156-215.80 · Question #187
Which feature in R77 permits blocking specific IP addresses for a specified time period?
The correct answer is A. Suspicious Activity Monitoring. Suspicious Activity Monitoring (SAM) is the Check Point R77 feature that allows administrators to dynamically block specific IP addresses for a defined time period without modifying or reinstalling the Security Policy.
Question
Which feature in R77 permits blocking specific IP addresses for a specified time period?
Options
- ASuspicious Activity Monitoring
- BHTTP Methods
- CLocal Interface Spoofing
- DBlock Port Overflow
How the community answered
(47 responses)- A94% (44)
- B2% (1)
- D4% (2)
Why each option
Suspicious Activity Monitoring (SAM) is the Check Point R77 feature that allows administrators to dynamically block specific IP addresses for a defined time period without modifying or reinstalling the Security Policy.
Suspicious Activity Monitoring (SAM) provides a real-time, dynamic mechanism for blocking, monitoring, or rate-limiting traffic from specific IP addresses for a configurable time period. It operates through the SAM API and is accessible from SmartView Monitor, allowing immediate enforcement without the overhead of editing and reinstalling the full Security Policy. The block automatically expires after the specified duration, making it ideal for temporary threat response.
HTTP Methods is an IPS protection category that filters based on HTTP request verbs such as GET or PUT, and does not provide any mechanism for blocking IP addresses by time period.
Local Interface Spoofing is an anti-spoofing control that identifies packets arriving on an unexpected interface, and is not designed to block specific IP addresses for a set duration.
Block Port Overflow is a port scan detection and response protection, not a feature for applying time-limited blocks to specific IP addresses.
Concept tested: Check Point SAM dynamic IP blocking by time period
Source: https://sc1.checkpoint.com/documents/R77/CP_R77_SmartViewMonitor_AdminGuide/html_frameset.htm
Topics
Community Discussion
No community discussion yet for this question.