You have discovered activity in your network. What is the BEST immediate action to take?

The correct answer is B. Create a suspicious action rule to block that traffic.. In Check Point environments, a Suspicious Activity Rule (also called a SAM rule - Suspicious Activity Monitor) allows an administrator to immediately block specific traffic without modifying and reinstalling the full Security Policy. This is the fastest and most targeted response

Security Policy Management

Question

Options

ACreate a policy rule to block the traffic.
BCreate a suspicious action rule to block that traffic.
CWait until traffic has been identified before making any changes.
DContact ISP to block the traffic.

How the community answered

(25 responses)

A
4% (1)
B
76% (19)
C
8% (2)
D
12% (3)

Explanation

In Check Point environments, a Suspicious Activity Rule (also called a SAM rule - Suspicious Activity Monitor) allows an administrator to immediately block specific traffic without modifying and reinstalling the full Security Policy. This is the fastest and most targeted response to an active threat. Creating a standard policy rule (A) requires a full policy install, which takes more time and affects all traffic. Waiting to identify the traffic (C) is dangerous when suspicious activity is already in progress - time is critical during an incident. Contacting the ISP (D) is slow, outside your direct control, and inappropriate as a first response for traffic you can act on directly with your own security tools.

Topics

#suspicious activity rules#traffic blocking#policy response#SmartConsole

Community Discussion

No community discussion yet for this question.

Full 156-215.80 Practice