Threat Prevention and Security Profiles
Threat Prevention and Security Profiles tests whether you can choose, apply, and troubleshoot the blades that inspect content after the Access Control rule accepts a connection. The exam cares about profile placement, prevention versus detection, and the encryption blind spot.
The blades and what they see
- IPS matches protections against traffic and can Prevent, Detect, or remain Inactive; prevention costs inspection cycles and can break fragile applications.
- Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction, Anti-Spam, and Zero Phishing inspect files, URLs, and behavior, often with ThreatCloud reputation.
- HTTPS Inspection is a prerequisite for inspecting encrypted sessions. Outbound inspection uses a certificate the client must trust; inbound inspection protects servers but is operationally sensitive.
- ThreatCloud supplies reputation and signature updates; stale updates are a common reason a profile looks ineffective.
Where a profile applies
- In R80 and later, Threat Prevention is a separate policy layer whose rules reference profiles and can be ordered like Access Control rules.
- A rule can use the profile's per-protection action ('According to profile') or override it for that rule.
- Exceptions should be narrow: a specific protection, destination, or service, not a whole profile disabled everywhere.
Worked example
A DMZ web server needs inbound protection but should not inspect outbound user downloads. Build a profile with IPS in Prevent for server-side protections, Anti-Bot in Prevent, Anti-Virus in Prevent, and Threat Emulation in background mode. Apply it to the Threat Prevention rule that covers inbound HTTPS to the server. Do not enable Threat Extraction for that server: it rewrites downloads for users, which is not the server's role. Enable HTTPS inspection only if the server's traffic is encrypted and you can manage the certificate and performance impact.
Traps
- Leaving every protection in Detect and expecting the dashboard to show blocked attacks.
- Applying a user-oriented profile (Threat Extraction, URL Filtering) to a server rule.
- Forgetting that encrypted traffic bypasses content blades without HTTPS inspection.
- Adding a broad exception that disables IPS for an entire network to fix one false positive.
- Installing the Access Control policy but not the Threat Prevention policy.