Exam 156-215.80 topic 1 question 215 discussion

Actual exam question from Checkpoint's 156-215.80

Question #: 215
Topic #: 1

You find a suspicious connection from a problematic host. You decide that you want to block everything from that whole network, not just the problematic host.
You want to block this for an hour while you investigate further, but you do not want to add any rules to the Rule Base. How do you achieve this?

A. Use dbedit to script the addition of a rule directly into the Rule Bases_5_0.fws configuration file.
B. Select Block intruder from the Tools menu in SmartView Tracker.
C. Create a Suspicious Activity Rule in Smart Monitor.
D. Add a temporary rule using SmartDashboard and select hide rule.

Show Suggested Answer

Suggested Answer: C 🗳️

by theManFromRoom5 at June 22, 2021, 8:48 p.m.

Comments

Submit Cancel

CCSAChallenger

1 month, 3 weeks ago

You do NOT want to create a rule, yet you do it... dumb question... i guess "rulebase's rules" is assumed...

upvoted 1 times

...

RCL_NAME

1 year ago

Monitoring Suspicious Activity Rules Suspicious Activity Monitoring (SAM) is a utility integrated in SmartView Monitor. It blocks activities that you see in the SmartView Monitor results and that appear to be suspicious. For example, you can block a user who tries several times to gain unauthorized access to a network or Internet resource. A Security Gateway with SAM enabled has Firewall rules to block suspicious connections that are not restricted by the security policy. These rules are applied immediately (Install Policy not required).

upvoted 2 times

...

theManFromRoom5

1 year, 6 months ago

Wouldn't it be 'B' as you don't want to add any rules to the rulebase? Or is a SAM rule not technically considered a rule?

upvoted 1 times

...

Exam 156-215.80 All Questions

View all questions & answers for the 156-215.80 exam

Exam 156-215.80 topic 1 question 215 discussion

Comments

CCSAChallenger

RCL_NAME

theManFromRoom5

SY0-701