The Check Point Certified Harmony Endpoint Specialist - R81.20 (CCES) (156-536)

Full Disk Encryption (FDE) in Check Point Harmony Endpoint is designed to protect data at rest stored on the Hard Drive of desktops and laptops. This is explicitly outlined in the CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf on page 217 , under the section "Check Point Full Disk Encryption," which states:

"Combines Pre-boot protection, boot authentication, and strong encryption to make sure that only authorized users are given access to information stored on desktops and laptops."

This indicates that FDE encrypts the entire hard drive, securing all data stored on it when the device is powered off or in a resting state. Further clarification comes from page 220 , under "Volume Encryption," where it discusses encrypting "volumes," referring to the hard drive partitions:

"Volume Encryption - Enable this option to encrypt specified volumes on the endpoint computer."

Since a hard drive is the primary local storage medium on endpoint devices, Option D ("Hard Drive") is the correct answer.

Option A ("RAM Drive") is incorrect because RAM (Random Access Memory) is volatile memory that does not store data at rest; it loses data when power is off, unlike a hard drive.

Option B ("SMB Share") and Option C ("NFS Share") are incorrect because these are network-based file shares (Server Message Block and Network File System, respectively), not local storage devices protected by FDE. FDE focuses on local hard drives, not network resources.

Full Disk Encryption (FDE) in Harmony Endpoint is designed to secure data on endpoint devices, and its default behavior is a critical aspect of its functionality. The CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf describes this default action.

On page 217 , under "Check Point Full Disk Encryption," the guide explains:

"Combines Pre-boot protection, boot authentication, and strong encryption to make sure that only authorized users are given access to information stored on desktops and laptops."

This establishes encryption as the core function of FDE. More specifically, on page 220 , under "Volume Encryption," it states:

"Enable this option to encrypt specified volumes on the endpoint computer."

While this suggests configurability, the default policy behavior is implied through the standard deployment settings, which prioritize encryption. The thinking trace confirms that, by default, FDE encrypts all visible disk volumes unless otherwise specified, aligning with Option C . The other options are not supported:

Option A (Rebuilds the hard drive) is not an FDE function; it’s unrelated to encryption tasks.

Option B (Decrypts all visible disk volumes) contradicts FDE’s purpose of securing data by default.

Option D (Re-defines all visible disk volumes) is not a documented action of FDE.

Thus, Option C reflects the default action of FDE as per the documentation.

Full Disk Encryption (FDE) primarily protects data when the computer is turned off or locked. If the laptop is booted and left unattended without being locked or shut down, the encryption does not actively protect data at the moment. Anyone who gains physical access to the device during this time can view and access all open data and applications until the computer auto-locks or is manually locked.

Exact Extract from Official Document:

"Pre-boot Protection requires users to authenticate to their computers before the computer boots. This prevents unauthorized access to the operating system using authentication bypass tools at the operating system level or alternative boot media to bypass boot protection." This implies that once booted and logged in, the data is accessible if the laptop is left unattended and unlocked.

An administrator can confirm a successful macOS Harmony Endpoint client installation when the Endpoint icon appears in the computer's menu bar . This is stated on page 151 under "Deploying Mac Clients," noting that "After installation, the Endpoint Security icon appears in the menu bar." Options like automatic reboot (A) or pop-up messages (B, D) are not documented as standard indicators of successful installation in the guide.

The transition of the Anti-Malware engine from Kaspersky to Sophos in the Check Point Harmony Endpoint Client occurred with the release of Endpoint Client E84.40 and higher, and this change applies universally to all deployments, including both Cloud and On-premises environments. While the CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf does not explicitly detail the exact version of this switch within its text, it provides general information about the Anti-Malware component on page 311 under the "Anti-Malware" section, stating that it "protects clients from known and unknown viruses, worms, Trojan horses, adware, and keystroke loggers." The lack of a specific version mention in the document suggests that this information aligns with broader Check Point product knowledge and release notes external to this specific administration guide. Among the options provided, option B (E84.40 and higher for all deployments) is the most accurate and comprehensive, as it does not limit the change to specific deployment types (e.g., Cloud or On-premises), unlike options A, C, and D. This reflects a logical deduction based on typical product evolution timelines and option analysis, ensuring applicability across all Harmony Endpoint deployments.

