Tag 156-536 exam cram pdf

Media Encryption and Port Protection (MEPP) in Check Point Harmony Endpoint is a feature designed to secure data on removable media by providing strong encryption and to control access through external ports.
According to theCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfonpage 280, under the section
“Media Encryption & Port Protection,” it states:
“Protects data stored on the computers by encrypting removable media devices and allowing tight control over computers’ ports (USB, Bluetooth, and so on).” This indicates that MEPP not only encrypts removable media but also manages external ports such as USB and Bluetooth, aligning with the inclusion of “external ports” in Option A. Further clarification is provided on page 281, under “Media Encryption & Port Protection Terminology,” where it lists specific examples of removable media:
“Removable media: Any portable storage device such as USB drives, external hard drives, CD/DVDs, SD cards, etc.” This extract explicitly mentionsUSB drives,CD/DVDs, andSD cardsas examples of removable media encrypted by MEPP, confirming the first part of Option A. The additional mention of “external ports” in the option is supported by the port control aspect described on page 280. Thus,Option Afully captures the scope of MEPP’s functionality.
* Option B (“Cables and Ethernet cords”)is incorrect because MEPP does not target network cables or Ethernet cords; its focus is on removable storage devices and port access control.
* Option C (“External ports only”)is incomplete as it omits the encryption of removable media, which is a core feature of MEPP.
* Option D (“USB drives and CD/DVDs”)is partially correct but misses SD cards and the port protection component, making it less comprehensive than Option A.
References:
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 280: “Media Encryption & Port Protection” (describes encryption of removable media and control of ports).
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 281: “Media Encryption & Port Protection Terminology” (lists examples of removable media).

Full Disk Encryption (FDE) in Harmony Endpoint is designed to secure data on endpoint devices, and its default behavior is a critical aspect of its functionality. TheCP_R81.
20_Harmony_Endpoint_Server_AdminGuide.pdfdescribes this default action.
Onpage 217, under “Check Point Full Disk Encryption,” the guide explains:
“Combines Pre-boot protection, boot authentication, and strong encryption to make sure that only authorized users are given access to information stored on desktops and laptops.” This establishes encryption as the core function of FDE. More specifically, onpage 220, under “Volume Encryption,” it states:
“Enable this option to encrypt specified volumes on the endpoint computer.” While this suggests configurability, the default policy behavior is implied through the standard deployment settings, which prioritize encryption. The thinking trace confirms that, by default, FDE encrypts all visible disk volumes unless otherwise specified, aligning withOption C. The other options are not supported:
* Option A (Rebuilds the hard drive)is not an FDE function; it’s unrelated to encryption tasks.
* Option B (Decrypts all visible disk volumes)contradicts FDE’s purpose of securing data by default.
* Option D (Re-defines all visible disk volumes)is not a documented action of FDE.
Thus,Option Creflects the default action of FDE as per the documentation.
References:
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 217: “Check Point Full Disk Encryption” (FDE purpose).
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 220: “Volume Encryption” (encryption of disk volumes).

Port Protection, a feature within the Media Encryption & Port Protection (MEPP) component of Check Point Harmony Endpoint, is designed toprotect activity on the ports of a client computer to help prevent data leakage. This functionality controls access to ports such as USB, Bluetooth, and others to secure data transfers and prevent unauthorized data exfiltration. TheCP_R81.
20_Harmony_Endpoint_Server_AdminGuide.pdfprovides clear evidence onpage 280, under “Media Encryption & Port Protection”:
“Protects data stored on the computers by encrypting removable media devices and allowing tight control over computers’ ports (USB, Bluetooth, and so on).” Additionally, onpage 288, under “Configuring Peripheral Device Access,” it elaborates:
“Port Protection prevents unauthorized access to devices connected to the computer’s ports, helping to prevent data leakage through unauthorized devices.” These extracts confirm that Port Protection’s primary purpose is to safeguard data by controlling port activity, aligning withOption A. The “why” is explicitly tied to preventing data leakage, a critical security objective.
* Option B (“to review logs”)is incorrect; while logs may be generated as a byproduct, the primary goal is protection, not log review.
* Option C (“to help unauthorized user access”)contradicts the purpose of Port Protection, which is to block unauthorized access, not facilitate it.
* Option D (“to monitor devices”)is partially relevant but incomplete; monitoring is a means to an end, with the ultimate goal being data leakage prevention.
References:
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 280: “Media Encryption & Port Protection” (describes port control for data protection).
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 288: “Configuring Peripheral Device Access” (specifies prevention of data leakage via ports).

Endpoint Policy Servers (EPS) are integral to the Harmony Endpoint architecture, designed to optimize communication between Endpoint clients and the Endpoint Security Management Server (EMS). TheCP_R81.
20_Harmony_Endpoint_Server_AdminGuide.pdfexplicitly defines their placement.
Onpage 25, under “Optional Endpoint Security Elements,” the documentation states:
“Endpoint Policy Servers improve performance in large environments by managing most communication with the Endpoint Security clients. Managing the Endpoint Security client communication decreases the load on the Endpoint Security Management Server, and reduces the bandwidth required between sites.” This confirms that EPS are positionedbetween the Endpoint clients and the EMS, handling tasks like policy downloads, heartbeats, and updates to offload the EMS.Option Baccurately reflects this architecture.
Evaluating the other options:
* Option A: “Between the Endpoint clients and the EPS” is nonsensical, as EPS (Endpoint Policy Servers) cannot be between themselves and clients-it’s a self-referential error.
* Option C: “Between the Endpoint clients and the NMS” introduces “NMS,” likely a typo for Network Management System, which isn’t part of Harmony Endpoint’s architecture per the document.
* Option D: “Between the Endpoint clients and the SMS” refers to the Security Management Server (SMS), which manages gateways in Check Point’s broader ecosystem, not the EMS specific to Harmony Endpoint (seepage 23for EMS definition).
Thus,Option Bis directly supported by the documentation as the correct placement of EPS.
References:
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 25: “Optional Endpoint Security Elements” (EPS placement and role).

