156-315.81.20 Threat Prevention and SandBlast Practice Test 4 — 15 Questions

Question 1

A Check Point administrator wants to ensure that files downloaded from the internet are inspected by Threat Emulation before reaching the user. Which blade must be enabled in the Threat Prevention policy to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat Emulation. Threat Emulation is the blade that sends files to a sandbox for behavioral analysis. It detects malicious files by executing them in a safe environment. Enabling it in the Threat Prevention policy ensures files are inspected before reaching users.

Answer

Antivirus

Answer

Threat Extraction

Answer

IPS

Question 2

A security administrator is configuring Threat Prevention on a R81.20 Security Gateway. They enable Threat Emulation for incoming files and want to reduce the gateway's CPU load by having emulation performed by a dedicated appliance rather than the gateway itself. Which Check Point component should they deploy and configure to achieve this?

Accepted Answer

Threat Emulation appliance (SandBlast TE2500). The dedicated Threat Emulation appliance is designed to offload emulation from Security Gateways, reducing their CPU load. The other options either are cloud-based, do not perform emulation, or are endpoint-focused, and thus do not meet the requirement of a dedicated appliance for gateway offload.

Answer

Check Point SandBlast Agent

Answer

ThreatCloud Emulation service

Answer

Security Management Server

Question 3

An administrator is reviewing Threat Prevention logs and notices that a file was marked as 'Benign' by Threat Emulation. The file was downloaded from a known malicious site but did not exhibit malicious behavior during emulation. What is the most likely reason for this verdict?

Accepted Answer

The file requires a specific environment or user interaction to activate, which was not present during emulation.. Threat Emulation may return a 'Benign' verdict for files that require specific conditions to activate malicious behavior, such as user interaction or specific software. The sandbox may not replicate these conditions, leading to a benign verdict despite the file's potential malicious nature. Other options involve failures or misclassifications that would produce different log entries.

Answer

The file is a zero-day exploit that evaded detection.

Answer

The file was incorrectly classified due to a signature database error.

Answer

The gateway failed to send the file to the emulation service.

Question 4

An administrator is configuring Threat Extraction on a R81.20 Security Gateway. They want to ensure that files are sanitized and delivered quickly while maintaining security. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure Threat Emulation to run in the background while the sanitized file is delivered.. Threat Extraction delivers a sanitized file immediately while Threat Emulation runs in the background on the original. This combination ensures fast delivery with security. Disabling emulation or delivering the original file first compromises security, and size-based sanitization is not a recommended practice.

Answer

Disable Threat Emulation to reduce latency.

Answer

Configure Threat Extraction to only sanitize files larger than 10 MB.

Answer

Set Threat Extraction to deliver the original file and then sanitize it if malicious.

Question 5

A security administrator notices that Threat Emulation is bypassing all files from a specific internal server. They want to ensure that files from this server are emulated. What is the most likely reason for the bypass, and how can it be resolved?

Accepted Answer

The server is listed in the Threat Emulation bypass list; remove it from the bypass list.. The Threat Emulation bypass list allows administrators to exclude specific sources from emulation. If an internal server is in this list, its files will bypass emulation. Removing the server from the list will ensure its files are emulated. Other options involve broader exceptions or limitations that would not be server-specific.

Answer

The server's IP address is in the Threat Prevention exception list; remove it from the exception list.

Answer

The server is using an unsupported protocol; enable emulation for that protocol.

Answer

The files are too large for emulation; increase the maximum file size for emulation.

Question 6

An administrator is troubleshooting why Threat Emulation is not inspecting files downloaded over HTTPS. The gateway is configured with HTTPS Inspection, but files are still bypassing emulation. What is the most likely cause?

Accepted Answer

The HTTPS Inspection policy is not configured to inspect the relevant category or site.. For Threat Emulation to inspect files over HTTPS, HTTPS Inspection must be enabled and the policy must include the relevant traffic. If the policy does not cover the sites or categories, traffic bypasses inspection, and files are not emulated. Other options are either limitations that do not exist or are less likely given the scenario.

Answer

The gateway's HTTPS Inspection certificate is not trusted by the clients.

