Latest [Oct 16, 2026] Realistic Verified 156-590 Dumps
Pass CheckPoint 156-590 Exam Updated 78 Questions
NEW QUESTION # 12
Task: Verify IPS protections are being enforced.
Answer:
Explanation:
See the Explanation.Explanation:
1- Open SmartConsole > Logs.
2- Filter: blade:"IPS" and action:"Prevented".
3- Confirm matching protections from the active profile.
4- View details: CVE, protocol, action, confidence level.
5- Export log details for auditing.
NEW QUESTION # 13
What are the three IPS update options?
- A. Manual Update, Scheduled Update, Auto Update
- B. Update Now, Schedule Update, Follow Protections
- C. Auto Update, Policy Update, Update Now
- D. Update Now, Schedule Update, Follow policy
Answer: B
Explanation:
The correct answer is B. Update Now, Schedule Update, Follow Protections . Check Point IPS protection maintenance includes manual updating, scheduled updating, and a follow-up workflow for newly updated protections. The official IPS Protections documentation explains that administrators can immediately update IPS from Custom Policy Tools > Updates > IPS > Update Now , and that IPS protections can also be updated by configuring a schedule for automatic downloads. It also notes that IPS updates require Threat Prevention Policy installation for enforcement.
The same IPS Protections section describes Follow Up behavior for protections: administrators can mark protections for follow-up, filter on them later, and updated protections can be automatically marked for follow- up so they can be reviewed after update. In the course-question wording, this maps to "Follow Protections." The purpose is operational control: update now provides immediate package retrieval, scheduled update automates routine maintenance, and follow protections gives administrators a practical workflow to review newly added or changed IPS protections. The other options either use non-standard names or omit the protection-review workflow. Reference topics: IPS Protections, Update Now, Scheduling IPS Updates, Follow Up Protections, Threat Prevention Policy installation.
NEW QUESTION # 14
Which is NOT an available setting under Custom Policy Tools?
- A. Indicators
- B. Malicious Activity Detection
- C. UserCheck
- D. IPS Protections
Answer: C
Explanation:
The correct answer is B. UserCheck . In SmartConsole, Custom Policy Tools are used to manage Threat Prevention policy objects and tuning components such as profiles, IPS protections, indicators, and protection categories. The official R81.20 guide shows Custom Policy Tools > Profiles for profile creation, editing, and cloning, and Custom Policy Tools > IPS Protections for managing IPS protection behavior. The same guide also shows Custom Policy Tools > Indicators as the location used to configure external IoC feeds.
Malicious Activity Detection is represented through Threat Prevention protection types: the Protections Browser displays protection types, and the guide states that Malicious Activity and Unusual Activity protection types contain lists of protections. UserCheck, however, is not itself a Custom Policy Tools setting.
It is a user interaction and notification mechanism configured inside relevant blade/profile settings, such as Anti-Bot or Zero Phishing UserCheck messages. Therefore, among the choices, UserCheck is the item that does not belong as an available Custom Policy Tools setting. Reference topics: Custom Policy Tools, IPS Protections, Indicators, Threat Prevention Profiles, Protections Browser, UserCheck settings.
NEW QUESTION # 15
Task: Verify cloud connectivity for AV and AB updates.
Answer:
Explanation:
See the Explanation.Explanation:
1- SSH into gateway.
2- Run: curl -v https://updates.checkpoint.com.
3- Ensure no proxy or DNS errors are shown.
4- Also test curl -v https://te.checkpoint.com.
5- Confirm successful connection and no certificate errors.
NEW QUESTION # 16
Task: Configure Anti-Bot in the Corporate_TP_Strict profile to prevent all high-confidence threats.
Answer:
Explanation:
See the Explanation.Explanation:
1- Edit the Corporate_TP_Strict profile.
2- Navigate to the Anti-Bot tab.
3- Set High Confidence to Prevent.
4- Set Medium Confidence to Detect or Prevent, depending on policy.
5- Save and publish changes.
NEW QUESTION # 17
What is the default Anti-Virus protected scope interface settings?
- A. All
- B. External
- C. DMZ
- D. External and DMZ
Answer: B
Explanation:
The correct answer is C. External . Anti-Virus protected scope settings define which traffic direction and interface types are sent for file inspection. Check Point explains that these settings are based on interface type, such as internal or external, and traffic direction, such as incoming or outgoing. In the Anti-Virus Protected Scope section, Check Point defines the option Inspect incoming files from and lists interface choices including External , External and DMZ , and All . The External choice means the gateway inspects incoming files from external interfaces, while files from DMZ and internal interfaces are not inspected.
The default exam answer is therefore External: the baseline Anti-Virus behavior focuses on inbound files arriving from untrusted external interfaces, which is the most common malware-introduction path for perimeter deployments. Option A is too narrow because DMZ alone would ignore Internet-to-user inbound exposure. Option B expands inspection to DMZ traffic, which is valid as a configuration choice but not the default answer. Option D is broader still and increases inspection coverage and resource use, but it is not the default protected-scope setting in this question. Reference topics: Anti-Virus Settings, Protected Scope, interface topology, incoming file inspection, External interface classification.
