Pass the Checkpoint CCES 156-536 Questions and answers with CertsForce

In Harmony Endpoint, permissions define access levels for administrators and users across the organizational structure. TheCheck Point Harmony Endpoint Server Administration Guide R81.20explains how these permissions can be applied, particularly at the organizational level.

Onpage 132, under "Endpoint Security Administrator Roles," the guide describes roles like Super Admin:

"Full control over all aspects of the system,"

This suggests a scope that encompasses the entire organization. More specifically, onpage 166, under "Defining Endpoint Security Policies," it states:

"You create and assign policies to the root node of the organizational tree as a property of each Endpoint Security component."

This indicates that permissions and policies can be set at the top level of the organizational hierarchy—the "root node"—applying uniformly to all entities beneath it. The term "organization-wide" best captures this concept, as it reflects a consistent access level across the entire organization, aligning withOption A.

Analyzing the other options:

Option B: Regional user permission settings– The guide does not define a "regional" scope; permissions are typically organizational or role-based, not geographically segmented (seepage 132).

Option C: Universal user permission settings– "Universal" is not a term used in the documentation and is too ambiguous to apply here.

Option D: Global user permission settings– While "global" might suggest broad scope, the guide consistently uses "organization" or "root node" to denote the highest level, making "organization-wide" more precise (perpage 166).

Option Ais directly supported by the guide’s terminology and policy assignment structure, particularly the reference to the "root node" onpage 166.

Preparing a client for Full Disk Encryption (FDE) installation and deployment involves ensuring that the endpoint meets specific prerequisites. TheCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfexplicitly outlines these requirements.

Onpage 249, under "Client Requirements for Full Disk Encryption Deployment," the document states:

"Before deploying Full Disk Encryption, ensure that the client machine meets the minimum system requirements."

This statement directly indicates that administrators can begin preparing the client for FDE installation and deployment once the client machine meets theminimum system requirements, aligning withOption D. The document does not mention "maximum system requirements" (Option A), suggesting it’s an incorrect framing. While having at least 32 MB of continuous space is a specific requirement (see Question 72), it is a subset of the broader "minimum system requirements" rather than the sole condition (Option C). Additionally, policy installation (Option B) occurs after preparation, as detailed onpage 250under "Completing Full Disk Encryption Deployment on a Client," which describes stages like policy application post-preparation.

Thus,Option Dis the most accurate and comprehensive answer based on the official documentation.

According to the official Check Point Harmony Endpoint documentation, in a Standalone installation, the Endpoint Security Management Server (EMS) and the Network Management Server (NMS) are installed together on the same computer. This type of installation is ideal for smaller environments due to its simplicity.

Exact Extract from Official Document:

"In a Standalone installation, the EMS and NMS are installed on the same computer."

External Endpoint Policy Servers (EPS) are optional components in Harmony Endpoint’s architecture, designed to enhance scalability and performance by offloading client communication tasks from the Endpoint Security Management Server (EMS). TheCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfexplicitly outlines their benefits.

Onpage 25, under "Optional Endpoint Security Elements," the guide states:

"The Endpoint Policy Server handles heartbeat and synchronization requests, Policy downloads, Anti-Malware updates, and Endpoint Security client logs."

This extract confirms that a primary benefit of the EPS is managingheartbeat and synchronization requests. Heartbeat requests are periodic signals from clients to report status and connectivity, while synchronization ensures clients remain aligned with server policies and updates. By handling these, the EPS reduces the load on the EMS and optimizes bandwidth, directly supportingOption B.

Let’s assess the other options:

Option A: Cluster and Delta requests– "Cluster" is unrelated to EPS functionality (it may pertain to HA), and "Delta requests" is not a defined term in the guide.

Option C: Test packet and delta requests– "Test packet" is not mentioned in the documentation, and "delta requests" lacks context, making this incorrect.

Option D: Polling beat and delta requests– "Polling beat" is not a recognized term (likely a misnomer for heartbeat), and "delta requests" is unsupported by the text.

Option Bis the only choice directly supported by the documentation, accurately reflecting the EPS’s role in improving communication efficiency.

Harmony Endpoint provides Endpoint Security Client packages forWindows, macOS, and Linux operating systems. This is explicitly documented in theCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf. Onpage 19, under the section "Endpoint Security Client," it states: "The Endpoint Security client is available on Windows and Mac." This confirms support for Windows and macOS. Further clarification is provided onpage 51, under "Supported Operating Systems for the Endpoint Client," which lists "macOS" and "Linux" as supported platforms, alongside detailed support for Microsoft Windows onpage 49. Together, these references confirm that the client packages are offered for Windows, macOS, and Linux.

Option A ("Unix, WinLinux and macOS")is incorrect because "WinLinux" is not a recognized operating system, and Unix is not listed as a supported client OS in the documentation.

Option C ("macOS, iPadOS and Windows")is incorrect as iPadOS, an OS for mobile devices, is not mentioned as a supported platform for the Endpoint Security Client.

Option D ("Windows, AppleOS and Unix operating systems")is incorrect because "AppleOS" is not a standard term (the correct term is macOS), and Unix is not supported as a client OS.

Thus,Option Bis the only fully accurate choice based on the official documentation.

The Kerberos keytab file is essential for Kerberos authentication, particularly in Harmony Endpoint’s integration with Active Directory (AD). While theCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfdoes not provide a standalone definition of the keytab file’s contents, its usage in AD authentication aligns with standard Kerberos principles, which are widely documented and implemented by Check Point.

