156-315.75 · Question #605
Your online bookstore has customers connecting to a variety of Web servers to place or change orders and check order status. You ran penetration tests through the Security Gateway to determine if…
The correct answer is B. Check the Products / Web Server box on the host node objects representing your Web servers. See the full explanation below for the reasoning.
Question
Your online bookstore has customers connecting to a variety of Web servers to place or change orders and check order status. You ran penetration tests through the Security Gateway to determine if the Web servers were protected from a recent series of cross-site scripting attacks. The penetration testing indicated the Web servers were still vulnerable. You have checked every box in the Web Intelligence tab, and installed the Security Policy. What else might you do to reduce the vulnerability?
Options
- AConfigure the Security Gateway protecting the Web servers as a Web server.
- BCheck the Products / Web Server box on the host node objects representing your Web servers.
- CAdd Port (TCP 443) as an additional port on the Web Server tab for the host node.
- DThe penetration software you are using is malfunctioning and is reporting a false-positive.
How the community answered
(28 responses)- A4% (1)
- B79% (22)
- C7% (2)
- D11% (3)
Community Discussion
7
Viktor S.Jun 26, 2026The correct answer is B, and here is why it actually matters instead of just being a trivia fact to memorize. Check Point's Web Intelligence inspection only activates on traffic flowing to objects that are designated as Web servers in the topology, meaning the gateway needs to know which hosts are Web servers so it knows which connections to apply those protections to. If you never check the Products / Web Server box on the host node object, the gateway treats that host like any other node and skips the deeper HTTP inspection entirely, so you checked every box in the Web Intelligence tab and got nothing for it. A is wrong because designating the gateway itself as a Web server makes no topological sense for this scenario, C is a distraction about ports that does not address the classification problem, and D is the classic cope answer you should always treat with suspicion on a real exam question.
Mateus R.Jun 24, 2026Option A is the classic trick here, but B is your real fix, you have to tell the gateway those hosts are actually web servers.
Hiroshi T.Jun 26, 2026Saw this exact scenario on my 156-315.75 sitting last year and almost picked A before I caught myself, because the blueprint is clear that Web Intelligence protection applies only to hosts defined as Web servers in their node object properties, so checking Products / Web Server on the host node is what actually enables the engine to inspect traffic destined for those machines. Without that checkbox, the gateway has no context that the host is a Web server and the Web Intelligence blade simply does not engage its protections for that traffic, per the R80 Security Management Administration Guide.
Bahar F.Jun 26, 2026B is the right call, but it catches people off guard because they assume checking the Web Intelligence boxes on the gateway is the whole story. The gateway needs to know which hosts are actually Web servers, so without checking "Products / Web Server" on the host node objects themselves, the engine has no context to apply those protections correctly.
Hiroshi T.Jun 28, 2026The host node classification matters, but to be precise about where this lives in the documentation, it is the SmartDefense profile assignment on the gateway combined with the "Web Server" protection scope in the IPS policy that drives context-aware inspection, and the host node "Products" field informs asset management and some correlation features rather than directly gating Web Intelligence enforcement.
Brenda K.Jun 26, 2026Honestly I was ready to bubble in A because "configure the gateway as a Web server" sounded like it would unlock the right inspection profile, but then I remembered that Web Intelligence only fires its XSS protections on traffic destined for objects flagged as Web servers, so if your host node objects do not have that Products / Web Server box checked, the gateway does not even know to apply that protection to them. B is the one, and it is a 15-second fix once you know it, so flag A if you see this and come back to confirm B before you submit.
Viktor S.Jun 29, 2026Brenda's got the right answer but worth being explicit about why A fails even harder than just "wrong profile," because configuring the gateway as a Web server changes how it handles its own inbound traffic, not how it classifies the protected hosts behind it, so you would be solving a completely different problem.