156-315.75 · Question #601
How do you block some seldom-used FTP commands, such as CWD, and FIND from passing through the Gateway?
The correct answer is B. Modify the desired profile in the FTP commands under Protection Details in the IPS tab. See the full explanation below for the reasoning.
Question
How do you block some seldom-used FTP commands, such as CWD, and FIND from passing through the Gateway?
Options
- AAdd the restricted commands to the aftpd.conf file in the Security Management Server.
- BModify the desired profile in the FTP commands under Protection Details in the IPS tab.
- CConfigure the restricted FTP commands in the Security Servers screen of the Global Properties.
- DEnable FTP Bounce checking / Application Intelligence / Protocol Protections from the IPS tab.
How the community answered
(61 responses)- A7% (4)
- B77% (47)
- C13% (8)
- D3% (2)
Community Discussion
7
Imani T.Jun 13, 2026Answer is B, and here is why that matters for understanding the question and not just memorizing the letter. Check Point handles FTP security through the IPS blade, and when you go into a protection profile and look at the Protection Details, you get granular control over which FTP commands are permitted or denied through the gateway. That is the right tool for this job because it is tied to a profile you can apply per policy, which gives you flexibility across different network segments. Option C trips people up because the Security Servers section in Global Properties does touch FTP, but that is for configuring things like welcome banners and general FTP security server behavior, not for restricting specific commands like CWD or FIND. Option D is about FTP Bounce, which is a completely different attack vector where an attacker abuses the PORT command to redirect connections, so do not confuse those two concepts on exam day.
Bahar F.Jun 15, 2026Solid breakdown, and the profile-per-policy flexibility is even more critical in a Maestro Security Group deployment where your SMO members are all enforcing the same Threat Prevention policy, so a misconfigured IPS profile scope can silently pass commands you meant to block across every member simultaneously.
Viktor S.Jun 26, 2026Option C is the classic trap here because Global Properties does have an FTP section and people assume that is where fine-grained command filtering lives, but that screen handles things like allowed FTP modes, not a per-command blocklist. The actual mechanism is in the IPS tab under the FTP security server profile, Protection Details, where you can explicitly restrict individual commands like CWD, so B is correct.
Bahar F.Jun 23, 2026Saw this one on my actual 156-315.75 sitting, almost went with C before I remembered FTP command filtering lives in the IPS tab profile under Protection Details, not Global Properties. B is your answer.
Imani T.Jun 24, 2026Good catch on the tab location, and worth adding that even if you knew the right answer the distractor on C is nasty because Global Properties does handle some legacy inspection settings, so it pays to know exactly which controls migrated to the profile level in R81.
Yusuf A.Jun 16, 2026The way I read this, C has to be right because the Security Servers screen in Global Properties is exactly where you tune what the FTP Security Server allows through the gateway, and blocking specific commands like CWD fits right into that configuration. My senior walked me through Global Properties last week and that Security Servers section is where the granular FTP command control lives, not the IPS tab.
Imani T.Jun 19, 2026Yusuf, the Security Servers section in Global Properties covers legacy content inspection defaults but it does not give you command-level FTP control inside a policy rule, and that is why B is the right pick, because blocking a specific command like CWD requires configuring an FTP Resource object and referencing it in the rule itself.