Exam 156-590 Topic 2 Question 74 Discussion

According to the official Check Point SmartConsole Admin Documentation, the Follow Protections tool allows you to monitor and handle specific IPS signatures by adding a "Follow Up" flag to them.
• The Practical Function: When you activate this feature for updates, it automatically marks newly downloaded or updated protections with a visual flag. This acts as a working task list for administrators, allowing them time to manually evaluate, test, or fine-tune new signatures before they fully enforce them across their environments
Option A — "Automatically activates new protections based on profile" — is incorrect because that describes what the assigned Threat Prevention profile does, not what "Follow Protections" does.

Here's the distinction:

Activation of new protections is governed by the profile settings (Severity, Confidence Level, Performance Impact thresholds) assigned to a rule. When a new protection is downloaded, whether it's turned on automatically is decided by whether it matches the active/inactive criteria already configured in that profile (e.g., the Optimized profile auto-activates protections meeting certain Severity/Performance thresholds). That activation logic belongs to the profile, not to "Follow Protections."
"Follow Protections" is a separate, distinct mechanism: it simply marks/flags newly downloaded or updated protections so an administrator can go find and review them — it's a review/tracking aid, not an activation engine. This is explicitly what your internal lab doc describes:"To be able to tell which protection were updated, they are marked by default. Review the settings under 'Follow Protections.'"

So A conflates two different things that Check Point treats separately — profile-driven auto-activation vs. Follow Protections' flag-for-review function. Since the question specifically asks what the Follow Protections feature does, A describes the wrong mechanism, and B is the one that matches its actual documented purpose.