Free 156-590 Practice Test Questions and Answers (2026)

After new IPS (ThreatCloud) signatures are downloaded to the Security Management Server, they are stored but not enforced on gateways until the administrator performs an Install Policy (Install Threat Prevention Policy). This step compiles the updated signature set into the gateway’s inspection engine so that new protections become active; no reboot or cpstop/cpstart is required.

A – Rebooting a gateway is unnecessary and does not load the new signatures.

C – The signature database is already updated; manual CLI reload is redundant without policy installation.

D – cpstop/cpstart restarts all blades, causing downtime and still requires policy install afterward.

1. Check Point IPS Administration Guide R81, chap. 7 “Updating Protections”, p.124 (“Install Policy to apply new protections”).

2. Check Point SK95188 “IPS automatic update process”, sec. ‘Enforcement on Gateways’.

Custom Policy Tools let administrators build user-defined IPS protections that persist locally and are never overwritten by signature updates; they can then be added to any Threat Prevention profile.

B – No TAC involvement is needed; administrators create and deploy them directly.

C – They are available from R77.30 onward, not limited to R80+.

D – They coexist with Core Protections and do not disable or replace them.

1. Check Point Threat Prevention Admin Guide R80.40, §6.3 “Creating Custom IPS Protections”, pp. 120-123.

2. sk65364 “IPS Custom Signatures – best practices”, §“Persistence after updates”.

Software blades on a Check Point Security Gateway are activated on a per-gateway basis through the SmartConsole management interface. The correct procedure is to edit the specific Security Gateway or Cluster object. Within the object's properties, on the "General Properties" page, the administrator can enable blades under the "Network Security" tab. To activate IPS, the administrator checks the box next to "IPS". The change takes effect after the policy is installed on the gateway.

(Based on assumed options: A. Creating a policy layer, B. Enabling in Global Properties, C. Running cpconfig)

A: Creating a Threat Prevention policy layer is necessary to define rules, but it does not activate the blade engine on the gateway itself.

B: Global Properties define settings that apply across the management domain, but blade activation is a specific setting for each individual gateway object.

C: cpconfig is a command-line utility on the gateway for initial setup tasks like licensing, not for enabling software blades managed by policy.

1. Check Point R81.20 Security Management Administration Guide, Chapter 4: "The Security Gateway", section "Enabling Software Blades on Security Gateways". This section provides the step-by-step procedure.

2. Check Point R81.20 Threat Prevention Administration Guide, Chapter 1: "Introduction to Threat Prevention", section "Enabling Threat Prevention Blades on the Security Gateway".

When the Threat Prevention Software Blade is enabled, Check Point automatically creates a default Threat Prevention Profile named "RecommendedProfile". This profile is pre-configured with Check Point's recommended settings for all Threat Prevention blades (IPS, Anti-Virus, Anti-Bot, Threat Emulation, and Threat Extraction). It is designed to provide a strong balance between security and performance and is automatically applied to the default Threat Prevention rule, ensuring immediate protection upon activation.

A. "Default" is a generic term but not the specific name of the pre-configured Threat Prevention profile in SmartConsole.

B. "Optimized" is a common profile name in other contexts or vendor products, but the specific Check Point default is "RecommendedProfile".

C. "BasicProtection" is not the name of the default profile. The "RecommendedProfile" offers more than just basic settings.

1. Check Point R81.20 Threat Prevention Administration Guide, Chapter 2 "The Threat Prevention Policy", Section "Threat Prevention Profiles", Page 32. (Explicitly names "RecommendedProfile" as the default profile).

2. Check Point R81.20 Threat Prevention Administration Guide, Chapter 2 "The Threat Prevention Policy", Section "The Threat Prevention Rule Base", Page 29. (Shows the default rule uses the "RecommendedProfile").

The pslavd (PSL AV-Daemon) is the primary process for the Check Point Anti-Virus software blade. This daemon is responsible for the core functions of the Anti-Virus engine, which includes managing, loading, and utilizing the malware signature database. As part of its duties, pslavd communicates with the Check Point ThreatCloud infrastructure to download and apply the latest Anti-Virus signature updates. This ensures the Security Gateway is equipped with the most current protections against emerging threats.

A. The CPAS Daemon (cpasd): This process is part of the Content Awareness blade and handles the active streaming of data for inspection; it is not responsible for Anti-Virus signature updates.

B. The Resource Advisor Daemon (RAD): This daemon's function is to monitor system resources (e.g., CPU, memory) to maintain gateway stability under heavy load, not to manage security updates.

D. The Threat Emulation Daemon "ted": This process is specific to the Threat Emulation blade and communicates with the ThreatCloud for file sandboxing, not for downloading Anti-Virus signatures.

1. Check Point SecureKnowledge sk111969 - "ATRG: Anti-Virus": This Advanced Technical Reference Guide identifies the key processes for the Anti-Virus blade. In the "Processes and Daemons" section, pslavd is listed as the "PSL AV-Daemon," confirming it as a central process for the blade's operation.

2. Check Point SecureKnowledge sk98322 - "How to troubleshoot Anti-Virus updates": This article provides debugging commands for Anti-Virus update issues. The troubleshooting steps involve interacting directly with the pslavd daemon (e.g., using pslavdadmin -d), which confirms its direct involvement in the update process.

3. Check Point R81.10 Threat Prevention Administration Guide: In the "Anti-Virus" chapter, the guide details the update mechanism, stating that "The Security Gateway gets Anti-Virus signature updates from the Check Point ThreatCloud." The pslavd daemon is the process that executes this function for the Anti-Virus blade.

