2026 Correct and Up-to-date CheckPoint 156-590 BrainDumps [Q11-Q29]

See the Explanation.Explanation:
1- Go to Threat Prevention > Profiles.
2- Click “New Profile” and name it.
3- Adjust IPS, Anti-Bot, and AV settings to “Prevent” or “Detect.”
4- Save and assign it to relevant policy layers.
5- Publish and install policy.

See the Explanation.Explanation:
1- Use EICAR test file in a browser.
2- Confirm file is blocked and logs show blade:”Anti-Virus” and action:”Prevented”.
3- Confirm the active profile name matches your custom profile.
4- Check logs for file hash and signature info.
5- Document success as part of validation.

The correct answer is B. Reports can be delivered to users who are not Check Point administrators .
SmartEvent Views are primarily interactive dashboards used by administrators and analysts for live investigation, drill-down, filtering, and operational analysis. Reports are designed for packaged distribution:
they summarize security activity, policy enforcement, trends, and incident data into a consumable format.
Check Point documentation states that views and reports can be exported to PDF or CSV using defined filters and time frames. It also documents scheduled report delivery, including the option to send a scheduled view or report automatically by email.
This delivery model is why reports are better suited for executives, auditors, business owners, and non- administrator stakeholders. They do not need SmartConsole access or Check Point administrator privileges to consume a PDF or scheduled email report. Option A describes Views more accurately because views are live and interactive. Option C is incorrect because reports do not inherently have more raw detail than views; they present selected information in a structured format. Option D is incorrect because both views and reports can be customized. Reference topics: SmartEvent Reports, Views and Reports, report scheduling, PDF/CSV export, email delivery, non-administrator reporting.

The correct answer is B. fail-close . Fail mode defines how the Threat Prevention inspection engine behaves when it is overloaded or experiences an internal failure. Check Point’s Threat Prevention Engine Settings documentation defines two options: Allow all connections (Fail-open) and Block all connections (Fail- close) . Fail-open allows connections when the engine is overloaded or fails; Fail-close blocks connections in that condition.
Because the question specifically says Mike wants to block all files if an internal failure occurs, the secure choice is fail-close. This prioritizes protection and containment over availability. It is appropriate where allowing unscanned files would be unacceptable, such as highly regulated environments, malware-sensitive segments, or traffic paths carrying untrusted downloads. The tradeoff is operational: fail-close can interrupt business traffic if the inspection engine is unavailable, overloaded, or unable to complete the decision. Fail- open is the default availability-oriented behavior because it keeps traffic moving during failure, but it permits files or connections that may not have completed inspection. “Open system” and “closed system” are not the correct Check Point Threat Prevention fail-mode terms in this context. Reference topics: Threat Prevention Engine Settings, ThreatSpect fail mode, fail-open, fail-close, inspection failure handling.

See the Explanation.Explanation:
1- Go to Threat Prevention > Updates.
2- Click “Check Now” under IPS section.
3- Wait for update to complete and view the status log.
4- On the gateway, check $FWDIR/log/ips_update.elg for details.
5- Confirm the update applied with ips stat.

The correct answer is A. Assess Health of System . HealthCheck Point, commonly referred to as HCP , is Check Point’s self-updatable health assessment suite. The official Security Management Administration Guide states that the HCP tool is designed for tests that assess the health of your system , WTS timelines that provide critical and informative events, and topology visualization. It also explains that HCP runs on managed Security Gateways every six hours and sends a status report to the Security Management Server or Domain Management Server.
Therefore, the “Tests” function of HCP is specifically system-health assessment. It is not primarily a SmartConsole connection checker, although management connectivity can affect visibility. It is also not a general “security posture” assessment engine in the sense of policy risk analysis, and it is not limited to SmartEvent status. In troubleshooting, HCP is useful because it gives administrators a structured view of platform health, recent critical events, and topology-related information, helping distinguish Threat Prevention blade problems from broader gateway, management, or system-health issues. Reference topics:
HealthCheck Point Tool, HCP Tests, system-health assessment, WTS, topology visualization, managed gateway status reporting.

See the Explanation.Explanation:
1- Edit the custom profile > Anti-Virus tab.
2- Ensure action for medium/high confidence is set to Prevent.
3- Enable Track = Log.
4- Save and push policy.
5- Review logs by filtering blade:”Anti-Virus” and action:”Prevented”.

See the Explanation.Explanation:
1- Open SmartConsole > Threat Prevention > Updates.
2- Enable “Check for updates automatically.”
3- Set schedule (e.g., daily at 2:00 AM).
4- Enable “Install updates automatically” for production or testing only.
5- Click OK and publish changes.

The correct answer is B. Firewall, Identity Awareness, Content Awareness, and IPS . The question asks for features common across the NGFW, NGTP, and SNBT package families. Check Point’s Network Security Software Bundles datasheet shows that Firewall , Identity Awareness , Content Awareness , and IPS are included across NGFW, NGTP, and SNBT. The same table also shows Application Control and several other capabilities, but among the listed answers, option B is the one whose components are common to all three package columns.
The package progression is important. NGFW is the base next-generation firewall bundle and includes core access-control and IPS capability. NGTP includes NGFW capabilities and adds prevention features such as Anti-Virus, Anti-Bot, URL Filtering, and DNS Security. SNBT, or SandBlast, includes NGTP and adds advanced zero-day protections such as Threat Emulation, Threat Extraction, and Zero Phishing. Therefore, answers containing Anti-Virus, Anti-Bot, or Threat Emulation are not “common” to all three packages. Anti- Virus and Anti-Bot are not part of the base NGFW package in the table, and Threat Emulation is specific to SNBT. Reference topics: Check Point Security Gateway Software Bundles, NGFW, NGTP, SNBT, IPS, Identity Awareness, Content Awareness.

