156-590 Practice Questions

Staging Mode is a feature designed to help administrators safely evaluate new and updated IPS protections without causing service disruptions from potential false positives. When Staging Mode is enabled for an IPS profile, any newly downloaded or modified protections are automatically set to the 'Detect' action for a specified period. This allows administrators to monitor the logs generated by these new protections and assess their impact on the network before changing their action to 'Prevent'.

B. Prevent: Setting new protections to 'Prevent' immediately is the opposite of the Staging Mode's purpose, as it could block legitimate traffic without a review period.

C. Inactive: Setting protections to 'Inactive' would provide no information about their potential impact, defeating the purpose of the evaluation period.

D. Ask: The 'Ask' action is not a standard, automated setting for protections in Staging Mode; the process is designed to be automatic ('Detect') for a defined time.

Check Point. (2023). R81.20 IPS Administration Guide. Page 50, "IPS Updates in Staging Mode". The guide explicitly states, "When you enable Staging, new and updated protections are set to the Detect action for the specified period."

The "Packet Capture" tracking option provides the most comprehensive data for analysis by capturing the complete network packets for a session matching a rule. This level of detail is often requested by the Check Point Technical Assistance Center (TAC) to perform in-depth troubleshooting of complex network or security issues, as it allows them to reconstruct the entire network conversation and analyze protocol-level details.

A. The "Log" option generates a standard log entry with summary information, which is often insufficient for deep technical analysis.

C. The "Alert" option primarily serves as a notification mechanism and does not inherently add more technical data to the log than the standard "Log" option.

D. "Extended Log" adds more fields and context to a log entry but does not capture the full packet payload as "Packet Capture" does.

- Check Point. (2022). R81.10 Logging and Monitoring Administration Guide. Chapter 2: The Logging and Monitoring Process, "Tracking".

- Check Point. (2022). R81.10 Security Management Administration Guide. Chapter 5: The Rule Base, "Track Options".

The fwaccel stats command queries SecureXL on the Security Gateway and returns packet-acceleration statistics: number/percentage of packets handled in Accelerated (Fast/SXL), Medium (PXL), and Slow (F2F) paths, packets/bytes accelerated, and related drop counters. It is used only for SecureXL monitoring and gives no CoreXL, interface, or debug information.

A – Describes CoreXL instance status, which is displayed by fw ctl affinity, not fwaccel stats.

C – Interface-level acceleration enable/disable is shown with fwaccel stat –i, not the plain stats command.

D – Packet-accelerator debug tables are produced by fwaccel dbg or sim dbg, not by fwaccel stats.

1. Check Point SecureXL Performance Guide R81, chap. 3 “Monitoring SecureXL”, p.35-36 (“fwaccel stats shows SXL/PXL/F2F packet counters”).

2. Check Point Gaia R81 CLI Reference, section “fwaccel stats”, p.712.

To create an exception in the Check Point Threat Prevention policy that excludes one or more blades (e.g., IPS, Anti-Bot), the correct procedure is to use a custom Threat Prevention Profile. An administrator must first create a new profile or clone an existing one. Within this profile's settings, the specific blades that need to be excluded are configured by setting their "Activation" status to "Inactive". This custom profile is then applied as the "Action" in a new rule, which is typically placed at the top of the Threat Prevention rule base. Traffic matching this rule will bypass inspection by the blades that were set to "Inactive" in the applied profile.

Setting the action to "Bypass": "Bypass" is not a valid, selectable action within the Threat Prevention policy rule base. This action is used in other policy types, such as HTTPS Inspection.

Setting the action to "Detect": The "Detect" action does not exclude a blade. The blade still inspects the traffic and generates a log for any threats found, but it does not block them.

Setting the action to "Accept": "Accept" is an action belonging to the Access Control (Firewall) policy layer. It is not a valid action within the Threat Prevention policy.

1. Check Point R81.10 Threat Prevention Administration Guide:

Page 38, "Creating Exceptions for Threat Prevention": "To create an exception, add a rule to the top of the Threat Prevention Rule Base. In the rule, specify the traffic that you want to be exempt from inspection. Then, in the Action column, select a Threat Prevention Profile in which some or all protections are inactive." This directly supports the explanation that using a profile with inactive blades is the correct method.

