Exam 156-315.80 topic 1 question 103 discussion

The TE250X is a Sandblast appliance itself so it can't be C. According to the datasheet there are 2 deployment options; Private Cloud i.e. connected to a GW or Inline as Degenhardt said, this means it cant be D. A SPAN port would mean copies of packets are sent to the TE250X, but the appliance just listens and it cannot prevent the clients from receiving the packets, so it can't be A. It has to be B.

C is correct, you would need a gateway to do the redirecting of the mail to a dedicated MTA. It says 'without a gateway'

Correct is B. Page 2 - https://www.checkpoint.com/downloads/products/sandblast-appliances-datasheet.pdf

La B es la respuesta correcta

C is correct

Threat Emulation Deployments: You can use inline or monitor deployments for file emulation. Inline - Use Prevent and Ask actions to block traffic before it goes to the internal computer. You can configure how Threat Emulation handles connections while it finishes the emulation of a file: Background - The traffic is allowed to enter the internal network Hold - The traffic is blocked and does not enter the internal network until after emulation is finished Monitor - Use a SPAN or TAP configuration to duplicate network traffic. The files are then sent directly to Threat Emulation and the computer in the internal network. If Threat Emulation discovers that a file contains malware, the applicable log action is done. Monitor deployments support only the Detect action. https://sc1.checkpoint.com/documents/R77/CP_R77_ThreatPrevention_WebAdmin/101646.htm

B is correct answer.

DEPLOYMENT OPTIONS Emulate threats in one of two deployment options: 1. Private cloud: Check Point security gateways send files to a SandBlast appliance for emulation 2. Inline: This is a stand-alone option that deploys a SandBlast Appliance inline as MTA or as an ICAP server or on a SPAN port, utilizing all NGTX Software Blades including IPS, Antivirus, Anti-Bot, Threat Emulation, Threat Extraction, URL Filtering and Application Control.

I'll choose D! Base on ATRG Documentation there is three (3) deployment mode Inline, SPAN and Remote only. Option C you still need Security Gateway to forward files. <-- Not a possible answer, though you can use the cloud service while inspecting all the traffic not only email traffic. Option B is not the possible answer based on the 3 deployment modes. Option A Span can't prevent. It can do detect only. <-- Not possible answer So D is the best option for me. Let me know your thoughts. You need a Checkpoint account to access the support center. Reference: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114806#Deployment%20options%20-%20Inline

You can't deploy the TE in standalone, always need SMS

B is correct. SandBlast appliances can be deployed in two modes: 1. Inline or Prevent - As a Mail Transfer Agent (MTA) and as part of the web traffic flow. 2. Detect Only - A SPAN port to receive a copy of traffic. From CCSE R80.10 Handbook, Page 628.

It's B. I think the keyword is standalone and MTA, the others are not relevant.

No. It's A: "Inline: This is a stand-alone option that deploys a SandBlast Appliance inline as MTA or as an ICAP server or on a SPAN port, utilizing all NGTX Software Blades including IPS, Antivirus, Anti-Bot, Threat Emulation, Threat Extraction, URL Filtering and Application Control" https://www.checkpoint.com/downloads/products/sandblast-appliances-datasheet.pdf