Online Access Free 156-730 Exam Questions

Which protocols are supported by the THREAT EMULATION blade?

• A.HTTP and SMTP only, there is no SSL/TLS security support
• B.HTTP(S), SMTP/TLS with optional CIFS
• C.HTTP(S), SMTP/TLS only
• D.CIFS, FTP, and optional HTTP and SMTP support

You have enabled Antivirus to scan all traffic passing through your Check Point gateway.
With the default settings your Antivirus will scan all traffic in streaming mode. For certain file types you would like to enable a mode that will collect the entire file before scanning.
This enables you to inspect archives. What is this functionality called?

• A.Deep scan
• B.Threatspect
• C.Inspect
• D.CPU Level scan

You can restrict a user from downloading an original file if it is getting a malicious verdict from Threat Emulation?

• A.True - Under Threat emulation settings you can configure this option.
• B.False - Due to security concerns, a user will never be able to download a file found to be malicious.
• C.False - Threat Emulation provides a recommendation verdict. The user can download the file even if it is found to be malicious.
• D.True - This is possible through the SmartDashboard Threat extraction settings.

What is a ROP Gadgets Dictionary?

• A.A generated stack of return addresses
• B.Lookup table used by CPU Level Emulation to detect malware
• C.List of commonly used passwords
• D.Feature sets which can be used to discover the true meaning of the code

Why should you use a Mail Transfer Agent when configuring Prevent/Hold-mode?
1. TE inspection in streaming mode can cause the sending mail server not to send any additional emails until the emulation of the prior email is completed.
2. TE inspection in Mail Transfer Agent mode will accept all valid incoming emails before inspection.
3. It will allow the email to reach the user while at the same time be sent for Dynamic Analysis.
4. There is no Mail Transfer Agent mode for Threat Emulation, only for Anti-Spam.

• A.2 and 3 are correct
• B.2 and 4 are correct
• C.1 and 2 are correct
• D.All are correct