configuration cause?

Accepted Answer

The maximum archive extraction depth limit in the Threat Emulation advanced settings was reached and traversal stopped.. SandBlast Threat Emulation enforces strict limits on archive extraction depth to protect gateway CPU and memory resources from denial-of-service attacks utilizing zip bombs. Exceeding the maximum archive depth threshold stops recursive extraction, meaning deeply nested files are passed without full emulation analysis. Administrators must balance security depth against gateway performance limits.

Answer

The file type filter profile was configured to exclude compressed archives exceeding four megabytes from sandbox evaluation.

Answer

Threat Extraction was disabled in the active policy layer, causing compressed payloads to bypass all inspection engines automatically.

Answer

The local Threat Emulation private cloud appliance encountered a CPU throttling event during the nested extraction phase.

Question 8

An administrator configures a Threat Emulation profile to use 'Hold until scanned' mode for email traffic. Users report that inbound emails with PDF attachments are delayed by several minutes. What is the operational impact and architectural reason for this delay?

Accepted Answer

The email gateway intercepts the attachment and delays delivery until the sandbox environment completes behavioral execution analysis.. The 'Hold until scanned' setting ensures that files are completely analyzed by the Threat Emulation sandbox before being released to the recipient. This security mechanism eliminates the window of exposure to zero-day threats but introduces processing latency, which is critical for administrators to balance against business operational requirements.

Answer

The gateway is caching the emails locally while waiting for ThreatCloud to update its daily anti-spam signature database.

Answer

Threat Extraction is failing to convert the PDF attachments, causing the mail server to retry transmission continuously.

Answer

The SMTP daemon on the Security Gateway is experiencing buffer overflows due to excessive concurrent attachment transfers.

Question 9

Which TWO of the following are primary components of the Check Point SandBlast Threat Extraction solution?

Accepted Answer

Conversion of files to a safe static format. Threat Extraction is a proactive security measure that ensures files are clean by removing active content. It achieves this by sanitizing files in real-time. By converting active content to static forms, the organization reduces the attack surface of common document formats. These two components represent the core workflow: immediate conversion of content to ensure safe delivery and the maintenance of a security-hardened environment by stripping potentially dangerous active code from incoming files.

Answer

Deep behavioral analysis of executables

Answer

Automatic quarantine of suspicious email accounts

Answer

Hardware-level instruction tracing

Question 10

Which component acts as the centralized repository for global threat intelligence in a Check Point deployment?

Accepted Answer

ThreatCloud. ThreatCloud is the centralized repository that receives updates from Check Point gateways worldwide. It maintains a massive database of malicious IPs, URLs, botnet signatures, and file hashes. By sharing this intelligence, all gateways receive real-time updates regarding new threats identified anywhere in the ecosystem. This ensures that the entire security infrastructure stays protected against evolving threats, significantly reducing the window of vulnerability for any individual customer environment.

Answer

SmartConsole

Answer

Management Server

Answer

Security Gateway

Question 11

Which THREE of the following are valid methods for deploying the SandBlast Threat Emulation service?

Accepted Answer

Cloud-based emulation service. SandBlast Threat Emulation is a flexible technology that can be deployed in multiple ways depending on the organization's architecture. It can reside on the local gateway for on-premises inspection, be offloaded to a dedicated appliance, or utilize the public cloud service. Understanding these deployment options is essential for architects to design solutions that meet performance requirements while maintaining deep inspection capabilities across various network segments and diverse traffic flows.

Answer

Endpoint agent only emulation

Answer

Log server emulation

Question 12

A security administrator needs to ensure that all encrypted traffic is inspected by the Threat Prevention blades. What is the mandatory requirement for this?

Accepted Answer

Configure the HTTPS Inspection policy and install the CA certificate on all client machines.. HTTPS Inspection is essential because many threats are delivered over encrypted channels to bypass inspection. By performing HTTPS Inspection, the gateway decrypts the traffic, inspects the payload using Threat Prevention blades, and re-encrypts it before sending it to the destination. This provides full visibility into the traffic, ensuring that malicious content hidden within encrypted payloads is effectively detected and blocked before reaching the internal network or the user's endpoint.

Answer

Enable SSL Inspection in the Threat Prevention policy.

Answer

Upgrade to the latest JHF (Jumbo Hotfix) on the Management Server only.

Answer

Enable the 'Deep Packet Inspection' blade globally on all interfaces.

Question 13

Which file type is most commonly targeted by Threat Extraction for active content removal?

Accepted Answer

Microsoft Word documents. Threat Extraction is highly effective for documents that support scripting or active objects, such as Microsoft Office files (Word, Excel, PowerPoint) and PDFs. These formats frequently contain macros or OLE objects that attackers use to deliver malware. By stripping these elements, the gateway ensures the file remains functional for the user while removing the potential for malicious code execution, which is the primary goal of the extraction technology.

Answer

JPEG images

Answer

Compressed ZIP files

Answer

MP3 audio files

Question 14

Refer to the exhibit. Why was 'invoice.pdf' blocked?

Accepted Answer

The Threat Emulation policy is configured to block files when the emulation result is inconclusive.. The 'Fallback Action' is set to 'Block' in the Threat Emulation configuration. When the emulation engine cannot reach a definitive conclusion (Inconclusive) about whether a file is malicious, the gateway defaults to this configured fallback. In high-security environments, blocking inconclusive files is a best practice to ensure no potential threats pass through, even at the cost of occasionally flagging benign but suspicious-looking files that failed the emulation process.

Answer

The file was identified as malicious by the local IPS blade.

Answer

The Threat Emulation cloud service was unreachable, triggering the fallback policy.

Answer

The file size exceeded the maximum allowed size for cloud emulation.

Question 15

What is the primary function of the 'ThreatCloud' service in the context of SandBlast Threat Prevention?

Accepted Answer

To provide real-time updates of malicious signatures and reputation intelligence.. ThreatCloud provides a dynamic, global repository of threat intelligence that is updated in real-time. It correlates data from millions of Check Point gateways, identifying new attack patterns and malicious entities. This intelligence is delivered to gateways to ensure they have the latest signatures and reputation data to block threats, including zero-day exploits, before they can cause damage, making it a cornerstone of the SandBlast architecture's effectiveness and reliability.

Answer

To store backup copies of decrypted HTTPS traffic for compliance auditing.

Answer

To perform physical hardware replacement for failed appliances in the field.

Answer

To manage the deployment of security policy updates to the Management Server.