View Full Checkpoint 156-536 Exam Dumps and Practice Test Dumps.

Question 181. What does Endpoint Firewall control?

1. Disk encryption
2. Network traffic
3. Malware signatures
4. Application inventory

Correct Answer: 2. Network traffic

Explanation:

Harmony Endpoint Firewall controls network traffic entering and leaving managed endpoint computers. Rules can make decisions based on connection details such as IP addresses, ports, protocols, network objects, and services. The firewall policy contains separate inbound and outbound rule bases so administrators can apply different controls to traffic reaching the endpoint and traffic originating from it. This host-based protection remains valuable when endpoints move between corporate and external networks because enforcement occurs directly on the protected device.

Question 182. What does an inbound Firewall rule control?

1. Outgoing web traffic
2. Application installation
3. Disk access
4. Traffic reaching the endpoint

Correct Answer: 4. Traffic reaching the endpoint

Explanation:

Inbound Firewall rules determine which network traffic is allowed to reach the endpoint computer. Check Point refers to the endpoint as localhost in this context. Administrators can allow all incoming traffic or restrict incoming connections to trusted zones and required connectivity services, with additional rules added as necessary. Inbound filtering helps prevent unauthorized systems from initiating connections to endpoint devices. Because the destination is always the local endpoint, the classic R81.20 inbound rule base does not require a separate destination column for ordinary rule definition.

Question 183. What does an outbound Firewall rule control?

1. Traffic leaving the endpoint
2. Incoming traffic only
3. Encryption recovery
4. User authentication

Correct Answer: 1. Traffic leaving the endpoint

Explanation:

Outbound Firewall rules control network connections initiated from the endpoint computer toward other systems or networks. Administrators can allow all outbound traffic or restrict it to trusted zones and common internet protocols, then customize the generated rule base as needed. Because the source of outbound traffic is the endpoint itself, the classic outbound rule base does not require a separate source column. Outbound filtering can reduce the ability of unauthorized applications or malicious processes to communicate externally.

Question 184. In what order are Firewall rules enforced?

1. Bottom to top
2. Random order
3. Top to bottom
4. Alphabetically

Correct Answer: 3. Top to bottom

Explanation:

Endpoint Firewall rules are enforced from the top of the rule base to the bottom. Rule priority therefore matters because the first matching rule determines how the traffic is handled. More specific rules should generally be placed above broader rules when the specific behavior needs to take precedence. Check Point notes that the final rule is commonly a Cleanup Rule that blocks traffic not matched by earlier allow rules. Understanding rule order is essential when troubleshooting traffic that appears unexpectedly permitted or denied.

Question 185. What is usually the last Firewall rule?

1. Stealth Rule
2. DHCP Rule
3. VPN Rule
4. Cleanup Rule

Correct Answer: 4. Cleanup Rule

Explanation:

A Cleanup Rule is commonly placed at the bottom of the Firewall rule base. Its purpose is to block traffic that has not matched any earlier explicit allow rule. This provides a default-deny approach rather than permitting unexpected connections simply because no specific rule addressed them. Check Point’s Endpoint Firewall documentation states that rules are processed in sequence and that the last rule is usually a Cleanup Rule that drops unmatched traffic. Logging the cleanup action can also help administrators identify connections that require additional policy review.

Question 186. What does the Trusted Zone contain?

1. Trusted network objects
2. Malware samples
3. Quarantined files
4. Encryption keys

Correct Answer: 1. Trusted network objects

Explanation:

The Trusted Zone contains network objects that the organization considers trusted for Endpoint Firewall purposes. Administrators should include only those network objects with which protected programs and endpoints legitimately need to interact. Examples can include corporate networks, DNS servers, domain controllers, file servers, management servers, and other approved infrastructure. Objects not included in the Trusted Zone are automatically treated as belonging to the Internet Zone. Careful Trusted Zone design helps distinguish corporate resources from less trusted network locations.

Question 187. Where do objects outside the Trusted Zone go?

