Advanced Threat Prevention

Which TWO actions occur when a file is submitted to Threat Emulation in Threat Extraction's 'Prevent' mode? (Choose TWO)

A security administrator needs to configure Threat Emulation to analyze suspicious files inside a secured, air-gapped network environment that lacks direct internet access to Check Point ThreatCloud. Which deployment architecture satisfies this requirement?

An administrator notices that the Anti-Bot software blade is generating numerous high-severity alerts for an internal server, but investigation reveals the traffic is generated by a legitimate corporate vulnerability scanner. Which action should the administrator take to prevent these false positives while maintaining maximum security for actual client subnets?

An administrator configures Threat Extraction in an environment experiencing heavy email traffic delays. Users complain that inbound emails containing ZIP archives are heavily delayed. Which setting should be adjusted to balance security and mail flow performance?

Refer to the exhibit. [Warning: ThreatCloud Emulation Timeout] File: payload.exe Action: Blocked Reason: Emulation timeout exceeded due to heavy load. An administrator reviews the log output shown above and wants to ensure that future legitimate large executable files are not blocked solely due to emulation timeouts during peak hours. Which configuration change best addresses this issue?

An organization's security policy requires that all Zero-Day malware detected by Threat Emulation must be quarantined instantly and reported to the local SOC. However, the security team complains that alerts lack sufficient contextual detail to determine the attack vector. Which feature should be enabled to improve forensic visibility into these detected threats?

A security administrator is troubleshooting an issue where Anti-Bot is failing to block communications to a known malicious Command and Control (C&C) server. The traffic traverses the firewall via an encrypted HTTPS tunnel. Which configuration ensures that Anti-Bot can inspect and block this encrypted traffic?

Refer to the exhibit. [Threat Prevention Log Summary] Protection Name: Suspicious_HTTP_Header Confidence: Low Action: Detect Source IP: 192.168.10.50 Destination IP: 203.0.113.25 An administrator reviews the log snippet above and notices that the action taken was 'Detect' despite the threat profile being set to 'Prevent'. What is the most likely cause for this behavior?

An administrator configures Threat Prevention on a Check Point Security Gateway to inspect incoming SMTP traffic using Threat Emulation and Threat Extraction. A user reports that a legitimate archive file containing confidential reports was modified, and all executable files inside the archive were stripped out. Which configuration adjustment resolves this while maintaining adequate security?

An organization is experiencing a high volume of malicious email attachments reaching user inboxes. The administrator decides to enable the Mail Transfer Agent (MTA) on the security gateway. What is the primary advantage of using MTA mode over traditional SMTP inspection for Threat Emulation?

Which TWO of the following actions are available when configuring Threat Extraction to handle potentially malicious documents? (Select 2)

Which SandBlast feature is specifically designed to protect users from entering their corporate credentials into known or suspected phishing websites?

Which TWO of the following statements accurately describe the functionality of the Threat Extraction blade in Check Point R81.x?

You are deploying Threat Prevention across a large, distributed enterprise network. To minimize false positives while maintaining a strong security posture, which strategy is recommended for the initial implementation of the Threat Prevention policy?

An organization is concerned about data exfiltration via DNS tunneling. Which THREE configurations should be applied to the Threat Prevention policy to effectively mitigate this risk?

A security architect is designing a Threat Emulation deployment for a high-security research lab. The lab's most sensitive hosts run a proprietary real-time operating system (RTOS) on ARM64 processors and cannot run any endpoint agent. Analysts need every suspicious file opened on these RTOS hosts to be emulated before execution, and they require the emulation to occur locally on a dedicated appliance with no internet connectivity. Which Threat Emulation deployment mode should the architect configure?

A security analyst is investigating a series of alerts from the Anti-Bot blade. The logs show that an internal host is repeatedly connecting to a domain that resolves to multiple IP addresses, and the connections use HTTP with a User-Agent string that changes on each request. The analyst suspects a botnet using domain generation algorithm (DGA) and fast-flux techniques. Which Check Point feature would provide the most direct evidence to confirm this suspicion?

A Check Point administrator is investigating a security incident where a user's computer was infected with malware. The malware was downloaded via HTTP and executed. The administrator reviews the Threat Prevention logs and sees that the Anti-Bot blade detected communication with a known command and control server but did not block it. The logs show the action as 'Detect' instead of 'Prevent'. What is the most likely reason for this?

A Check Point administrator is tuning ThreatCloud Intelligence consumption on a Security Gateway that fronts a busy web farm. Internal penetration tests show that files downloaded over TLS are reaching endpoints without ever being emulated, even though the Threat Emulation blade is enabled on the gateway and shows as active. Reviewing SmartConsole, the administrator confirms the HTTPS inspection policy exists but no certificate is presented to internal clients. What is the most likely cause of the missing emulation?