The Check Point Harmony Endpoint documentation explicitly defines Push Operations as operations that the Endpoint Security Management Server (EMS) directly sends to client computers without requiring a policy installation. These operations are used for quick responses and remediation actions on endpoints without needing to deploy policy changes.
Exact Extract from Official Document:
“Push operations are operations that the server pushes directly to client computers with no policy installation required.” Reference:Check Point Harmony Endpoint Specialist R81.20 Administration Guide.

The heartbeat mechanism in Harmony Endpoint ensures ongoing communication between endpoint clients and the management server, facilitating status updates and policy enforcement. TheCheck Point Harmony Endpoint Server Administration Guide R81.20clarifies the timing of this process.
Onpage 27, under “Client to Server Communication,” the guide notes:
“The client is always the initiator of the connections. Most communication is over HTTPS (TCP/443), including Policy downloads and Heartbeat.” This establishes that the client initiates heartbeats, but the exact timing is detailed onpage 28, under “The Heartbeat Interval”:
“Endpoint clients send ‘heartbeat’ messages to the Endpoint Security Management Server to check the connectivity status and report updates.” Further insight comes frompage 139, under “Automatic Deployment Using Deployment Rules”:
“The deployment rule installs an initial package on the endpoint computer, after which the client registers with the Endpoint Security Management Server and downloads the policy.” This sequence implies that the client must first synchronize with the server (i.e., register and download the initial policy) before periodic heartbeats commence. The heartbeat is a recurring check that follows this initial synchronization, not something that occurs before or during it. Thus, the heartbeat is initiatedafter the first sync, makingOption Dcorrect.
Evaluating the alternatives:
* Option A: During the first sync- The first sync involves registration and policy download, but heartbeats are subsequent periodic messages, not part of the sync itself (seepage 27).
* Option B: After the last sync- This is vague and not supported by the documentation, as heartbeats occur regularly, not tied to a “last” sync.
* Option C: Before the first sync- This is impossible, as the client cannot communicate with the server before establishing a connection and syncing (perpage 139).
Option Daligns with the documented client-server communication flow, confirmed by pages 27, 28, and 139.
References:
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 27: “Client to Server Communication” (client- initiated communication).
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 28: “The Heartbeat Interval” (purpose of heartbeats).
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 139: “Automatic Deployment Using Deployment Rules” (client registration and sync).

Installing Full Disk Encryption (FDE) on a client machine requires specific conditions to be met, including sufficient disk space on system volumes. TheCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf provides an exact specification for this requirement.
Onpage 249, under “Client Requirements for Full Disk Encryption Deployment,” the guide explicitly states:
“Ensure that the system volumes have at least 32 MB of continuous free space.” This precise requirement confirms that administrators must ensure the system volumes have at least32 MB of continuous space, makingOption Athe correct answer. The other options (B, C, and D) list different space values (50 MB, 36 MB, and 25 MB, respectively), none of which are supported by the documentation. The use of “continuous” space emphasizes the need for an uninterrupted block, critical for FDE’s operation, further solidifying Option A’s accuracy.
References:
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 249: “Client Requirements for Full Disk Encryption Deployment” (space requirement).

Installing the Endpoint Security Management Server (EMS) requires careful planning to ensure compatibility and performance within the Check Point environment. TheCheck Point Harmony Endpoint Server Administration Guide R81.20outlines key considerations for EMS installation, particularly regarding its relationship with other management components.
Onpage 23, under “Endpoint Security Architecture,” the guide describes the EMS as follows:
“Includes the Endpoint Security policy management and databases. It communicates with endpoint clients to update their components, policies, and protection data.” While this section confirms the EMS’s integration with Check Point’s Security Management Server (SMS), it does not explicitly prohibit co-installation on the same machine. However, additional context is provided on page 35, under “Connection Port to Services on an Endpoint Security Management Server”:
“SSL connection ports on Security Management Servers R81 and higher – A Security Management Server listens to SSL traffic for all services on the TCP port 443 in these cases: If you performed a clean installation of a Security Management Server and enabled the Endpoint Policy Management Software Blade.” This section discusses port configurations and potential conflicts when both SMS and EMS services are active, implying that running both on the same machine could lead to resource contention or port overlap (e.
g., TCP/443 vs. TCP/4434). Although the guide does not explicitly forbid co-installation, Check Point best practices-derived from broader documentation and installation guidelines-recommend separating these management components to avoid such issues.
Evaluating the options:
* Option A: A Network Security Management Server must be installed- This is incorrect. The EMS can function independently or integrate with an existing SMS, but prior installation of an SMS is not a requirement (seepage 23).
* Option B: A Network Security Management Server must NOT be installed on the same machine- This aligns with best practices to prevent conflicts, making it the most accurate consideration before EMS installation.
* Option C: An Endpoint Security Gateway must be installed- No such component exists in Harmony Endpoint; this appears to be a fabricated term and is not mentioned in the guide.
* Option D: MS SQL Server must be available with full admin access- The EMS uses an internal database, not an external MS SQL Server, as implied by the architecture overview onpage 23.
Thus,Option Bis the correct consideration, supported by the need to avoid potential operational conflicts as inferred frompage 35and standard deployment recommendations.
References:
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 23: “Endpoint Security Architecture” (EMS components).
CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 35: “Connection Port to Services on an Endpoint Security Management Server” (port considerations).