1. Quarantine Zone
2. DMZ Zone
3. Internet Zone
4. Management Zone

Correct Answer: 3. Internet Zone

Explanation:

Any network object that is not part of the Trusted Zone is automatically considered part of the Internet Zone. This simplifies policy construction because administrators do not need to manually enumerate every untrusted external network. The firewall can apply more permissive controls to trusted corporate resources and more restrictive controls to everything else. Access Zones therefore provide a logical security classification that Firewall rules can reference when deciding how inbound and outbound traffic should be handled.

Question 188. How many Trusted Zones can one device enforce?

1. Unlimited
2. One
3. Two
4. Four

Correct Answer: 2. One

Explanation:

A device can enforce only one Trusted Zone at a time. If multiple policy rules apply to the same endpoint and more than one Trusted Zone could be selected, only the last applicable Trusted Zone is enforced. Administrators should therefore design Access Zones carefully and understand policy order so the endpoint receives the intended trusted-network definition. This restriction helps keep the effective security-zone configuration unambiguous on each managed device.

Question 189. Which address must always remain accessible locally?

1. 127.0.0.1
2. 8.8.8.8
3. 255.255.255.255
4. 169.254.1.1

Correct Answer: 1. 127.0.0.1

Explanation:

The endpoint must always have access to its local loopback address, 127.0.0.1. Check Point defines the LocalMachine_Loopback network object for this purpose and includes it in the initial Trusted Zone configuration. Local applications often use the loopback interface to communicate with services running on the same device. Check Point also warns against software that changes or hides the local loopback address, such as some personal proxy tools, because such behavior can interfere with expected endpoint networking.

Question 190. What does All_Internet represent?

1. Only private IP addresses
2. Only corporate WANs
3. Loopback addresses
4. All legal IP addresses

Correct Answer: 4. All legal IP addresses

Explanation:

The All_Internet object represents all legal IP addresses. It appears in the initial Access Zones configuration along with LocalMachine_Loopback. Check Point notes that having All_Internet in the initial Trusted Zone does not by itself mean all internet traffic is automatically permitted, because Access Zones are used as components of Firewall policy rather than functioning as an independently enforced allow policy. Administrators should evaluate and customize zone membership before relying on it for production security decisions.

Question 191. Which object can belong to a Trusted Zone?

1. Malware hash
2. Network Group
3. Encryption user
4. Threat report

Correct Answer: 2. Network Group

Explanation:

Network Groups are among the supported object types that can be placed in a Trusted Zone. Other supported types include hosts, networks, domains, and address ranges. This gives administrators flexibility when describing trusted portions of the infrastructure. For example, several related corporate networks can be placed into a Network Group and then added to the Trusted Zone as one logical object. Using structured objects simplifies policy maintenance compared with repeatedly entering individual IP addresses.

Question 192. What identifies an Endpoint Firewall service?

1. Username only
2. File hash
3. Protocol, port, and signature
4. Disk volume

Correct Answer: 3. Protocol, port, and signature

Explanation:

Endpoint Firewall services are matched according to network characteristics such as IP protocol, TCP or UDP port number, and protocol signature. Service objects let administrators describe network communication patterns in a reusable way and reference them in firewall rules. For example, rules can permit a required application protocol while blocking unrelated traffic. Service Groups can combine multiple service objects when several protocols should receive the same policy treatment.

Question 193. Why is rule priority important?

1. Rules are processed sequentially
2. It changes encryption strength
3. It updates malware signatures
4. It controls licenses

Correct Answer: 1. Rules are processed sequentially

Explanation:

Rule priority matters because Endpoint Firewall evaluates rules according to their sequence in the rule base. A rule near the top can match traffic before a broader rule lower in the policy is reached. Administrators should therefore place specific exceptions and required access rules in positions that produce the desired behavior. When traffic is unexpectedly blocked or allowed, reviewing rule sequence is one of the first troubleshooting steps. The Cleanup Rule is normally kept at the end so unmatched traffic is denied after all intentional exceptions are considered.

Question 194. Which traffic can the default inbound action permit?

