Checkpoint 156-315.81 Practice Test - Questions Answers, Page 7

It is recommended to enable Detect-Only for Troubleshooting on the profile during the initial installation of IPS. This option overrides any protections that are set to Prevent so that they will not block any traffic.

During this time you can analyze the alerts that IPS generates to see how IPS will handle network traffic, while avoiding any impact on the flow of traffic.

Suspicious Activity Rules Solution

Suspicious Activity Rules is a utility integrated into SmartView Monitor that is used to modify access privileges upon detection of any suspicious network activity (for example, several attempts to gain unauthorized access).

The detection of suspicious activity is based on the creation of Suspicious Activity rules. Suspicious Activity rules are Firewall rules that enable the system administrator to instantly block suspicious connections that are not restricted by the currently enforced security policy. These rules, once set (usually with an expiration date), can be applied immediately without the need to perform an Install Policy operation.

The inspection pointBig lis the first point immediately following the tables and rule base check of a packet coming from outside of the network.It is also the last point before the packet leaves the Security Gateway to the internal network1.The other inspection points are either before or after the rule base check, or in a different direction of traffic flow2.

Reference: Check Point R81 Security Gateway Architecture and Packet Flow,156-315.81 Checkpoint Exam Info and Free Practice Test - ExamTopics

Threat Extraction is a technology that removes potentially malicious features that are known to be risky from files (macros, embedded objects and more), rather than determining their maliciousness.By cleaning the file before it enters the organization, Threat Extraction preemptively prevents both known and unknown threats, providing better protection against zero-day attacks1.Any active contents of a document, such as JavaScripts, macros and links will be removed from the document and forwarded to the intended recipient, which makes this solution very fast2. The other options are either incorrect or irrelevant to the mechanism behind Threat Extraction.

Reference:Threat Extraction (CDR) - Check Point Software,Check Point Document Threat Extraction Technology