CheckPoint 156-590 Exam Dumps

The correct answer is A. Block List files - Configure disallowed files. Custom Policy Tools are used to manage Threat Prevention objects and enforcement helpers under the Threat Prevention policy view. A Block List file is used to define files that should be treated as disallowed, blocked, or explicitly malicious/undesired according to the policy objective. This is the opposite of the Allow List, which Check Point documents as a list of trusted files that the Threat Prevention engine does not inspect for malware, viruses, and bots, helping reduce gateway resource utilization. The official guide shows Allow List Files under Threat Prevention > Custom Policy Tools > Allow List Files.

Option A is therefore the correct true statement because it accurately describes the role of block-list file handling. Option B sounds plausible but is not the tested correct statement in this question's answer key; the course item is specifically validating the Block List definition. Option C is incorrect because indicators are not ''benign activity''; indicators usually represent observables such as IPs, domains, URLs, or hashes used for threat intelligence or enforcement. Option D is incorrect because profiles are not only available for Autonomous Threat Prevention; Custom Threat Prevention also uses profiles such as Basic, Optimized, and Strict. Reference topics: Custom Policy Tools, Block List Files, Allow List Files, Indicators, Threat Prevention Profiles.

The correct answer is A. Users surfing the website directly by IP address or using domains registered within the last 30 days. Anti-Bot is focused on post-infection compromise evidence: it identifies hosts that may already be infected and attempts to prevent command-and-control communication or other botnet behavior. Check Point documentation describes Anti-Bot as a Threat Prevention component that blocks botnet behavior and communication to Command and Control centers, while the broader Threat Prevention solution provides multi-layered pre- and post-infection defense.

Direct IP browsing and use of newly registered domains are suspicious because malware frequently avoids mature domain reputation controls, rotates infrastructure quickly, or contacts IP-based C2 endpoints directly to bypass domain-based filtering. Domains registered within a recent window are a common risk indicator because malicious campaigns often use disposable infrastructure with short operational lifetimes. Option B is not inherently evidence of bot infection; explicit proxy use may be a network design choice. Option C describes normal intranet access patterns. Option D may indicate weak encryption hygiene but is not specific evidence of compromise. In Anti-Bot analysis, indicators such as suspicious destinations, direct IP access, newly observed domains, and C2-like behavior help identify infected internal hosts. Reference topics: Anti-Bot, post-infection detection, Command and Control communication, suspicious domains, infected-host analysis.

The correct answer is C. External. Anti-Virus protected scope settings define which traffic direction and interface types are sent for file inspection. Check Point explains that these settings are based on interface type, such as internal or external, and traffic direction, such as incoming or outgoing. In the Anti-Virus Protected Scope section, Check Point defines the option Inspect incoming files from and lists interface choices including External, External and DMZ, and All. The External choice means the gateway inspects incoming files from external interfaces, while files from DMZ and internal interfaces are not inspected.

The default exam answer is therefore External: the baseline Anti-Virus behavior focuses on inbound files arriving from untrusted external interfaces, which is the most common malware-introduction path for perimeter deployments. Option A is too narrow because DMZ alone would ignore Internet-to-user inbound exposure. Option B expands inspection to DMZ traffic, which is valid as a configuration choice but not the default answer. Option D is broader still and increases inspection coverage and resource use, but it is not the default protected-scope setting in this question. Reference topics: Anti-Virus Settings, Protected Scope, interface topology, incoming file inspection, External interface classification.

The correct answer is C. Cleanup Rules are not strictly required in the Threat Prevention Policy. Threat Prevention policy behavior is governed by ordered layers and rule matching, but an administrator is not forced to create an explicit cleanup rule in every Threat Prevention rulebase. Check Point documentation explains that a Threat Prevention Rule Base can contain multiple Policy Layers and that each layer calculates its action separately. For a single layer, the enforced rule is the first rule matched; for multiple layers, the final behavior depends on the layer matches and resulting action logic.

A cleanup rule is still a strong operational best practice because it makes the terminal behavior explicit, easier to audit, and easier for operations teams to troubleshoot. Without an explicit cleanup rule, behavior depends on the layer's implicit cleanup logic and the policy architecture. Check Point Security Management documentation shows that implicit cleanup behavior exists at the layer level and can be configured as Drop or Accept in the Layer Editor. The question asks whether cleanup rules are mandatory, not whether they are recommended. Options A and D incorrectly tie cleanup rule requirement to the Basic Profile. Option B incorrectly links Threat Prevention cleanup requirements to the Access Control cleanup rule. Reference topics: Threat Prevention Policy Layers, implicit cleanup rule, explicit cleanup best practice, Layer Editor behavior.

The correct answer is A. Detect. IPS Staging Mode is designed to introduce newly updated protections safely by observing their effect before enforcing active prevention. Check Point documentation states that when newly updated protections are set to Staging Mode, they remain in staging until the administrator changes their configuration. The default action for protections in staging mode is Detect, and this can be changed manually in the IPS Protections page. The R81.20 guide states the same behavior: newly updated protections in staging mode remain there until changed, and their default action is Detect.

This behavior is important during IPS lifecycle management because new signatures can introduce unexpected matches in production traffic. Detect mode allows the gateway to log and expose what the protection would have matched while avoiding immediate blocking. That gives administrators time to validate logs, tune exceptions, confirm confidence level, and assess business impact before switching to Prevent. Bypass would skip inspection and is not the staging default. None is not the default action. Prevent may be the final desired enforcement state, but staging intentionally avoids immediate prevention until analysis is complete. Reference topics: IPS Updates Policy, Staging Mode, Newly Updated Protections, Detect action, IPS protection rollout.