1. Only DNS
2. Only SMTP
3. Only HTTPS
4. Trusted-zone and connectivity traffic

Correct Answer: 4. Trusted-zone and connectivity traffic

Explanation:

One available inbound action automatically permits traffic from trusted zones together with required connectivity services while blocking other inbound traffic. Check Point documentation identifies IP-obtaining traffic such as DHCP-related services among the automatically generated inbound rules. Administrators can inspect and customize the resulting rule base when additional inbound services are required. This provides a safer default than accepting every incoming connection while still permitting essential endpoint connectivity and approved trusted-network communication.

Question 195. Why is DHCP allowed in the default inbound rule base?

1. For disk encryption
2. To obtain network configuration
3. To scan applications
4. To create logs

Correct Answer: 2. To obtain network configuration

Explanation:

DHCP-related traffic is permitted in the default inbound configuration so an endpoint can obtain necessary network parameters such as an IP address. Check Point’s default inbound rule examples include BOOTP and DHCP request, reply, and relay-related services under the IP-obtaining rule. Without this connectivity, a device could be unable to establish normal network communication after joining a network. Firewall policy must therefore distinguish essential infrastructure traffic from unnecessary inbound connections.

Question 196. What is absent from the classic inbound Rule Base?

1. Action column
2. Source column
3. Destination column
4. Service column

Correct Answer: 3. Destination column

Explanation:

The classic R81.20 Endpoint inbound Rule Base does not include a destination column because the destination of all inbound traffic is the endpoint computer itself. Administrators instead define the source, service, action, tracking behavior, and other relevant rule properties. This simplifies the endpoint-specific inbound policy model compared with a gateway rule base where both source and destination can vary widely. Knowing this design also helps candidates distinguish inbound endpoint firewall rules from outbound rules.

Question 197. What is absent from the classic outbound Rule Base?

1. Source column
2. Destination column
3. Action column
4. Service column

Correct Answer: 1. Source column

Explanation:

In the classic outbound Rule Base, the source is always the local endpoint computer, so a separate source column is not required. Administrators mainly define destinations, services, actions, and other rule properties for traffic leaving the protected device. This mirrors the inbound model, where the destination is implicitly the endpoint. Understanding this distinction makes it easier to build and troubleshoot rules in the correct direction.

Question 198. When does domain-object DNS resolution occur?

1. Every packet
2. Every minute
3. Every heartbeat
4. At policy application or reboot

Correct Answer: 3. At policy application or reboot

Explanation:

For Endpoint Firewall domain objects, Check Point documents that DNS resolution occurs when the policy is applied or after the endpoint reboots. It is not continuously resolved for every packet or heartbeat. Administrators should understand this behavior when firewall rules depend on FQDN-based objects, because DNS changes may not be reflected immediately on an endpoint until the next supported resolution event. Sub-sites also need to be defined separately, and wildcard characters are not supported for these domain objects.

Question 199. Are wildcard characters supported in Firewall domain objects?

1. Always
2. Only *
3. No
4. Only ?

Correct Answer: 4. No

Explanation:

Wildcard symbols such as * are not supported when defining Endpoint Firewall domain objects in the referenced R81.20 web-management documentation. Administrators must use a fully qualified domain name, and sub-sites that require separate handling need to be added individually. Non-qualified domain names are also unsupported. These restrictions are important when building domain-based rules because administrators cannot assume one wildcard domain object will automatically cover every subdomain.

Question 200. What should happen after changing Firewall rules?

1. Install Policy
2. Reformat the endpoint
3. Recreate the tenant
4. Run Appscan

Correct Answer: 2. Install Policy

Explanation:

After Firewall rule changes are saved, the updated policy must be installed so managed endpoints receive and enforce the new configuration. Editing a rule in the management console alone does not complete enforcement. Check Point’s Firewall management procedure explicitly includes saving the changes and then clicking Install Policy above the rule base. This is an important troubleshooting point when an administrator changes a firewall rule but endpoint behavior remains unchanged.