156-590 Exam Dumps : Check Point Certified Threat Prevention Specialist (CTPS)

The correct answer for the uploaded course-question set is B. 1 Million . IOC files are used to import indicators of compromise so that the gateway can match known malicious or suspicious observables such as domains, URLs, IP addresses, and file hashes. In the Threat Prevention architecture, these indicators complement ThreatCloud intelligence by letting administrators add organization-specific or third-party intelligence into enforcement. The key certification point in this question is scale: R81.20 IOC Files are tested with a maximum of 1 million patterns or observables in this exam context.

Operationally, this limit matters because large IOC files affect memory use, update processing, compilation time, and gateway enforcement behavior. Architects should avoid treating IOC ingestion as unlimited; feeds must be curated, deduplicated, normalized, and prioritized. The current public R81.20 release documentation distinguishes expanded IoC feed scale and states that IoC feeds can support significantly more observables on XFS systems, while EXT3 has a lower limit. For this specific question wording, however, the answer key’s “IOC Files” limit is 1 Million , while later Custom Threat Indicators and external-feed capacities are treated separately in related questions. Reference topics: IOC Files, Threat Indicators, R81.20 Threat Prevention, observable limits, feed sizing and gateway resource planning.

The correct answer is A. Users surfing the website directly by IP address or using domains registered within the last 30 days . Anti-Bot is focused on post-infection compromise evidence: it identifies hosts that may already be infected and attempts to prevent command-and-control communication or other botnet behavior. Check Point documentation describes Anti-Bot as a Threat Prevention component that blocks botnet behavior and communication to Command and Control centers, while the broader Threat Prevention solution provides multi-layered pre- and post-infection defense.

Direct IP browsing and use of newly registered domains are suspicious because malware frequently avoids mature domain reputation controls, rotates infrastructure quickly, or contacts IP-based C2 endpoints directly to bypass domain-based filtering. Domains registered within a recent window are a common risk indicator because malicious campaigns often use disposable infrastructure with short operational lifetimes. Option B is not inherently evidence of bot infection; explicit proxy use may be a network design choice. Option C describes normal intranet access patterns. Option D may indicate weak encryption hygiene but is not specific evidence of compromise. In Anti-Bot analysis, indicators such as suspicious destinations, direct IP access, newly observed domains, and C2-like behavior help identify infected internal hosts. Reference topics: Anti-Bot, post-infection detection, Command and Control communication, suspicious domains, infected-host analysis.

The correct answer is A. Block List files - Configure disallowed files . Custom Policy Tools are used to manage Threat Prevention objects and enforcement helpers under the Threat Prevention policy view. A Block List file is used to define files that should be treated as disallowed, blocked, or explicitly malicious/undesired according to the policy objective. This is the opposite of the Allow List, which Check Point documents as a list of trusted files that the Threat Prevention engine does not inspect for malware, viruses, and bots, helping reduce gateway resource utilization. The official guide shows Allow List Files under Threat Prevention > Custom Policy Tools > Allow List Files .

Option A is therefore the correct true statement because it accurately describes the role of block-list file handling. Option B sounds plausible but is not the tested correct statement in this question’s answer key; the course item is specifically validating the Block List definition. Option C is incorrect because indicators are not “benign activity”; indicators usually represent observables such as IPs, domains, URLs, or hashes used for threat intelligence or enforcement. Option D is incorrect because profiles are not only available for Autonomous Threat Prevention; Custom Threat Prevention also uses profiles such as Basic, Optimized, and Strict. Reference topics: Custom Policy Tools, Block List Files, Allow List Files, Indicators, Threat Prevention Profiles.