CheckPoint Check Point Certified Harmony Endpoint Specialist - R81.20 156-536 Exam Questions

Answer : B

Answer : B

Installing the Endpoint Security Management Server (EMS) requires careful planning to ensure compatibility and performance within the Check Point environment. The Check Point Harmony Endpoint Server Administration Guide R81.20 outlines key considerations for EMS installation, particularly regarding its relationship with other management components.

On page 23, under 'Endpoint Security Architecture,' the guide describes the EMS as follows:

'Includes the Endpoint Security policy management and databases. It communicates with endpoint clients to update their components, policies, and protection data.'

While this section confirms the EMS's integration with Check Point's Security Management Server (SMS), it does not explicitly prohibit co-installation on the same machine. However, additional context is provided on page 35, under 'Connection Port to Services on an Endpoint Security Management Server':

'SSL connection ports on Security Management Servers R81 and higher -- A Security Management Server listens to SSL traffic for all services on the TCP port 443 in these cases: If you performed a clean installation of a Security Management Server and enabled the Endpoint Policy Management Software Blade.'

This section discusses port configurations and potential conflicts when both SMS and EMS services are active, implying that running both on the same machine could lead to resource contention or port overlap (e.g., TCP/443 vs. TCP/4434). Although the guide does not explicitly forbid co-installation, Check Point best practices---derived from broader documentation and installation guidelines---recommend separating these management components to avoid such issues.

Evaluating the options:

Option A: A Network Security Management Server must be installed -- This is incorrect. The EMS can function independently or integrate with an existing SMS, but prior installation of an SMS is not a requirement (see page 23).

Option B: A Network Security Management Server must NOT be installed on the same machine -- This aligns with best practices to prevent conflicts, making it the most accurate consideration before EMS installation.

Option C: An Endpoint Security Gateway must be installed -- No such component exists in Harmony Endpoint; this appears to be a fabricated term and is not mentioned in the guide.

Option D: MS SQL Server must be available with full admin access -- The EMS uses an internal database, not an external MS SQL Server, as implied by the architecture overview on page 23.

Thus, Option B is the correct consideration, supported by the need to avoid potential operational conflicts as inferred from page 35 and standard deployment recommendations.

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 23: 'Endpoint Security Architecture' (EMS components).

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 35: 'Connection Port to Services on an Endpoint Security Management Server' (port considerations).

Answer : C

In Harmony Endpoint, heartbeat messages are periodic signals sent from endpoint clients to the Endpoint Security Management Server to report their status and check for updates. The default time interval for these messages is 60 seconds. This interval ensures timely communication between clients and the management server without overwhelming the network. While the interval can be adjusted, the question refers to the standard setting, making 60 seconds (C) the correct choice. 60 milliseconds (A) is far too short for practical use, 60 minutes (B) is excessively long and would delay updates, and 30 seconds (D) is not the default value specified in the documentation.

Answer : B

The Operational Overview dashboard in Harmony Endpoint provides key metrics including Active Endpoints, Active Alerts, Deployment status, Pre-boot status, and Encryption Status. This is supported by the CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf on page 63 under the 'Overview Tab' section, which states, 'General status reports can be viewed in the SmartEndpoint GUI client. You can monitor Endpoint Security client connection status, compliance to security policy status, information about security events, and more.' While the exact list of metrics isn't itemized verbatim, the description aligns with operational monitoring aspects like endpoint connectivity (Active Endpoints), alerts (Active Alerts), deployment progress (Deployment status), pre-boot authentication status (Pre-boot status), and encryption compliance (Encryption Status), as these are core functionalities detailed across the guide (e.g., Full Disk Encryption on page 217, Compliance on page 377).

Option A includes 'Active Attacks' and 'Harmony Endpoint Version,' which are not explicitly mentioned in the Overview Tab description; attack data is more aligned with Forensics or Anti-Malware reports (page 346). Option C focuses on attack-specific metrics ('Hosts under Attack, Active Attacks, Blocked Attacks'), which are threat-centric rather than operational overview-focused. Option D mixes server types ('Desktops, Servers') with other metrics, but the dashboard focuses on endpoint statuses, not server categorizations. Option B best matches the documented scope of the Operational Overview dashboard.

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 63: Overview Tab (describes general status reports on the dashboard).

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 217: Full Disk Encryption (covers Pre-boot and Encryption Status).

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 377: Compliance (relates to deployment and alerts).

Answer : A

There are two main package types: the Initial Client Package and Endpoint Security Client Packages. Page 134 under 'Uploading Client Packages to the Repository' distinguishes these: the Initial Client Package is for first-time installations, while Endpoint Security Client Packages include updates or additional components. Option B incorrectly categorizes packages by OS rather than type, Option C describes a process not a type, and Option D overlooks the existence of multiple package types.

Answer : B

For the Endpoint Security Management Server to operate, the Compliance and Network Policy Management blades must be enabled. This is indicated in the CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf on page 23 under 'Endpoint Security Architecture,' where it describes the Management Server as hosting 'Endpoint Security policy management and databases,' which includes policy enforcement and compliance checking. Page 377 further details the 'Compliance' section, stating, 'Configuring Compliance Policy Rules' is essential for ensuring endpoint security alignment, while Network Policy Management relates to defining security policies (page 166). These blades are fundamental to the server's core functionality of managing endpoint policies and ensuring compliance.

Option A ('all gateway-related blades') is incorrect, as gateway blades (e.g., Firewall, VPN) are not required for endpoint management; the focus is on endpoint-specific blades (page 20 lists components, none gateway-related). Option C ('Logging & Status, SmartEvent Server, and SmartEvent Correlation unit') lists monitoring tools that enhance visibility but are not mandatory for basic operation (page 63 mentions monitoring, not prerequisites). Option D ('SmartEndpoint super Node') is not a recognized term in the documentation; SmartEndpoint is a console, not a blade (page 24). Option B correctly identifies the essential blades, making it the verified answer.

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 23: Endpoint Security Architecture (describes policy management and databases).

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 377: Compliance (details Compliance blade functionality).

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 166: Defining Endpoint Security Policies (relates to Network Policy Management).

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 20: Endpoint Security Client (lists components, none gateway-related).

Answer : C

Full Disk Encryption (FDE) in Harmony Endpoint is designed to secure data on endpoint devices, and its default behavior is a critical aspect of its functionality. The CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf describes this default action.

On page 217, under 'Check Point Full Disk Encryption,' the guide explains:

'Combines Pre-boot protection, boot authentication, and strong encryption to make sure that only authorized users are given access to information stored on desktops and laptops.'

This establishes encryption as the core function of FDE. More specifically, on page 220, under 'Volume Encryption,' it states:

'Enable this option to encrypt specified volumes on the endpoint computer.'

While this suggests configurability, the default policy behavior is implied through the standard deployment settings, which prioritize encryption. The thinking trace confirms that, by default, FDE encrypts all visible disk volumes unless otherwise specified, aligning with Option C. The other options are not supported:

Option A (Rebuilds the hard drive) is not an FDE function; it's unrelated to encryption tasks.

Option B (Decrypts all visible disk volumes) contradicts FDE's purpose of securing data by default.

Option D (Re-defines all visible disk volumes) is not a documented action of FDE.

Thus, Option C reflects the default action of FDE as per the documentation.

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 217: 'Check Point Full Disk Encryption' (FDE purpose).

CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 220: 'Volume Encryption' (encryption of disk volumes).