Vce 156-590 Questions Latest

The correct answer is D. The Threat Prevention Policy is only applied after traffic is accepted by Access Control Policy . Threat Prevention is a follow-up inspection framework for traffic that has already passed the access decision. The Access Control policy determines whether a connection is allowed, rejected, or dropped. Only traffic that is allowed by Access Control can proceed into Threat Prevention evaluation for IPS, Anti-Bot, Anti-Virus, Threat Emulation, and related blades. Check Point’s policy workflow separates Access Control and Threat Prevention, and the Threat Prevention guide describes the Threat Prevention rulebase as the policy used to activate needed protections and prevent attacks against accepted traffic flows.

Options B and C are incorrect because Threat Prevention does not resurrect or override a connection that Access Control has already dropped or rejected. The inspection chain is sequential from an enforcement perspective: blocked traffic does not continue to malware or IPS inspection as an accepted connection. Option A is also incorrect because a gateway is assigned policy through its policy package and Threat Prevention policy structure, not by stacking multiple independent Threat Prevention policies on the same target as competing enforcement policies. Reference topics: Threat Prevention Policy workflow, Access Control then Threat Prevention sequence, policy package enforcement, accepted-traffic inspection.

The correct answer is B. Rule Header and Rule Options . Check Point supports SNORT rule import so administrators can create custom IPS protections from SNORT signatures. The official Check Point SNORT Signature Support documentation states that SNORT rules use signatures to define attacks and that a SNORT rule has a rule header and rule options . It also provides the syntax structure, where the first section contains action, protocol, source, destination, ports, and direction, while the options section contains keywords such as message and content match criteria.

The Rule Header defines the traffic selector and enforcement context: protocol, source address, source port, direction, destination address, and destination port. The Rule Options define the detection logic and metadata inside parentheses, such as msg, content, and other matching keywords. “Rule body” is not the formal Check Point/SNORT term in this context, and “rule start/rule stop” is not a recognized logical construction. This matters because imported SNORT rules become IPS protections, so syntax correctness affects whether the Management Server can parse, import, and enforce the custom signature. Reference topics: SNORT Signature Support, Custom IPS Protections, Rule Header, Rule Options, imported SNORT protections.