156-585: Check Point Certified Troubleshooting ExpertDemo

By Checkpoint · Question Mode

QuestionQ8

Advanced Troubleshooting Techniques

What actions can you take to prevent IPS false positives?

  • A Exclude problematic services from being protected by IPS (sip, H.323, etc.)
  • B Use IPS only in Detect mode
  • C Use Recommended IPS profile
  • D Capture packets, Update the IPS database, and Back up custom IPS files
Explanation

Packet captures allow IPS events to be validated and tuned against the actual traffic. Keeping the IPS database current incorporates updated detection content, and backing up custom IPS files preserves local tuning intended to avoid recurring false-positive behavior.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!