View Full Checkpoint 156-536 Exam Dumps and Practice Test Dumps.

Question 161. What does Endpoint Firewall inspect?

1. Disk partitions
2. Malware signatures only
3. Encryption recovery files
4. Network and application traffic

Correct Answer: 4. Network and application traffic

Explanation:

Harmony Endpoint Firewall examines network and application traffic entering and leaving protected endpoint devices. It evaluates connection information such as source, destination, ports, protocols, and configured firewall rules to determine whether traffic should be allowed or blocked. The firewall provides host-level protection even when an endpoint operates outside the organization’s internal network. Administrators should design the policy so legitimate user activity remains possible while unnecessary or risky communications are restricted. Check Point describes the Firewall as guarding the network ports through which endpoint traffic enters and leaves.

Question 162. What does an inbound rule control?

1. Outgoing web requests only
2. Traffic reaching the endpoint
3. Disk encryption traffic
4. Policy downloads only

Correct Answer: 2. Traffic reaching the endpoint

Explanation:

Inbound Firewall rules determine which incoming network traffic is permitted to reach an Endpoint Security computer. In the inbound rulebase, the destination represents the protected endpoint and cannot be arbitrarily changed because the rule is specifically controlling traffic arriving at that device. Administrators can create rules based on source, service, action, and tracking requirements. Check Point includes several default inbound rules, including rules for the Trusted Zone, IP address acquisition, and supported VPN-related protocols, followed by a cleanup rule.

Question 163. What does an outbound rule control?

1. Traffic leaving the endpoint
2. Only inbound DNS
3. Disk writes
4. Login authentication

Correct Answer: 1. Traffic leaving the endpoint

Explanation:

Outbound Firewall rules control traffic that originates from the protected endpoint and travels toward another destination. In an outbound rule, the source represents the local endpoint, user, or group to which the rule applies. Administrators can then define destinations, services, actions, and tracking behavior. Check Point’s documented default outbound rule allows any outbound traffic, although organizations can create more restrictive rules when their security requirements demand tighter control. Outbound controls are useful for limiting unauthorized applications, suspicious destinations, or unnecessary services.

Question 164. In what order are Firewall rules enforced?

1. Bottom to top
2. Randomly
3. Top to bottom
4. Alphabetically

Correct Answer: 3. Top to bottom

Explanation:

Endpoint Firewall rules are evaluated from top to bottom in the rulebase. The first applicable rule determines how the matching traffic is handled. For this reason, rule order is important: a broad rule near the top can prevent a more specific rule below it from ever being evaluated. Administrators should place narrow exceptions and explicit permissions in the correct sequence and normally keep the cleanup rule at the bottom. Proper ordering makes the policy predictable and reduces accidental exposure or unnecessary blocking.

Question 165. What does a Cleanup Rule normally do?

1. Allows all traffic
2. Blocks unmatched traffic
3. Deletes old logs
4. Restarts the client

Correct Answer: 2. Blocks unmatched traffic

Explanation:

A cleanup rule is normally placed at the bottom of a Firewall rulebase to block traffic that was not matched by any previous rule. This follows the security principle of explicitly allowing required communications and rejecting everything else. Check Point’s default inbound configuration includes a cleanup rule with source Any, service Any, action Block, and tracking set to Log. A cleanup rule also provides visibility into unexpected connections because blocked traffic can be recorded for troubleshooting or security investigation.

Question 166. What is the default outbound Firewall action?

1. Block any outbound
2. Alert only
3. Quarantine traffic
4. Allow any outbound

Correct Answer: 4. Allow any outbound

Explanation:

The documented default outbound rule allows traffic from Endpoint computers to any destination using any service, with no tracking action. This provides broad connectivity initially, although administrators can create more restrictive outbound rules when business or security requirements call for tighter controls. For example, they can limit selected destinations or services or add logging for specific traffic. Understanding the default rule is important because an administrator who needs restrictive egress filtering must explicitly modify or replace the default behavior.

Question 167. What belongs in the Trusted Zone?

