Pass the Checkpoint CTPS 156-590 Questions and answers with CertsForce

The correct answer is B. Rule Header and Rule Options . Check Point supports SNORT rule import so administrators can create custom IPS protections from SNORT signatures. The official Check Point SNORT Signature Support documentation states that SNORT rules use signatures to define attacks and that a SNORT rule has a rule header and rule options . It also provides the syntax structure, where the first section contains action, protocol, source, destination, ports, and direction, while the options section contains keywords such as message and content match criteria.

The Rule Header defines the traffic selector and enforcement context: protocol, source address, source port, direction, destination address, and destination port. The Rule Options define the detection logic and metadata inside parentheses, such as msg, content, and other matching keywords. “Rule body” is not the formal Check Point/SNORT term in this context, and “rule start/rule stop” is not a recognized logical construction. This matters because imported SNORT rules become IPS protections, so syntax correctness affects whether the Management Server can parse, import, and enforce the custom signature. Reference topics: SNORT Signature Support, Custom IPS Protections, Rule Header, Rule Options, imported SNORT protections.

The correct answer is D. Individual Protections . Core Activation Exceptions are used to override activation behavior at the protection level, not at a broad ThreatCloud, inspection-engine, or protection-group abstraction. The official IPS profile settings documentation explains that the Additional Activation section gives administrators granular control to select IPS protections to activate or deactivate. It states that activated protections are enforced by gateways, while deactivated protections are not enforced, regardless of the general profile protection settings.

Check Point’s IPS Protections documentation reinforces this object-level model: each profile is a set of activated protections plus instructions for what IPS does if traffic matches an activated protection, and administrators can change the action for a specified protection. Therefore, a Core Activation Exception is not a general tuning category and does not apply to the entire ThreatCloud or to engine-wide inspection settings. It is used when a specific protection requires a different activation state than the profile would normally produce. This is common during false-positive handling, staged rollout, exception tuning, or targeted hardening for a specific vulnerability. Reference topics: IPS Protections, Additional Activation, activation overrides, individual protection enforcement, profile-based IPS tuning.