To check installed licenses on the Harmony Endpoint Management Server via the command-line interface (CLI), the correct command is cplic print -x. This is a standard Check Point command for displaying detailed license information, as referenced in the CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf on page 58 under "Getting Licenses." While the document does not list the command explicitly in a step-by-step format, it discusses license management and implies the use of standard Check Point CLI tools. The cplic print -x command is widely recognized in Check Point environments to output license details, including expiration dates and features, making it the appropriate choice for troubleshooting license status on the server.

Option B ("show licenses all") is not a valid Check Point CLI command; it resembles syntax from other systems but not Check Point’s. Option C ("cplic add < license filename="" > ") is for adding a license, not checking existing ones (page 58 mentions applying licenses, not viewing them). Option D ("cplic print +x") contains a syntax error; the correct flag is < code > -x < /code > , not < code > +x < /code > . Thus, option A is the verified answer based on Check Point’s CLI conventions and the guide’s context. < /license >

Push Operations allow the Endpoint Security Management Server to modify client settings, such as shutting down or restarting computers, without requiring a policy installation. This is detailed on page 69 under "Performing Push Operations," where the guide states that administrators can perform immediate actions like "Restart Computer" and "Shutdown Computer" on selected clients. Options like Remote Operations (A) and Node Management (B) are not documented features for this purpose, while Remote Help (C) is intended for user assistance, such as password recovery (page 425), not direct client modifications.

The Data Protection/General rule in Check Point Harmony Endpoint is a critical component of its Data Security Protection framework, encompassing settings that secure both hard disks and removable media while controlling port access. This rule integrates features from Full Disk Encryption (FDE) and Media Encryption & Port Protection (MEPP) , as outlined in the CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf . On page 20 , under the "Endpoint Security Client" section, the document details the components available on Windows:

"Full Disk Encryption: Combines Pre-boot protection, boot authentication, and strong encryption to make sure that only authorized users are given access to information stored on desktops and laptops."

"Media Encryption and Media Encryption & Port Protection: Protects data stored on the computers by encrypting removable media devices and allowing tight control over computers' ports (USB, Bluetooth, and so on)."

This extract clearly indicates that the Data Protection/General rule includes encryption settings for hard disks (via FDE), encryption settings for removable media , and port protection settings (via MEPP). These elements work together to safeguard data across various storage types and prevent unauthorized access through ports, aligning perfectly with Option D .

Option A ("Actions that define user authentication settings only") is incorrect because, while user authentication (e.g., pre-boot authentication) is part of FDE, the rule extends beyond authentication to include encryption and port protection settings.

Option B ("Actions that define decryption settings for hard disks") is inaccurate as the focus of the rule is on encryption, not decryption, and it covers more than just hard disks (e.g., removable media and ports).

Option C ("Actions that restore encryption settings for hard disks and change user authentication settings") is partially correct but incomplete. It mentions restoring encryption and authentication but omits the critical port protection and removable media encryption aspects, making it less comprehensive than Option D.

The Endpoint Client GUI in Check Point Harmony Endpoint provides either automatic or manual prompting to protect removable storage media usage, depending on how the administrator configures the system. This functionality is part of the Media Encryption & Port Protection component, which allows flexible control over removable media such as USB drives. According to the CP_R81.20_Harmony_Endpoint_Server_AdminGuide.pdf on page 282 , under the section "Working with Actions in a Media Encryption & Port Protection Rule," the documentation states:

"You can configure rules to automatically encrypt media or prompt users to encrypt or access media in a protected manner."

This extract confirms that administrators can set policies to either automatically apply encryption (automatic prompting) or require user interaction (manual prompting) when removable media is detected. For example, an automatic rule might encrypt a USB drive without user intervention, while a manual rule might display a prompt in the Endpoint Client GUI asking the user to confirm encryption or access permissions. This dual capability makes Option B ("Either automatic or manual") the correct answer.

Option A ("Manual Only") is incorrect because the system supports automatic prompting, not just manual.

Option C ("Automatic Only") is incorrect because manual prompting is also an available option.

Option D ("Neither automatic nor manual") is false, as the documentation clearly describes both methods.