1. Trusted network objects
2. All malware samples
3. Only Internet hosts
4. Quarantined files

Correct Answer: 1. Trusted network objects

Explanation:

The Trusted Zone contains network objects that the organization considers trusted and with which endpoint programs are expected to communicate. Check Point supports hosts, networks, network groups, domains, and address ranges as Trusted Zone objects. Administrators should keep the Trusted Zone limited to genuinely trusted infrastructure because broader membership gives those network locations more favorable treatment in the Endpoint Firewall policy. Traffic not associated with the Trusted Zone is automatically treated as part of the Internet Zone.

Question 168. What is the Internet Zone?

1. Only public DNS servers
2. Only web browsers
3. Objects not in the Trusted Zone
4. Only remote-access gateways

Correct Answer: 3. Objects not in the Trusted Zone

Explanation:

The Internet Zone automatically represents network objects that are not included in the Trusted Zone. Administrators therefore define which networks, hosts, domains, or address ranges are trusted, while other network locations fall into the Internet Zone. This simplifies policy construction because rules can distinguish trusted internal resources from less-trusted or external destinations without manually listing every possible Internet address. Carefully defining the Trusted Zone is important because an overly broad trusted definition can weaken the distinction between internal and external traffic.

Question 169. What is LocalMachine_Loopback?

1. Any public IP
2. A VPN gateway
3. A trusted domain
4. The endpoint’s 127.0.0.1 address

Correct Answer: 4. The endpoint’s 127.0.0.1 address

Explanation:

LocalMachine_Loopback represents the endpoint device’s loopback address, 127.0.0.1. Check Point notes that the endpoint must always be able to access its own loopback address because many local applications and services depend on this communication. Software that hides or changes normal loopback behavior, such as some personal proxy applications, can interfere with expected Endpoint Security operation. The loopback object is therefore treated specially within Endpoint Firewall security-zone handling.

Question 170. What does the Track setting Log do?

1. Records rule enforcement
2. Shows a popup only
3. Blocks the rule
4. Changes the service

Correct Answer: 1. Records rule enforcement

Explanation:

The Log tracking option records Firewall rule enforcement in the Endpoint Security Client Log Viewer. Logging is useful when administrators need evidence showing which rule matched a connection and what action was taken. This can support troubleshooting, security analysis, and validation of newly deployed rules. Check Point also provides Alert, which records the event and displays a message on the endpoint, and None, which creates neither a log entry nor an alert message.

Question 171. What does Track Alert add?

1. Disk encryption
2. A user message plus a log
3. Automatic quarantine
4. A new rule

Correct Answer: 2. A user message plus a log

Explanation:

The Alert tracking option both records the Firewall rule enforcement in the Endpoint Security Client Log Viewer and displays a message on the endpoint computer. It is useful when administrators want the user to know that traffic has matched a particular security rule while also retaining an audit record. By comparison, Log records the event without displaying a user alert, and None creates neither. Tracking settings do not themselves determine whether traffic is allowed or blocked; the separate Action column controls enforcement.

Question 172. What does Track None create?

1. An alert only
2. A log only
3. No log or alert
4. A quarantine entry

Correct Answer: 3. No log or alert

Explanation:

When the tracking action is set to None, Harmony Endpoint does not create a Firewall log entry and does not display an alert message for traffic matching that rule. The rule’s Allow or Block action is still enforced, but the match is not recorded through those tracking mechanisms. This option can reduce unnecessary logging for predictable, low-value traffic. Administrators should use it carefully because excessive use can make troubleshooting or security investigations more difficult when connection history is needed.

Question 173. In an inbound rule, what is fixed locally?

1. Destination
2. Source
3. Service
4. Track action

Correct Answer: 1. Destination

Explanation:

For inbound rules, the destination is always the local endpoint computer, user, or group protected by the rule. This is because inbound rules define which external traffic can reach that endpoint. Administrators primarily vary the source, service, action, and tracking behavior to control those incoming connections. The reverse concept applies to outbound rules, where the source is local because the connection originates from the endpoint. Understanding this directionality helps prevent mistakes when building rules in the unified Firewall rulebase.

Question 174. What does Allow hotspot registration do?

1. Blocks public Wi-Fi
2. Requires Full Disk Encryption
3. Disables DHCP
4. Temporarily bypasses Firewall for hotspot access

Correct Answer: 4. Temporarily bypasses Firewall for hotspot access

Explanation:

The Allow hotspot registration setting permits users to connect through public hotspots, such as those used in hotels or airports. Check Point explains that when the option is enabled, the Firewall is bypassed as required to let the user complete hotspot network registration. Without this option, users may be unable to reach a captive portal and establish Internet connectivity. Because the setting relaxes normal Firewall enforcement during hotspot registration, administrators should enable it only when their mobile-user requirements justify the behavior.