2. Check Point R81.10 Security Management Administration Guide:

Page 413, "The Threat Prevention Rule Base": This section describes the columns of the Threat Prevention policy. It clarifies that the "Action" column contains the name of the Threat Prevention Profile applied to matching traffic. This confirms that the rule's action is fundamentally a profile, and any exclusions must be configured within that profile.

The pslavd (PSL AV-Daemon) is the primary process for the Check Point Anti-Virus software blade. This daemon is responsible for the core functions of the Anti-Virus engine, which includes managing, loading, and utilizing the malware signature database. As part of its duties, pslavd communicates with the Check Point ThreatCloud infrastructure to download and apply the latest Anti-Virus signature updates. This ensures the Security Gateway is equipped with the most current protections against emerging threats.

A. The CPAS Daemon (cpasd): This process is part of the Content Awareness blade and handles the active streaming of data for inspection; it is not responsible for Anti-Virus signature updates.

B. The Resource Advisor Daemon (RAD): This daemon's function is to monitor system resources (e.g., CPU, memory) to maintain gateway stability under heavy load, not to manage security updates.

D. The Threat Emulation Daemon "ted": This process is specific to the Threat Emulation blade and communicates with the ThreatCloud for file sandboxing, not for downloading Anti-Virus signatures.

1. Check Point SecureKnowledge sk111969 - "ATRG: Anti-Virus": This Advanced Technical Reference Guide identifies the key processes for the Anti-Virus blade. In the "Processes and Daemons" section, pslavd is listed as the "PSL AV-Daemon," confirming it as a central process for the blade's operation.

2. Check Point SecureKnowledge sk98322 - "How to troubleshoot Anti-Virus updates": This article provides debugging commands for Anti-Virus update issues. The troubleshooting steps involve interacting directly with the pslavd daemon (e.g., using pslavdadmin -d), which confirms its direct involvement in the update process.

3. Check Point R81.10 Threat Prevention Administration Guide: In the "Anti-Virus" chapter, the guide details the update mechanism, stating that "The Security Gateway gets Anti-Virus signature updates from the Check Point ThreatCloud." The pslavd daemon is the process that executes this function for the Anti-Virus blade.

SmartEvent is Check Point's security event analysis and reporting solution. To inform a CEO about a security incident, a high-level, easily digestible summary is required. The most appropriate SmartEvent mechanism is a customized View or a generated Report. These features allow an administrator to consolidate relevant event data, present it graphically with timelines and charts, and summarize the key findings, business impact, and response actions. This format is ideal for an executive audience that does not need to see raw log data.

A. The Logs view in SmartConsole shows raw, individual log entries, which are far too technical and granular for a CEO-level briefing.

C. The command-line interface (CLI) is a tool for system administration and advanced troubleshooting, not for creating executive-level summaries or reports.

D. Real-time event monitoring is used by security operations staff to track events as they happen, not to create a summary report of a past incident.

1. Check Point R81.10 Logging and Monitoring Administration Guide, Chapter 6 "SmartEvent", section "SmartEvent Reports", Page 113. "SmartEvent includes predefined reports and the ability to create custom reports. You can generate reports on-demand or schedule them to run automatically... Reports are generated as PDF documents."

2. Check Point R81.10 Logging and Monitoring Administration Guide, Chapter 6 "SmartEvent", section "Working with Views", Page 109. "Views let you see a high-level, graphical summary of events and network traffic."

When the Threat Prevention Software Blade is enabled, Check Point automatically creates a default Threat Prevention Profile named "RecommendedProfile". This profile is pre-configured with Check Point's recommended settings for all Threat Prevention blades (IPS, Anti-Virus, Anti-Bot, Threat Emulation, and Threat Extraction). It is designed to provide a strong balance between security and performance and is automatically applied to the default Threat Prevention rule, ensuring immediate protection upon activation.

A. "Default" is a generic term but not the specific name of the pre-configured Threat Prevention profile in SmartConsole.

B. "Optimized" is a common profile name in other contexts or vendor products, but the specific Check Point default is "RecommendedProfile".

C. "BasicProtection" is not the name of the default profile. The "RecommendedProfile" offers more than just basic settings.

