156-215.81.20 Application Control and URL Filtering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add the malicious sites to a custom group and apply a 'Block' action in the URL Filtering policy.

  Why it's wrong here

  Manually adding malicious sites to a custom group is impractical because new malicious sites appear constantly. The built-in 'Malicious Sites' category is automatically updated via ThreatCloud, providing dynamic protection. Custom groups require manual maintenance and would quickly become outdated.

• ✗

  Configure a Threat Prevention profile with a 'Block' action for malicious sites.

  Why it's wrong here

  Threat Prevention profiles handle malware, viruses, and intrusions at the network level, not URL categorization. While they can block malicious content, they do not specifically block access to websites based on URL categories. URL Filtering is the correct feature for blocking access to categorized websites.

• ✓

  Enable the 'Malicious Sites' category in a URL Filtering rule with a 'Block' action.

  Why this is correct

  The 'Malicious Sites' category is specifically designed to block websites known to distribute malware or phishing content. Enabling it with a Block action in a URL Filtering rule will prevent users from accessing these dangerous sites. This leverages Check Point's ThreatCloud intelligence, which continuously updates the category.

• ✗

  Create an Application Control rule to block the 'Web Browsing' application.

  Why it's wrong here

  Blocking the 'Web Browsing' application would prevent all web access, not just malicious sites. This is overly restrictive and would disrupt legitimate business activities. Application Control is not designed to categorize websites by risk; it identifies applications regardless of the website's reputation.