A Kerberos keytab file containspairs of Kerberos principals and their associated encryption keys. A principal is an identity (e.g., a user or service) in the Kerberos system, and the encryption key is used to authenticate that principal without requiring interactive password entry. This is crucial for automated authentication in Harmony Endpoint’s AD integration.

The guide references Kerberos in the context of AD authentication onpage 208, under "Active Directory Authentication," where it discusses secure authentication mechanisms, though it doesn’t explicitly detail the keytab file’s structure. However, standard Kerberos functionality (as per Check Point’s broader documentation and industry norms) confirms that keytabs storeKerberos principals and encryption keys, makingOption Ccorrect.

Evaluating the alternatives:

Option A: Pairs of authentication settings and un-authentication settings– This is vague and not a recognized Kerberos concept; keytabs deal with credentials, not abstract settings.

Option B: Pairs of encryption and decryption keys– While keytabs involve encryption keys, they are tied to principals, not paired as encryption/decryption sets independently. This option is incomplete.

Option D: Pairs of ktpass tools– This is incorrect; ktpass is a Windows command-line tool used to generate keytab files, not a component stored within them.

Option Cis the precise and correct description of a Kerberos keytab file’s contents, consistent with its role in Harmony Endpoint’s authentication framework.

Harmony Endpoint’s Next-Generation Anti-Virus (NGAV) is designed to combat advanced threats using a combination of behavioral analysis, exploit prevention, and ransomware protection. The documentation specifies that NGAV includesAnti-Ransomware,Anti-Exploit, andBehavioral Guardas core capabilities.

TheCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfoutlines these onpage 20, under "Endpoint Security Client":

"Harmony Endpoint Anti-Ransomware, Behavioral Guard and Forensics: Prevents ransomware attacks. Monitors files and the registry for suspicious processes and network activity. Analyzes incidents reported by other components."

Additionally, onpage 358, under "Harmony Endpoint Threat Extraction, Emulation and Anti-Exploit":

"Anti-Exploit: Detects and prevents exploitation of vulnerabilities in software."

While the term "NGAV" is not explicitly used, these components—Anti-Ransomware, Behavioral Guard, and Anti-Exploit—represent the next-generation approach to antivirus protection, focusing on behavior-based detection and prevention of advanced threats like exploits and ransomware. This matchesOption A.

The other options are incorrect:

Option B ("Anti-IPS, Anti-Firewall & Anti-Guard"): These are not recognized capabilities in the documentation; they appear to be fabricated terms.

Option C ("Zero-Phishing, Anti-Bot & Anti-Virus"): Zero-Phishing (page 366) and Anti-Bot (page 353) are separate features, and Anti-Virus is traditional, not NGAV-specific.

Option D ("Threat Extraction, Threat-Emulation & Zero-Phishing"): These relate to document sanitization and phishing protection (pages 358-366), not NGAV’s core focus.

Thus,Option Aaccurately reflects Harmony Endpoint NGAV capabilities.

As detailed in the official Check Point Harmony Endpoint documentation, the Push Operation Wizard supports various push operations categorized specifically into Anti-Malware, Forensics and Remediation, and Agent Settings. These operations allow administrators to remotely manage security actions such as malware scans, forensic data collection, remediation tasks, and settings related to endpoint agents.

Exact Extract from Official Document:

"Push operations supported include Anti-Malware, Forensics and Remediation, and Agent Settings."

The Remote Help tool in Check Point Harmony Endpoint assists users with password recovery for specific scenarios, namely Full Disk Encryption (FDE) and Media Encryption & Port Protection (MEPP). TheCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfonpage 425, under "Remote Help," provides a clear description:

"There are two types of Full Disk Encryption Remote Help:

One Time Login - One Time Login lets users access Remote Help using an assumed identity for one session, without resetting the password. Users who lose their Smart Cards must use this option.

Remote password change - This option is applicable for users with fixed passwords who are locked out.For USB storage devices protected by Media Encryption & Port Protection policies, only remote password change is available."

This extract confirms that Remote Help offersUser Logon Pre-boot Remote Help(for FDE, covering one-time login and password changes) andMedia Encryption Remote Help(for MEPP, limited to password changes), precisely matchingOption B.

Option Ais incorrect because Remote Help is an active assistance tool, not merely a source of procedural information or FAQs (see page 425).

Option Cis inaccurate; providing links to encrypted files or decryption keys would compromise security and is not mentioned in the documentation.

Option Dis wrong as Remote Help assists end-users with their own access, not admin accounts on SmartEndpoint (see page 425).

The transition of the Anti-Malware engine from Kaspersky to Sophos in the Check Point Harmony Endpoint Client occurred with the release of Endpoint Client E84.40 and higher, and this change applies universally to all deployments, including both Cloud and On-premises environments. While theCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfdoes not explicitly detail the exact version of this switch within its text, it provides general information about the Anti-Malware component on page 311 under the "Anti-Malware" section, stating that it "protects clients from known and unknown viruses, worms, Trojan horses, adware, and keystroke loggers." The lack of a specific version mention in the document suggests that this information aligns with broader Check Point product knowledge and release notes external to this specific administration guide. Among the options provided, option B (E84.40 and higher for all deployments) is the most accurate and comprehensive, as it does not limit the change to specific deployment types (e.g., Cloud or On-premises), unlike options A, C, and D. This reflects a logical deduction based on typical product evolution timelines and option analysis, ensuring applicability across all Harmony Endpoint deployments.