If traffic fails to match any explicit Threat Prevention rule, it is evaluated by the implicit “Catch-All” rule that applies the default Threat Prevention profile (Optimized, unless the administrator changes it). Thus the traffic is still inspected by IPS/Anti-Bot/Anti-Virus protections defined in that profile and then either Prevented or Detected according to the profile’s settings; it is not passed unchecked or dropped outright.

A – Stating the traffic is dropped contradicts the implicit rule behaviour.

B – Claiming traffic bypasses Threat Prevention ignores the mandatory catch-all inspection.

D – Reject with RST/ICMP is not used by the implicit Threat Prevention rule.

1. Check Point Threat Prevention Administration Guide R81, chap. 5 “Threat Prevention Rule Base”, p.95 (implicit rule description).

2. Check Point SK92474 “Understanding the default Threat Prevention policy behaviour”, para. 3.

Cleanup rules are not mandatory in a Check Point Threat Prevention Policy. Unlike the Firewall policy, which has an implicit "drop" rule at the end, the Threat Prevention policy has an implicit "allow" rule. This means any traffic that does not match a rule in the Threat Prevention policy is allowed to pass without inspection by the Threat Prevention blades. Therefore, while the policy will function and install without a cleanup rule, it is a critical best practice to add one to explicitly define the action for all other traffic, preventing threats from bypassing inspection.

A. The policy will install and function without a cleanup rule; the implicit rule will simply allow non-matching traffic without inspection.

B. They are not mandatory for policy function, although they are essential for a comprehensive security posture.

D. The Threat Prevention policy has an implicit allow rule, not a deny rule. This makes a cleanup rule even more critical than in the Firewall policy.

1. Check Point R81.20 Threat Prevention Administration Guide, Chapter 2 "The Threat Prevention Policy", Section "The Threat Prevention Rule Base", Page 29. (Explains the rule base logic and the implicit rule that allows traffic if no rule is matched).

2. Check Point R81.20 Security Management Administration Guide, Chapter 6 "The Rule Base", Section "Implicit Rules". (Contrasts the implicit drop in Access Control with behaviors in other policies).

When managing the IPS protections within SmartConsole, the "Protection Name" is a primary and essential searchable field. Administrators use this field to locate specific protections to view their details, modify their action (Prevent/Detect), or create exceptions. While other attributes like CVE ID or performance impact are also searchable, the name is the most direct and commonly used identifier for a protection within the IPS database. The other options listed are typically found in log files, not as search criteria for the protection database itself.

A: A Packet Capture Timestamp is metadata within a specific log or capture file, not a searchable field in the IPS protections database.

C: A User Session ID is a dynamic value associated with a specific traffic log, not a static, searchable attribute of an IPS protection.

D: A Firewall Rule UID is a unique identifier for a rule in the Access Control policy, not a field for searching IPS protections.

Check Point R81.20 Threat Prevention Administration Guide, Chapter 3, "Configuring the IPS Policy", section "Managing IPS Protections".

Check Point R81.20 Logging and Monitoring Administration Guide, Chapter 3, "Working with Logs", section "Searching and Filtering Log Records".

The Common Vulnerabilities and Exposures (CVE) program is sponsored by the U.S. Department of Homeland Security's (DHS) Cybersecurity and Infrastructure Security Agency (CISA). The program is operated and maintained by the MITRE Corporation, a not-for-profit organization. MITRE's role is to manage the CVE list, assign CVE Identifiers to new vulnerabilities, and ensure the program serves the public interest by providing a standardized catalog of publicly disclosed cybersecurity vulnerabilities.

(Based on assumed options: A. NIST, B. SANS Institute, D. FIRST)

A: The National Institute of Standards and Technology (NIST) maintains the National Vulnerability Database (NVD), which enriches CVE data, but it does not own the CVE program.

B: The SANS Institute is a private organization focused on cybersecurity training and certification, not on managing vulnerability databases.

D: FIRST (Forum of Incident Response and Security Teams) is an organization for incident response teams and does not operate the CVE program.

1. MITRE Corporation. (n.d.). About the CVE Program. CVE. Retrieved from https://www.cve.org/About/Overview. The official site states, "The CVE Program is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). The CVE Program is operated by the MITRE Corporation..."

2. MITRE Corporation. (n.d.). CVE Program History. CVE. Retrieved from https://www.cve.org/About/History. This page details MITRE's role since the program's inception in 1999.

The IPS Profile Cleanup option is a maintenance feature within SmartConsole. Its purpose is to optimize an IPS profile by removing any protections that have been manually added or modified but are not currently set to an active state (i.e., they are not set to 'Prevent' or 'Detect'). This helps to reduce profile complexity and potential performance overhead by ensuring that only relevant and active protections are included in the policy pushed to the Security Gateway.

A. Deletes old logs: Log deletion is managed by Log Server settings and is unrelated to the IPS profile cleanup function, which only affects the profile's configuration.

C. Resets the profile to default settings: This action would revert all profile settings, including active protections, to their default state, which is a different function than cleanup.

D. Cleans up temporary files on the gateway: Profile cleanup is a management server operation that modifies a configuration profile; it does not perform file system maintenance on the Security Gateway.

Check Point. (2023). R81.20 IPS Administration Guide. Page 48, "Cleaning Up an IPS Profile". The guide states, "You can clean up an IPS Profile to remove protections that are not active."