NEW QUESTION # 18
Task: Validate the IPS update server connectivity from the gateway.
Answer:
Explanation:
See the Explanation.Explanation:
1- SSH into the gateway.
2- Use: curl -v https://updates.checkpoint.com
3- Confirm DNS resolves and certificate is valid.
4- Check proxy settings if blocked.
5- Verify SmartConsole > Gateways > Update section reflects success.
NEW QUESTION # 19
Task: Confirm IPS protections are correctly layered when using shared layers.
Answer:
Explanation:
See the Explanation.Explanation:
1- Go to Threat Prevention Policy > Layers tab.
2- Confirm shared layer is attached to Threat Prevention layer.
3- Double-check profile bindings per rule.
4- Publish and install to apply globally.
5- Use logs to validate consistent protection across gateways.
NEW QUESTION # 20
Task: Verify the enabled Software Blades on a Check Point Security Gateway.
Answer:
Explanation:
See the Explanation.Explanation:
1- SSH into the Security Gateway.
2- Run the command: cplic print to check license details.
3- Use: enabled_blades or cpstat os to verify enabled blades.
4- Confirm Threat Prevention blades like IPS, Anti-Bot, and Anti-Virus are listed.
5- Use SmartConsole > Gateway > General Properties to visually confirm the same.
NEW QUESTION # 21
What is the primary benefit of DNS Trap?
- A. Blocking known bad URLs
- B. Blocking inbound malicious DNS queries
- C. Infected host identification
- D. Blocking outbound malicious DNS queries
Answer: C
Explanation:
The correct answer is A. Infected host identification . Malware DNS Trap is designed to help identify compromised clients by redirecting malicious DNS resolution to a controlled false IP address and then observing which internal hosts attempt to connect to that trap address. Check Point's R81.20 Threat Prevention guide states that Malware DNS Trap can be used to detect compromised clients by checking logs with connection attempts to the false IP address. It also notes that internal DNS servers can be added to better identify the origin of malicious DNS requests.
This makes the primary operational benefit host attribution. While DNS security can block or prevent malicious DNS-related activity, DNS Trap's distinctive value is showing which internal endpoint is likely infected or attempting malicious communication. Option B is more aligned with URL Filtering or URL reputation, not DNS Trap. Option C describes a blocking outcome, but it misses the key trap mechanism and attribution purpose. Option D is incorrect because the usual DNS Trap use case concerns internal clients generating suspicious outbound DNS or follow-up connections, not inbound malicious DNS queries.
Reference topics: Malware DNS Trap, Anti-Bot & Advanced DNS, false IP address, compromised-client detection, infected-host investigation.
NEW QUESTION # 22
Task: Check the current IPS protection version on the Security Gateway.
Answer:
Explanation:
See the Explanation.Explanation:
1- Open SmartConsole > Gateways & Servers.
2- Select the gateway and go to the "Threat Prevention" tab.
3- Note the IPS database version and timestamp.
4- On CLI: run ips stat to cross-verify.
5- Ensure version matches the latest published by Check Point.
NEW QUESTION # 23
Task: Create a custom Threat Prevention profile named Corporate_TP_Strict in SmartConsole.
Answer:
Explanation:
See the Explanation.Explanation:
1- Go to Threat Prevention > Profiles.
2- Click "New Profile", name it Corporate_TP_Strict.
3- In the base profile, select Optimized as a starting point.
4- Enable IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction.
5- Save the profile for later assignment to a policy rule.
NEW QUESTION # 24
Task: Enable DNS reputation check in Anti-Bot.
Answer:
Explanation:
See the Explanation.Explanation:
1- Go to SmartConsole > Gateway Properties > Threat Prevention.
2- Under Anti-Bot settings, enable DNS reputation check.
3- Save and install the policy.
4- Simulate a DNS lookup to a known malicious domain.
5- Confirm log entries for DNS reputation actions.
NEW QUESTION # 25
Which mode allows you to tune or troubleshoot the Threat Prevention Blade?
- A. Display Mode
- B. Watch Mode
- C. Observe Mode
- D. Detect Mode
Answer: D
Explanation:
The correct answer is B. Detect Mode . Detect Mode is used when an administrator wants visibility into Threat Prevention behavior without immediately enforcing a blocking decision. In troubleshooting and tuning, this is essential because it allows security teams to identify which protections would have triggered, review logs, validate false positives, and adjust profiles or exceptions before moving to full prevention. Check Point's official troubleshooting guidance for Autonomous Threat Prevention describes Detect Only mode and states that protections set to Prevent allow traffic to pass while continuing to track threats according to the Track setting.