1. Check Point R81.20 Threat Prevention Administration Guide, Chapter 2 "The Threat Prevention Policy", Section "Threat Prevention Profiles", Page 32. (Explicitly names "RecommendedProfile" as the default profile).

2. Check Point R81.20 Threat Prevention Administration Guide, Chapter 2 "The Threat Prevention Policy", Section "The Threat Prevention Rule Base", Page 29. (Shows the default rule uses the "RecommendedProfile").

The Content Anti-Virus (cav) user-space process carries out archive and file scanning for the Anti-Virus and Threat Emulation blades on a Security Gateway; therefore it is the component responsible for Archive Scanning.

B avsd only manages Anti-Virus database updates and blade coordination; it does not perform inline archive inspection.

C fwd is the logging/alerting daemon; it never examines file content.

D cpd handles policy installation and SIC communication, not Anti-Virus scanning.

1. Check Point Threat Prevention Administration Guide R81.20, “Process Reference”, table “Anti-Virus/Anti-Bot processes – cav”, p.232.

2. Gaia Technical Reference R81, Appendix A “Security Gateway Processes”, entries cav, avsd, fwd, cpd, pp.301-304.

The "Profile Cleanup" utility within the Threat Prevention policy settings is a maintenance tool for the Security Management Server. Its specific function is to scan the configuration and identify any custom-made Threat Prevention profiles that are not currently assigned to any active rule in the policy. It then allows the administrator to remove these unused profiles, which helps to keep the management database clean, reduce clutter, and prevent the use of obsolete configurations.

B. Deleting old logs is a function of Log Management and retention policies, configured separately in the Log Server settings.

C. Rulebase optimization, such as finding shadowed or redundant rules, is performed by tools like fwaccel db stat or via other policy analysis features.

D. Resetting profiles to their factory defaults is a distinct action and is not the purpose of the "Profile Cleanup" tool.

- Check Point. (2022). R81.10 Threat Prevention Administration Guide. Chapter 2: The Threat Prevention Policy, "Managing Threat Prevention Profiles".

An active bot infection on an internal system generates specific network traffic that serves as evidence of compromise. This includes outbound communication attempts from the infected host to a remote Command and Control (C&C) server, which is how the bot receives instructions. Furthermore, many modern bots use Domain Generation Algorithms (DGA) to locate their C&C servers, leading to a high volume of DNS queries for non-existent or rapidly changing domains. This combination of outbound C&C traffic and anomalous DNS activity are hallmark indicators of a bot-infected system operating from within the network.

B. This describes a SYN flood, a type of Denial-of-Service attack. The traffic is inbound from external sources, not evidence of a compromise originating from inside.

C. A security audit report showing missing patches indicates vulnerabilities or weaknesses. It is a precursor to a potential compromise, not evidence that one has already occurred.

D. An IPS alert for a blocked external attack shows a successful prevention action against an external threat, not an active, successful compromise originating from an internal host.

1. Check Point R81.10 Threat Prevention Administration Guide, "Anti-Bot" Chapter, Page 1. The guide states, "The Anti-Bot Software Blade detects bot-infected machines, prevents bot damages by blocking bot C&C (Command and Control) communications...". This confirms that C&C communication is the primary indicator detected.

2. Check Point Security Administration R81.10 Guide, "The Check Point Solution" Chapter, "Threat Prevention" Section. It describes how the Anti-Bot blade provides "post-infection detection" by identifying communications between infected clients and C&C centers.

3. Alauthaman, M., Al-Tawil, M., Al-Saba, M., & Al-Hadramy, S. (2021). "A Comprehensive Survey on Botnet Detection and Classification". IEEE Access, 9, 161239-161272. Section IV-A, "DNS-Based Detection," details how anomalous DNS query patterns, such as those generated by DGAs, are a key method for identifying botnet activity. https://doi.org/10.1109/ACCESS.2021.3125380

4. MIT OpenCourseWare, 6.858 Computer Systems Security, Fall 2014. Lecture 15, "Malware," discusses the architecture of botnets, emphasizing the critical role of the C&C channel for command dissemination and how monitoring for this traffic is a primary detection strategy.