156-315.81.20 Threat Prevention and SandBlast Practice Question
When configuring Threat Prevention, what is the significance of the 'Hold' vs. 'Background' emulation mode?
⚠ Common exam trap
Candidates often flip the definitions, assuming 'Background' is the safer mode because it sounds more thorough, while incorrectly thinking 'Hold' mode only applies to specific high-risk file types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
'Hold' mode prevents the file from reaching the user until the emulation is finished.
The emulation mode determines the user experience and security trade-off. 'Hold' mode blocks file access until the emulation is complete, ensuring maximum security but adding latency. 'Background' mode allows the file to be downloaded immediately while emulation runs in parallel. If the file is later found malicious, the security gateway can then block it, but the user may have already received the file, presenting a risk of temporary exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
'Hold' mode is only available for files larger than 10MB.
Why it's wrong here
Hold mode is a configuration setting for the Threat Emulation blade that applies regardless of file size. It is not limited by a 10MB threshold. Administrators can choose to apply Hold mode to all files or specific subsets, and it is a fundamental choice between security posture and network performance.
- ✗
'Background' mode is the default and most secure setting.
Why it's wrong here
Background mode is not the most secure setting because it introduces a window of vulnerability where a user could potentially execute a malicious file before the emulation results are returned. 'Hold' mode is objectively more secure, as it prevents any potentially malicious file from reaching the end user at all.
- ✓
'Hold' mode prevents the file from reaching the user until the emulation is finished.
Why this is correct
Hold mode is specifically designed to prioritize security over performance by delaying the download until the file has been fully analyzed in the sandbox. This ensures that no malicious file ever enters the internal network, making it the preferred configuration for high-security environments where even a momentary risk is unacceptable.
- ✗
'Background' mode is necessary for all HTTPS traffic.
Why it's wrong here
Background mode is not required for HTTPS traffic. The choice between Hold and Background is a policy decision based on user tolerance for latency versus the required security level. It functions the same way regardless of the underlying protocol, provided the gateway has the necessary visibility into the content being transferred.
About these practice questions
This 156-315.81.20 question is part of Courseiva's 210-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-315.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-315.81.20 exam.