See the Explanation.Explanation:
1- Navigate to Threat Prevention > Inspection Settings in SmartConsole.
2- Choose “Performance Optimization” tab.
3- Lower detection sensitivity or exclude internal trusted networks.
4- Save changes and apply policy to the relevant gateways.
5- Monitor logs for false negatives and adjust as needed.

See the Explanation.Explanation:
1- Go to Threat Prevention > Inspection Settings.
2- Add a new exception group for mobile user IP pool.
3- Set reduced inspection sensitivity for this group.
4- Save, publish, and test VPN user traffic.
5- Ensure logs still show critical threats being detected.

The correct answer is D. 2 million . In R81.20, Check Point expanded the supported scale for custom threat intelligence observables. The R81.20 Threat Prevention Administration Guide states that, starting from R81.
20, the Security Gateway supports at least 2 million patterns/observables for URL, Domain, IP address, and Hash observable types. It also notes that the maximum number is limited by available memory and disk space on the Security Gateway, and that the gateway checks whether 50% of total memory is free before loading more patterns or observables.
This capability applies to Custom Intelligence Feeds, which let administrators fetch feeds from third-party servers directly to the Security Gateway for enforcement by Anti-Virus, Anti-Bot, and IPS blades. The feature reduces operational overhead by allowing external indicators to be managed and monitored through the Threat Prevention enforcement path. The incorrect options either understate or overstate the documented baseline.
“Unlimited” is also incorrect because Check Point explicitly ties the upper boundary to memory and disk capacity. Reference topics: Custom Threat Indicators, External IoC Feeds, Custom Intelligence Feeds, observable scale, R81.20 Threat Prevention, URL/domain/IP/hash indicators.

See the Explanation.Explanation:
1- In SmartConsole, attempt policy install again and note error.
2- View install_policy.elg in $FWDIR/log/.
3- Verify SIC is active.
4- Ensure policy contains no rulebase errors.
5- Re-push after resolving syntax or connectivity issues.

The correct answer is D. The IPS Blade must be activated on the individual Security Gateway object .
Check Point Software Blades are enabled on the enforcement point that inspects traffic, which is the Security Gateway or Cluster object, not merely on the Management Server. The official Threat Prevention guide states that to enable IPS, the administrator opens the Security Gateway / Cluster object , goes to General Properties > Network Security , selects IPS , and follows the wizard. For IPS package installation, Check Point also documents the sequence: enable IPS in the Security Gateway object, enable IPS in the corresponding Threat Prevention policy, and install the Threat Prevention Policy.
Licensing alone is therefore insufficient; a license permits use, but blade activation defines whether the gateway enforces IPS inspection. Option A is wrong because enabling the blade on the Management Server object does not activate IPS enforcement on all managed gateways. Option C is also wrong in standard ClusterXL management because blades are configured on the Cluster object, not separately and inconsistently on individual members. Operationally, enabling IPS on the correct gateway or cluster object ensures SmartConsole exposes the appropriate Threat Prevention controls and that policy installation targets the enforcement points. Reference topics: IPS Blade activation, Gateway object configuration, Threat Prevention policy installation, Cluster object management.

See the Explanation.Explanation:
1- Clone an existing profile, name it Web_Servers_Profile.
2- Disable Anti-Bot (not applicable for outbound traffic).
3- Keep Anti-Virus and IPS with only essential protections enabled.
4- Set high-performance protections to “Detect” or “Inactive.”
5- Apply the profile to traffic destined for web servers.

The correct answer is D. Only a subset of file types supported . In Check Point traffic inspection architecture, Passive Streaming and Active Streaming are stream-handling mechanisms used by content- inspection components. Passive Streaming allows inspection of traffic as a stream is observed, while Active Streaming is more intrusive because the gateway can actively participate in traffic handling, buffering, or modification. In Anti-Virus inspection, this distinction matters because file classification and supported file handling depend on the inspection mechanism and file-type processing model. Check Point’s Anti-Virus settings expose file-type controls, including processing file-type families and configuring actions per file type.
Check Point’s Security Gateway documentation also identifies CPAS as Check Point Active Streaming and PSL as Passive Streaming Layer, with MUX selecting between passive and active streaming for application traffic.
The exam distinction is that Active Streaming does not provide unrestricted Anti-Virus inspection coverage across every possible file type; its limitation is that only a subset of file types is supported. Option A is wrong because Anti-Virus inspection is not limited to scheduled scans. Option B is not the distinct comparative limitation in this context. Option C is incorrect because there is a documented architectural distinction between the two streaming approaches. Reference topics: CPAS, PSL, MUX, Anti-Virus file-type processing, content inspection architecture.

See the Explanation.Explanation:
1- Create multiple Threat Prevention profiles per zone (DMZ, Internal, External).
2- In Threat Prevention Policy, add separate rules by source zone.
3- Apply respective profile in each rule.
4- Publish and install the policy.
5- Monitor logs to verify zone-specific detection.

See the Explanation.Explanation:
1- SSH into the Gateway.
2- Run: cpview > Threat Prevention section.
3- Check CPU, memory, and update status.
4- Look for blade-specific errors or crashes.
5- Use cpstat threat-prevention for CLI summary.

See the Explanation.Explanation:
1- Open Threat Prevention > Protections.
2- Choose “Anti-Virus Protections” and select the one triggered.
3- Add Exception: Service/Port = custom (e.g., 8081).
4- Set action to “Detect” for this exception.
5- Publish changes and validate behavior in logs.