View Full Checkpoint 156-536 Exam Dumps and Practice Test Dumps.

Question 121. Which rule controls traffic reaching an endpoint?

1. Outbound rule
2. Inbound rule
3. Deployment rule
4. Compliance rule

Correct Answer: 2. Inbound rule

Explanation:

Inbound Firewall rules control network traffic that attempts to reach the endpoint computer. Harmony Endpoint Firewall evaluates connection information such as IP addresses, ports, services, and protocols before allowing or blocking the traffic. Outbound rules perform the opposite function by controlling connections initiated from the endpoint. Separating inbound and outbound policy allows administrators to define different security requirements depending on traffic direction. For example, an endpoint might be allowed to initiate web connections while unsolicited inbound traffic remains blocked.

Question 122. What is the default outbound Firewall rule?

1. Block all outbound
2. Allow DNS only
3. Allow Trusted Zone only
4. Allow any outbound

Correct Answer: 4. Allow any outbound

Explanation:

The default outbound rule in the Harmony Endpoint Firewall policy is Allow any outbound. Its destination is Any, its service is Any, and its action is Allow. No tracking is configured by default for this rule. Administrators can replace or modify this behavior if the organization requires tighter control over endpoint-initiated connections. Check Point also provides an alternative predefined outbound action that allows all traffic to trusted zones while permitting common internet protocols to the Internet Zone.

Question 123. What belongs to the Internet Zone?

1. Objects not in the Trusted Zone
2. Domain controllers only
3. Loopback addresses only
4. Managed laptops only

Correct Answer: 1. Objects not in the Trusted Zone

Explanation:

Any network location that is not included in the Trusted Zone automatically belongs to the Internet Zone. Access Zones therefore divide network destinations into trusted and untrusted categories that the Firewall policy can reference. Administrators should carefully define the Trusted Zone so only required corporate resources and approved network objects receive trusted treatment. The Internet Zone acts as the automatic classification for everything else, simplifying policy design because administrators do not need to manually list every untrusted network location.

Question 124. How many Trusted Zones can one endpoint enforce?

1. Unlimited
2. Two
3. One
4. Four

Correct Answer: 3. One

Explanation:

A computer can enforce only one Trusted Zone at a time. If several Access Zones rules apply to the same computer and more than one Trusted Zone would otherwise match, Check Point states that only the last applicable Trusted Zone is enforced. Administrators should therefore design Access Zones rules carefully so overlapping assignments do not produce unexpected results. Understanding this behavior is particularly important in environments where different endpoint groups require distinct definitions of trusted corporate networks and resources.

Question 125. Which address is trusted by default?

1. 8.8.8.8
2. 0.0.0.0
3. 255.255.255.255
4. 127.0.0.1

Correct Answer: 4. 127.0.0.1

Explanation:

The LocalMachine_Loopback object, representing 127.0.0.1, is included in the initial Trusted Zone. The endpoint must always be able to communicate with its own loopback interface because applications frequently use it for local inter-process communication and services. Check Point warns that users should not run software that changes or hides the local loopback address, such as some personal proxy applications. Keeping the loopback address trusted ensures that local endpoint communications required by applications can continue to function correctly.

Question 126. Which object is initially in the Trusted Zone?

1. DMZ_Only
2. All_Internet
3. External_Hosts
4. Unknown_Networks

Correct Answer: 2. All_Internet

Explanation:

The initial Access Zones policy includes the All_Internet object in the Trusted Zone. This object represents all legal IP addresses. However, the Access Zones policy is not enforced by itself; it provides zone definitions that are used by Firewall policy. Administrators are expected to adjust the Trusted Zone according to organizational security requirements rather than assume the initial configuration is appropriate for production. Check Point specifically recommends including only those network objects with which endpoint programs genuinely need to interact.

Question 127. How are Firewall rules evaluated?

1. Top to bottom
2. Randomly
3. Bottom to top
4. Alphabetically

Correct Answer: 1. Top to bottom

Explanation:

Harmony Endpoint Firewall rules are enforced from the top of the Rule Base toward the bottom. Rule priority is therefore important because traffic is evaluated according to rule sequence. A more specific rule usually needs to appear before a broader rule that could otherwise match the same connection. The final rule is typically a Cleanup Rule that blocks traffic not explicitly accepted earlier. Correct rule ordering prevents broad allow or block rules from unintentionally overriding more specific security requirements.