Question 175. What does Block IPv6 network traffic do?

1. Blocks IPv4 only
2. Blocks IPv6 traffic to endpoints
3. Disables DNS
4. Blocks loopback traffic

Correct Answer: 2. Blocks IPv6 traffic to endpoints

Explanation:

The advanced Firewall setting Block IPv6 network traffic determines whether IPv6 traffic is blocked for protected endpoint devices. Clearing the checkbox allows IPv6 traffic. This setting is important in organizations that have not fully secured or monitored IPv6 and prefer to prevent endpoints from using an alternate network protocol that could bypass IPv4-focused controls. Administrators should understand their network architecture before changing it because disabling IPv6 traffic can affect legitimate applications or services that rely on IPv6 connectivity.

Question 176. What policy is enforced above Endpoint Firewall by default during Remote Access?

1. URL Filtering policy
2. Anti-Malware policy
3. Endpoint Firewall policy itself
4. The selected Remote Access enforcement layer

Correct Answer: 3. Endpoint Firewall policy itself

Explanation:

Check Point’s advanced Endpoint Firewall settings allow administrators to choose what Firewall policy is enforced when Remote Access is in use. The default option is to enforce the policy above the Endpoint Firewall policy. Organizations migrating from an older Endpoint Security VPN architecture can instead select the Remote Access Desktop Security Policy to continue using the legacy Desktop Policy configuration. This option is particularly relevant when maintaining compatibility with existing remote-access policy designs during a transition to the complete Endpoint Security solution.

Question 177. Which object can be placed in a Trusted Zone?

1. Malware signature
2. Address range
3. Quarantine entry
4. Application hash only

Correct Answer: 2. Address range

Explanation:

Check Point permits several network-object types in the Endpoint Firewall Trusted Zone, including hosts, networks, network groups, domains, and address ranges. An address range is useful when a trusted environment uses a contiguous range of IP addresses that should receive trusted treatment without defining every address individually. Administrators create Firewall objects through the Access policy management interface and can then reuse those objects across policies and Trusted Zone definitions.

Question 178. What should Endpoint Firewall explicitly allow?

1. All unknown Internet traffic
2. Every inbound service
3. All peer-to-peer applications
4. Connections to domain controllers

Correct Answer: 4. Connections to domain controllers

Explanation:

Check Point specifically recommends creating explicit Endpoint Firewall rules that allow endpoint computers to connect to all domain controllers on the network. Domain-controller connectivity is essential for services such as authentication, policy-related operations, and normal domain functionality. An overly restrictive Firewall policy that blocks required domain-controller communication can cause authentication and endpoint-management problems. Administrators should therefore identify the necessary domain controllers and services and place the required allow rules above broader blocking or cleanup rules.

Question 179. What can Endpoint Firewall objects represent?

1. Physical and logical network components
2. Only endpoint users
3. Only malware files
4. Only encryption keys

Correct Answer: 1. Physical and logical network components

Explanation:

Firewall objects can represent physical and virtual network resources, such as endpoint devices and servers, as well as logical network concepts such as IP address ranges. Administrators create these objects once and can reuse them in policies and Firewall rules. Reusable objects improve consistency because rules can reference a descriptive object instead of repeatedly entering addresses manually. The management interface can also show administrators which rules currently use a selected object, helping them understand the impact before modifying or deleting it.

Question 180. What BEST improves Endpoint Firewall security?

1. Allow everything
2. Disable logging everywhere
3. Explicitly allow required traffic, then block the rest
4. Put all networks in Trusted Zone

Correct Answer: 3. Explicitly allow required traffic, then block the rest

Explanation:

A strong Endpoint Firewall design explicitly permits necessary business communication and blocks traffic that is not required. Check Point’s rulebase guidance uses a cleanup rule at the bottom to block traffic that did not match earlier allow rules. Administrators should also keep the Trusted Zone limited to genuinely trusted resources and maintain explicit rules for essential services such as domain-controller connectivity. This approach reduces endpoint exposure while preserving required network access. Rule order remains important because Firewall rules are evaluated from top to bottom.