Answer

Threat Emulation does not support files downloaded over HTTPS.

Answer

Threat Emulation is only applied to HTTP traffic by default.

Question 7

A security administrator is configuring a Check Point R81 gateway running Threat Emulation and Threat Extraction blades. They want to ensure that files downloaded by users are inspected and, when necessary, sanitized before delivery. Which two of the following statements correctly describe the behavior of Threat Extraction? (Choose two.)

Accepted Answer

Threat Extraction removes potentially malicious content from supported file types and delivers a sanitized version to the user.. Threat Extraction sanitizes supported files by removing active content and delivers a safe version to the user. It can also reconstruct the original file if needed and if the file is clean. These two behaviors are fundamental to the blade's operation and align with the administrator's goal of inspecting and sanitizing downloads.

Answer

Threat Extraction requires a separate license and is not included with the Threat Prevention blades.

Answer

Threat Extraction only works on files transferred over HTTP and does not support SMTP or FTP.

Answer

Threat Extraction sends the original file to ThreatCloud for analysis and blocks it if malicious.

Question 8

A Check Point R81 gateway is configured with Threat Emulation. An administrator notices that a suspicious executable file downloaded via HTTP was not emulated. The log shows the action as 'Bypassed'. Which of the following is the most likely reason for this bypass?

Accepted Answer

The file size exceeded the maximum emulation limit configured on the gateway.. The most likely reason for a bypass is that the file size exceeded the configured emulation limit. Threat Emulation has a maximum file size setting, and files larger than this are not emulated to prevent resource exhaustion. This results in a 'Bypassed' action in the logs, which matches the administrator's observation.

Answer

The Threat Emulation blade was disabled on the gateway.

Answer

The file was downloaded from a trusted internal server.

Answer

The file hash was not found in the ThreatCloud database.

Question 9

An administrator is configuring Threat Emulation on a Check Point R81.20 Security Gateway. The administrator wants to ensure that files downloaded from the internet are inspected in a sandbox environment. Which of the following best describes the function of the Threat Emulation blade?

Accepted Answer

It executes files in a virtual sandbox to detect malicious behavior and block threats.. Threat Emulation is a Check Point blade that sends files to a sandbox for dynamic analysis, executing them in a virtual environment to detect malicious behavior. This allows it to catch unknown threats that signature-based methods might miss. The other options describe different blades: Threat Extraction sanitizes content, Anti-Virus uses signatures, and Anti-Bot monitors traffic, none of which provide sandbox execution.

Answer

It inspects network traffic for command and control communication and blocks it.

Answer

It scans files for known virus signatures and blocks them based on a signature database.

Answer

It extracts malicious macros from documents and replaces them with benign content.

Question 10

A Check Point administrator is troubleshooting a Threat Emulation issue where a specific PDF file was not emulated, despite the Threat Prevention policy being configured to inspect PDFs. The log shows the file was allowed with the action 'Bypass' under Threat Emulation. The administrator verifies that the file is not password-protected and is under the maximum file size limit. What is the most likely reason for the bypass?

Accepted Answer

The file hash was found in the ThreatCloud whitelist, so emulation was skipped.. A 'Bypass' action in Threat Emulation logs often occurs when the file's hash is found in the ThreatCloud whitelist, indicating it is known to be benign. This avoids unnecessary emulation and reduces latency. Other common bypass reasons include unsupported file types, password-protected files, or files that exceed size limits, but those are ruled out by the scenario. Therefore, the whitelist is the most likely cause.

Answer

The PDF contained embedded JavaScript, which Threat Emulation cannot inspect.

Answer

The Threat Emulation blade was not enabled on the Security Gateway.

Answer

The PDF file was too large and exceeded the maximum file size for emulation.

Question 11

A Check Point R81 gateway is using Threat Emulation. An administrator observes that a PDF file was emulated, and the log shows the verdict as 'Malicious'. However, the user was able to open the file without any warning. What is the most likely cause of this behavior?