Question 128. Which rule is usually last?

1. Allow PPTP
2. Allow DHCP
3. Cleanup Rule
4. Application Rule

Correct Answer: 3. Cleanup Rule

Explanation:

The Cleanup Rule is normally placed at the end of the Firewall Rule Base. Its purpose is to handle traffic that did not match any previous rule. In the default Harmony Endpoint inbound configuration, the Cleanup Rule matches Any source and Any service, blocks the traffic, and logs the event. This follows the common security principle of explicitly allowing necessary traffic and then denying everything else that remains unmatched. Administrators should therefore be careful when adding rules above the Cleanup Rule because only earlier matches can bypass its final block action.

Question 129. What does the default inbound Cleanup Rule do?

1. Blocks and logs traffic
2. Allows all traffic
3. Blocks without logging
4. Alerts without blocking

Correct Answer: 1. Blocks and logs traffic

Explanation:

The default inbound Cleanup Rule uses Any as the source, Any as the service, Block as the action, and Log as the tracking setting. It therefore blocks inbound traffic that failed to match an earlier allow rule and records the enforcement event. This provides both security and visibility because unauthorized traffic is denied while administrators can still review what was blocked. Cleanup logging is particularly useful during policy tuning because it shows which connections are being rejected by the final rule.

Question 130. What does Allow Trusted Zone permit?

1. DNS only
2. DHCP only
3. PPTP only
4. Any service from the Trusted Zone

Correct Answer: 4. Any service from the Trusted Zone

Explanation:

The default Allow Trusted Zone inbound rule uses Trusted_Zone as its source, Any as its service, and Allow as its action. This means incoming traffic from objects classified as trusted can reach the endpoint regardless of service unless a customized policy changes that behavior. Because this default is broad, administrators should define Trusted Zone membership carefully. Adding unnecessary networks to the Trusted Zone can indirectly expand which systems are permitted to initiate inbound communications with protected endpoints.

Question 131. What does Allow IP obtaining permit?

1. HTTPS
2. SSH
3. DHCP-related services
4. SMTP

Correct Answer: 3. DHCP-related services

Explanation:

The default Allow IP obtaining inbound rule permits DHCP-related services from the Internet Zone. Check Point lists services such as bootp, dhcp-relay, dhcp-req-local, and dhcp-rep-local. These services allow the endpoint to obtain and maintain network addressing even when the surrounding network is classified as untrusted. Without appropriate DHCP communication, endpoints may fail to receive IP configuration and lose network connectivity. The default rule therefore permits essential address-assignment traffic while other unsolicited inbound connections remain subject to additional rules and the Cleanup Rule.

Question 132. Which protocol appears in the default Allow PPTP rule?

1. SSH
2. GRE
3. SMTP
4. SNMP

Correct Answer: 2. GRE

Explanation:

The default Allow PPTP inbound rule includes GRE along with pptp-tcp and L2TP services. These protocols support VPN-related connectivity. The rule applies to traffic from the Internet Zone and permits the listed services. Administrators should understand why such predefined rules exist before modifying or deleting them because removing required VPN-related traffic can interrupt remote connectivity. At the same time, organizations that do not require these protocols may choose to tailor the Firewall Rule Base according to their own security policy.

Question 133. Why is inbound Destination fixed?

1. The destination is always the endpoint
2. The destination is always the gateway
3. The destination is always DNS
4. The destination is always the Internet Zone

Correct Answer: 4. The destination is always the endpoint

Explanation:

For inbound Firewall traffic, the destination is always the protected endpoint computer. Because of this, the inbound rule structure does not require administrators to choose arbitrary remote destination objects. Instead, administrators mainly define where the incoming traffic originates, which service it uses, and what action should be taken. This simplifies endpoint Firewall policy by treating the local computer as the fixed inbound destination. The same concept is reversed for outbound traffic, where the local endpoint is the fixed source.

Question 134. Why is outbound Source fixed?

