Important CheckPoint 156-590 CTPS Exam Questions

Answer: C

Explanation:

The correct answer is C. Cleanup Rules are not strictly required in the Threat Prevention Policy. Threat Prevention policy behavior is governed by ordered layers and rule matching, but an administrator is not forced to create an explicit cleanup rule in every Threat Prevention rulebase. Check Point documentation explains that a Threat Prevention Rule Base can contain multiple Policy Layers and that each layer calculates its action separately. For a single layer, the enforced rule is the first rule matched; for multiple layers, the final behavior depends on the layer matches and resulting action logic.

A cleanup rule is still a strong operational best practice because it makes the terminal behavior explicit, easier to audit, and easier for operations teams to troubleshoot. Without an explicit cleanup rule, behavior depends on the layer's implicit cleanup logic and the policy architecture. Check Point Security Management documentation shows that implicit cleanup behavior exists at the layer level and can be configured as Drop or Accept in the Layer Editor. The question asks whether cleanup rules are mandatory, not whether they are recommended. Options A and D incorrectly tie cleanup rule requirement to the Basic Profile. Option B incorrectly links Threat Prevention cleanup requirements to the Access Control cleanup rule. Reference topics: Threat Prevention Policy Layers, implicit cleanup rule, explicit cleanup best practice, Layer Editor behavior.

Answer: D

Explanation:

The correct answer is D. The IPS Blade must be activated on the individual Security Gateway object. Check Point Software Blades are enabled on the enforcement point that inspects traffic, which is the Security Gateway or Cluster object, not merely on the Management Server. The official Threat Prevention guide states that to enable IPS, the administrator opens the Security Gateway / Cluster object, goes to General Properties > Network Security, selects IPS, and follows the wizard. For IPS package installation, Check Point also documents the sequence: enable IPS in the Security Gateway object, enable IPS in the corresponding Threat Prevention policy, and install the Threat Prevention Policy.

Licensing alone is therefore insufficient; a license permits use, but blade activation defines whether the gateway enforces IPS inspection. Option A is wrong because enabling the blade on the Management Server object does not activate IPS enforcement on all managed gateways. Option C is also wrong in standard ClusterXL management because blades are configured on the Cluster object, not separately and inconsistently on individual members. Operationally, enabling IPS on the correct gateway or cluster object ensures SmartConsole exposes the appropriate Threat Prevention controls and that policy installation targets the enforcement points. Reference topics: IPS Blade activation, Gateway object configuration, Threat Prevention policy installation, Cluster object management.

Answer: A

Explanation:

The correct answer is A. Users surfing the website directly by IP address or using domains registered within the last 30 days. Anti-Bot is focused on post-infection compromise evidence: it identifies hosts that may already be infected and attempts to prevent command-and-control communication or other botnet behavior. Check Point documentation describes Anti-Bot as a Threat Prevention component that blocks botnet behavior and communication to Command and Control centers, while the broader Threat Prevention solution provides multi-layered pre- and post-infection defense.

Direct IP browsing and use of newly registered domains are suspicious because malware frequently avoids mature domain reputation controls, rotates infrastructure quickly, or contacts IP-based C2 endpoints directly to bypass domain-based filtering. Domains registered within a recent window are a common risk indicator because malicious campaigns often use disposable infrastructure with short operational lifetimes. Option B is not inherently evidence of bot infection; explicit proxy use may be a network design choice. Option C describes normal intranet access patterns. Option D may indicate weak encryption hygiene but is not specific evidence of compromise. In Anti-Bot analysis, indicators such as suspicious destinations, direct IP access, newly observed domains, and C2-like behavior help identify infected internal hosts. Reference topics: Anti-Bot, post-infection detection, Command and Control communication, suspicious domains, infected-host analysis.

Answer: D

Explanation:

The correct answer is D. The traffic is not dropped. It is simply not inspected by the Threat Prevention Engine. Access Control and Threat Prevention are separate enforcement stages. The Access Control policy first decides whether the connection is allowed, rejected, or dropped. If Access Control accepts the connection, Threat Prevention is then applied only if the connection matches a Threat Prevention rule and therefore receives a Threat Prevention profile. Check Point documentation describes Threat Prevention policy as the mechanism used to activate only the protections needed and prevent attacks that most threaten the network. It also explains that Threat Prevention policy layers calculate their action separately and that in a single layer, the first matched rule is enforced.

Therefore, if accepted traffic does not match the Threat Prevention rulebase, no Threat Prevention profile is selected for that connection. The traffic is not blocked merely because of the non-match; it passes according to the Access Control decision, but without Threat Prevention inspection. Option A is too aggressive and incorrect. Option B incorrectly assumes logging. Option C is directionally true but incomplete because the key point is that Threat Prevention inspection is not applied. Reference topics: Access Control before Threat Prevention, Threat Prevention Rule Base, profile selection, unmatched traffic, ordered layer evaluation.

Answer: B

Explanation:

The correct answer is B. Firewall, Identity Awareness, Content Awareness, and IPS. The question asks for features common across the NGFW, NGTP, and SNBT package families. Check Point's Network Security Software Bundles datasheet shows that Firewall, Identity Awareness, Content Awareness, and IPS are included across NGFW, NGTP, and SNBT. The same table also shows Application Control and several other capabilities, but among the listed answers, option B is the one whose components are common to all three package columns.

The package progression is important. NGFW is the base next-generation firewall bundle and includes core access-control and IPS capability. NGTP includes NGFW capabilities and adds prevention features such as Anti-Virus, Anti-Bot, URL Filtering, and DNS Security. SNBT, or SandBlast, includes NGTP and adds advanced zero-day protections such as Threat Emulation, Threat Extraction, and Zero Phishing. Therefore, answers containing Anti-Virus, Anti-Bot, or Threat Emulation are not ''common'' to all three packages. Anti-Virus and Anti-Bot are not part of the base NGFW package in the table, and Threat Emulation is specific to SNBT. Reference topics: Check Point Security Gateway Software Bundles, NGFW, NGTP, SNBT, IPS, Identity Awareness, Content Awareness.