CCSM Advanced Threat Prevention Practice Question
An administrator investigating slow web browsing notices that Threat Emulation is submitting every downloaded portable executable to the cloud sandbox, including files from a trusted internal software repository. The repository is on the internal network, and the administrator wants to stop emulation for those downloads without weakening protection for internet traffic. Which configuration change best addresses this requirement?
⚠ Common exam trap
The trap here is reaching for a global toggle, such as changing the action or disabling the blade, when the requirement calls for a narrowly scoped exception.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an exception in the Threat Prevention profile that excludes the internal repository IP or subnet from Threat Emulation.
Threat Prevention profiles support exceptions scoped to sources, destinations, or individual protections. Excluding the trusted internal repository from Threat Emulation stops the redundant sandbox submissions and the associated latency while leaving emulation active for untrusted internet downloads. This keeps enforcement intact and is far more precise than disabling the blade or relaxing its action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an exception in the Threat Prevention profile that excludes the internal repository IP or subnet from Threat Emulation.
Why this is correct
Profile-level exceptions let specific sources, destinations, or protections be excluded while the profile stays active for everything else. Excluding the trusted repository subnet stops needless sandbox submissions for those downloads and preserves emulation for internet traffic. This is the supported, surgical way to reduce latency and sandbox load without degrading coverage for untrusted sources.
- ✗
Disable the Threat Emulation blade on the internal-facing gateway interface.
Why it's wrong here
Disabling the blade on an interface removes emulation for all traffic traversing that interface, including internet-bound sessions that may route through it. This over-broad change weakens protection well beyond the trusted repository and does not target the specific internal source. A scoped exception is needed rather than turning off the protection on an entire interface.
- ✗
Set the Threat Emulation action to Detect instead of Prevent in the profile used by the gateway.
Why it's wrong here
Changing the action to Detect affects every file the profile inspects, not just the internal repository. It would stop blocking malicious payloads across all traffic, which is a significant security regression. The requirement is to stop emulating a trusted source, not to downgrade enforcement globally. A targeted exception is the appropriate control.
- ✗
Configure a File Type policy that excludes all executable files from inspection.
Why it's wrong here
Excluding all executables from inspection would prevent emulation of malicious binaries everywhere, defeating the purpose of the blade. The problem is a trusted source generating unnecessary submissions, not executables in general. Narrowing by source keeps detection intact for downloads from the internet while eliminating the redundant sandbox traffic from the repository.
About these practice questions
Courseiva writes every CCSM question from scratch — 219 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This CCSM practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSM exam.