Accepted Answer

The Threat Emulation blade was configured in 'Detect' mode instead of 'Prevent' mode.. The most likely cause is that Threat Emulation is configured in Detect mode, which only logs malicious files without blocking them. This allows users to open the file despite the malicious verdict. Switching to Prevent mode would block the file and prevent user access, aligning with the security policy.

Answer

The PDF file was corrupted and could not be executed, so it was allowed.

Answer

The file was downloaded over HTTPS, which bypasses Threat Emulation.

Answer

The user has administrative privileges and overrode the block.

Question 12

A security administrator is configuring Threat Prevention profiles on a Check Point R81.20 Security Gateway. The administrator wants to ensure that the organization benefits from Check Point's recommended settings for Threat Emulation and Threat Extraction. Which two of the following are characteristics of the 'Recommended' Threat Prevention profile? (Choose two.)

Accepted Answer

It balances security and performance by using pre-tuned settings.. The Recommended profile is pre-tuned by Check Point to provide a balance of security and performance, and it is continuously updated through ThreatCloud with new protections. It does not enable all blades blindly or require manual configuration, and it does not disable Threat Extraction. These characteristics make it a convenient and effective starting point for many organizations.

Answer

It disables Threat Extraction by default to avoid user disruption.

Answer

It automatically enables all Threat Prevention blades with default settings.

Answer

It requires manual configuration of each blade's advanced settings.

Question 13

A Check Point administrator is analyzing logs and notices that a file was marked as 'Emulation Failed' in the Threat Emulation logs. The file was downloaded from a reputable website and is a common document format. The administrator wants to understand why this status occurred. Which of the following is the most likely cause for an 'Emulation Failed' status?

Accepted Answer

The sandbox environment encountered a technical error while analyzing the file.. An 'Emulation Failed' status indicates that the sandbox attempted to analyze the file but encountered a technical error, such as a timeout or crash. This is distinct from bypasses due to size, encryption, or whitelisting. The administrator should check the sandbox's health and logs to determine the root cause. The other options describe scenarios that result in different log statuses.

Answer

The file was password-protected and could not be opened.

Answer

The file was too large to be sent to the sandbox.

Answer

The file's hash was not found in ThreatCloud, so emulation was skipped.

Question 14

A security analyst is reviewing logs and sees multiple entries indicating that files were sent to Threat Emulation but the verdict was 'Malicious'. However, the files were not blocked. What is the most likely cause?

Accepted Answer

The Threat Prevention policy is configured in 'Detect' mode instead of 'Prevent' mode.. When Threat Prevention is set to 'Detect' mode, malicious files are logged but not blocked. This mode is often used during initial deployment or testing. To enforce blocking, the policy must be changed to 'Prevent' mode. The logs clearly show detection without prevention, pointing to the policy mode as the cause.

Answer

Threat Emulation only detects but never blocks; blocking is handled by another blade.

Answer

The files were allowed because the user has administrator privileges and bypassed the policy.

Answer

The gateway is not licensed for Threat Emulation, so it only logs and does not block.

Question 15

A security engineer configures a Threat Prevention profile with Threat Emulation enabled for PDF files. Users report that some PDF files are not being emulated, and the logs show the action 'Bypass' with the reason 'File size exceeds limit'. The engineer wants to ensure all PDFs are inspected without overloading the gateway. What is the most appropriate action?

Accepted Answer

Increase the 'Maximum file size for emulation' in the Threat Emulation blade settings to a value that accommodates the largest PDFs, while monitoring gateway performance.. Threat Emulation bypasses files that exceed the configured maximum size to protect gateway resources. To inspect larger PDFs, the administrator must increase this limit in the Threat Emulation settings. However, because emulation is CPU and memory intensive, the limit should be raised cautiously with performance monitoring. Other options describe non-existent features or incorrect offloading to ThreatCloud.

Answer

Enable 'Threat Emulation for large files' in the gateway's global properties, which automatically compresses files before emulation to stay under the size limit.

Answer

Disable the 'Bypass files larger than' option in the Threat Prevention profile, which will force all files to be emulated regardless of size.

Answer

Configure a file size exception in the Threat Prevention policy for PDF files, specifying that they should be sent to ThreatCloud for emulation instead of local emulation.