The interview question that filters senior from junior
Interview: "You enabled all 5 Threat Prevention blades on Optimized profile. CPU is 95%, SOC drowning in alerts. What do you do?"
Junior: "Switch off some blades". Senior: "(1) Move HTTPS Inspection to selective bypass — banking + Office365 + Apple. (2) Build a custom profile from Optimized → demote 'Low confidence' protections to Detect-only. (3) Move IPS to Detect-only on user-segment for 2 weeks → collect baseline → curate exception group → switch back to Prevent. (4) For TE, move to MTA mode for SMTP and 'Background prevention' for HTTP — no user-facing latency. The blades stay on; the profile gets surgical."
💡 The IGI Airport security analogy
You enter Delhi airport. Visa check (Access Control) → you're allowed in the country. Then security: X-ray (IPS — signatures of known bad shapes), Metal detector (AV — known-malware signature scan), Sniffer dog (Anti-Bot — looks for outbound signals to known C2 / drug dealers), Strip-search room (Threat Emulation — pulls suspicious bags into a contained room and watches what happens), Forensic cleanup (Threat Extraction — extracts the wallet & passport from the bag, throws the bag away, gives you a clean replacement). Each adds 5-30 sec of latency. Profiles = how strict each station is. Exception group = the diplomatic-passport lane.
① IPS — the signature engine + the protection categorization
IPS doesn't just match signatures. Every protection has 3 dimensions:
- Severity — Critical / High / Medium / Low / Info. How bad is it if this protection's traffic is malicious?
- Confidence — High / Medium / Low. How sure is Check Point that the signature is correct (vs false positive)?
- Performance impact — Critical / High / Medium / Low. How much CPU does running this protection cost?
Profiles set the action based on these dimensions. Optimized: Prevent when Severity High + Confidence High + Perf-impact ≤ Medium. Strict: Prevent across nearly everything. Basic: Prevent only Critical + High-confidence + Low-impact.
4 things every interview asks about
Severity = how bad if true. Confidence = how sure we are it's true. Optimized profile prevents only when both are High. Low-confidence stays Detect to avoid blocking legitimate traffic.
Mail Transfer Agent mode — gateway sits inline between sender's MX and your Exchange / Google. TE sandboxes attachments BEFORE delivery. Slows mail by ~3 min but catches zero-day phish.
TE on HTTP/HTTPS file downloads. User gets the file IMMEDIATELY. TE verdict comes back in ~3-5 min. If malicious, AB+SIEM alerts fire + AV signature gets pushed fleetwide. Zero user-facing latency.
Reusable bypass list (specific protection / source / dest / file type). Attach to many TP rules. Precedence: Exception > Override > Profile. One exception group can save you from re-doing 12 site policies.
② Anti-Bot — when the prevention failed
IPS, AV, TE all try to block ingress. Anti-Bot watches egress. Already-infected endpoints (laptop got malware from a USB stick at home, came to office) will try to phone home to a C2 server. Anti-Bot detects this by: (a) reputation lookup against ThreatCloud, (b) DGA pattern recognition, (c) known-bad domain DNS.
③ Threat Emulation + Threat Extraction — the sandbox combo
An employee receives a PDF "purchase_order.pdf" attached to an email. Two paths:
- TE only: mail held until sandbox returns verdict (~3-5 min). User waits. If clean → released. If malicious → quarantined + SOC alert.
- TE + TEX: user receives a cleaned PDF in seconds (TEX stripped macros + embedded scripts + active content). Original goes to sandbox. If malicious → SOC alert + AV signature pushed. User wasn't waiting on anything.
▶ Watch TE + TEX catch a malicious PDF
Priya at Infosys receives "invoice_april.pdf" from a vendor address. TE + TEX in MTA mode.
invoice_april.pdf (842 KB).185.x.x.x Russian C2. TE flags: MALICIOUS.Sneha enables IPS in Optimized profile but a known critical exploit signature (CVSS 9.8, Confidence High, Perf High) doesn't fire. Most likely cause?
④ Profiles + exception groups — the surgical knob
Three predefined profiles:
- Basic — most permissive. Only the bullet-proof signatures fire. Use on perf-constrained gateways or for legacy app segments.
- Optimized — balanced. The default. Severity High + Confidence High + Perf ≤ Medium → Prevent.
- Strict — most aggressive. Prevents on Medium confidence too. Expect false positives; budget SOC time.
Exception groups are reusable: define once, attach to many TP rules. Example: "SAP-Allowlist" exception group covers the 4 false-positive IPS signatures that SAP traffic always trips. Attach to the rule that protects SAP. Update once → all SAP-protected gateways inherit.
Aditya enables TE on HTTPS file downloads. CFO complains every download takes 4 minutes. What's the fix that preserves protection AND UX?
The HTTPS Inspection dependency nobody mentions
IPS, AV, AB, TE — they all need to see L7. Without HTTPS Inspection, TLS-encapsulated malware passes through invisibly. The 2024 reality: ~85% of web traffic is HTTPS. Run TP blades without HTTPS Inspection? You're inspecting 15% of the traffic. Whole point of the suite is wasted.
The CVE-2024-24919 lesson — Mobile Access blade decisions
Threat Prevention also applies inside the SSL VPN portal flow when Mobile Access is enabled. Pre-CVE-2024-24919, the right answer was "enable Mobile Access wherever users connect". Post-CVE, the right answer is: disable Mobile Access on gateways that don't need it; if you need it, lock the bypass list, run dedicated HTTPS Inspection, enable TE in MTA mode for any uploaded files, and patch within 24-72h of KEV listing. Hotfix in sk182336.
🤖 Ask the AI Tutor
Tap any question — instant context-aware answer.
Deeper questions → chat.techclick.in.
The 5 mistakes that cost L2/L3 candidates the senior role
CPU melts, SOC drowns. Always start Optimized, tune from there.
You're inspecting 15% of traffic. Plan HTTPS Inspection bypass order before enabling TP blades.
4-min user wait on every download. Use Background prevention for web; inline (MTA) for mail only.
Can't audit "what's whitelisted". Always use Exception Groups; attach to rules.
Post-CVE-2024-24919, every un-needed blade is attack surface. Disable what you don't use.
📝 Check your understanding — 10 questions, 70% to pass
Q1–Q2 above already count. Below are Q3 to Q10.
Which TP blade catches outbound C2 / DGA traffic from already-infected endpoints?
Rahul needs to deploy TP for an SMTP gateway. Mail latency of 3-5 min for sandboxing is acceptable. What's the right TE setup?
SAP traffic keeps triggering 4 specific IPS protections (all known false positives for SAP). Karthik runs 5 SAP-protected sites. What's the cleanest design?
Priya enables TE on web downloads. CFO complains every download takes 4 min. SOC says "we're catching real zero-day weekly". What's the right move?
After enabling all 5 TP blades on Optimized, gateway CPU stays at 92% during business hours. SOC reports normal alert volume. What's the FIRST triage step?
An employee's machine is infected. Outbound TLS connections every 30 min to 185.x.x.x Russian IP. Which TP blade is BEST positioned to catch this and how?
For a 5000-user enterprise after a phishing campaign, which TP architecture gives the best protection / cost / UX trade-off?
Post-CVE-2024-24919, what's the right TP hygiene policy?
Next up — Check Point HTTPS Inspection
TP doesn't see TLS without HTTPS Inspection. Next blog covers bypass order, cert pinning fixes, and the deep-dive that makes the 5 blades actually work.