1. Traffic originates from the endpoint
2. Traffic originates from DNS
3. Traffic originates from the Internet Zone
4. Traffic originates from the gateway

Correct Answer: 1. Traffic originates from the endpoint

Explanation:

For outbound Firewall rules, the source of the traffic is always the endpoint computer or the applicable local computer, user, or group. Administrators therefore focus on the outbound destination, service, action, and tracking configuration. Inbound rules work in the opposite direction because the endpoint is always the destination. Understanding these fixed perspectives makes the Firewall Rule Base easier to interpret and helps prevent administrators from confusing remote network objects with the local endpoint being protected.

Question 135. What does Track = Log do?

1. Displays only a popup
2. Records enforcement in the Client Log Viewer
3. Blocks all traffic automatically
4. Disables tracking

Correct Answer: 2. Records enforcement in the Client Log Viewer

Explanation:

When a Firewall rule uses the Log tracking action, rule enforcement is recorded in the Endpoint Security Client Log Viewer. This gives administrators visibility into connections that matched the rule without necessarily presenting a message to the endpoint user. Logging is useful when troubleshooting connectivity or confirming whether policy behaves as expected. Check Point distinguishes Log from Alert, which both records the event and displays a user message. None creates neither log entries nor alert messages for matching traffic.

Question 136. What does Track = Alert do?

1. Records silently only
2. Allows without tracking
3. Shows a message and records the event
4. Deletes the rule

Correct Answer: 3. Shows a message and records the event

Explanation:

The Alert tracking action both displays a message on the endpoint computer and records the Firewall rule enforcement in the Endpoint Security Client Log Viewer. This is more visible than Log, which records the event without displaying an alert message. Administrators should use alerts selectively because frequent user messages can become distracting. Check Point also requires the relevant Client Settings options to permit Network Protection alerts when Firewall alerts are expected to appear on endpoint computers.

Question 137. What does Track = None create?

1. Only an alert
2. No log or alert
3. Only a log
4. A forensic report

Correct Answer: 2. No log or alert

Explanation:

When tracking is set to None, the matching Firewall traffic is enforced according to the rule’s action, but no log or user alert is generated. This setting can reduce unnecessary logging for routine high-volume traffic where administrators do not need additional visibility. However, using None on important security rules may make troubleshooting or incident review more difficult because matching events are not recorded through Firewall tracking. Administrators should therefore decide carefully which rules require Log, Alert, or no tracking.

Question 138. What can a Firewall Source or Destination reference?

1. Only usernames
2. Only IP addresses
3. Only domain controllers
4. Network objects or security zones

Correct Answer: 4. Network objects or security zones

Explanation:

Firewall Source and Destination fields can reference network objects defined through Access Zones as well as Trusted or Internet Zone objects. Depending on the rule direction, one side represents the local endpoint while the other identifies the relevant remote network location. Check Point supports zone definitions based on object types such as hosts, networks, network groups, domains, and address ranges. This gives administrators flexibility to create policies based on meaningful network structures rather than writing every rule with individual IP addresses.

Question 139. What should be configured before Firewall policy?

1. Full Disk Encryption
2. Appscan
3. Access Zones
4. Threat Extraction

Correct Answer: 3. Access Zones

Explanation:

Check Point recommends configuring Access Zones before configuring the Endpoint Firewall because Firewall rules can reference the Trusted Zone and Internet Zone. Access Zones determine which network locations are trusted and automatically place all other locations into the Internet Zone. Defining these zones first gives Firewall rules meaningful network context. If the zone definitions are inaccurate or overly broad, Firewall behavior can also become broader than intended, so Access Zones should be planned carefully before enforcement rules are finalized.

Question 140. What is a good Trusted Zone practice?

1. Include only required trusted network objects
2. Trust every IP address permanently
3. Add all unknown networks
4. Disable zone classification

Correct Answer: 1. Include only required trusted network objects

Explanation:

The Trusted Zone should include only network objects that endpoint programs genuinely need to interact with as trusted resources. Check Point specifically recommends limiting membership and provides examples such as management servers, domain controllers, DNS servers, file servers, print servers, corporate WANs, VPN gateway ranges, and required local subnets. Overly broad Trusted Zones weaken Firewall segmentation because rules such as Allow Trusted Zone may permit extensive inbound communication. A carefully scoped Trusted Zone supports least-privilege network access while preserving required business connectivity.