A security administrator is configuring Threat Emulation for a new gateway. The administrator wants to ensure that files are emulated in a way that matches the actual endpoint environment as closely as possible, including the specific operating system version, installed applications, and browser plug-ins. Which Threat Emulation setting should the administrator configure to achieve this?

An administrator investigating slow web browsing notices that Threat Emulation is submitting every downloaded portable executable to the cloud sandbox, including files from a trusted internal software repository. The repository is on the internal network, and the administrator wants to stop emulation for those downloads without weakening protection for internet traffic. Which configuration change best addresses this requirement?

A security engineer is troubleshooting why Threat Emulation is not detecting a malicious document that exploits a vulnerability in a specific PDF reader version. The engineer confirms that the file is sent for emulation and that the emulation completes successfully, but no malicious activity is observed. The engineer suspects that the emulation environment does not have the vulnerable PDF reader version installed. Which action should the engineer take to resolve this issue?

A security operations team wants to correlate ThreatCloud verdicts with local logs. They observe that a file downloaded from an external site was blocked by Threat Emulation, but the SmartLog record shows the verdict as 'Malicious' with no forensic report attached. The administrator confirms the file was submitted successfully. Which statement best explains the missing forensic report?

An administrator is reviewing a Threat Prevention log and sees a high volume of 'Low Confidence' detections for a custom-protected HTTP header on a public-facing web server. The administrator wants to reduce noise while still logging these events for later analysis, without blocking legitimate traffic. What should the administrator do?

An administrator is hardening a Threat Prevention policy against zero-day exploits. The goal is to reduce exposure to unknown exploits while limiting false positives on business-critical applications. Which TWO measures are appropriate for this objective? (Choose two.)

A Check Point administrator is configuring the Anti-Virus blade on a Security Gateway. The organization wants to prevent users from downloading files that match known malware signatures, but also wants to avoid blocking legitimate files that are merely suspicious. Which Anti-Virus action should the administrator select for the malware signature category?

An administrator is deploying Threat Emulation in a data center where a Security Gateway cluster handles both north-south and east-west traffic. The team wants files to be emulated without sending them to the public cloud, because data residency rules forbid external submission. Which deployment approach satisfies the requirement while keeping emulation functional?

A Check Point administrator is configuring Anti-Bot to detect and block communication with command-and-control servers. The administrator wants to ensure that the gateway can identify botnet traffic even when the C&C server uses a domain generation algorithm (DGA) to frequently change its domain names. Which Anti-Bot feature should the administrator enable to address this?

An administrator is configuring Threat Extraction to sanitize documents. The organization requires that all active content be removed from PDF files, but the original file must be retained for auditing. Which Threat Extraction setting should be configured?

A Check Point administrator is tuning a Threat Prevention profile for a site that repeatedly generates 'Protected Scope' violations with the 'Prevent' action on the 'Suspicious Executable Download' protection. The administrator wants to stop blocking these downloads while still logging them, but must not weaken any other protections in the profile. What is the most precise way to accomplish this?

A security analyst is investigating a malware outbreak and needs to identify the command and control (C&C) infrastructure used by the malware. The analyst has access to Check Point ThreatCloud and SmartLog. Which two actions should the analyst take to identify the C&C servers? (Choose two.)

A Check Point Security Master is configuring ThreatCloud to receive and share threat intelligence. The organization's policy requires that no file content ever leave the premises, but they still want to benefit from global reputation and indicator feeds. Which ThreatCloud feature should be enabled or disabled to meet this requirement while keeping reputation services functional?

A security administrator is analyzing a Check Point Threat Emulation report for a suspicious PDF file that was emulated. The report indicates that the file attempted to connect to a remote server and download additional content. The administrator wants to identify the specific Indicators of Compromise (IOCs) from the report to block future attacks. Which TWO pieces of information should the administrator extract from the Threat Emulation report to create effective threat prevention rules? (Choose two.)

A Check Point administrator configures Threat Emulation to run on a Security Gateway. Files submitted for emulation are taking too long, and the administrator wants to ensure that users are not blocked indefinitely while still protecting them. Which Threat Emulation configuration best addresses this?

A Check Point administrator is reviewing Threat Prevention logs and notices a high number of 'Detect' alerts for the protection 'Suspicious_Executable_Download' but no 'Prevent' actions. The administrator wants to ensure that this protection blocks malicious downloads in the future. What should the administrator do?

A Check Point administrator wants to verify that Threat Prevention is inspecting traffic on a specific Security Gateway. The administrator needs a quick, built-in way to see which protections are active and whether they are logging. Which tool should be used?