Does Threat-Prevention exception inherit DNS-Trap property of profiles

[robin_van_royen]

Hello,

The title of this post already expresses my question pretty well.
I have a situation where I must maintain visiblity for the "Reputation Domains" protection of a few specific servers, without it triggering the Malware DNS-Trap for those specific servers only.

I have possible solutions in mind such as creating a copy of the profile, disabling DNS-trap on it, and putting the servers only under this new profile. But those feel like sloppy solutions with too much ugly configuration to be justified.

Which brings me to my question, If I were to create an exception bound to this profile with the action detect. Will the DNS trap still be triggered as it would use the parameters of the profile?
One step further, if I were to include it in a global exception, would it also inherit the action? Because the global exception sort-off appends an exception but to every existing profile, I'd expect the same behaviour as with an exception to a profile specifically.

Thanks in advance for your input.

Running R80.40 on Quantum 15400 appliances

[PhoneBoy · Accepted solution]

As far as I know, exceptions for this specific protection should work.
That said, we do log as detect even when it's preventing prior to R81.
See: https://community.checkpoint.com/t5/Threat-Prevention/Threat-Prevention-is-Not-Block-DNS-Reputation-... 

[robin_van_royen]

Thank you very much for the feedback.

I have tried the detect rule, and it works like a charm. Now resulting in "action: exception". Also good to know that this categorization as detect is changed for R81.