This makes Detect Mode the correct operational mode for safe tuning. It preserves observability while reducing the risk of production disruption during policy validation, IPS profile changes, new blade rollout, or incident investigation. Observe Mode , Display Mode , and Watch Mode are not the Check Point Threat Prevention operating modes used for this purpose in the exam context. In a certification scenario, Detect Mode should be understood as a non-blocking validation state: it logs and tracks what Threat Prevention would have done, but does not stop the connection based on a Prevent action. Reference topics: Detect Only, Threat Prevention troubleshooting, profile tuning, false-positive validation, Track settings.
NEW QUESTION # 26
Task: Test connection to Check Point Update Services.
Answer:
Explanation:
See the Explanation.Explanation:
1- SSH into Gateway.
2- Use: curl -v https://updates.checkpoint.com.
3- Validate certificate and connection success.
4- Check DNS resolution of update servers.
5- Use SmartConsole > Logs to monitor blocked connections if failed.
NEW QUESTION # 27
What are the three Preconfigured Threat Prevention Profiles?
- A. North-South, East-West, Lateral Movement.
- B. Inbound, Outbound, Etherbound.
- C. Basic, Optimized, Strict.
- D. Perimeter, Datacenter, East-West Communication.
Answer: C
Explanation:
The correct answer is D. Basic, Optimized, Strict . Check Point supplies out-of-the-box Threat Prevention profiles to give administrators predefined security/performance baselines. The official Threat Prevention Profiles section states that administrators can clone a selected profile but cannot change the out-of-the-box profiles: Basic, Optimized, and Strict .
These profiles represent different operating postures. Basic is designed for reliable protection with lower performance impact. Optimized is the default-style balanced approach, providing strong protection for common products and protocols while preserving gateway performance. Strict provides wider coverage and more aggressive protection selection, but can increase inspection cost and may require closer tuning. The other answer choices describe architectural traffic directions or deployment zones, not the official preconfigured profile names. "Perimeter," "Datacenter," and "East-West" are useful design concepts, especially in modern segmentation and Autonomous Threat Prevention discussions, but they are not the three preconfigured Custom Threat Prevention profiles in this question. From a certification perspective, the distinction matters because profiles are selected as the Action in Threat Prevention rules and determine which protections and blades are active. Reference topics: Threat Prevention Profiles, out-of-the-box profiles, Basic profile, Optimized profile, Strict profile, profile cloning.
NEW QUESTION # 28
Task: Enable DNS reputation protection under Anti-Bot in a custom profile.
Answer:
Explanation:
See the Explanation.Explanation:
1- Edit your custom Threat Prevention profile.
2- Under the Anti-Bot section, enable DNS Reputation.
3- Set to Prevent on High Confidence queries.
4- Ensure "Inspect DNS traffic" is enabled.
5- Save and apply the profile.
NEW QUESTION # 29
What does the IPS Follow Protections feature do?
- A. Highlights log entries for new protections
- B. Automatically activates new protections based on profile
- C. Generates a report of activity from new protections
- D. Flags newly downloaded protections for review
Answer: B
Explanation:
The correct answer is A. Automatically activates new protections based on profile . IPS protections are governed by Threat Prevention profiles, and those profiles determine which protections are activated for a rule or policy. Check Point documentation states that a Threat Prevention profile determines which protections are activated and which Software Blades are enabled for the specified rule or policy. For newly downloaded IPS protections, Check Point documents that automatic IPS update behavior can use the profile settings as the default action for those newly downloaded protections.
This is the core logic behind the answer: IPS Follow Protections aligns newly available protections with the active profile's protection-selection logic instead of requiring the administrator to manually evaluate and activate every update. The profile already contains the criteria for activation, including threat severity, confidence, and performance considerations. Option B describes a different review-oriented workflow, commonly associated with marking protections for follow-up or staging. Option C is incorrect because reporting is a SmartEvent or logging function, not the purpose of Follow Protections. Option D is also incorrect because highlighting log entries does not activate enforcement. Reference topics: IPS profile settings, newly updated IPS protections, automatic update behavior, activation according to profile settings, IPS protection lifecycle.
NEW QUESTION # 30
Task: Enable logging of blocked malware downloads in the profile.
Answer:
Explanation:
See the Explanation.Explanation:
1- Edit the custom profile > Anti-Virus tab.
2- Ensure action for medium/high confidence is set to Prevent.
3- Enable Track = Log.
4- Save and push policy.
5- Review logs by filtering blade:"Anti-Virus" and action:"Prevented".
NEW QUESTION # 31
......
Get 2026 Updated Free CheckPoint 156-590 Exam Questions and Answer: https://www.prepawayete.com/CheckPoint/156-590-practice-exam-dumps.html
156-590 Dumps PDF and Test Engine Exam Questions: https://drive.google.com/open?id=1uwEzgC5MF6We5qGO7JSuVN2ZyxOXPjl_