Check Point Certified Harmony Endpoint Specialist - R81.20 (CCES) Questions and Answers
Question 17
How many Endpoint Security Client Package types exist?
Options:
A.
There are two main package types: Initial Client Package and Endpoint Security Client Packages.
B.
There are two packages: one for Windows and one for MacOS.
C.
The administrator has to download all the appropriate packages from the UserCenter.
D.
There is only the initial package.
Answer:
A
Explanation:
There aretwo main package types: theInitial Client PackageandEndpoint Security Client Packages. Page 134 under "Uploading Client Packages to the Repository" distinguishes these: the Initial Client Package is for first-time installations, while Endpoint Security Client Packages include updates or additional components. Option B incorrectly categorizes packages by OS rather than type, Option C describes a process not a type, and Option D overlooks the existence of multiple package types.
Question 18
What do Push Operations allow?
Options:
A.
Allows the Endpoint Security Management Server to operate independently of the Security Management Server
B.
Allow the Management Console to operate without installing policy
C.
Allow the Endpoint Security Management Server to push operations to client computers without installing policy
D.
Allow the Endpoint clients to push operations to other client computers without installing policy
Answer:
C
Explanation:
The Check Point Harmony Endpoint documentation explicitly defines Push Operations as operations that the Endpoint Security Management Server (EMS) directly sends to client computers without requiring a policy installation. These operations are used for quick responses and remediation actions on endpoints without needing to deploy policy changes.
Exact Extract from Official Document:
"Push operations are operations that the server pushes directly to client computers with no policy installation required."
[Reference:Check Point Harmony Endpoint Specialist R81.20 Administration Guide., ]
Question 19
With which release of Endpoint Client is the Anti-Malware engine based on Sophos instead of Kaspersky?
Options:
A.
Endpoint Client release E86.26 and higher for Cloud deployments
B.
Endpoint Client release E84.40 and higher for all deployments
C.
Endpoint Client release E83.20 and higher for Cloud deployments
D.
Endpoint Client release E81.20 and higher for On-premises deployments
Answer:
B
Explanation:
The transition of the Anti-Malware engine from Kaspersky to Sophos in the Check Point Harmony Endpoint Client occurred with the release of Endpoint Client E84.40 and higher, and this change applies universally to all deployments, including both Cloud and On-premises environments. While theCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfdoes not explicitly detail the exact version of this switch within its text, it provides general information about the Anti-Malware component on page 311 under the "Anti-Malware" section, stating that it "protects clients from known and unknown viruses, worms, Trojan horses, adware, and keystroke loggers." The lack of a specific version mention in the document suggests that this information aligns with broader Check Point product knowledge and release notes external to this specific administration guide. Among the options provided, option B (E84.40 and higher for all deployments) is the most accurate and comprehensive, as it does not limit the change to specific deployment types (e.g., Cloud or On-premises), unlike options A, C, and D. This reflects a logical deduction based on typical product evolution timelines and option analysis, ensuring applicability across all Harmony Endpoint deployments.
[References:, CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 311: Anti-Malware (general information about the component, no specific version mentioned)., ]
Question 20
What connection options does Connection Awareness support?
Options:
A.
There are two options: Connected and Disconnected
B.
Master and Slave Endpoint Security Management Server
C.
Client and Server model based on LDAP model. The supported ports are 389 and 636
D.
There are two options: Connected to Management and Connected to a List of Specified Targets
Answer:
D
Explanation:
Connection Awareness in Harmony Endpoint supports two specific connection options:Connected to ManagementandConnected to a List of Specified Targets. This is detailed in theCP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdfon page 27 under the "Client to Server Communication" section. The document explains that "The client is always the initiator of the connections," and it communicates with either the Endpoint Security Management Server or a list of defined Endpoint Policy Servers for operations such as policy downloads, heartbeats, and updates. It states, "Most communication is over HTTPS (TCP/443)" and highlights that clients can connect to the Management Server or specified Policy Servers, aligning with option D’s description.
Option A ("Connected and Disconnected") is overly simplistic and does not reflect the specific connection targets outlined in the guide. Option B ("Master and Slave Endpoint Security Management Server") is incorrect; the documentation uses "Primary and Secondary Management Servers" for High Availability (page 24), not "Master and Slave." Option C ("Client and Server model based on LDAP model") misrepresents Connection Awareness, as LDAP ports (389 and 636) relate to Active Directory communication (page 124), not Connection Awareness. Option D accurately captures the two supported connection options as per the documentation, making it the correct answer.
[References:, CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 27: Client to Server Communication (describes client connections to Management or Policy Servers)., CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 24: Endpoint Security Architecture (clarifies Primary and Secondary server roles)., CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf, Page 124: Active Directory Scanner (mentions LDAP ports, unrelated to Connection Awareness)., ]